1627 files changed, 99996 insertions, 24110 deletions

diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 53c2690..459204d 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,25473 @@
+2009-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG feComposite: operator over mixes up inputs
+        [https://bugs.webkit.org/show_bug.cgi?id=30205]
+
+        SVG feComposite operator over mixed up the inputs.
+        The pixel-test svg/filters/feComposite.svg can already test this.
+        No new test result is needed as long as filters are disabled.
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+
+2009-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by George Staikos.
+
+        Move SVGURIReference ANIMATED_* macros in classes that inherit from it
+        https://bugs.webkit.org/show_bug.cgi?id=30184
+
+        The long term goal is to kill the need for the virtual contextElement() function in SVG code. 
+        No change in functionality, thus no new tests.
+
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::SVGAElement):
+        * svg/SVGAElement.h:
+        * svg/SVGAltGlyphElement.cpp:
+        (WebCore::SVGAltGlyphElement::SVGAltGlyphElement):
+        * svg/SVGAltGlyphElement.h:
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::SVGCursorElement):
+        * svg/SVGCursorElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::SVGFilterElement):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::SVGGradientElement):
+        * svg/SVGGradientElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::SVGImageElement):
+        * svg/SVGImageElement.h:
+        * svg/SVGMPathElement.cpp:
+        (WebCore::SVGMPathElement::SVGMPathElement):
+        (WebCore::SVGMPathElement::pathElement):
+        * svg/SVGMPathElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::SVGMaskElement):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::SVGPatternElement):
+        * svg/SVGPatternElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::SVGTRefElement):
+        * svg/SVGTRefElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::SVGTextPathElement):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGURIReference.cpp:
+        (WebCore::SVGURIReference::SVGURIReference):
+        * svg/SVGURIReference.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement):
+        * svg/SVGUseElement.h:
+
+2009-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Re-add the QApplication::syncX() line for plugin windows removed
+        by r49169. Also changed the location of the sync just after the
+        creation instead of just before sending it to the plugin.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-10-08  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: NodeLists Don't Display Well in the Console
+        https://bugs.webkit.org/show_bug.cgi?id=28061
+
+        * inspector/front-end/InjectedScript.js:
+        (Object.type):
+
+2009-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Remove unnecessary XSync for opaque mode.
+        
+        The reason for the XSync was that the plugin would not know about the
+        Drawable. It turns out that the real reason behind this is that even
+        though XCreatePixmap returns a handle, this id is unknown to the server
+        until we flush the connection.
+        
+        So, move the XSync to right after we create the Pixmap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30207
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30188
+        
+        Fixes an issue where performing a non DHTML drag-and-drop operation 
+        does not work as expected. For instance, dragging some selected text 
+        to an external application, such as TextEdit.
+        
+        This issue was a regression that arose from patching bug #30107.
+        
+        This change is covered by the manual test: 
+        drag-out-of-background-window.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When performing a non-DHTML drag 
+        operation then default to drag operations DragOperationGeneric and 
+        DragOperationCopy according to similar functionality removed when fixing
+        bug #30107, see: 
+        http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430 
+
+2009-10-07  Xan Lopez  <xlopez@igalia.com>
+
+        Fix more breakage in the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move PolicyChecker to it's own file
+        https://bugs.webkit.org/show_bug.cgi?id=30193
+
+        This is just moving code around and re-naming things.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCallback.cpp: Added.
+        (WebCore::PolicyCallback::PolicyCallback):
+        (WebCore::PolicyCallback::~PolicyCallback):
+        (WebCore::PolicyCallback::clear):
+        (WebCore::PolicyCallback::set):
+        (WebCore::PolicyCallback::call):
+        (WebCore::PolicyCallback::clearRequest):
+        (WebCore::PolicyCallback::cancel):
+        * loader/PolicyCallback.h: Added.
+        (WebCore::PolicyCallback::request):
+        * loader/PolicyCheck.cpp: Removed.
+        * loader/PolicyCheck.h: Removed.
+
+2009-10-07  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Mark Rowe.
+
+        Include <limits> for std::numeric_limits.  Required by gcc-4.4
+        https://bugs.webkit.org/show_bug.cgi?id=30197
+
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasIntArray.h:
+        * html/canvas/CanvasShortArray.h:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        * html/canvas/CanvasUnsignedShortArray.h:
+
+2009-10-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Factor PolicyChecker out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30155
+
+        This patch separates PolicyChecker from FrameLoader.  Loader policy is
+        in change of managing the FrameLoaderClient callbacks.  Ideally, it
+        shouldn't know anything about FrameLoader, but I couldn't quite remove
+        all knowledge (although we might be able to do more later).  In a
+        future patch, I'll move PolicyChecker into a separate file.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::PolicyChecker::handleUnimplementablePolicy):
+        (WebCore::PolicyChecker::cannotShowMIMEType):
+        (WebCore::PolicyChecker::PolicyChecker):
+        (WebCore::PolicyChecker::checkNavigationPolicy):
+        (WebCore::PolicyChecker::checkContentPolicy):
+        (WebCore::FrameLoader::shouldReloadToHandleUnreachableURL):
+        (WebCore::FrameLoader::stopAllLoaders):
+        (WebCore::PolicyChecker::cancelCheck):
+        (WebCore::PolicyChecker::stopCheck):
+        (WebCore::PolicyChecker::continueAfterContentPolicy):
+        (WebCore::PolicyChecker::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::PolicyChecker::checkNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNewWindowPolicy):
+        (WebCore::PolicyChecker::continueAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        * loader/FrameLoader.h:
+        (WebCore::PolicyChecker::loadType):
+        (WebCore::PolicyChecker::setLoadType):
+        (WebCore::PolicyChecker::delegateIsDecidingNavigationPolicy):
+        (WebCore::PolicyChecker::delegateIsHandlingUnimplementablePolicy):
+        (WebCore::FrameLoader::policy):
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didCancel):
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+
+2009-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed <rdar://problem/5751979> Database code takes JSLock on secondary
+        thread, permanently slowing down JavaScript
+
+        Changed callback objects to use a standard helper object. The helper
+        object ASSERTs that it is deleted on the main thread, so no lock is
+        required when unprotecting its members. It also centralizes some previously
+        duplicated code.
+        
+        Callback objects that might be deleted on a secondary thread use
+        callOnMainThread to delete their helper objects on the main thread.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCallbackData.cpp: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::deleteData):
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSCallbackData.h: Copied from bindings/js/JSCustomSQLTransactionCallback.cpp.
+        (WebCore::JSCallbackData::JSCallbackData):
+        (WebCore::JSCallbackData::~JSCallbackData):
+        (WebCore::JSCallbackData::callback):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::~JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Fix StringImpl::m_buffer
+        https://bugs.webkit.org/show_bug.cgi?id=30189
+
+        Fix my previous StringImpl patch to avoid using an indefinite-length array member,
+        since MSVC doesn't like it. Instead, go back to offsetting by sizeof(StringImpl).
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::createUninitialized):
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::bufferIsInternal):
+
+2009-10-07  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Update isolated worlds under v8 to support world reuse.
+        https://bugs.webkit.org/show_bug.cgi?id=30145
+
+        * bindings/v8/ScriptController.cpp:
+        Replace evaluateInNewIsolatedWorld() withe evaluateInIsolatedWorld(id).
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h: Ditto.
+        * bindings/v8/V8Proxy.cpp: Ditto.
+        (WebCore::V8Proxy::~V8Proxy): Dittio.
+        (WebCore::V8Proxy::evaluateInIsolatedWorld): Ditto.
+        * bindings/v8/V8Proxy.h: Ditto.
+        * bindings/v8/V8IsolatedWorld.cpp:
+        Add support for controlling lifetime of a world, rather than relying on GC.
+        (WebCore::V8IsolatedWorld::contextWeakReferenceCallback): Ditto.
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld): Ditto.
+        (WebCore::V8IsolatedWorld::destroy): Ditto.
+        * bindings/v8/V8IsolatedWorld.h: Ditto.
+
+2009-10-07  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for http://trac.webkit.org/changeset/49272 on Windows
+
+        * platform/text/StringImpl.h:
+
+2009-10-07  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Optimization of StringImpl:
+        - Remove unnecessary m_bufferIsInternal member (saves 4 bytes). Instead, check whether
+          m_data points to just past the end of the object's members.
+        - copy() and createWithTerminatingNullCharacter() create the string in a single malloc
+          block instead of 2 (saves ~20 bytes and considerable CPU cycles, increases locality).
+        - Move m_length next to m_hash to save 4 bytes of padding in 64-bit builds.
+          
+        https://bugs.webkit.org/show_bug.cgi?id=29500
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl): Re-ordered members.
+        (WebCore::StringImpl::~StringImpl): Change to is-buffer-internal check.
+        (WebCore::StringImpl::createUninitialized): Use new m_buffer member instead of sizeof()
+            to ensure chars are copied to correct location.
+        (WebCore::StringImpl::createWithTerminatingNullCharacter): Make sure copy is created
+            in a single malloc block.
+        (WebCore::StringImpl::threadsafeCopy): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::crossThreadString): Make sure copy is created in a single malloc block.
+        (WebCore::StringImpl::sharedBuffer): Change to is-buffer-internal check.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith): Just fixed a confusing param name.
+        (WebCore::StringImpl::bufferIsInternal): Changed member var into accessor method.
+        (WebCore::StringImpl::m_data): Repositioned for optimal member packing in 64-bit.
+        (WebCore::StringImpl::m_buffer): Added to provide an explicit location for where internal buffer goes.
+
+2009-10-07  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30102
+        And
+        <rdar://problem/5015957>
+        
+        Manual test to confirm that the not-allowed cursor is shown for an
+        invalid drag-and-drop operation.
+        
+        We cannot test this using DRT because of a discrepancy between the Windows
+        API-based drop effect and the WebKit drop effect. See bug #24731 for more
+        details.
+
+        * manual-tests/drag-cursor-notallowed.html: Added.
+
+2009-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-07  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        This function implements showing cookies for all sub-resources of a page.
+        When the page is loaded, it populates the Storage Panel with a list of all
+        domains that were loaded as part of the full page load (iframes, ads, etc).
+        When the user selects one of the domains, the inspector calls back into the
+        controller, and the controller combines all of the cookies from that domain
+        into a list, and sends that list is sent back to the controller to render.
+        
+        A domain now needs to be passed into CookieItemsView, and CookieSidebarTreeElement.
+        
+        As a result of a previous patch, we now have detailed cookie information for
+        both Windows on CFNetwork and Mac. Additionally, this patch provides deleteCookie
+        support on Windows.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::getCookies):
+        (WebCore::InspectorController::buildArrayForCookies):
+        (WebCore::InspectorController::buildObjectForCookie):
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addCookieDomainForDocument):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.addCookieDomain):
+        (WebInspector.StoragePanel.prototype.showCookies):
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addCookieDomain):
+        * platform/Cookie.h:
+        (WebCore::CookieHash::hash):
+        (WebCore::CookieHash::equal):
+        (WTF::):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::deleteCookie):
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add ScriptObject::set(const char*, unsigned).
+
+        https://bugs.webkit.org/show_bug.cgi?id=30104
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptObject::set):
+        * bindings/v8/ScriptObject.h:
+
+2009-10-07  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo).
+
+        Provide implementation of new BitmapImage::create that was
+        added in @r49060.
+
+        * platform/graphics/win/ImageCairoWin.cpp:
+
+2009-10-07  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Refactor RenderThemeChromiumMac and RenderThemeChromiumSkia to render media controls using GraphicsContext.
+
+        Design was based on existing RenderMediaControls.cpp used by RenderThemeSafari/Win.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29987
+
+        Covered by existing layout tests as no new functionality was introduced.
+
+        * WebCore.gypi: Added RenderMediaControlsChromium.cpp/h.
+        * css/mediaControlsChromium.css: Tweaked media slider position and border style.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::toParentMediaElement): Taken from RenderMediaControls.
+        (WebCore::MediaControlElement::rendererIsNeeded): Don't call shouldRenderMediaControlPart() if element has no appearance.
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Ditto.
+        * rendering/RenderMediaControls.cpp: Moved parentMediaElement() to MediaControlElements.
+        * rendering/RenderMediaControlsChromium.cpp: Added.
+        (WebCore::platformResource): Helper to load and cache media control image resources.
+        (WebCore::mediaSliderThumbImage): Implementation refactored from RenderThemeChromiumMac/Skia.
+        (WebCore::mediaVolumeSliderThumbImage): Ditto.
+        (WebCore::paintMediaButton): Ditto.
+        (WebCore::paintMediaMuteButton): Ditto.
+        (WebCore::paintMediaPlayButton): Ditto.
+        (WebCore::paintMediaSlider): Ditto.
+        (WebCore::paintMediaSliderThumb): Ditto.
+        (WebCore::paintMediaVolumeSlider): Ditto.
+        (WebCore::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::paintMediaTimelineContainer): Ditto.
+        (WebCore::RenderMediaControlsChromium::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart): Same
+        (WebCore::RenderMediaControlsChromium::adjustMediaSliderThumbSize):
+        * rendering/RenderMediaControlsChromium.h: Added.
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumMac::shouldRenderMediaControlPart): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground): Ditto.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground): Implementation delegated to RenderMediaControlsChromium.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Ditto.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Ditto.
+
+2009-10-07  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make plugins work with beforeload.
+
+        Added fast/dom/beforeload/flash-before-load.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-10-07  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Protect JS listener object from GC while clearing a property on it.
+        See http://crbug.com/23780.
+        https://bugs.webkit.org/show_bug.cgi?id=30137
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Rubber-stamped by Eric Seidel.
+
+        Allow custom memory allocation control for WebCore's CachedResourceClient class
+        https://bugs.webkit.org/show_bug.cgi?id=30165
+
+        Inherits CachedResourceClient class from FastAllocBase because (its
+        child class) CSSFontFaceSource has been instantiated by 'new' in WebCore/css/CSSFontFaceSource.h:46.
+
+        * loader/CachedResourceClient.h:
+
+2009-10-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Allow custom memory allocation control for WebCore's IdentifierRep 
+        https://bugs.webkit.org/show_bug.cgi?id=30159                                                        
+
+        Inherits IdentifierRep class from FastAllocBase because it has been                                 
+        instantiated by 'new' in WebCore/bridge/IdentifierRep.cpp:61.  
+
+        * bridge/IdentifierRep.h:
+
+2009-10-07  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fetch pointers to C++ DOM window immediately from holder
+        object (do not search prototype chain for proper JS wrapper).
+        https://bugs.webkit.org/show_bug.cgi?id=29031
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::installDOMWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+2009-10-07  Adam Roben  <aroben@apple.com>
+
+        Fix typo in PluginView::load that was causing cross-origin loads to
+        be allowed
+
+        This typo was introduced in the build fix in r49213.
+
+        Fixes <http://webkit.org/b/30168> REGRESSION (r49213):
+        http/tests/plugins/local-geturl-from-remote.html is failing on Windows
+
+        Reviewed by Sam Weinig.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load): Removed a comma operator that was making
+        a condition always evaluate to true.
+
+2009-10-07  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not create valid QColor's for invalid WebCore::Color's.
+
+        * platform/graphics/qt/ColorQt.cpp:
+        (WebCore::Color::operator QColor):
+
+2009-10-07  Janne Koskinen  <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Symbian SBSv2 .data segment adress fix
+        https://bugs.webkit.org/show_bug.cgi?id=30157
+
+        RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+        base address to start from 0x800000 instead of the toolchain default 0x400000
+
+        * WebCore.pro:
+
+2009-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Migrate database inspection to the injected script-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29788
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::databaseForId):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        (WebCore::InspectorBackend::databaseForId):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::getDatabaseTableNames):
+        (WebCore::InspectorBackend::reportDidDispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::selectDatabase):
+        (WebCore::InspectorController::databaseForId):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        (WebCore::InspectorDatabaseResource::database):
+        (WebCore::InspectorDatabaseResource::id):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::didGetDatabaseTableNames):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/Database.js:
+        (WebInspector.Database):
+        (WebInspector.Database.prototype.get id):
+        (WebInspector.Database.prototype.set name):
+        (WebInspector.Database.prototype.set version):
+        (WebInspector.Database.prototype.set domain):
+        (WebInspector.Database.prototype.getTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        (InjectedScript.executeSql):
+        (InjectedScript.executeSql.errorCallback):
+        (InjectedScript.executeSql.queryTransaction):
+        * inspector/front-end/InjectedScriptAccess.js:
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.dataGridForResult):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDatabase):
+
+2009-10-07  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless Plugins: Disable content propagation for QGraphicsView items
+        
+        We cannot support content propagation for items in QGraphicsView because
+        the contents of the backing store might be transformed. So turn it off
+        if we are not painting on QWidget.
+        
+        Note that this check will not work for a QWebView in a
+        QGraphicsProxyWidget, but I guess it's fine. Alternative is to do an
+        even uglier cast: static_cast painter's paintDevice() to QWidget and
+        check if it is the viewport() of QGraphicsView.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30149
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build by adding the missing files to the build.
+
+        * WebCore.pro:
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix incorrect convertion of double into int while assigning it to
+        a float.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Fix rounding error issues in height calculation in 64 bits.
+
+        Already covered by existing tests.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-10-07  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Dual lines in css2.1 layout tests do not match:
+        https://bugs.webkit.org/show_bug.cgi?id=23262
+
+        Now we can put a counter node as the next sibling of a reset node.
+        Re-layout the counter content when the count is updated.
+
+        Tests: fast/css/counters/t1204-increment-00-c-o.html
+               fast/css/counters/t1204-increment-01-c-o.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::recount):
+        * rendering/RenderCounter.cpp:
+        (WebCore::findPlaceForCounter):
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Removed unused member variable from FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30146
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        * loader/FrameLoader.h:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        A few small/trivial tweaks to the last build fix.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Need to adjust MessagePort, etc. code for the post clone work done.
+        https://bugs.webkit.org/show_bug.cgi?id=30147
+
+        No change in functionality so no new tests.
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/SerializedScriptValue.h: Added.
+         A very simple implementation of SerializedScriptValue
+         that only works for strings.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageEventCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/7271202>
+        Dispatch resource load delegate functions for the media element.
+        Since we don't get the required callbacks from the media engine,
+        just fake the parameters to the delegate functions as best as possible.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::willLoadMediaElementURL):
+        * loader/FrameLoader.h:
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        More build fixes.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::getProperty):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Build and formatting fix.
+
+        * ForwardingHeaders/runtime/ExceptionHelpers.h: Added.
+        * bindings/js/SerializedScriptValue.cpp:
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore::SerializedScriptValueData::operator bool):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+
+2009-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        It should be possible to post (clone) built-in JS objects to Workers
+        https://bugs.webkit.org/show_bug.cgi?id=22878
+
+        Implement object cloning semantics for postMessage.  Currently only
+        a partial implementation of the spec -- cloning of File, FileList,
+        ImageData, and RegExp were left out as they would have significantly
+        increased patch size.
+
+        Cloning requires multiple tree walks so we use a templated tree
+        walk function, allowing us to share a single implementation for
+        serialization, deserialization, and eventual destruction of the
+        serialized object tree.
+
+        Test: fast/dom/Window/window-postmessage-clone.html
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::JSMessageEvent::initMessageEvent):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore::handlePostMessage):
+        * bindings/js/SerializedScriptValue.cpp: Added.
+        (WebCore::SerializedObject::set):
+        (WebCore::SerializedObject::names):
+        (WebCore::SerializedObject::values):
+        (WebCore::SerializedObject::create):
+        (WebCore::SerializedObject::clear):
+        (WebCore::SerializedObject::SerializedObject):
+        (WebCore::SerializedArray::setIndex):
+        (WebCore::SerializedArray::canDoFastRead):
+        (WebCore::SerializedArray::getIndex):
+        (WebCore::SerializedArray::getSparseIndex):
+        (WebCore::SerializedArray::length):
+        (WebCore::SerializedArray::create):
+        (WebCore::SerializedArray::clear):
+        (WebCore::SerializedArray::SerializedArray):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SharedSerializedData::asArray):
+        (WebCore::SharedSerializedData::asObject):
+        (WebCore::):
+        (WebCore::walk):
+        (WebCore::BaseWalker::BaseWalker):
+        (WebCore::BaseWalker::shouldTerminate):
+        (WebCore::BaseWalker::ticksUntilNextCheck):
+        (WebCore::BaseWalker::didTimeOut):
+        (WebCore::BaseWalker::throwStackOverflow):
+        (WebCore::BaseWalker::throwInterruptedException):
+        (WebCore::SerializingTreeWalker::SerializingTreeWalker):
+        (WebCore::SerializingTreeWalker::null):
+        (WebCore::SerializingTreeWalker::isArray):
+        (WebCore::SerializingTreeWalker::isObject):
+        (WebCore::SerializingTreeWalker::asInputArray):
+        (WebCore::SerializingTreeWalker::asInputObject):
+        (WebCore::SerializingTreeWalker::createOutputArray):
+        (WebCore::SerializingTreeWalker::createOutputObject):
+        (WebCore::SerializingTreeWalker::length):
+        (WebCore::SerializingTreeWalker::canDoFastRead):
+        (WebCore::SerializingTreeWalker::getIndex):
+        (WebCore::SerializingTreeWalker::getSparseIndex):
+        (WebCore::SerializingTreeWalker::getProperty):
+        (WebCore::SerializingTreeWalker::convertIfTerminal):
+        (WebCore::SerializingTreeWalker::getPropertyNames):
+        (WebCore::SerializingTreeWalker::putIndex):
+        (WebCore::SerializingTreeWalker::putProperty):
+        (WebCore::SerializingTreeWalker::startArray):
+        (WebCore::SerializingTreeWalker::endArray):
+        (WebCore::SerializingTreeWalker::startObject):
+        (WebCore::SerializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::serialize):
+        (WebCore::DeserializingTreeWalker::DeserializingTreeWalker):
+        (WebCore::DeserializingTreeWalker::null):
+        (WebCore::DeserializingTreeWalker::isArray):
+        (WebCore::DeserializingTreeWalker::isObject):
+        (WebCore::DeserializingTreeWalker::asInputArray):
+        (WebCore::DeserializingTreeWalker::asInputObject):
+        (WebCore::DeserializingTreeWalker::createOutputArray):
+        (WebCore::DeserializingTreeWalker::createOutputObject):
+        (WebCore::DeserializingTreeWalker::length):
+        (WebCore::DeserializingTreeWalker::canDoFastRead):
+        (WebCore::DeserializingTreeWalker::getIndex):
+        (WebCore::DeserializingTreeWalker::getSparseIndex):
+        (WebCore::DeserializingTreeWalker::getProperty):
+        (WebCore::DeserializingTreeWalker::convertIfTerminal):
+        (WebCore::DeserializingTreeWalker::getPropertyNames):
+        (WebCore::DeserializingTreeWalker::putIndex):
+        (WebCore::DeserializingTreeWalker::putProperty):
+        (WebCore::DeserializingTreeWalker::startArray):
+        (WebCore::DeserializingTreeWalker::endArray):
+        (WebCore::DeserializingTreeWalker::startObject):
+        (WebCore::DeserializingTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::deserialize):
+        (WebCore::TeardownTreeWalker::shouldTerminate):
+        (WebCore::TeardownTreeWalker::ticksUntilNextCheck):
+        (WebCore::TeardownTreeWalker::didTimeOut):
+        (WebCore::TeardownTreeWalker::throwStackOverflow):
+        (WebCore::TeardownTreeWalker::throwInterruptedException):
+        (WebCore::TeardownTreeWalker::null):
+        (WebCore::TeardownTreeWalker::isArray):
+        (WebCore::TeardownTreeWalker::isObject):
+        (WebCore::TeardownTreeWalker::asInputArray):
+        (WebCore::TeardownTreeWalker::asInputObject):
+        (WebCore::TeardownTreeWalker::createOutputArray):
+        (WebCore::TeardownTreeWalker::createOutputObject):
+        (WebCore::TeardownTreeWalker::length):
+        (WebCore::TeardownTreeWalker::canDoFastRead):
+        (WebCore::TeardownTreeWalker::getIndex):
+        (WebCore::TeardownTreeWalker::getSparseIndex):
+        (WebCore::TeardownTreeWalker::getProperty):
+        (WebCore::TeardownTreeWalker::convertIfTerminal):
+        (WebCore::TeardownTreeWalker::getPropertyNames):
+        (WebCore::TeardownTreeWalker::putIndex):
+        (WebCore::TeardownTreeWalker::putProperty):
+        (WebCore::TeardownTreeWalker::startArray):
+        (WebCore::TeardownTreeWalker::endArray):
+        (WebCore::TeardownTreeWalker::startObject):
+        (WebCore::TeardownTreeWalker::endObject):
+        (WebCore::SerializedScriptValueData::tearDownSerializedData):
+        * bindings/js/SerializedScriptValue.h: Added.
+        (WebCore::SharedSerializedData::~SharedSerializedData):
+        (WebCore::SerializedScriptValueData::):
+        (WebCore::SerializedScriptValueData::type):
+        (WebCore::SerializedScriptValueData::~SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::SerializedScriptValueData):
+        (WebCore::SerializedScriptValueData::asImmediate):
+        (WebCore::SerializedScriptValueData::asDouble):
+        (WebCore::SerializedScriptValueData::asString):
+        (WebCore::SerializedScriptValueData::asObject):
+        (WebCore::SerializedScriptValueData::asArray):
+        (WebCore::SerializedScriptValueData::operator bool ):
+        (WebCore::SerializedScriptValueData::release):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::toString):
+        (WebCore::SerializedScriptValue::deserialize):
+        (WebCore::SerializedScriptValue::~SerializedScriptValue):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::data):
+        * dom/MessageEvent.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::message):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp:
+        (WebCore::EventSource::createMessageEvent):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didReceiveMessage):
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix for Windows.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move FrameLoader::canLoad to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30111
+
+        * WebCore.base.exp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadSubframe):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::createJavaAppletWidget):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::canLoad):
+        (WebCore::SecurityOrigin::shouldHideReferrer):
+        * page/SecurityOrigin.h:
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move setLocalLoadPolicy and friends to SecurityOrigin
+        https://bugs.webkit.org/show_bug.cgi?id=30110
+
+        These have more to do with security policies than with loading frames.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::setLocalLoadPolicy):
+        (WebCore::SecurityOrigin::restrictAccessToLocal):
+        (WebCore::SecurityOrigin::allowSubstituteDataAccessToLocal):
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::):
+
+2009-10-06  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Preparation for <http://webkit.org/b/30104>.
+        Inspector should show cookies of sub-resources on the page.
+        
+        Implement getRawCookies for CFNetwork for Windows, so we can see more
+        than just a key/value pair for Cookies when we are on Windows.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30132, make beforeload work with <link> elements and
+        XML processing instructions.
+
+        Fix up ProcessingInstruction's setData call so that it actually updates a stylesheet when the
+        data gets changed.
+
+        Move dispatchBeforeLoadedEvent to ContainerNode so all Elements (and ProcessingInstruction) can
+        access it.
+
+        Added fast/dom/beforeload/link-before-load.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::dispatchBeforeLoadEvent):
+        * dom/ContainerNode.h:
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::checkStyleSheet):
+        (WebCore::ProcessingInstruction::setData):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        accessibility/media-element.html crashes (and has incorrect result)
+        https://bugs.webkit.org/show_bug.cgi?id=30108
+
+        Fix up the accessibilty label for the newly added fullscreen button,
+        and update the test result accordingly.
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        (WebCore::AccessibilityMediaControl::controlTypeName):
+
+2009-10-06  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30028>
+        Multiple calls to SetFrontendProxyObject can leave an InspectorTimelineAgent with an invalid
+        InspectorFrontend.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject): Adds a check for an existing timeline agent.
+
+2009-10-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Move textRects to the right category in DOM.mm. Include DOMPrivate.h to ensure that the interfaces match.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]):
+
+2009-10-06  Benjamin C Meyer  <bmeyer@rim.com>
+
+        Reviewed by Ariya Hidayat.
+        
+        Match the behavior of other WebKit browser and have the first url of the drag data be the url passed in declareAndWriteDragImage and set the text of the drag data to be the title argument.
+        
+        Manual test: Drag the readability js link from http://lab.arc90.com/experiments/readability/
+        
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+        
+        HTMLInputElement::max and min are not defined for COM because they
+        conflict with the standard min() and max() macros.
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-06  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move m_openedByDOM to Page
+        https://bugs.webkit.org/show_bug.cgi?id=30109
+
+        We only need one instance of m_openedByDOM per page, we should move it
+        to a page-scoped object.  Notice that it's only ever touched for the
+        main frame.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::openedByDOM):
+        (WebCore::Page::setOpenedByDOM):
+        * page/Page.h:
+
+2009-10-06  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Some functions in GraphicsContext do not work
+        as expected if the associated painter has no clipping.
+        https://bugs.webkit.org/show_bug.cgi?id=29691
+
+        No new tests are associated with this because DumpRenderTree
+        always sets clipping on the painter, thus it would never hit 
+        the test case, but fast/box-shadow/basic-shadows.html is a
+        good example of what happens if the clipping is not set by
+        the user of QtWebKit.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        Fixed to handle the case that there is no clipping
+        before the call.
+
+2009-10-06  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30131, make beforeload fire on script elements.
+
+        Added tests in fast/dom/beforeload/.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchBeforeLoadEvent):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchBeforeLoadEvent):
+        * svg/SVGScriptElement.h:
+
+2009-10-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Enable caret movement commands also when caret browsing setting is
+        enabled.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::caretBrowsingEnabled):
+        (WebCore::enabledVisibleSelectionOrCaretBrowsing):
+        (WebCore::enabledInEditableTextOrCaretBrowsing):
+        (WebCore::CommandEntry::):
+        * manual-tests/gtk/caret-browsing.html: Added.
+
+2009-10-06  Anton Muhin  <antonm@chromium>
+
+        Reviewed by Dimitri Glazkov.
+
+        Non standard, but popular exetension allows automagically
+        turn a function into a namespace resolver.  Support that in
+        Chromium as well.
+
+        Adjust CodeGeneratorV8 to treat XPathNSResolver in a special way.
+        https://bugs.webkit.org/show_bug.cgi?id=30128
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::getXPathNSResolver):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: close inspector client view on
+        InspectorController::close API call.
+
+        In order to run batch web inspector layout tests (and not affect
+        subsequent tests) we should close inspector client's view upon
+        InspectorController::close API call.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30009
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::close):
+
+2009-10-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build by stubbing out the still image
+        support for halted plugins for the Qt build.
+
+        Bugzilla entry https://bugs.webkit.org/show_bug.cgi?id=30130
+        tracks removing this by implementing Frame::nodeImage().
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::halt):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Change QImageReader usage in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Replace the ReadContext with another appoach to
+        reading the image. Attempt to only read meta information
+        like the image size and number of frames (for animations)
+        first and then when the page is getting drawn decode
+        the image with the QImageReader.
+
+        This is a huge benefit on pages with many images and saves
+        ~2GB of memory on the szeged image test page.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        (WebCore::ImageDecoderQt::internalDecodeSize):
+        (WebCore::ImageDecoderQt::internalReadImage):
+        (WebCore::ImageDecoderQt::internalHandleCurrentImage):
+        (WebCore::ImageDecoderQt::forceLoadEverything):
+        (WebCore::ImageDecoderQt::failRead):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make use of RGBA32Buffer in ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Use the RGBA32Buffer instead of the internal ImageData
+        to be able to use support of the base class, optionally
+        support WebCore decoders for Qt and most importantly
+        separate metadata and image data for better cache control.
+
+        Remove ImageSourceQt as everything is now shared with
+        the normal ImageSource.
+
+        Change the ownership of the NativeImagePtr/QPixmap in
+        ImageQt.cpp to delete the m_frame to be subject to cache
+        control.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        (WebCore::ImageDecoderQt::clearFrameBufferCache):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::decodedImage):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/qt/RGBA32BufferQt.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::setDecodedImage):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] ImageDecoderQt avoid QString creation.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Avoid going from CString to QString to String
+        and go directly from CString to String. Also
+        avoid going to lower case to avoid an extra
+        memory allocation.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Cleanup the ImageDecoder of Qt.
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove the various enums for partial load. The fact is
+        that this image decoder will decode everything that is
+        in the file at once. Make it look like it behaves to
+        ease fixing this core problem.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageData::ImageData):
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::hasFirstImageHeader):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Reimplement instead of overload frameCount in ImageDecoderQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Reimplement frameCount instead of overloading it.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameCount):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QImageReader does not support progressive reading
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Change the ImageDecoderQt::setData to store the encoded
+        data in ImageDecoder.
+
+        Only call ReadContext when the whole Resource has been
+        loaded to avoid needless calls to reset and the
+        ReadContext as progressive loading is not supported.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-10-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove dead code from ImageDecoderQt
+        https://bugs.webkit.org/show_bug.cgi?id=27538
+
+        Remove unused variables and debugging code. The debug
+        code has never been used and does not provide anything
+        useful.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::read):
+        (WebCore::ImageDecoderQt::ReadContext::readImageLines):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        (WebCore::ImageDecoderQt::frameCount):
+        (WebCore::ImageDecoderQt::repetitionCount):
+        (WebCore::ImageDecoderQt::filenameExtension):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+
+2009-10-06  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] segfault when calling gst_video_format_parse_caps in the video sink
+        https://bugs.webkit.org/show_bug.cgi?id=30120
+
+        Fix use of gst_video_format_parse_caps()
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update mediaControls CSS
+
+        * css/mediaControlsQt.css:
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Get rid of Preferences.ignoreWhitespace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30092
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.update):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype.onpopulate):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.isCaretAtEndOfPrompt):
+        * inspector/front-end/inspector.js:
+        * inspector/front-end/utilities.js:
+        (Node.prototype.rangeOfWord):
+        (traverseNextNode):
+        (traversePreviousNode):
+        (onlyTextChild):
+
+2009-10-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not call nodeTitleInfo twice +
+        followup fixes for r49101.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30087
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Enable painting on printer.
+
+        The print preview dialog crashed because the depth of the drawable
+        changed owing to a bug in Qt - if you draw onto a 32-bit pixmap,
+        and set a 24-bit pixmap as source, it will convert the source to
+        32-bit.
+
+        1210fa5b2d65895ad2be1f9ca7cae586e3b29dc1 is the bug fix in Qt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Make painting and events work when page is zoomed.
+
+        The element gets resized when zoomed. So, we have to make sure that we resize
+        the drawable and do a setwindow call. Multiple calls to setwindow do not
+        crash plugin in windowless mode (unlike in windowed mode).
+
+        For mouse events we have to convert the pos to post-zoom position.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Add PluginQuirkRequiresDefaultScreenDepth quirk for Flash.
+
+        Flash does not use the visual provided by us to draw into the drawable.
+        It instead uses the system default visual (as returned by XDefaultVisual).
+        This means that if the screen default visual is 24-bit, Flash won't be
+        able to draw on 32-bit drawable created by us. This is a bug in Flash
+        and for the moment, the above quirk is only set for Flash.
+
+        Our strategy to create the drawable:
+        1. Create a 32-bit drawable if the default screen depth is 32 or the
+        quirk is not set (i.e not flash)
+        2. If we didn't create a 32-bit drawable (maybe the Display has no such
+        visual), we create a drawable with default screen depth.
+
+        As a result of the above changes, content propagation behavior changes as:
+        1. Content propagation is possible only if the drawable we create and
+        Qt's backing store are of the same depth.
+        2. If we created a 32-bit drawable, there is no need for content
+        propagation (Qt will take care of it).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Qt build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29362.
+
+        In Qt 4.5, a new function QPainter::fillRect(QRect, QColor) is
+        introduced to avoid the expensive construction of QBrush.
+        By casting WebCore::Color to QColor, we can compile on Qt 4.4
+        and use optimization for solid color fill in Qt 4.5.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::drawBorderlessRectShadow):
+
+2009-10-05  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Eric Carlson.
+
+        Allow the platform media player to know the <video> poster URL.
+        Add MediaPlayerPrivate::prepareToPlay() to support media engines
+        that do not buffer video data automatically. This method allows
+        such media engines to start the buffering just before starting
+        playback.
+        https://bugs.webkit.org/show_bug.cgi?id=29133
+
+        All platforms that currently implement <video> return false
+        in MediaPlayerPrivate::canLoadPoster() and do nothing in
+        MediaPlayerPrivate::prepareToPlay() their behavior is
+        unchanged. The current set of media test should then be
+        sufficient to guarantee that this patch does not break anything.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource):
+        After the MediaPlayer is created, inform it what the poster URL is.
+        (WebCore::HTMLMediaElement::updatePlayState):
+        Add another case where prepareToPlay is called for the platforms
+        that do not buffer video content automatically.
+        (WebCore::HTMLMediaElement::couldPlayIfEnoughData)
+        Same as potentiallyPlaying, except that we don't check for
+        the readyState being at least HAVE_FUTURE_DATA.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::canLoadPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::NullMediaPlayerPrivate::setPoster):
+        Empty implementation for the NullMediaPlayerPrivate.
+        (WebCore::MediaPlayer::canLoadPoster):
+        Proxy to the m_private.
+        (WebCore::MediaPlayer::setPoster):
+        Proxy to m_private.
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::canLoadPoster):
+        (WebCore::MediaPlayerPrivateInterface::setPoster):
+        Add new methods that allow the platform player to receive the poster URL.
+        (WebCore::MediaPlayerPrivateInterface::prepareToPlay):
+        Notifies the media engine that playback should start. The media engine
+        should start preparing (e.g. by initializing the player and starting to buffer)
+        and call back when the state is changed to HAVE_FUTURE_DATA.
+
+2009-10-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        StringImpl needs a method to get an instance for another thread which doesn't copy the underlying buffer.
+        https://bugs.webkit.org/show_bug.cgi?id=30095
+
+        All String::copy methods were changed to call either threadsafeCopy or crossThreadString. The method
+        call was made threadsafeCopy unless I could show that threadsafety wasn't needed.
+
+        No visible change in functionality so no new tests.
+
+        * dom/MessagePortChannel.cpp:
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        (WebCore::IconDatabase::iconForPageURL):
+        (WebCore::IconDatabase::iconURLForPageURL):
+        (WebCore::IconDatabase::retainIconForPageURL):
+        (WebCore::IconDatabase::releaseIconForPageURL):
+        (WebCore::IconDatabase::setIconDataForIconURL):
+        (WebCore::IconDatabase::setIconURLForPageURL):
+        (WebCore::IconDatabase::databasePath):
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin): Since this is used by SecurityOrigin::threadsafeCopy,
+        it makes threadsafe calls.
+        (WebCore::SecurityOrigin::threadsafeCopy): The only place that called this
+        needed a threadsafe method.
+        * page/SecurityOrigin.h:
+        * platform/CrossThreadCopier.cpp:
+        (WebCore::::copy):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/sql/SQLValue.cpp:
+        (WebCore::SQLValue::SQLValue):
+        (WebCore::SQLValue::string):
+        * platform/sql/SQLValue.h:
+        (WebCore::SQLValue::SQLValue):
+        All constructors now initialize the m_number which is a double. Failure to
+        do so can result in unexpected crashes when it is copied in the copy constructor.
+        See http://blogs.msdn.com/oldnewthing/archive/2008/07/02/8679191.aspx, I was that colleague.
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::threadsafeCopy):
+        (WebCore::String::crossThreadString):
+        * platform/text/StringImpl.cpp:
+        Removed StringImpl::substringCopy which was no longer being used anywhere.
+        (WebCore::StringImpl::threadsafeCopy): Changed the name to indicate that
+        it is threadsafe.
+        (WebCore::StringImpl::crossThreadString): The way to get strings for
+        another thread which is not threadsafe. This shares the underlying buffer
+        with both strings and gives them a way to do threadsafe refcounting for it.
+        * platform/text/StringImpl.h:
+        * storage/ChangeVersionWrapper.cpp:
+        (WebCore::ChangeVersionWrapper::ChangeVersionWrapper):
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap):
+        (WebCore::Database::Database):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::Database::version):
+        (WebCore::Database::setExpectedVersion):
+        (WebCore::Database::securityOriginCopy):
+        (WebCore::Database::stringIdentifier):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::scheduleNotifyDatabaseChanged):
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::addDatabase):
+        * storage/SQLError.h:
+        (WebCore::SQLError::message):
+        (WebCore::SQLError::SQLError):
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::SQLStatement):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::syncTimerFired):
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::importItem):
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::url): Do the copy of the url in a way that is threadsafe.
+        (WebCore::SharedWorkerProxy::name):
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::DefaultSharedWorkerRepository::getProxy): Do the copy of the url in a way that is threadsafe.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::Task::Task):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Windowless plugins: Use X Pixmap instead of QPixmap.
+
+        This has the following advantages:
+        1. Allows more sharing of code between gtk and Qt ports in the future
+        2. QPixmap creates 24-bit by default. We have to later 'upgrade' it to 32-bit.
+        3. QPixmap may sometime change depth behind our back! This will require us to
+        update the plugin about the new visual and colormap.
+        4. We cannot ensure that QPixmap is backed by a X Drawable. For example, with
+        -graphicssystem raster, QPixmap uses the raster (image) backend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::platformDestroy):
+
+2009-10-06  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add support for windowless NPAPI plugins
+
+        https://bugs.webkit.org/show_bug.cgi?id=20081
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::setSharedXEventFields):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::setXKeyEventSpecificFields):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::inputEventState):
+        (WebCore::setXButtonEventSpecificFields):
+        (WebCore::setXMotionEventSpecificFields):
+        (WebCore::setXCrossingEventSpecificFields):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleFocusInEvent):
+        (WebCore::PluginView::handleFocusOutEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::getPluginDisplay):
+        (WebCore::PluginView::platformStart):
+
+2009-10-05  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filters do not support source images besides "sourceGraphic"
+        [https://bugs.webkit.org/show_bug.cgi?id=6022]
+
+        Add support for SourceAlpha to SVG filters.
+
+        Test: svg/filters/sourceAlpha.svg
+
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+
+2009-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix reliablity bot crash in DateExtension.
+        https://bugs.webkit.org/show_bug.cgi?id=30033
+
+        There were a few problems using the weak persistent pointers because no one else had a
+        handle to them.  The new approach stores them as a hidden value on the Date constructor.
+
+        * bindings/v8/DateExtension.cpp:
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::Setup):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::sleepFunction):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+2009-10-05  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash when trying to load a null stylesheet for a site specific hack. 
+        https://bugs.webkit.org/show_bug.cgi?id=30105
+
+        Created a testcase and tested in browser.  DRT doesn't test
+        site specific hacks.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+
+2009-10-05  James Robinson  <jamesr@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fix forward declaration (struct vs class mismatch)
+
+        https://bugs.webkit.org/show_bug.cgi?id=30094
+
+        * loader/RedirectScheduler.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, last Chromium build fix corresponding to revision 49113.
+        Add include for BeforeLoadEvent to DOMObjectsInclude.h.
+
+        * bindings/v8/DOMObjectsInclude.h:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build.
+
+        * html/HTMLMediaElement.cpp:
+
+2009-10-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build: MediaControllerThemeQT was renamed to MediaControllerThemeQuickTime.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+
+2009-10-05  Pierre d'Herbemont  <pdherbemont@webkit.org>
+
+        Reviewed by Simon Fraser
+        
+        Support fullscreen in MediaPlayer (Mac)
+        https://bugs.webkit.org/show_bug.cgi?id=26742
+
+        Add a fullscreen button to the <video> controller if the media engine,
+        and the theme have support for fullscreen, and can show appropriate controls.
+        Clicking the button calls through the ChromeClient to the WebVideoFullscreenController
+        in WebKit to do a nice animation to fullscreen, with a custom controller.
+
+        * DerivedSources.make:
+        * WebCore.Video.exp: Added.
+        New export file for when VIDEO is enabled.
+        
+        * WebCore.base.exp: Export WebCore::HTMLNames::videoTag
+        * WebCore.xcodeproj/project.pbxproj: New files
+        
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::willRemove):
+        (WebCore::HTMLMediaElement::screenRect):
+        (WebCore::HTMLMediaElement::enterFullscreen):
+        (WebCore::HTMLMediaElement::exitFullscreen):
+        (WebCore::HTMLMediaElement::platformMedia):
+        Add fullscreen logic. platformMedia returns a pointer to platform-specific playback data
+        used for fullscreen.
+        
+        * html/HTMLVideoElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::supportsFullscreen): Check with both the player and the ChromeClient
+        to see if it's possile to enter fullscreen for this element.
+        
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::supportsFullscreenForNode):
+        (WebCore::ChromeClient::enterFullscreenForNode):
+        (WebCore::ChromeClient::exitFullscreenForNode):
+        New methods
+        
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayer::platformMedia):
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::platformMedia):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        New methods to return platform-specific playback data for fullscreen.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        Hook up the fullscreen button.
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::shouldRenderMediaControlPart):
+        Allow the RenderThemeMac to make a decision about the availability of fullscreen based
+        on the QuickTime version, since this affects what controls are availabl.e
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Export a few more methods from Settings.h
+        
+        Rubberstamped by Jon Honeycutt.
+        
+        * WebCore.base.exp:
+
+2009-10-05  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        1-char fix for obviously reverse condition.
+        https://bugs.webkit.org/show_bug.cgi?id=30100
+        No test since the only difference is a timing of GC.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::clear): Revert condition. Almost a typo.
+
+2009-09-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update platform-specific #ifdefs in GraphicsContext3D.h for the
+        Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=29936
+
+        * platform/graphics/GraphicsContext3D.h:
+        Changed #if PLATFORM(SKIA) to #if PLATFORM(CHROMIUM).
+
+2009-10-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47440): Inserting text in the middle of content in a scrolled textfield results in painting bugs
+        <rdar://problem/7269108>
+        https://bugs.webkit.org/show_bug.cgi?id=29982
+
+        Test: fast/repaint/line-in-scrolled-clipped-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Use the unclipped overflow rect
+        (including layout overflow) for the repaint rect calculation.
+
+2009-10-05  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Chromium wants to turn off SharedWorkers at runtime
+        https://bugs.webkit.org/show_bug.cgi?id=29757
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::sharedWorker):
+        Now returns jsUndefined if isAvailable() returns false, to allow SharedWorkers to be disabled at runtime.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerRepository::isAvailable):
+        Made SharedWorkers available by default.
+        * workers/SharedWorkerRepository.h:
+        Added definition for SharedWorkerRepository::isAvailable().
+
+2009-10-05  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A super quick fix for Bug 28710.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28710
+
+        This change just resets the style sent to addStyleMarkup() to avoid an assertion error
+        and creates an empty style when computedStyleAtPosition is 0 to avoid a crash.
+        (This change is nothing but a better-than-crash change.)
+
+        Tests: editing/selection/select-crash-001.html
+               editing/selection/select-crash-002.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::editingStyleAtPosition): Resets the style sent to addStyleMarkup() if it is not valid.
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Creates an empty style if computedStyleAtPosition is 0.
+
+2009-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Silence duplicate errors logged for missing getComputedStyle
+        implementations. Improves the error message as well.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::logUnimplementedPropertyID):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #3.  Add V8BeforeLoadEvent.[cc|h] to derived sources.
+
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+
+2009-10-05  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the GTK build.
+
+        * GNUmakefile.am:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix #2.  Add new BEFORELOADEVENT to V8ClassIndex.
+
+        * bindings/v8/V8Index.h:
+
+2009-10-05  Julie Parent  <jparent@chromium.org>
+
+        Unreviewed, Chromium build fix.  Missing "," after entry for BeforeLoadEvent.idl. 
+
+        * WebCore.gypi:
+
+2009-10-05  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a beforeload event that will be fired before subresources load. (It isn't fired yet.)  The event
+        has one field, the URL that is going to be requested.  Setting preventDefault will stop the load
+        from occurring.
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/BeforeLoadEvent.h: Added.
+        (WebCore::BeforeLoadEvent::create):
+        (WebCore::BeforeLoadEvent::initBeforeLoadEvent):
+        (WebCore::BeforeLoadEvent::url):
+        (WebCore::BeforeLoadEvent::BeforeLoadEvent):
+        * dom/BeforeLoadEvent.idl: Added.
+        * dom/EventNames.h:
+        * page/DOMWindow.idl:
+
+2009-10-05  Priit Laes  <plaes@plaes.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Add Gentoo-specific paths for searching browser plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=30088
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::defaultPluginDirectories):
+
+2009-10-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Add functionality to pause/throttle CSS transitions/animations in a WebView
+        https://bugs.webkit.org/show_bug.cgi?id=29942
+
+        Exporting call from AnimationController
+
+        * WebCore.base.exp:
+
+2009-10-05  Kevin Decker  <kdecker@apple.com>
+
+        Rubberstamped by Anders Carlsson.
+        
+        * WebCore.base.exp: Update export of HaltablePlugin/PluginHalterClient.
+        * WebCore.xcodeproj/project.pbxproj: Likewise.
+
+2009-10-05  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r49104.
+        http://trac.webkit.org/changeset/49104
+
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Update style immediately when validation-related values are updated.
+        https://bugs.webkit.org/show_bug.cgi?id=28868
+
+        In order to apply :valid, :invalid, :optional or :required lively,
+          - call setNeedsStyleRecalc() when properties which can change
+            willValidate state are updated, and
+             (Parent form element, name, disabled, readonly)
+          - call updateValidity() when properties which can change validity
+            state are updated. (value, pattern, required)
+
+        Tests: fast/forms/input-live-pseudo-selectors.html
+               fast/forms/textarea-live-pseudo-selectors.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement):
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        (WebCore::HTMLFormControlElement::required):
+        (WebCore::HTMLFormControlElement::updateValidity):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement min/max attributes, ValidityState.rangeUnderflow and
+        ValidityState.rangeOverflow for <input type=number> and <input type=range>
+        https://bugs.webkit.org/show_bug.cgi?id=29069
+
+        Tests: fast/forms/ValidityState-rangeOverflow-number.html
+               fast/forms/ValidityState-rangeOverflow-range.html
+               fast/forms/ValidityState-rangeUnderflow-number.html
+               fast/forms/ValidityState-rangeUnderflow-range.html
+               fast/forms/input-minmax.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::rangeMinimum):
+        (WebCore::HTMLInputElement::rangeMaximum):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::rangeUnderflow):
+        (WebCore::ValidityState::rangeOverflow):
+        * html/ValidityState.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::SliderRange):
+        (WebCore::SliderRange::valueFromElement):
+
+2009-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduces
+         - new CSS pseudo selector: "-webkit-input-list-button"
+         - new CSS apperance type: "list-button"
+         - new ControlPart value: "ListButtonPart"
+        for the UI of the list attribute of the input element, and adds
+        implementation to draw ListButtonPart on Mac.
+        The code is guarded by ENABLE(DATALIST).
+
+        https://bugs.webkit.org/show_bug.cgi?id=27794
+
+        Test: platform/mac/fast/forms/input-list-button-size.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * css/CSSValueKeywords.in:
+        * css/html.css:
+        * html/HTMLInputElement.cpp:
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::listButtonSizes):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minimumControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-10-05  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30065>
+        nodeTitleInfo should be placed in ElementsTreeOutline.
+        
+        Move nodeTitleInfo into ElementsTreeOutline.js from utilities.js.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateTitle):
+        (WebInspector.ElementsTreeElement.prototype._nodeTitleInfo):
+        * inspector/front-end/utilities.js:
+
+2009-10-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Inform the application when a new request is created
+        https://bugs.webkit.org/show_bug.cgi?id=29975
+
+        Emit a signal each time a request is created, with the request and the frame
+        that created it.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::start):
+
+2009-10-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT in updateGuidVersionMap.
+        https://bugs.webkit.org/show_bug.cgi?id=30077
+
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): ASSERT that the guidMutex() is locked.
+
+2009-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Allow V8 to throw an exception in _NPN_SetException without worrying about context
+        if we don't have enough information to find the correct context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30026
+
+        Part of the fix for Chromium's failure of LayouTests/plugins/netscape-throw-exception.html.
+
+        * bindings/v8/NPV8Object.cpp: 
+        (_NPN_SetException): Don't suppress the exception if we can't find the relevant context.
+
+2009-10-05  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Place "Close" button in docked mode on the same side as the window "Close" button in detached mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29961
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-10-05  J-P Nurmi  <jpnurmi@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Added pure virtual QWebPageClient::pluginParent()
+
+        https://bugs.webkit.org/show_bug.cgi?id=29710
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-05  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] windowsKeyCodeForKeyEvent() returns a wrong value for the F10 key.
+        https://bugs.webkit.org/show_bug.cgi?id=30042
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-10-05  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Unreviewed build fix for ENABLE(WEB_SOCKETS) and v8.
+
+        V8ObjectEventListener.h has been removed at r48978
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector console stops working while JS in IFRAME is paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29958
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Introduce inspected object groups for console
+        and watch evaluation results so that they could be released
+        explicitly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29891
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::wrapObject):
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::releaseWrapperObjectGroup):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        (WebCore::InspectorController::releaseWrapperObjectGroup):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript.evaluateInCallFrame):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Move mediaControls extras for the Qt port into WebCore/css like other ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        * WebCore.pro:
+        * WebCore.qrc:
+        * css/mediaControlsQt.css: Renamed from WebCore/css/qt/mediaControls-extras.css.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+
+2009-10-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Carlson.
+
+        Rename WebCore/css/mediaControlsQT.css and MediaControllerThemeQT
+
+        https://bugs.webkit.org/show_bug.cgi?id=30013
+
+        The QT suffix has been expanded to QuickTime, to not cause confusion
+        and name-crashes with similar files in the Qt port.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/mediaControlsQuickTime.css: Renamed from WebCore/css/mediaControlsQT.css.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet):
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30064>
+        Syntax Highlighting CSS shouldn't be duplicated.
+
+        Refactor syntax highlighting CSS into a new file, add it to the
+        projects, and have SourceFrame.js and inspector.html include the
+        new CSS file.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspectorSyntaxHighlight.css: Added.
+        * inspector/front-end/WebKit.qrc:
+
+2009-10-04  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30062>
+        Inspector should syntax highlight JS/CSS in elements view.
+
+        Add syntax highlighting of CSS and JavaScript tags to the elements panel.
+        Copied CSS rules from SourceFrame.js to inspector.css, and have the text nodes
+        in utilities.js call the CSS or JS Syntax highlighters if their parent is a script
+        or style tag.
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/utilities.js:
+
+2009-10-04  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Enable Web Sockets in chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=29917
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Revert previous patch, as the newly added test breaks other tests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustova Noronha.
+
+        [GTK] performs a POST when refreshing a view that was obtained with a GET
+        https://bugs.webkit.org/show_bug.cgi?id=29761
+
+        Update the HTTP method in the request stored by willSendRequest
+        after a redirect, since it could have changed.
+
+        Test: http/tests/navigation/postredirect-reload.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-10-04  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fixed Function leak in V8LazyEventListener.
+        (Should fix the remaning leak in
+        https://bugs.webkit.org/show_bug.cgi?id=29093).
+        V8LazyEventListeners used to create FunctionTemplates for each
+        wrapped listener which in turn created Functions that were cached
+        forever in V8 Context. Now there is at most one such Function per
+        Context.
+        https://bugs.webkit.org/show_bug.cgi?id=30060
+
+        Added new hidden property name to store toString result:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        Switched to static FunctionTemplate:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Support for WebKit's CSS Variables @variables and var()
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.CSSSourceSyntaxHighligher):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector should remember preferences for docked/undocked etc
+        https://bugs.webkit.org/show_bug.cgi?id=29089
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): toggle the preference
+        * inspector/front-end/inspector.js:
+        (WebInspector._loadPreferences): factored out loading preferences
+        (WebInspector.loaded):
+
+2009-10-03  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        CSS Source View Should be Syntax Highlighted
+        https://bugs.webkit.org/show_bug.cgi?id=14359
+
+          Trigger the Syntax Highlighter for CSS files.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        (WebInspector.SourceFrame.prototype.syntaxHighlightCSS):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+          Factored out the Syntax Highlighting procedure into a "Class"
+          Added CSSSourceSyntaxHighlighter and JavaScriptSourceSyntaxHighlighter
+
+        (WebInspector.SourceSyntaxHighligher):
+        (WebInspector.SourceSyntaxHighligher.prototype.createSpan):
+        (WebInspector.SourceSyntaxHighligher.prototype.process.processChunk):
+        (WebInspector.SourceSyntaxHighligher.prototype.process):
+        (WebInspector.CSSSourceSyntaxHighligher): the CSS Highlighter
+        (WebInspector.JavaScriptSourceSyntaxHighligher): the JS Highlighter
+
+2009-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Factor back-forward list methods out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=30037
+
+        This change moves these back-forward related methods from FrameLoader
+        to Page.  It's possible we should move these methods into some kind of
+        "page controller" object, but we can figure that out in a future patch.
+
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp:
+        (WebCore::RedirectScheduler::timerFired):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close):
+        * page/History.cpp:
+        (WebCore::History::length):
+        * page/Page.cpp:
+        (WebCore::Page::canGoBackOrForward):
+        (WebCore::Page::goBackOrForward):
+        (WebCore::Page::getHistoryLength):
+        * page/Page.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: prepare InspectorController for being used from layout tests.
+        This change adds evaluateForTestInFrontend method with the callback that
+        allows evaluating arbitrary code in the frontend context.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30008
+
+        * WebCore.Inspector.exp:
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::didEvaluateForTestInFrontend):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::evaluateForTestInFrontend):
+        (WebCore::InspectorController::didEvaluateForTestInFrontend):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::evaluateForTestInFrontend):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.evaluateForTestInFrontend):
+
+2009-10-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Node search mode is not getting reset on element selection.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30016
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <https://bugs.webkit.org/show_bug.cgi?id=30036>
+        Should be able to resize Cookie Columns.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.resize):
+
+2009-09-25  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Make WebCore::PluginView participate in plug-in halting.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/BitmapImage.h:
+        Declare a create() function that takes an HBITMAP.
+
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::create):
+        Use GetObject() to fill out a DIBSECTION structure for the given
+        HBITMAP. Call CGBitmapContextCreate() to create a CG context from the
+        bits of the bitmap. Create a CG image from the context, and pass this
+        when creating a new BitmapImage.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        If we successfully started, tell our parent frame's Page.
+        (WebCore::PluginView::stop):
+        Tell our parent frame's Page that we stopped.
+        (WebCore::PluginView::node):
+
+        * plugins/PluginView.h:
+        Inherit from HaltablePlugin.
+        (WebCore::PluginView::setPlatformPluginWidget):
+        On platforms where the platform plug-in widget is the WebCore::Widget's
+        platform widget, have setPlatformPluginWidget() call
+        setPlatformWidget().
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::halt):
+        Stubbed.
+        (WebCore::PluginView::restart):
+        Stubbed.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::platformDestroy):
+        After destroying the window, set the platform plug-in widget to 0 to
+        ensure that Widget isn't holding a stale handle.
+        (WebCore::PluginView::halt):
+        Have our element's RenderWidget display a screenshot of the plug-in,
+        then stop the plug-in and destroy it.
+        (WebCore::PluginView::restart):
+        Clear the RenderWidget's substitute image, then start the plug-in.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::showSubstituteImage):
+        Set m_substituteImage to the passed image, and repaint.
+        (WebCore::RenderWidget::paint):
+        If we have a substitute image, paint that instead of allowing the
+        widget to paint itself.
+
+        * rendering/RenderWidget.h:
+        Declare showSubstituteImage(). Added a member to store the substitute
+        image.
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move PolicyCheck out of FrameLoader.{h,cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=30035
+
+        Purely code motion (and adding a destructor).
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/PolicyCheck.cpp:
+        * loader/PolicyCheck.h:
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Add NPNVToolkit value quirk in plugins for nspluginwrapper.
+        Plugin error message was:
+        ERROR: failed to initialize brower-side RPC events listener
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        (WebCore::staticPluginQuirkRequiresGtkToolKit_NPN_GetValue):
+        (WebCore::PluginPackage::load):
+
+2009-10-02  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] X sync our XEmbed container window creation before sending the
+        xid to plugins.
+        https://bugs.webkit.org/show_bug.cgi?id=25053
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Setting zero size on a container of a video element doesn't hide the controller
+        https://bugs.webkit.org/show_bug.cgi?id=30031
+        
+        Fix a logic error in enclosingCompositingLayer() when mixing normal flow and 
+        positioned layers. This resulted in enclosingCompositingLayer() giving back a different
+        answer to the logic used to actually parent compositing layers, so layer positions
+        and layer hierarchy would be out of agreement.
+        
+        Test: compositing/geometry/clipped-video-controller.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::compositingContainer):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+
+2009-10-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Move the following methods of HTMLInputElement and HTMLTextAreaElement
+          to HTMLTextFormControlElement.
+           setSelectionStart()
+           setSelectionEnd()
+           select()
+           setSelectionRange()
+           selectionStart()
+           selectionEnd()
+           selection()
+
+        - Introduce cachedSelectionStart() and cachedSelectionEnd().
+
+        - Unify HTMLInputElement::isTextFieldWithRenderer() and
+         HTMLTextAreaElement::rendererAfterUpdateLayout() into textRendererAfterUpdateLayout().
+        
+        - Unify a part of parseMappedAttribute() of HTMLInputElement and HTMLTextAreaElement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29782
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::textRendererAfterUpdateLayout):
+        (WebCore::HTMLTextFormControlElement::setSelectionStart):
+        (WebCore::HTMLTextFormControlElement::setSelectionEnd):
+        (WebCore::HTMLTextFormControlElement::select):
+        (WebCore::HTMLTextFormControlElement::setSelectionRange):
+        (WebCore::HTMLTextFormControlElement::selectionStart):
+        (WebCore::HTMLTextFormControlElement::selectionEnd):
+        (WebCore::HTMLTextFormControlElement::selection):
+        (WebCore::HTMLTextFormControlElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::cachedSelectionStart):
+        (WebCore::HTMLInputElement::cachedSelectionEnd):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::cachedSelectionStart):
+        (WebCore::HTMLTextAreaElement::cachedSelectionEnd):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Disconnect event listeners on navigation.
+        Fixes http://crbug.com/23597.
+        https://bugs.webkit.org/show_bug.cgi?id=30027
+
+        Added V8ListenerGuard that is shared by listeners and proxy. On
+        navigation proxy sets a flag in the guard turning off listeners.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8ListenerGuard::create):
+        (WebCore::V8ListenerGuard::isDisconnected):
+        (WebCore::V8ListenerGuard::disconnectListeners):
+        (WebCore::V8ListenerGuard::V8ListenerGuard):
+        (WebCore::V8AbstractEventListener::disconnected):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        (WebCore::V8Proxy::clearForNavigation):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::listenerGuard):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::V8WorkerContextEventListener):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        (WebCore::V8WorkerContextEventListener::create):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Fix WebGL build after CustomGetter constructor changes
+        https://bugs.webkit.org/show_bug.cgi?id=30020
+
+        * page/DOMWindow.idl:
+        Changed CustomGetter to JSCCustomGetter for CanvasArray constructors.
+
+2009-10-02  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: text in a "Request Payload" section disappears on selection
+        https://bugs.webkit.org/show_bug.cgi?id=29967
+
+        No new tests.
+
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+
+2009-10-02  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Recursion guard for V8Proxy::callFunction.
+        Fixes http://crbug.com/23278.
+        https://bugs.webkit.org/show_bug.cgi?id=29974
+
+        Test: fast/xmlhttprequest/xmlhttprequest-recursive-sync-event.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::callFunction):
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix test breakages by adding null checks, and putting inspector code in
+        ENABLE(INSPECTOR).
+
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Clean up the QNetworkReplyHandler to only apply HTTP headers
+        for protocols in the HTTP family.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Move error check into sendResponseIfNeeded() as suggested
+        by Eric Seidel. Also, remove some dead code.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-10-02  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Assertion failure in CompositeEditCommand::moveParagraphs() and crash in Node::nodeIndex() when pasting.
+        <rdar://problem/7148712>
+        https://bugs.webkit.org/show_bug.cgi?id=28992
+
+        Test: editing/selection/replace-selection-crash.html
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Handle properly the case of
+        the destination position matching the end of the paragraph to move.
+
+2009-10-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement per-storage-area quotas for LocalStorage
+        https://bugs.webkit.org/show_bug.cgi?id=29991
+
+        I put 90% of the code in StorageMap since the decision to allow an update is
+        closely tied to quota tracking.  The quota is set via a page's Settings class.
+        Like with the local storage path and whether it's enabled, it's assumed that
+        all pages in the same group will have the same settings.  The setting defaults
+        to 5mb which is what the spec suggests, but it can easily be changed to
+        anything else--including StorageMap::noQuota.  Any values in LocalStorage are
+        grandfathered in regarudless of quota, so importItem only tracks (and will
+        never block) imports.
+
+        I believe this change is a good transition to more complex quota management.
+        For example, if we wanted to track quotas in the SQLite DB, then we'd just add
+        a function to the StorageMap that sets the quota.  This would be fine since all
+        use of LocalStorage is blocked on the import completing, so you'd never hit a
+        quota error in the mean time.  Also, if embedders wanted to ask the user
+        whether to expand the quota whenever it's hit (before deciding whether or not
+        to raise an exception), a callback via the chrome client should be fairly easy.
+        That said, I think it's best to add these features in steps rather than one
+        huge patch.  (Both of these are on my TODO list, btw.)
+
+        Included is a layout test that verifies the behavior.  It assumes the default
+        quota is 5mb (since that's what Settings defaults to).
+
+        Test: storage/domstorage/localstorage/quota.html
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setLocalStorageQuota):
+        * page/Settings.h:
+        (WebCore::Settings::localStorageQuota):
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::create):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::create):
+        (WebCore::StorageMap::StorageMap):
+        (WebCore::StorageMap::copy):
+        (WebCore::StorageMap::setItem):
+        (WebCore::StorageMap::removeItem):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+        (WebCore::StorageMap::quota):
+        * storage/StorageNamespace.cpp:
+        (WebCore::StorageNamespace::localStorageNamespace):
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::localStorageNamespace):
+        (WebCore::StorageNamespaceImpl::sessionStorageNamespace):
+        (WebCore::StorageNamespaceImpl::StorageNamespaceImpl):
+        (WebCore::StorageNamespaceImpl::copy):
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-10-02  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Database Inspector crashes Safari when table has more than 21 columns
+        https://bugs.webkit.org/show_bug.cgi?id=29924
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.dataGridForResult): adjust the minimum column width percentage to be flexible for many columns.
+
+2009-10-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Fixes <http://webkit.org/b/14370>.
+        Inspector's timeline should record when certain DOM events fired.
+        
+        This patch adds calls into the Web Inspector when the main frame
+        fires an load event, and when the document fires its DOMContent
+        event. Once these values are passed in, they are sent to the Web Inspector
+        as a timing change, and these are denoted by vertical lines in the resources
+        panel (blue for DOM Content, red for load event).
+
+        * English.lproj/localizedStrings.js: Added tooltip text.
+        * dom/Document.cpp:
+        (WebCore::Document::finishedParsing): Added an Inspector callback for DOM Content.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent): Tell the main resource it got the event.
+        (WebCore::InspectorController::mainResourceFiredLoadEvent): Ditto.
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource): Added new variables.
+        (WebCore::InspectorResource::updateScriptObject): Send new variables to inspector.js.
+        (WebCore::InspectorResource::markDOMContentEventTime): Send a TimingChange event.
+        (WebCore::InspectorResource::markLoadEventTime): Ditto.
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceLoadTime):
+        (WebInspector.ResourcesPanel.prototype.get mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.set mainResourceDOMContentTime):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Draw dividers for event timings.
+        (WebInspector.ResourceTimeCalculator.prototype.computePercentageFromEventTime):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchLoadEvent): Add an Inspector callback for the Load event.
+
+2009-10-02  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add support for blacklist patterns to user stylesheets and scripts in addition to whitelist patterns.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        * page/PageGroup.h:
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        * page/UserContentURLPattern.h:
+        * page/UserScript.h:
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::whitelist):
+        (WebCore::UserScript::blacklist):
+        * page/UserStyleSheet.h:
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::whitelist):
+        (WebCore::UserStyleSheet::blacklist):
+
+2009-10-02  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Build fix when SVG is not enabled
+        https://bugs.webkit.org/show_bug.cgi?id=30011
+
+        Move TextRenderingMode related functions out from
+        the ENABLE(SVG) guard.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+
+2009-10-02  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebGL crashes with recent CanvasArray change
+        https://bugs.webkit.org/show_bug.cgi?id=30018
+
+        Test: fast/canvas/webgl/array-unit-tests.html
+
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        Fix bug where PassRefPtr was tested after transferring value to RefPtr.
+
+2009-10-02  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=29989>
+        Safari version number shouldn't be exposed in WebKit code
+        
+        For a WebKit version of 532.3.4:
+        Product version is: 5.32.3.4 (was 4.0.3.0)
+        File version is: 5.32.3.4 (was 4.532.3.4)
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-10-02  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Enable two point radial gradients in Chromium/Skia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=30017
+
+        Covered by the following tests:
+
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-13-b.svg
+        LayoutTests/fast/backgrounds/svg-as-background-3.html
+        LayoutTests/fast/gradients/generated-gradients.html
+        LayoutTests/fast/gradients/simple-gradients.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-10-02  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Conditionally guard cursor code (cursor and updateCursor functions) with !QT_NO_CURSOR.
+        Otherwise, it is inconsistent with class declaration of QCursor.
+
+        No new tests.
+
+        * platform/qt/QWebPageClient.h:
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        cleanup of caps handling in the video sink
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+
+2009-10-02  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compiler warnings about unused function arguments.
+
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::initializeParserContext):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::getCachedFontPlatformData):
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFiles):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::frameBufferAtIndex):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::setEndTime):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/network/qt/DnsPrefetchHelper.h:
+        (WebCore::DnsPrefetchHelper::lookedUp):
+        * platform/qt/ContextMenuQt.cpp:
+        (WebCore::ContextMenu::setPlatformDescription):
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::supportsFocusRing):
+        (WebCore::RenderThemeQt::systemFont):
+        (WebCore::RenderThemeQt::adjustButtonStyle):
+        (WebCore::RenderThemeQt::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        * platform/qt/SearchPopupMenuQt.cpp:
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::paint):
+        * xml/XSLStyleSheetQt.cpp:
+        (WebCore::XSLStyleSheet::loadChildSheet):
+        (WebCore::XSLStyleSheet::setParentStyleSheet):
+        * xml/XSLTProcessorQt.cpp:
+        (WebCore::XSLTMessageHandler::handleMessage):
+        (WebCore::XSLTProcessor::transformToString):
+
+2009-10-02  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.
+
+        Stale database version persists through browser refresh (changeVersion doesn't work)
+        https://bugs.webkit.org/show_bug.cgi?id=27836
+
+        Scale the cairo surface of the video sink depending on the
+        pixel-aspect-ratio of the video buffer to paint. Also
+        destruct/re-create the surface when setSize() is called with a new
+        size.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-02  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] missing support for anamorphic PAR video size
+        https://bugs.webkit.org/show_bug.cgi?id=29717
+
+        Tests: storage/change-version-handle-reuse.html
+               storage/change-version.html
+
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Implement the V8 binding for database.changeVersion().
+        (WebCore::createTransaction): Fix a bug that was checking the wrong argument index to save the success callback.
+        * storage/Database.cpp:
+        (WebCore::updateGuidVersionMap): Safely update the Guid/version hash map.
+        (WebCore::Database::~Database): Remove code that removes the database from the guid->database and guid->version maps.
+        (WebCore::Database::setVersionInDatabase): Add a comment to explain some behaviour.
+        (WebCore::Database::close): Move the code that updates the maps from the destructor to here.
+        (WebCore::Database::performOpenAndVerify): Call updateGuidVersionMap instead of setting the hash map directly.
+        (WebCore::Database::setExpectedVersion): Update the in memory guid->version map when we want to update the database version.
+
+2009-10-02  Janne Koskinen <janne.p.koskinen@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Partial WINSCW build fix.
+
+        Add parentheses around the function pointer declaration, similar to the
+        second hunk in r48825.
+
+        * loader/CachedResourceHandle.h:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed attempted build fix by Xcode magic.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-10-02  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed build fix.  Actually add the new files.
+
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RedirectScheduler to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=29952
+
+        This change is purely code motion.
+
+        No behavior change.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/RedirectScheduler.cpp: Added.
+        (WebCore::ScheduledRedirection::):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        * loader/RedirectScheduler.h: Added.
+
+2009-10-02  Dave MacLachlan  <dmaclach@gmail.com>
+
+        Reviewed by David Levin.
+
+        Clean up warnings in WebCore/bindings/v8/npruntime.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29971
+
+        Gets rid of warnings on gcc about using anonymous namespaces 
+          warning: 'StringKeyHashTraits' has a base
+          'WTF::GenericHashTraits<<unnamed>::StringKey>' 
+          whose type uses the anonymous namespace
+        and
+          warning: 'WTF::PairHashTraits<StringKeyHashTraits,
+          WTF::HashTraits<PrivateIdentifier*> >' has a base
+          'WTF::GenericHashTraits<std::pair<<unnamed>::StringKey,
+          PrivateIdentifier*> >' whose type uses the anonymous namespace
+
+        No tests required.
+
+        * bindings/v8/npruntime.cpp:
+
+2009-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger build.  Don't unconditionally enable 3D canvas as it is not supported on Tiger.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-10-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn on ENABLE_3D_CANVAS in TOT
+        https://bugs.webkit.org/show_bug.cgi?id=29906
+
+        Fixed a bug found when running tests with flag on
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.base.exp:
+        * bindings/js/JSCanvasArrayBufferConstructor.h:
+        (WebCore::construct):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        * html/canvas/CanvasArray.cpp:
+        (WebCore::CanvasArray::CanvasArray):
+        * html/canvas/CanvasByteArray.cpp:
+        (WebCore::CanvasByteArray::create):
+        * html/canvas/CanvasFloatArray.cpp:
+        (WebCore::CanvasFloatArray::create):
+        * html/canvas/CanvasIntArray.cpp:
+        (WebCore::CanvasIntArray::create):
+        * html/canvas/CanvasShortArray.cpp:
+        (WebCore::CanvasShortArray::create):
+        * html/canvas/CanvasUnsignedByteArray.cpp:
+        (WebCore::CanvasUnsignedByteArray::create):
+        * html/canvas/CanvasUnsignedIntArray.cpp:
+        (WebCore::CanvasUnsignedIntArray::create):
+        * html/canvas/CanvasUnsignedShortArray.cpp:
+        (WebCore::CanvasUnsignedShortArray::create):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebGLEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::webGLEnabled):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/7264725> Re-add a vendor prefix to box-
+        shadow (29927)
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29927
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::ShadowParseContext::ShadowParseContext):
+        (WebCore::ShadowParseContext::commitValue):
+        (WebCore::ShadowParseContext::commitLength):
+        (WebCore::ShadowParseContext::commitColor):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        At bad merge at some point in the development of my patch must have 
+        put TextRenderMode.h in a weird spot in the xcodeproj. Moving it 
+        back where it belongs!
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove FrameLoader::schedule* APIs
+        https://bugs.webkit.org/show_bug.cgi?id=29950
+
+        Change clients of FrameLoader::schedule* to call redirectScheduler
+        directly.
+
+        No behavior change.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::reload):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::receivedFirstData):
+        * loader/FrameLoader.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Just removing a comment I accidentally committed earlier. 
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up use of const and mutable in StorageMap
+        https://bugs.webkit.org/show_bug.cgi?id=29933
+
+        What's the point of having every single member variable be mutable and nearly
+        every method be const?  Let's clean it up.
+
+        * storage/StorageMap.cpp:
+        (WebCore::StorageMap::setIteratorToIndex):
+        (WebCore::StorageMap::key):
+        (WebCore::StorageMap::importItem):
+        * storage/StorageMap.h:
+
+2009-10-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6934421> Support CSS for Text Kerning and 
+        ligature
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=6136
+
+        This patch makes the SVG CSS property text-rendering work with any 
+        HTML, much like it does in Firefox. It accepts four possible input 
+        values: auto, optimizeSpeed, optimizeLegibility, and 
+        geometricPrecision. Right now, in this implementation, here is what 
+        those values correspond to:
+
+        auto = optimizeSpeed = what we normally when the value's not set
+        optimizeLegibility = geometricPrecision = ligatures + kerning
+
+        Add new file TextRenderingMode.h to the project files.
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        CSS support for the new CSSPropertyTextRendering
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator TextRenderingMode):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+        All the old SVG CSS support for this property can go away. When 
+        it's used in SVG, it will just fall into the normal HTML case.
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/SVGCSSPropertyNames.in:
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * css/SVGCSSValueKeywords.in:
+
+        FontDescription stores the m_textRendering bit.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::textRenderingMode):
+        (WebCore::FontDescription::setTextRenderingMode):
+        (WebCore::FontDescription::operator==):
+
+        We want to fall into the complex text rendering code path if 
+        kerning and ligatures have been enabled with this property.
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::canUseGlyphCache):
+
+        Now takes a TextRenderingMode as a parameter.
+        * platform/graphics/SimpleFontData.h:
+
+        New header for the enum.
+        * platform/graphics/TextRenderingMode.h: Added.
+        (WebCore::):
+
+        getCFStringAttributes() now takes a TextRenderingMode as an 
+        attribute.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+        Enable kerning and ligatures whenever the TextRenderingMode is 
+        OptimizeLegibility or GeometricPrecision
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::disableLigatures):
+        (WebCore::initializeATSUStyle):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes):
+
+        More SVG CSS stuff that isn't needed anymore since SVG will use the 
+        new HTML CSS implementation.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Use isClosure property of scope proxy to decide whether the
+        scope is a closure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29965
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Odd color transitions on anchors with transition-property: all
+        https://bugs.webkit.org/show_bug.cgi?id=29911
+
+        When transitioning maybe-invalid colors, if the source and destination
+        color are both invalid, then don't animate.
+        
+        This fixes an issue where a child element of an element running a color
+        transition, with -webkit-transition-property:all, would show a color change.
+        This happened because the "maybe invalid color" logic copied the color style
+        into -webkit-text-fill-color for both endpoints, causing -webkit-text-fill-color
+        to animate while the transition ran, and to then to disappear when the transition
+        finished.
+        
+        Test: transitions/color-transition-all.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperMaybeInvalidColor::equals):
+        (WebCore::PropertyWrapperMaybeInvalidColor::blend):
+
+2009-10-01  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Allow dragging a node who has child nodes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28632
+
+        Test: fast/events/drag-parent-node.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldDragAutoNode):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] media player: better mute support
+        https://bugs.webkit.org/show_bug.cgi?id=29960
+
+        Handle volume and mute state with the two corresponding properties
+        of playbin2.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::setVolume):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] video sink pad template colorspace is wrong
+        https://bugs.webkit.org/show_bug.cgi?id=29953
+
+        Set sink pad template colorspace depending on byte order.
+
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+
+2009-10-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Refactored V8 event listeners:
+        (This change should fix http://crbug.com/21079 and
+        https://bugs.webkit.org/show_bug.cgi?id=29093.)
+         o All listeners use weak handles to JS objects to avoid creating
+           cycles and leaking memory.
+         o "Object" variants of listeners removed.
+         o All event accessor callbacks are generated.
+         o Custom event accessors removed.
+         o All wrappers have hidden dependencies on their listeners to
+           prevent listeners from being collected.
+         o All variats of getEventListener function grouped in V8DOMWrapper.
+         o Pointers to C++ EventListener wrappers are stored in JS objects
+           instead of event listener lists.
+        https://bugs.webkit.org/show_bug.cgi?id=29825
+
+        * WebCore.gypi: Removed "Object" listeners.
+        * bindings/scripts/CodeGeneratorV8.pm: Now handles event accessors.
+        * bindings/v8/DOMObjectsInclude.h:
+
+        V8AbstractEventListener manages weak JS handle:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::weakEventListenerCallback):
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::setListenerObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::cast):
+        (WebCore::V8AbstractEventListener::isLazy):
+        (WebCore::V8AbstractEventListener::getListenerObject):
+        (WebCore::V8AbstractEventListener::getExistingListenerObject):
+        (WebCore::V8AbstractEventListener::hasExistingListenerObject):
+        (WebCore::V8AbstractEventListener::disconnectFrame):
+        (WebCore::V8AbstractEventListener::disconnected):
+        (WebCore::V8AbstractEventListener::prepareListenerObject):
+        (WebCore::V8AbstractEventListener::lineNumber):
+        (WebCore::V8AbstractEventListener::virtualisAttribute):
+
+        Grouped getEventListener functions:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::getEventListener):
+        * bindings/v8/V8DOMWrapper.h:
+
+        Removed most event listener objects bookkeeping:
+        * bindings/v8/V8EventListenerList.cpp:
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::findWrapper):
+        (WebCore::V8EventListenerList::clearWrapper):
+        (WebCore::V8EventListenerList::doFindWrapper):
+        (WebCore::V8EventListenerList::getHiddenProperty):
+        (WebCore::V8EventListenerList::findOrCreateWrapper):
+
+        Added hidden properties for storing EventListener wrappers:
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore::V8HiddenPropertyName::listener):
+        (WebCore::V8HiddenPropertyName::attributeListener):
+        * bindings/v8/V8HiddenPropertyName.h:
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::isLazy):
+        * bindings/v8/V8ObjectEventListener.cpp: Removed.
+        * bindings/v8/V8ObjectEventListener.h: Removed.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::disconnectFrame):
+        (WebCore::V8Proxy::disconnectEventListeners):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::reportError):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Removed.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Removed.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8AbstractWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::getListenerFunction):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+
+2009-10-01  Alexis Menard  <alexis.menard@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Rename QWebGraphicsItem to QGraphicsWebView
+
+        * WebCore.pro:
+
+2009-10-01  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Read-only transactions do not change file sizes and therefore
+        should not trigger quota updates.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29945
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight):
+        (WebCore::SQLTransaction::runStatements):
+
+2009-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Fix list box scrolling by correctly overriding the scroll()
+        function on RenderBox.
+
+        <rdar://problem/7255440> REGRESSION (r48683): Mousewheel scrolling
+        of listboxes is broken (29756)
+
+        Reviewed by Dan Bernstein.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scroll):
+        * rendering/RenderListBox.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-10-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make a copy of listeners array before dispatching an event in
+        WebInspector.Object.prototype.dispatchEventToListeners. Otherwise if current
+        listener removes itself from the array next listener will be skipped.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29920
+
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.dispatchEventToListeners): make a copy of listeners array before dispatching an event
+
+2009-10-01  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GtkIMContext filtering interferes with DOM key events
+        https://bugs.webkit.org/show_bug.cgi?id=28733
+
+        Ensure that keyboard events filtered by the GtkIMContext still create
+        the proper DOM events.
+
+        No tests added. Instead previously skipped tests have been enabled.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-10-01  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] data: uri support in media player
+        https://bugs.webkit.org/show_bug.cgi?id=29842
+
+        New GStreamer element to handle data: uris. For now only base64
+        encoded data is supported. Decoded data is handed over to
+        giostreamsrc.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/DataSourceGStreamer.cpp: Added.
+        (_do_init):
+        (webkit_data_src_base_init):
+        (webkit_data_src_class_init):
+        (webkit_data_src_reset):
+        (webkit_data_src_init):
+        (webkit_data_src_finalize):
+        (webkit_data_src_uri_get_type):
+        (webkit_data_src_uri_get_protocols):
+        (webkit_data_src_uri_get_uri):
+        (webkit_data_src_uri_set_uri):
+        (webkit_data_src_uri_handler_init):
+        * platform/graphics/gtk/DataSourceGStreamer.h: Added.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::do_gst_init):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::mimeTypeCache):
+
+2009-09-30  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29944
+        
+        Reduces false positives in the XSSAuditor by explicitly allowing requests
+        that do not contain illegal URI characters.
+        
+        As a side effect of this change, the tests property-inject.html, 
+        property-escape-noquotes.html, and property-escape-noquotes-tab-slash-chars.html 
+        fail because these attacks do not contain any illegal URI characters and 
+        thus are now allowed by the XSSAuditor, where previously they weren't. A future
+        change may reinstate this functionality.
+
+        Tests: http/tests/security/xssAuditor/script-tag-safe2.html
+               http/tests/security/xssAuditor/script-tag-safe3.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isIllegalURICharacter): Added method.
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::findInRequest): Added parameter 
+        allowRequestIfNoIllegalURICharacters.
+        * page/XSSAuditor.h:
+
+2009-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        reproducible freeze and crash on closing form popup at bosch-home.nl
+        https://bugs.webkit.org/show_bug.cgi?id=28948
+
+        showModalDialog calls getDirect on what is actually a window shell,
+        so ends up not getting a value (since no value can ever be placed
+        directly on the shell), which leads to incorrect behaviour.
+
+        We use a manual test rather than automatic as it was not
+        possible to get a modal run loop to work inside DRT.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+        * manual-tests/showModalDialog-returnValue.html: manual testcase.
+
+2009-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Adds ValidityState.tooLong support for <input> and <textarea>.
+
+        Introduces tooLong() in HTMLFormControlElement and it always returns false.
+        HTMLInputElement and HTMLTextAreaElement overrides it and checks the text
+        length and maxLength.  tooLong() should work only for `dirty' values.
+        So, introduces m_isDirty flag for HTMLTextAreaElement, and
+        !m_data.value().isNull() works as a dirty flag for HTMLInputElement.
+
+        Renames parameter names of setMaxLength().
+
+        https://bugs.webkit.org/show_bug.cgi?id=27454
+
+        Tests: fast/forms/ValidityState-tooLong-input.html
+               fast/forms/ValidityState-tooLong-textarea.html
+
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::tooLong):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::tooLong):
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::reset):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        (WebCore::HTMLTextAreaElement::tooLong):
+        * html/HTMLTextAreaElement.h:
+        * html/ValidityState.h:
+        (WebCore::ValidityState::tooLong):
+
+2009-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Factor RedirectScheduler out of FrameLoader
+        https://bugs.webkit.org/show_bug.cgi?id=29948
+
+        This change introduces a new sub-object of Frame, redirectScheduler.
+        The redirectScheduler is responsible for scheduling redirects.
+
+        This change leaves the code for the redirectScheduler in
+        FrameLoader.cpp.  A future change will move the class into its own
+        file.
+
+        No behavior change (hopefully!).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::RedirectScheduler::RedirectScheduler):
+        (WebCore::RedirectScheduler::~RedirectScheduler):
+        (WebCore::RedirectScheduler::redirectScheduledDuringLoad):
+        (WebCore::RedirectScheduler::clear):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::isScheduledLocationChangePending):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::RedirectScheduler::scheduleRedirect):
+        (WebCore::RedirectScheduler::mustLockBackForwardList):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::RedirectScheduler::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleFormSubmission):
+        (WebCore::RedirectScheduler::scheduleFormSubmission):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::RedirectScheduler::scheduleRefresh):
+        (WebCore::RedirectScheduler::locationChangePending):
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::scheduleHistoryNavigation):
+        (WebCore::RedirectScheduler::timerFired):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::RedirectScheduler::schedule):
+        (WebCore::RedirectScheduler::startTimer):
+        (WebCore::RedirectScheduler::cancel):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::committedFirstRealDocumentLoad):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::redirectScheduler):
+        * page/Frame.h:
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        More Windows build fixes for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Build fix, not reviewed.
+
+        Fix windows build for fix for https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+
+2009-09-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] HTMLAudioElement, HTMLImageElement, and HTMLOptionElement are constructable, but they shouldn't be.
+        Only Audio, Image, and Option should be constructable.
+        https://bugs.webkit.org/show_bug.cgi?id=29940
+
+        Test: fast/dom/dom-constructor.html
+
+        * WebCore.gypi: Added new files to project.
+        * bindings/scripts/CodeGeneratorV8.pm: Modified to generate custom constructors.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate): Removed handling of HTMLImageElement, HTMLOptionElement
+          and HTMLAudioElement construction.
+        * bindings/v8/V8HTMLAudioElementConstructor.h: Added.
+        * bindings/v8/V8HTMLImageElementConstructor.h: Added.
+        * bindings/v8/V8HTMLOptionElementConstructor.h: Added.
+        * bindings/v8/V8Index.cpp: Added new headers.
+        * bindings/v8/V8Index.h: Added Audio, Image and Option decls.
+        * bindings/v8/custom/V8CustomBinding.h: Ditto.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Added custom constructors.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Added custom template creator.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::V8HTMLOptionElementConstructor::GetTemplate): Ditto.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::V8HTMLImageElementConstructor::GetTemplate): Ditto.
+
+2009-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        307 redirects should pass along http body and Content-Type header
+        https://bugs.webkit.org/show_bug.cgi?id=29943
+
+        Follow-up fix for:
+        <rdar://problem/3802660> SAP: 307 (Temporary Redirect) responses should use POST, not GET
+        
+        Test: http/tests/loading/resources/redirect-methods-result.php
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest): Pass along http body and Content-Type header.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): ditto
+
+2009-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=29941
+        REGRESSION (r48882-r48888): Many memory leaks on SnowLeopard leaks bot
+
+        Forgot to implement a destructor for JSDOMWindowBaseData, so it was
+        leaking its RefPtr data member.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::destroyJSDOMWindowBaseData):
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData::JSDOMWindowBaseData):
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Make sure the removal of user stylesheets results in all of the WebViews being updated to
+        reflect the changes.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentWithURLForWorld):
+        (WebCore::PageGroup::removeUserContentForWorld):
+
+2009-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r47440): drop down menus at americanexpress.com disappear on mouse out
+        https://bugs.webkit.org/show_bug.cgi?id=29209
+
+        Test: fast/inline/relative-positioned-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow): Add self-painting
+        inlines to overflow to ensure that they are included in hit-testing.
+
+2009-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        transforms/3d tests are not run in Release builds
+        https://bugs.webkit.org/show_bug.cgi?id=29827
+
+        Make sure we export the WebCoreHas3DRendering symbol in Release builds,
+        because this symbols is used by run-webkit-tests (via 'nm') to detect whether
+        WebCore was built with ENABLE_3D_RENDERING turned on.
+
+        * DerivedSources.make:
+        * WebCore.3DRendering.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix for QT.  Didn't know WebCore.pro existed.
+
+        * WebCore.pro:
+
+2009-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Add a method for removal of user scripts and stylesheets by URL from a specific world.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::removeUserContentURLForWorld):
+        * page/PageGroup.h:
+
+2009-09-30  Chris Hawk  <hawk@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix for conditionals in the WebCore gyp file, which contained two separate
+        'conditions' values for the webcore target. The first entry was ignored,
+        resulting in some missine defines.
+        https://bugs.webkit.org/show_bug.cgi?id=29907
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-21  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=29265
+
+        DOM Storage needs to be more careful about where "ThreadSafe" objects are
+        destroyed.  With the current code, there actually isn't a race condition, but
+        it sure would be easy for someone to introduce one.  A bunch of
+        ThreadSafeShared objects have RefPtrs to objects that are NOT ThreadSafeShared
+        objects.  If it were possible any of these objects' destructors to be fired off
+        the main thread, then the you'd have a race condition.  The code should be more
+        clear and self-documenting about how things related to each other.
+
+        Since the lifetime of a LocalStorageTask is bounded by the LocalStorageThread
+        which is bounded by the StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync, there's no reason for LocalStorageTask to store anything other
+        than pointers.  By breaking this dependency, we can eliminate the risk.
+
+        Note that we _could_ have LocalStorageThread's task queue just store
+        LocalStorageTask*'s rather than RefPtr<LocalStorageTask>s but then we'd need to
+        manually take care of deleting.  It'd probably also be possible to change
+        LocalStorageThread around so that it needn't hold onto a reference of itself
+        and have a more deterministic shutdown, but my initial attempts to do so
+        failed, and I decided it wasn't worth changing.  The queue is killed before
+        hand, so the thread is 100% impotent before the main thread continues anyway.
+
+        The constructors and destructors of StorageSyncManager, StorageAreaImpl, and
+        StorageAreaSync now have ASSERTs to verify they're running on the main thread. 
+        I'm fairly positive that it'd be impossible to hit these asserts and the fact
+        that these classes are no longer ThreadSafeShared should make it clear how
+        they're meant to be used, but I think it's worth it to be extra sure.  Of
+        course, ideally, we'd have such an assert every time a ref is incremented or
+        decremented.
+
+        Behavior should be unchanged and this is just an internal code cleanup, so no
+        new tests.
+
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        (WebCore::LocalStorageTask::createTerminate):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::~StorageAreaImpl):
+        (WebCore::StorageAreaImpl::StorageAreaImpl):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::~StorageAreaSync):
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::~StorageSyncManager):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-09-28  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered
+        https://bugs.webkit.org/show_bug.cgi?id=29655
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        Behavior should not change with this, so no updates to tests.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/StorageAreaImpl.cpp:
+        (WebCore::StorageAreaImpl::setItem):
+        (WebCore::StorageAreaImpl::removeItem):
+        (WebCore::StorageAreaImpl::clear):
+        * storage/StorageAreaImpl.h:
+        * storage/StorageEventDispatcher.cpp: Copied from WebCore/storage/StorageAreaImpl.cpp.
+        (WebCore::StorageEventDispatcher::dispatch):
+        * storage/StorageEventDispatcher.h: Added.  (Well, technically in the other half of this patch.)
+
+2009-09-30  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Need to check NULL frame in EventHandler::updateDragAndDrop.
+        https://bugs.webkit.org/show_bug.cgi?id=29929
+
+        Test: http/tests/misc/drag-over-iframe-invalid-source-crash.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+
+2009-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        Generalize the fix for this bug to account for cases where there may be multiple
+        containing blocks between the repaint container, and the container of the element
+        being repainted.
+
+        Test: compositing/repaint/opacity-between-absolute2.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        Call offsetFromAncestorContainer() to get the correct offset.
+        
+        (WebCore::RenderBox::computeRectForRepaint): Ditto
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint): Ditto.
+        
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromAncestorContainer):
+        New method that computes an offset from some object in the ancestor container() chain.
+
+2009-09-30  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix TextCodecQt::decode method after r48752 to return a non-null string if the length of the input is 0.
+        This fixes https://bugs.webkit.org/show_bug.cgi?id=29736.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix a couple of bugs with patterns.  Move the setting of the document URL to before the style
+        selector gets constructed so that pattern match testing gets the correct URL.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/UserContentURLPattern.cpp:
+        (WebCore::UserContentURLPattern::parse):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Rubber-stamped by Brady Eidson.
+
+        Assertion failure in http/tests/xmlhttprequest/failed-auth.html.
+
+        I couldn't find out why this only started to happen now, but it was incorrect to check
+        persistence of a credential returned by CredentialStorage::get() without checking that it
+        was non-null. When there is no credential for the protection space in storage, get()
+        returns a new object, and Credentil constructor doesn't initialize m_persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Moved the
+        assertion after credential null check.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Added the same persistence
+        assertion, matching sync code (and CF one, as well).
+
+2009-09-29  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT for UTF8Encoding().isValid()
+        https://bugs.webkit.org/show_bug.cgi?id=29908
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF8Encoding):
+
+2009-09-29  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29892
+        Add support for whitelist patterns to control conditional injection of user scripts and
+        user stylesheets.
+
+        No new tests. Not testable until WebKit portion is added in followup patch.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::pageGroupUserSheets):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/UserContentURLPattern.cpp: Added.
+        (WebCore::UserContentURLPattern::matchesPatterns):
+        (WebCore::UserContentURLPattern::parse):
+        (WebCore::UserContentURLPattern::matches):
+        (WebCore::UserContentURLPattern::matchesHost):
+        (WebCore::MatchTester::MatchTester):
+        (WebCore::MatchTester::testStringFinished):
+        (WebCore::MatchTester::patternStringFinished):
+        (WebCore::MatchTester::eatWildcard):
+        (WebCore::MatchTester::eatSameChars):
+        (WebCore::MatchTester::test):
+        (WebCore::UserContentURLPattern::matchesPath):
+        * page/UserContentURLPattern.h: Added.
+        (WebCore::UserContentURLPattern::UserContentURLPattern):
+        (WebCore::UserContentURLPattern::scheme):
+        (WebCore::UserContentURLPattern::host):
+        (WebCore::UserContentURLPattern::path):
+        (WebCore::UserContentURLPattern::matchSubdomains):
+
+2009-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Reproducible crash pressing return inside quoted content
+        at WebCore::BreakBlockquoteCommand::doApply.
+        <rdar://problem/7085453>
+        In some case, like the one provided in the test case, m_downStreamEnd
+        refers to a node that gets deleted when executing the DeleteSelectionCommand.
+        We shouldn't use m_downStreamEnd to recalculate the new m_endPosition when
+        pruning is needed, because it may be point to a node that has been deleted, but
+        rather rely on removeNode in CompositeEditCommand to update m_endPosition correctly.
+
+        Test: editing/selection/blockquote-crash.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added check for invalid position
+        to avoid dereferencing a null node pointer.
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Don't reset m_endPosition
+        using the value in m_downStreamEnd when it is necessary to prune the start block.
+        
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Basic authentication credentials are not sent automatically to top resources
+        https://bugs.webkit.org/show_bug.cgi?id=29901
+
+        No new tests - I don't want to pollute root directory of http tests to check for this rather
+        minor issue.
+
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set): Changed to always preserve leading slash.
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential): Made breaking out of the
+        loop more explicit.
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector REGRESSION(r47820-r47822): Profiles aren't
+        added to the inspector unless the inspector is already open
+        when the profile completes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29897
+
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Rubberstamped by David Hyatt.
+
+        Fix to logic of earlier commit 48902.
+
+        When merging two if's before committing, I forgot to invert the
+        bool check.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+
+2009-09-29  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, build fix.
+
+        Fixing Chromium build, following r48884.
+
+        [https://bugs.webkit.org/show_bug.cgi?id=29894]
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/V8WorkerContextEventListener.h:
+
+2009-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Follows HTML5's maxLength change in September 2009.
+        - Change HTMLTextAreaElement.maxLength type to signed.
+        - HTMLTextAreaElement.maxLength returns -1 if maxlength= attribute is missing.
+        - HTMLTextAreaElement.maxLength and HTMLInputElement.maxLength
+          throw INDEX_SIZE_ERR for setting negative values.
+        https://bugs.webkit.org/show_bug.cgi?id=29796
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setMaxLength):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48894, because review discussion was not complete.
+        http://trac.webkit.org/changeset/48894
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG Filter feComposite implementation is missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28362]
+
+        feComposite implementation for SVG.
+
+        Test: svg/filters/feComposite.svg
+
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::arithmetic):
+        (WebCore::FEComposite::apply):
+
+2009-09-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Starting all read-only transactions with an explicit BEGIN
+        DEFERRED command instead of BEGIN, since some ports (chromium)
+        might compile their own SQLite library and set BEGIN to BEGIN
+        IMMEDIATE by default; which would result in a deadlock in case of
+        two concurrent read-only transactions on the same DB, and would
+        unnecessarily delay other potential transactions to the same DB.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29729
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::begin):
+
+2009-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add support for run-time flag for 3D canvas
+        https://bugs.webkit.org/show_bug.cgi?id=29826
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext): Check page settings for
+        experimental WebGL flag before returning 3D graphics context.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize new flag to false.
+        (WebCore::Settings::setExperimentalWebGLEnabled):
+        * page/Settings.h: Set new flag.
+        (WebCore::Settings::experimentalWebGLEnabled): Return new flag.
+
+2009-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Chromium needs to be able to override the way storage events are delivered - part 1
+        https://bugs.webkit.org/show_bug.cgi?id=29889
+
+        Chromium needs to be able to override the way storage events are delivered.
+        This replaced https://bugs.webkit.org/show_bug.cgi?id=29257 because it'll be
+        faster (no vtables and extra allocation) and somewhat cleaner (no dependency
+        injection).  This is necessary because Chromium needs to transport events across
+        a process barrier and then dispatch them without use of a Frame*.
+
+        This patch should be a no-op for all ports other than Chromium.
+
+        * WebCore.gypi:
+        * storage/StorageEventDispatcher.h: Added.
+
+2009-09-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (missed file).
+
+        Adding file missed in previous commit.
+
+        * manual-tests/gtk/resources/long_cell.cur: Copied from WebCore/dom/PositionCreationFunctions.h.
+
+2009-09-29  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [V8] Correct an issue with XMLHttpRequest attribute event listeners never being cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=29888
+
+        Test: LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-abort-readyState-shouldDispatchEvent.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener): Added isAttribute parameter.
+        (WebCore::ACCESSOR_SETTER): Made all event listener setters create attribute listeners.
+        (WebCore::CALLBACK_FUNC_DECL): Made addEventListener create object listener.
+
+2009-09-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix corruption for non-square images.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Added an additional manual-test for this issue to the existing Gtk
+        cursor image test.
+
+        * manual-tests/gtk/cursor-image.html:
+        * manual-tests/gtk/resources/long_cell.cur: Added.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-09-29  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Build fix - pass a proper ScriptExecutipnContext to getEventListenerHandlerBody()
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Ensure that we don't scroll lock to an anchor node after a
+        user-initiated scroll, even if that scroll doesn't propagate
+        all the way up to FrameView.
+
+        Test: fast/events/node-event-anchor-lock.html
+
+        * page/EventHandler.cpp: Call setFrameWasScrolledByUser() when a scroll is handled by a node rather than a frame.
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use setFrameWasScrolledByUser();
+        (WebCore::EventHandler::setFrameWasScrolledByUser): Split out of sendScrollEvent();
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/EventHandler.h: Declare setFrameWasScrolledByUser().
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Don't force EventTarget implementation on Node -
+        it doesn't work yet (it didn't quite work before this patch, too, because it assumed that
+        any object implementing EventTarget COM interface originated from WebCore).
+
+        * dom/EventListener.idl: Just like in ObjC, EventListener should be a pure interface in
+        COM bindings.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed virtual destructor from JSGlobalObjectData to eliminate pointer
+        fix-ups when accessing JSGlobalObject::d.
+        
+        Replaced with an explicit destructor function pointer.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::destroyJSDOMGlobalObjectData):
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Don't rely on QNetworkReply::NetworkError codes, but
+        on HTTP error codes instead.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::ignoreHttpError):
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Use const references when using Qt's foreach.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix handling of QNetworkReply errors.
+
+        In the QNetworkReplyHandler::finish() a response was sent even when
+        the reply contained an error. This resulted in a sendResponseIfNeeded()
+        calling didReceiveResponse on the client, leading to the destruction
+        of the m_resourceHandle, discontinuing further processing in finish(),
+        and thus not calling didFail on the client.
+
+        Instead it continued as everything went fine, and
+        FrameLoaderClientQt::dispatchDecidePolicyForMIMEType() changed the
+        policy to PolicyDownload due to not being able to show the non existing
+        MIMEType. As the download also obviously fails, it ended up with a
+        policy change error.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        The code for showing error pages when the response was
+        a 401/403/404, was not actually doing so. This patch
+        fixes that.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-28  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/7259965> REGRESSION: http/tests/xmlhttprequest/cross-origin-authorization.html
+        is failing/crashing intermittently
+        https://bugs.webkit.org/show_bug.cgi?id=29322
+
+        This was caused by CStringBuffer::encodeBase64() returning a buffer that wasn't zero terminated.
+        The code had other issues as well, so I removed it altogether:
+        - it claimed to avoid some buffer copies, but it didn't;
+        - and I don't think that base64 encoding should be part of CString interface.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::encodeBasicAuthorization): Encode username and password using Base64.h directly.
+        (WebCore::ResourceHandle::start): Use encodeBasicAuthorization().
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Extended logging
+        to synchronous case.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp: Matched Mac changes.
+
+        * platform/text/CString.cpp:
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+        Removed code that was added for Base64 in r48363.
+
+2009-09-29  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix typo in Localizations.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=29872
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementHelpText):
+
+2009-09-29  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Make the XSLT conditional in DOMWindow.idl's xsltProcessor
+        attribute conditional in the generated files, similar to
+        r44116.
+
+        * page/DOMWindow.idl:
+
+2009-09-29  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann and Tor Arne Vestbø.
+
+        Use the ResourceError as it is supposed to and handle
+        not HTTP errors from QNetworkReply.
+
+        Thanks to Adam Roben for his input.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2009-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Encapsulate JS listeners specifics into ScriptEventListener.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29816
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::getEventListenerHandlerBody):
+        * bindings/v8/ScriptEventListener.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+
+2009-09-29  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the build.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-09-28  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add experimentalWebSocketsEnabled in Settings.
+        https://bugs.webkit.org/show_bug.cgi?id=28941
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getConstructor):
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalWebSocketsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalWebSocketsEnabled):
+        
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add platform code to support WebSocket for chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=29171
+
+        To build within chromium tree, it requires a patch in bug 29174.
+        Real implementation will be landed in chromium tree.
+
+        * WebCore.gypi:
+        * platform/network/chromium/SocketStreamError.h: Added.
+        (WebCore::SocketStreamError::SocketStreamError):
+        * platform/network/chromium/SocketStreamHandle.h: Added.
+        (WebCore::SocketStreamHandle::create):
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/7157288> Crash in RenderStyle::computedLineHeight()
+        when Times New Roman is not installed
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): If Times New Roman is
+        not available, use the Windows default GUI font.
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Do not add platform-specific methods to cross-platform header
+        FileSystem.h per Darin's feedback for 29109.
+        https://bugs.webkit.org/show_bug.cgi?id=29830
+
+        * platform/FileSystem.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+
+2009-09-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Register Chromium's VFSs with a proper sqlite3_io_methods
+        finder. This should only affect the POSIX implementation. The
+        Windows change is included for consistency and in case sqlite
+        starts using something similar in its Windows VFS in the future.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29743
+
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+        (WebCore::SQLiteFileSystem::registerSQLiteVFS):
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Change the V8 bindings' handling of window.toString(),
+        so we return [object DOMWindow] (like JSC), not [object global].
+
+        https://bugs.webkit.org/show_bug.cgi?id=29742
+
+        This will fix a couple of Chromium port test failures and enable us to
+        use the default expectations for a bunch more.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Use the DOMWindow wrapper instead
+        of the global object wrapper when it's available in the DOMWindow toString callback.
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Rubber stamped by David Levin.
+
+        Chromium build fix, add back in #include of V8Proxy.h in V8WebKitPointConstructor.cpp.
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Re-include V8Proxy.h.
+
+2009-09-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NotNullPassRefPtr: smart pointer optimized for passing references that are not null
+        https://bugs.webkit.org/show_bug.cgi?id=29822
+        
+        Added NotNullPassRefPtr, and deployed it in all places that initialize
+        JavaScript objects.
+
+        * bindings/js/DOMObjectWithSVGContext.h:
+        (WebCore::DOMObjectWithSVGContext::DOMObjectWithSVGContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::DOMObjectWithGlobalPointer::DOMObjectWithGlobalPointer):
+        (WebCore::DOMConstructorObject::DOMConstructorObject):
+        (WebCore::DOMConstructorWithDocument::DOMConstructorWithDocument):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+
+2009-09-28  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Allow V8 to handle x/y parameters in a WebKitPoint constructor.
+        https://bugs.webkit.org/show_bug.cgi?id=29823
+
+        Fixes V8's handling of LayoutTests/fast/dom/Window/webkitConvertPoint.html
+
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Allow for x/y parameters in constructor.
+
+2009-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build by doing something approximating reasonableness in the Xcode project.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Prospective Tiger build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Try to use unique IDs for the new files.
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Add explicit frontend event for commit load.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29814
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didCommitLoad):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDocument):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.didCommitLoad):
+
+2009-09-28  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium port - recognize we are being built independently
+        of chromium and look for dependencies under webkit/chromium rather
+        than chromium/src.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29722
+
+        * WebCore.gyp/WebCore.gyp: See above. Also removed a few files from
+          the sources list, since they are not supposed to be built here.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Implement XSLT support with QtXmlPatterns.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::setTransformSource):
+        * dom/Document.h:
+        (WebCore::Document::transformSource):
+        * dom/TransformSource.h: Added.
+        (WebCore::TransformSource::platformSource):
+        * dom/TransformSourceLibxslt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a libxml2 document.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/TransformSourceQt.cpp: Added.
+        (WebCore::TransformSource::TransformSource): Wraps a plain string.
+        (WebCore::TransformSource::~TransformSource):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::parseProcessingInstruction):
+        * xml/XSLStyleSheet.h:
+        (WebCore::XSLStyleSheet::sheetString):
+        * xml/XSLStyleSheetLibxslt.cpp:
+        (WebCore::XSLStyleSheet::document):
+        * xml/XSLStyleSheetQt.cpp: Added.
+        * xml/XSLTProcessor.h:
+        * xml/XSLTProcessorLibxslt.cpp:
+        (WebCore::xmlDocPtrFromNode):
+        * xml/XSLTProcessorQt.cpp: Added.
+        (WebCore::XSLTMessageHandler::XSLTMessageHandler): A subclass of QAbstractMessageHandler.
+        (WebCore::XSLTMessageHandler::handleMessage): Forwards all processor messages to the Console.
+        (WebCore::XSLTProcessor::transformToString): Uses QXmlQuery.
+
+2009-09-28  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Delegate implementation of rendererIsNeeded() for media control elements to RenderTheme.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28689
+
+        Covered by LayoutTests/media/video-no-audio.html
+
+        * rendering/MediaControlElements.cpp: Removed subclass implementations of rendererIsNeeded().
+        (WebCore::MediaControlElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        (WebCore::MediaControlInputElement::rendererIsNeeded): Include calling shouldRenderMediaControlPart().
+        * rendering/MediaControlElements.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::shouldRenderMediaControlPart): New method.  Contains logic moved from subclass implementations of rendererIsNeeded().
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::shouldRenderMediaControlPart): Override to always render mute button.
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-28  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] DragData::asURL should return file URL.
+        https://bugs.webkit.org/show_bug.cgi?id=29109
+
+        Tested by LayoutTests/fast/events/drag-to-navigate.html.
+
+        * platform/FileSystem.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::asURL):
+        * platform/chromium/FileSystemChromium.cpp:
+        (WebCore::getAbsolutePath):
+        (WebCore::isDirectory):
+        (WebCore::filePathToURL):
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Add a special case to handle index arguments, because we need to be
+        able to see if they're < 0.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/dom/html/level1/core/hc_characterdataindexsizeerrdeletedatacountnegative.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Added special case (matching CodeGeneratorJS.pm)
+          for index arguments.
+
+2009-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Extend the MediaWiki/KHTMLFixes.css workaround to cover older MediaWiki versions
+        https://bugs.webkit.org/show_bug.cgi?id=29792
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the linked style sheet is one of two versions of the
+        MediaWiki KHTMLFixes.css. If so, remove the offending rule.
+
+2009-09-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Fix an error in type logic in CodeGeneratorV8.pm, where
+        unsigned ints are accidentally used as signed.
+        https://bugs.webkit.org/show_bug.cgi?id=29810
+
+        Test: LayoutTests/fast/forms/textarea-maxlength.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Made sure "unsigned long" in IDL is
+          properly generates on "unsigned" return value.
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, rename XSLStyleSheet.cpp to XSLStyleSheetLibxslt.cpp as we will
+        have our own implementation which most likely will not share any code
+        with the current one.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLStyleSheet.cpp: Renamed to XSLStyleSheetLibxslt.cpp.
+        * xml/XSLStyleSheetLibxslt.cpp: Added.
+
+2009-09-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Prospective build fix for r48812.
+
+        Forgot to remove the inline reset() implementation when reverting the indentation
+        changes in the file.
+
+        * xml/XSLTProcessor.h:
+
+2009-09-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial follow up fix), Joseph Pecoraro LGTM-ed.
+
+        Web Inspector: Follow up to r48809.
+        InspectorController.wrapObject should only be called on the inspectable page side.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+
+        * inspector/front-end/EventListenersSidebarPane.js:
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection):
+        (WebInspector.EventListenersSection.prototype.update):
+        (WebInspector.EventListenerBar):
+        (WebInspector.EventListenerBar.prototype.update):
+
+2009-09-28  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move the libxslt specific part of XSLTProcessor to a separate file.
+        https://bugs.webkit.org/show_bug.cgi?id=28303
+
+        In preparation for adding XSLT support with QtXmlPatterns to the Qt
+        port, move the libxslt part of the XSLTProcessor implementation into
+        another file and leave the part that can be reused and shared.
+
+        Additionally, fix some coding style issues.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::XSLTProcessor::createDocumentFromSource): Remove trailing whitespaces.
+        (WebCore::createFragmentFromSource): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::transformToFragment): Remove trailing whitespaces.
+        (WebCore::XSLTProcessor::reset): Moved out of the class definition.
+        * xml/XSLTProcessorLibxslt.cpp: Added.
+        (WebCore::XSLTProcessor::genericErrorFunc): Moved.
+        (WebCore::XSLTProcessor::parseErrorFunc): Moved.
+        (WebCore::docLoaderFunc): Moved.
+        (WebCore::setXSLTLoadCallBack): Moved.
+        (WebCore::writeToVector): Moved.
+        (WebCore::saveResultToString): Moved.
+        (WebCore::xsltParamArrayFromParameterMap): Moved.
+        (WebCore::freeXsltParamArray): Moved.
+        (WebCore::xsltStylesheetPointer): Moved.
+        (WebCore::xmlDocPtrFromNode): Moved.
+        (WebCore::resultMIMEType): Moved.
+        (WebCore::XSLTProcessor::transformToString): Moved.
+
+2009-09-28  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Fix the crash of SVG that crashes when use a non-exist symbol
+        https://bugs.webkit.org/show_bug.cgi?id=27693
+
+        Test: svg/custom/use-non-existing-symbol-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::shadowTreeContainsChangedNodes):
+
+2009-09-28  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Should Show Event Listeners/Handlers Registered on each Node
+        https://bugs.webkit.org/show_bug.cgi?id=17429
+        
+          Extracted a method from dispatchEvent to get the event ancestor chain
+        
+        * dom/Node.cpp:
+        (WebCore::Node::eventAncestors): the extracted method
+        (WebCore::Node::dispatchGenericEvent): use eventAncestors
+        * dom/Node.h:
+
+          Asynchronous Flow For the Inspector, Backend -> DOM Agent -> Frontend
+          The DOMAgent's getEventListenersForNode handles the logic of finding
+          all the relevant listeners in the event flow.
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getEventListenersForNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getEventListenersForNode):
+        (WebCore::InspectorDOMAgent::buildObjectForEventListener):
+        (WebCore::InspectorDOMAgent::buildObjectForNode): added localName
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::EventListenerInfo::EventListenerInfo):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetEventListenersForNode):
+        * inspector/InspectorFrontend.h:
+        (WebCore::InspectorFrontend::scriptState):
+        * inspector/front-end/DOMAgent.js: added localName to WebInspector.DOMNode from payload
+        (WebInspector.EventListeners.getEventListenersForNodeAsync.mycallback):
+        (WebInspector.EventListeners.getEventListenersForNodeAsync):
+
+          New Sidebar Pane in the Element's Panel
+          Includes Gear Menu for filtering the Event Listeners on the
+          "Selected Node Only" or "All Nodes"
+
+        * inspector/front-end/ElementsPanel.js: Handles refreshing the Pane when necessary
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.updateEventListeners):
+        * inspector/front-end/EventListenersSidebarPane.js: Added. 
+        (WebInspector.EventListenersSidebarPane): The 1st level in the Pane
+        (WebInspector.EventListenersSidebarPane.prototype.update.callback):
+        (WebInspector.EventListenersSidebarPane.prototype.update):
+        (WebInspector.EventListenersSection): The 2nd level in the Pane
+        (WebInspector.EventListenersSection.prototype.update): filters on Preference
+        (WebInspector.EventListenersSection.prototype.addListener):
+        (WebInspector.EventListenerBar): The 3rd level in the Pane
+        (WebInspector.EventListenerBar.prototype._getNodeDisplayName):
+        (WebInspector.EventListenerBar.prototype._getFunctionDisplayName):
+        (WebInspector.EventListenersSidebarPane.prototype._changeSetting): For the Gear Menu
+        
+          Consolidated "appropriateSelectorForNode"
+
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/utilities.js:
+
+          Miscellaneous Updates
+
+        * English.lproj/localizedStrings.js: "Event Listeners", "No Event Listeners", "Selected Node Only", "All Nodes"
+        * WebCore.gypi: included the new inspector files
+        * WebCore.vcproj/WebCore.vcproj: included source files that were missing
+        * inspector/front-end/Images/grayConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/Images/whiteConnectorPoint.png: Added. Thanks to Timothy Hatcher.
+        * inspector/front-end/inspector.js: Preferences for the Gear Menu Event Listeners filter
+        * inspector/front-end/inspector.css: reused as much as possible
+        * inspector/front-end/inspector.html: include the new script
+        * inspector/front-end/WebKit.qrc: included the new inspector files
+
+2009-09-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29760
+        Implement CSSOM Range.getClientRects/getBoundingClientRect 
+
+        Tests: fast/dom/Range/getBoundingClientRect-getClientRects-relative-to-viewport.html
+               fast/dom/Range/getBoundingClientRect.html
+               fast/dom/Range/getClientRects.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::getClientRects):
+        (WebCore::Range::getBoundingClientRect):
+        (WebCore::adjustFloatQuadsForScrollAndAbsoluteZoom):
+        (WebCore::Range::getBorderAndTextQuads):
+        * dom/Range.h:
+        * dom/Range.idl:
+        Implement Range.getClientRects/getBoundingClientRect.
+
+        * dom/Element.cpp:
+        * rendering/RenderObject.h: 
+        (WebCore::adjustForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        Move point/quad adjustment methods from Element.cpp to RenderObject.h
+        so that Range.cpp can use them as well.
+
+2009-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed fix for WebInspector with Qt build.
+
+        Simply re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by nobody (trivial ChangeLog fix).
+
+        Restore WebCore/ChangeLog truncated in r48778.
+
+2009-09-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: DOM store is being unbound twice, leading to assertion failure.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29770
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::unbind):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Do not track DOM changes while inspector window is closed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29769
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+
+2009-09-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: [REGRESSION] Double Clicking Resources Fails to Open in New Window
+
+        https://bugs.webkit.org/show_bug.cgi?id=29762
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleText):
+        (InjectedScript.openInInspectedWindow):
+        * inspector/front-end/InjectedScriptAccess.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+
+2009-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        Fix ENABLE_ORIENTATION_EVENTS for non-Mac platforms.
+
+        * DerivedSources.make: Moved Platform.h check for
+        ENABLE_ORIENTATION_EVENTS into Mac-only section and added
+        default of ENABLE_ORIENTATION_EVENTS = 0 to non-Mac section.
+        Added ifndef test to make it possible to override both
+        ENABLE_DASHBOARD_SUPPORT and ENABLE_ORIENTATION_EVENTS external
+        to the makefile.  Moved addition of ENABLE_ORIENTATION_EVENTS to
+        ADDITIONAL_IDL_DEFINES to common section.
+        * GNUmakefile.am: Added support for ENABLE_ORIENTATION_EVENTS if
+        it is ever used.
+        * WebCore.pro: Ditto.
+
+2009-09-26  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Kilzer.
+
+        Move placeholder-related code to HTMLTextFormControlElement from
+        HTMLInputElement, WMLInputElement, InputElement, and
+        HTMLTextAreaElement.
+        https://bugs.webkit.org/show_bug.cgi?id=28703
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/InputElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::~HTMLTextFormControlElement):
+        (WebCore::HTMLTextFormControlElement::dispatchFocusEvent):
+        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent):
+        (WebCore::HTMLTextFormControlElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLTextFormControlElement::handleFocusEvent):
+        (WebCore::HTMLTextFormControlElement::handleBlurEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::handleFocusEvent):
+        (WebCore::HTMLInputElement::handleBlurEvent):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::supportsPlaceholder):
+        (WebCore::HTMLInputElement::isEmptyValue):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::supportsPlaceholder):
+        (WebCore::HTMLTextAreaElement::isEmptyValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::createRenderer):
+        * wml/WMLInputElement.h:
+
+2009-09-26  Shu Chang  <Chang.Shu@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Optimize the code so only the text from start to end is scanned.
+        https://bugs.webkit.org/show_bug.cgi?id=29092
+
+        On a platform with webkit+Qt+Symbian, the parsing time for a 600K text
+        file improved from 400ms to 40ms (10x faster).
+
+        * dom/Text.cpp:
+        (WebCore::Text::createWithLengthLimit):
+
+2009-09-26  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This Patch fixes [chromium] the drop-down is always left-aligned even
+        for RTL element.
+        https://bugs.webkit.org/show_bug.cgi?id=29612
+
+        For auto-complete, the items in drop-down should be right-aligned if
+        the directionality of <input> field is RTL.
+        For <select><option>, the items in drop-down should be right-aligned
+        if the directionality of <select> is RTL.
+
+        No automatic test is possible. Manual tests are added.
+
+        * manual-tests/autofill_alignment.html: Added.
+        * manual-tests/select_alignment.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow): Adjust the starting x-axis of text to
+        be paint if it should be right-aligned.
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r48775) FontList.plist written by TOT WebKit causes Safari 4
+        to crash on launch
+        https://bugs.webkit.org/show_bug.cgi?id=29759
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::writeFontDatabaseToPlist): Reverted to saving the CG font DB
+        property list at the root of FontList.plist, but with an additional
+        key for the last value of the Fonts registry key.
+        (WebCore::populateFontDatabase): Pass the FontList.plist in its entirety
+        to populatFontDatabaseFromPlist.
+
+2009-09-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix. Adding missing header files.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+
+2009-09-25  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: <http://webkit.org/b/29753> DerivedSources.make broken for non-Mac targets
+
+        Reviewed by Darin Adler.
+
+        * DerivedSources.make: Move tests for ENABLE_CONTEXT_MENUS,
+        ENABLE_DRAG_SUPPORT and ENABLE_INSPECTOR into Mac-only section.
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Load blocks during unload should not affect targeted loads
+        https://bugs.webkit.org/show_bug.cgi?id=29747
+
+        Move the check of the unload state after checking for targeted links.
+
+        Test: fast/loader/unload-hyperlink-targeted.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+
+2009-09-25  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add initial V8 bindings for WebGL
+        https://bugs.webkit.org/show_bug.cgi?id=29664
+
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8CanvasArrayBufferCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CanvasArrayCustom.h: Added.
+        (WebCore::constructCanvasArray):
+        * bindings/v8/custom/V8CanvasByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasFloatArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp: Added.
+        (WebCore::jsArrayToFloatArray):
+        (WebCore::jsArrayToIntArray):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::):
+        (WebCore::vertexAttribAndUniformHelperf):
+        (WebCore::uniformHelperi):
+        (WebCore::uniformMatrixHelper):
+        * bindings/v8/custom/V8CanvasShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * platform/graphics/GraphicsContext3D.h:
+
+2009-09-25  Jeremy Orlow  <jorlow@chromium.org>
+
+        This is breaking Chromium try bots, so I'm counting this as a build fix.
+
+        Add more svn:ignore exceptions.  On different platforms, these files are
+        generated with different case for WebCore.
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-25  Alexey Proskuryakov  <ap@apple.com>
+
+        Reverting r48767, as it broke Windows build in a non-trivial way.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::reportError):
+        (WebCore::EventListener::jsFunction):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+
+2009-09-24  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add a gyp variable to allow building a debug webcore without debug
+        symbols.  This allows for faster compile, link, and gdb times.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29721
+
+        No new tests, build config change.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2009-09-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Declare RegisteredEventListener as a class instead of a struct.
+        This fixes a warning in the Chromium build.
+
+        * dom/RegisteredEventListener.h:
+
+2009-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        WebCore part of
+        <rdar://problem/7211635> 2 byte characters are displayed as garbaged
+        <rdar://problem/7212626> garbled/gibberish text (off-by-one)
+
+        When the Windows Fonts directory contains more than one font file for a
+        given font name, which of the fonts gets assigned to the name in the
+        Core Graphics font database was determined arbitrarily and did not
+        always match the font GDI used for the same font name. The mismatch
+        caused character-to-glyph mapping to use one font and glyph rendering to
+        use another.
+
+        The fix is to update the Core Graphics font database from the registry
+        entries (that reflect the name-to-font mapping that GDI uses) after
+        populating it with the result of scanning the Fonts directory. As a
+        consequence, the directory needs to be scanned at startup every time the
+        registry key changes, so the last value of the registry key is kept
+        in the property list on disk so that it could be compared to the current
+        value on startup.
+
+        * platform/graphics/win/FontDatabase.cpp:
+        (WebCore::populateFontDatabaseFromPlist): Now takes a property list as
+        a parameter and avoids round-tripping through XML by calling
+        wkAddFontsFromPlist() instead of wkAddFontsFromPlistRepresentation().
+        (WebCore::fontFilenamesFromRegistryKey):
+        (WebCore::cgFontDBKey):
+        (WebCore::writeFontDatabaseToPlist): Now takes the CG font DB property
+        list and a property list with the font filenames from the registry and
+        writes a dictionary with those property lists as values.
+        (WebCore::fontFilenamesFromRegistry): Added. Returns an array with the
+        values in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
+        registry key.
+        (WebCore::populateFontDatabase): Changed to read the contents of the
+        Fonts registry key and compare it with the last-saved value from the
+        property list, and to call wkAddFontsFromRegistry() after populating the
+        CG font DB from the file system. Uses wkCreateFontsPlist() instead of
+        wkCreateFontsPlistRepresentation() to avoid round-tripping through XML.
+
+2009-09-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Inlined some object creation code, including lexicalGlobalObject access
+        https://bugs.webkit.org/show_bug.cgi?id=29750
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::currentCallFrame):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::hasBreakpoint): Updated for JavaScriptCore
+        API changes.
+
+2009-09-25  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24399
+        Make @import work in user stylesheets.  The first bug was that the URL wasn't being set on the
+        user sheets themselves, so relative @import URLs couldn't resolve properly.  The second bug
+        was that the loads would be denied.  This is fixed by using the requestUserCSSStyleSheet method
+        instead of the normal request method.  In order to know when to do this, CSSStyleSheets now have
+        a propagated boolean, m_isUserStyleSheet, that lets them know if they are user stylesheets or not.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setIsUserStyleSheet):
+        (WebCore::CSSStyleSheet::isUserStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::pageGroupUserSheets):
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILED: !repaintContainer || repaintContainer == this
+        https://bugs.webkit.org/show_bug.cgi?id=29755
+        
+        It's possible for RenderObject::container() to return an object that is higher
+        in the hierarchy than the repaintContainer that is being used to repaint an
+        object. For example, this can happen when running an accelerated opacity
+        transition on an element with a position:absolute parent, and a position:absolute child.
+        
+        In this case we need to detect when RenderObject::container() will skip over
+        repaintContainer, and in that case adjust the coords to shift into repaintContainer's space.
+
+        Test: compositing/repaint/opacity-between-absolute.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::container):
+        * rendering/RenderObject.h:
+
+2009-09-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash with hardware accelerated rotation of a PDF image in a data URL
+        <rdar://problem/7250378>
+        
+        PDF images don't return a color space from CGImageGetColorSpace(),
+        so we need to null-check the return value before use.
+
+        Test: compositing/color-matching/pdf-image-match.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Null-deref when first access to an Attr node is after its Element is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=29748
+
+        Test: fast/dom/Attr/access-after-element-destruction.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::markChildren): Added. Keeps the ownerElement alive as
+        long as the Attr is alive.
+
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::markChildren): Added. Keeps the Element alive as
+        long as the NamedNodeMap is alive.
+
+        * dom/Attr.idl: Added CustomMarkFunction attribute.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::getAttributeItem): Tweaked formatting.
+        (WebCore::NamedNodeMap::detachFromElement): Call clearAttributes so we don't
+        have attributes hanging around that might need an Attr node created; that way
+        we won't crash with a null-dereference trying to deal with one of them. This
+        can't happen when working with JavaScript since the Element will be kept
+        alive due to the change above.
+        (WebCore::NamedNodeMap::addAttribute): Fix function name in comment.
+        (WebCore::NamedNodeMap::removeAttribute): Removed unneeded "+ 1" and added
+        missing braces.
+
+        * dom/NamedAttrMap.h: Made the element function public so it can be used by
+        the JavaScript binding to keep the Element alive.
+
+        * dom/NamedNodeMap.idl: Added CustomMarkFunction attribute.
+
+2009-09-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        Onclick not fired for an element copied with cloneContents() or cloneNode()
+        https://bugs.webkit.org/show_bug.cgi?id=25130
+
+        The change here is that JS event listeners don't keep a reference to a global object from
+        where they were created, and instead take it as a parameter when parsing source code. Also,
+        the listener creation won't fail just because it happens for an element in a frameless
+        document.
+        Thus, moving nodes between documents no longer results in having incorrect registered
+        lazy event listeners on them.
+
+        Tests: fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-cloned-from-frameless-doc-context.html
+               fast/events/attribute-listener-cloned-from-frameless-doc.xhtml
+               fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html
+               fast/events/attribute-listener-extracted-from-frameless-doc-context.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener): Don't take a reference to JSDOMGlobalObject.
+        (WebCore::JSEventListener::jsFunction): Take ScriptExecutionContext as a parameter for
+        getting to JSDOMGlobalObject. It's not used in base class, but is in JSLazyEventListner.
+        (WebCore::JSEventListener::markJSFunction): Don't mark the global object.
+        (WebCore::JSEventListener::handleEvent): Get global object from ScriptExecutionContext.
+        (WebCore::JSEventListener::reportError): Ditto.
+
+        * bindings/js/JSEventListener.h: (WebCore::JSEventListener::create): Don't keep a reference
+        to JSDOMGlobalObject.
+
+        * bindings/js/JSLazyEventListener.cpp: (WebCore::JSLazyEventListener::parseCode): Listener
+        creation was split between this function and ScriptEventListener; moved it here, as JS
+        global object can be different now.
+
+        * bindings/js/JSLazyEventListener.h: (WebCore::JSLazyEventListener::create): Keep source URL,
+        which can not be determined at parsing time.
+
+        * bindings/js/ScriptEventListener.cpp: (WebCore::createAttributeEventListener): Moved code
+        for listener creation to JSLazyEventListener. XSSAuditor code remains here, because tests
+        expect that errors are logged at document parsing time, and because I don't know what other
+        side effects moving it vould have.
+
+        * dom/EventListener.h: handleEvent() and reportError() now take ScriptExecutionContext,
+        because JSC needs a global context here.
+
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        Don't pass global object to JSEventListener::create(), which no longer needs it.
+        Note that some of these functions still have an early return for null global object, which
+        can probably be removed in a later patch.
+        Pass ScriptExecutionContext to EventListener methods that now need it.
+
+2009-09-25  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein, Adele Peterson, and others.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29740
+        <rdar://problem/7168738> Gmail: After changing a foreground text color, pressing return doesn't apply background to new line
+
+        Change the way style is preserved when inserting a new paragraph.
+        The original code handled insertion at the beginning and at the end of a paragraph as special
+        cases. The newly created paragraph contained a set of nodes generated starting from the
+        computed style of the insertion node. This approach has two problems:
+        1. if the insertion node has a non opaque background color and one of the parent element did have
+        a solid background color the new paragraph did not have the element with the solid color in the tree.
+        2. in some circumstances it generated more markup than the original paragraph had (a span with bold, italic,
+        background color and some font attribute was being reproduced as span + bold + italic + font as separate tags.
+        The new approach is to recreate in the new paragraph the same hierarchy of nodes found in the
+        paragraph where the insertion point is.
+
+        Test: editing/inserting/insert-bg-font.html
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::getAncestorsInsideBlock): retrieves the list of all the ancestors
+        between the insert node and the outer block.
+        (WebCore::InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock): uses the list of ancestors to recreate
+        in the new paragraph the same element hierarchy present in the starting paragraph.
+        (WebCore::InsertParagraphSeparatorCommand::doApply): changed the code to handle the general case of insertion
+        in the middle of the paragraph to use the new methods. Changed the handling of the insertion at the beginning and
+        at the end of the paragraph to use the new methods instead of applying the calculated style.
+        * editing/InsertParagraphSeparatorCommand.h: added methods getAncestorsInsideBlock and cloneHierarchyUnderNewBlock.
+
+2009-09-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Content-type parameters not taken into account when building form-data
+        https://bugs.webkit.org/show_bug.cgi?id=28970
+
+        existing manual test case extended with new tests
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        * manual-tests/inspector/display-form-data.html:
+
+2009-09-25  Yuan Song  <song.yuan@ericsson.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14566
+
+        Raise SECURITY_ERR exception if an attempt is made to change document.domain to an invalid value.
+
+        Test: fast/js/invalid-domain-change-throws-exception.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        When setTimeout is called with a string argument in an isolated
+        world, we now compile the string in the isolated world.
+
+        Last time we tried this change, we got a lot of crashes.  This
+        time we're using a fresh local handle as our context to avoid
+        trouble if the peristent handle gets disposed before we leave
+        the context.
+
+        Test: fast/dom/timer-clear-interval-in-handler-and-generate-error.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-25  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a regression in Mac Chromium popup menus, where the user's
+        selection was ignored and the popup became unresponsive.
+        https://bugs.webkit.org/show_bug.cgi?id=29726
+
+        The fix is to notify the popup's client that the popup was hidden,
+        even if the popup has no parent.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-25  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Enable Pasteboard::writePlainText for Chromium and fix code style nits.
+        https://bugs.webkit.org/show_bug.cgi?id=29734
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+
+2009-09-25  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28876
+        [Qt] reduce peak memory consumption of text decoding.
+
+        Chop large input buffer into small buffers to reduce peak memory
+        during decoding.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2009-09-24  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add a mechanism for automatically halting plug-ins.
+
+        Reviewed by Oliver Hunt and Alice Liu.
+
+        * GNUmakefile.am:
+
+        * WebCore.base.exp:
+        Update export of Page constructor.
+
+        * WebCore.gypi:
+
+        * WebCore.pro:
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Add PluginHalter.{h,cpp}, PluginHalterClient.h, and
+        HaltablePlugin.h.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add files to Mac project.
+
+        * loader/EmptyClients.h:
+        Added an empty PluginHalterClient.
+        (WebCore::EmptyPluginHalterClient::shouldHaltPlugin):
+        Return false.
+
+        * page/PluginHalter.cpp: Added.
+        (WebCore::PluginHalter::PluginHalter):
+        (WebCore::PluginHalter::didStartPlugin):
+        Add the object to the plug-in set. If this is the only item in the set,
+        set m_oldestStartTime to this object's time, and start the timer.
+        (WebCore::PluginHalter::didStopPlugin):
+        Remove the plug-in from the set.
+        (WebCore::PluginHalter::timerFired):
+        Find the cut-off time as the current time minus the allowed run time;
+        plug-ins older than this may be halted. Iterate over the plug-ins. Find
+        the object with the oldest start time that is too young to be halted;
+        we'll use its start time to set the timer's next fire time. For all
+        plug-ins that are candidates to be halted, call the
+        PluginHalterClient's shouldHaltPlugin(). If this function returns true,
+        call the plug-in's halt() function. Remove these objects from the set
+        of tracked plug-ins. Call startTimerIfNecessary() to restart the timer.
+        (WebCore::PluginHalter::startTimerIfNecessary):
+        If the timer is set to fire, or the set of tracked plug-ins is empty,
+        return early. Set the timer to fire after the oldest plug-in has run
+        for the allowed run time.
+
+        * page/PluginHalter.h: Added.
+        (WebCore::PluginHalter::setPluginAllowedRunTime):
+
+        * page/PluginHalterClient.h: Added.
+        (WebCore::PluginHalterClient::~PluginHalterClient):
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        Initialize m_pluginHalterClient. Call pluginHalterEnabledStateChanged()
+        to create the PluginHalter if necessary.
+        (WebCore::Page::pluginHalterEnabledStateChanged):
+        If plug-in halting is enabled, create the PluginHalter. If it is
+        disabled, clear it.
+        (WebCore::Page::pluginAllowedRunTimeChanged):
+        If there is a plug-in halter, call its setPluginAllowedRunTime().
+        (WebCore::Page::didStartPlugin):
+        If there is a plug-in halter, call its didStartPlugin().
+        (WebCore::Page::didStopPlugin):
+        If there is a plug-in halter, call its didStopPlugin().
+
+        * page/Page.h:
+        Add a parameter to the Page constructor for the PluginHalterClient.
+        Added declarations for didStartPlugin() and didStopPlugin(), which are
+        called when HaltablePlugins are added to or removed from the page. Adds
+        pluginAllowedRunTimeChanged() and pluginHalterEnabledStateChanged() to
+        notify the Page when these settings are changed. Added members to hold
+        the PluginHalter and the PluginHalterClient.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setPluginHalterEnabled):
+        If the enabled state has changed, call the Page's
+        pluginHalterEnabledStateChanged().
+        (WebCore::Settings::setPluginAllowedRunTime):
+        Call the Page's pluginAllowedRunTimeChanged().
+
+        * page/Settings.h:
+        (WebCore::Settings::pluginHalterEnabled):
+        (WebCore::Settings::pluginAllowedRunTime):
+
+        * page/HaltablePlugin.h: Added. Defines an interface for plug-ins that
+        can be automatically halted.
+        (WebCore::HaltablePlugin::~HaltablePlugin):
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        Pass a dummy PluginHalterClient.
+
+2009-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        REGRESSION: webkit-transform scale no longer works properly in nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=29730
+        
+        When the initial or final state of a scale animation does not specify a transform,
+        use a default scale of 1, rather than zero.
+
+        Test: compositing/transitions/scale-transition-no-start.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+
+2009-09-24  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Eric Seidel.
+
+        isEnabled switch for notifications (experimental) in Page Settings
+        https://bugs.webkit.org/show_bug.cgi?id=28930
+
+        Adds a run-time flag in Settings object that controls whether
+        to expose desktop notifications.
+
+        No new test, but test code also modified to set this preference.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications): check preference before returning notifications object
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setExperimentalNotificationsEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::experimentalNotificationsEnabled):
+
+2009-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <rdar://problem/7162000> Crash while trying to
+        calculate the horizontal position of image
+
+        Test: fast/inline-block/relative-positioned-rtl-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced): Corrected an
+        isInline() test to isRenderInline(). This is similar to r41259.
+
+2009-09-24  Jessie Berlin  <jberlin@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix expanding profile call stacks being broken after sorting.
+        https://bugs.webkit.org/show_bug.cgi?id=26423
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.sort):
+        Set shouldRefreshChildren to true on collapsed nodes with children so that expanding it
+        causes the children to be placed in the right positions.
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Fixed sudden termination console spew due to too many calls to
+        enableSuddenTermination.
+        
+        <rdar://problem/7063125> 10A410: Safari logging enableSuddenTermination errors
+
+        * page/DOMWindow.cpp:
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners): Only
+        enableSuddenTermination if the set of listeners is empty *and* this
+        window was in the set. Otherwise, a no-op will cause us to enableSuddenTermination.
+
+2009-09-24  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebKit returns "" instead of null when getting
+        inexistent, forbidden or invalidly named headers.
+        https://bugs.webkit.org/show_bug.cgi?id=29140
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed to return null as it should according to the spec.
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add GYP generated files to svn:ignore
+        https://bugs.webkit.org/show_bug.cgi?id=29724
+
+        Adding the following files to the svn:ignore list (all in the
+        WebCore/WebCore.gyp directory)
+
+        WebCore.xcodeproj
+        WebCore.sln
+        WebCore.vcproj
+        WebCore_Debug.rules
+        WebCore_Release.rules
+        WebCore_Release - no tcmalloc.rules
+        WebCore_Purify.rules
+        WebCore.mk
+        WebCore_Debug_rules.mk
+        WebCore_Release_rules.mk
+        WebCore_Release - no tcmalloc_rules.mk
+        WebCore_Purify_rules.mk
+        WebCore.scons
+        WebCore_main.scons
+
+        * WebCore.gyp: Changed property svn:ignore.
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Mac build fix.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
+        remove unused parameter from function signature;
+
+2009-09-24  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Implement correct horizontal scrollbar behavior for GTK+ also on
+        styled scrollbars.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29348
+        [Gtk] Scrollwheel on horizontal scrollbars should slide horizontally
+
+        Test: platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent): on GTK+, when using the
+        wheel with the pointer on the horizontal scrollbar, scroll
+        horizontally;
+        * platform/PlatformWheelEvent.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::swapOrientation): allow adding a
+        vertical scroll to the horizontal one;
+
+2009-09-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        StorageNamespace::storageArea() should take in a PassRefPtr<StorageOrigin>
+        https://bugs.webkit.org/show_bug.cgi?id=29290
+
+        Modified StorageNamespace::storageArea() to take in a PassRefPtr<StorageOrigin>
+        per http://webkit.org/coding/RefPtr.html
+
+        No behavior change, so no tests.
+
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::storageArea):
+        * storage/StorageNamespaceImpl.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added back enable/disableSuddenTermination() functionality I accidentally
+        removed in my last patch.
+
+        * page/DOMWindow.cpp:
+        (WebCore::addUnloadEventListener):
+        (WebCore::removeUnloadEventListener):
+        (WebCore::removeAllUnloadEventListeners):
+        (WebCore::addBeforeUnloadEventListener):
+        (WebCore::removeBeforeUnloadEventListener):
+        (WebCore::removeAllBeforeUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg and Mark Rowe.
+
+        Don't pass -F to GCC on non-mac platforms since it is an darwin only.
+
+        * DerivedSources.make:
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Element.idl:
+
+2009-09-23  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Revert the relevant parts of r47925, and implement an alternate
+        fix (localize the coordinate check to GraphicsContext::clipPath()).
+        This fixes http://crbug.com/21174.
+
+        Covered by LayoutTests/svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates):
+
+2009-09-24  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merge changes from Mozilla's FTP directory parser.
+        <rdar://problem/7227620> and https://bugs.webkit.org/show_bug.cgi?id=29294
+
+        FTP layout tests not possible at this time.
+        https://bugs.webkit.org/show_bug.cgi?id=29719 tracks making them possible.
+
+        * loader/FTPDirectoryParser.cpp:
+        (WebCore::ParsingFailed):
+        (WebCore::parseOneFTPLine):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] re-enable some media tests
+        https://bugs.webkit.org/show_bug.cgi?id=29716
+
+        make canPlayType() return "probably" if mime-type is known
+        and codecs string is not empty. If codecs is empty return
+        "maybe".
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29703
+        Add a function to element to check whether it matches a CSS selector
+
+        Implement Element.webkitMatchesSelector.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::forEachSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::CSSSelectorList::selectorsNeedNamespaceResolution):
+        * css/CSSSelectorList.h:
+        Moved code to iterate the CSSSelectorList and determine if any
+        selectors need namespace resolution from a static function in
+        Node.cpp to CSSSelectorList so that it can be used by webkitMatchesSelector
+        as well as querySelector/querySelectorAll.
+
+        * dom/Element.cpp:
+        (WebCore::Element::webkitMatchesSelector):
+        * dom/Element.h: 
+        * dom/Element.idl:
+        Implement the new function. Handles exceptional cases identically to
+        querySelector/querySelectorAll.
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        Moved selectorsNeedNamespaceResolution to CSSSelectorList from here.
+
+2009-09-24  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fixed bindings build after http://trac.webkit.org/changeset/48701
+        https://bugs.webkit.org/show_bug.cgi?id=29713
+
+        Got rid of isWindowEvent in function signatures:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        (WebCore::V8WorkerContextEventListener::getReceiverObject):
+        * bindings/v8/V8WorkerContextEventListener.h:
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomEventListener.h:
+
+        Switched to EventTarget methods of adding/removing listeners:
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+        (WebCore::toEventID):
+        (WebCore::ACCESSOR_SETTER):
+
+        * dom/EventTarget.h: Some functions were incorrectly marked
+        as JSC-specific.
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Color-code watch expression errors with red.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29707
+
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        * inspector/front-end/inspector.css:
+
+2009-09-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Fix formatting for messages derived from resource warnings,
+        couple of drive-by formatting fixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29705
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateAndWrap):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionsSection.prototype.update):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Implement InspectorController::copyNode(id).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28357
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::copyNode):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+
+2009-09-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY(rollout)
+
+        Roll out r48712 as it is incorrect.
+
+        Overriding getPropertyNames is incorrect.
+
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+
+2009-09-24  Xan Lopez  <xlopez@igalia.com>
+
+        Revert r48697, since it broke key handling notification to GTK+.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-24  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] GStreamer MediaPlayer is unable to correctly querry duration
+        https://bugs.webkit.org/show_bug.cgi?id=24639
+
+        check duration returned by gst_element_query_duration() only
+        when using GStreamer < 0.10.23.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-09-24  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        The indices of RuntimeArray should be enumerated like for a regular array.
+        https://bugs.webkit.org/show_bug.cgi?id=29005
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getPropertyNames):
+        * bridge/runtime_array.h:
+
+2009-09-23  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce Pasteboard::writePlaintext(const String&) so that copying
+        of the inspected elements HTML will be possible in WebInspector.
+        https://bugs.webkit.org/show_bug.cgi?id=29634
+
+        * platform/Pasteboard.h:
+        * platform/android/TemporaryLinkStubs.cpp:
+        (Pasteboard::writePlainText):
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/haiku/PasteboardHaiku.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wince/PasteboardWince.cpp:
+        (WebCore::Pasteboard::writePlainText):
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writePlainText):
+        (WebCore::Pasteboard::writeURL):
+
+2009-09-24  Oswald Buddenhagen  <oswald.buddenhagen@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix QApp::translate() calls to provide the correct class name without
+        a trailing comma.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaTimeDescription):
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        More build fix: Removed JSSharedWorkerContextCustom.cpp from project
+        files, since it no longer exists in the repository.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix: Declare set/unsetPendingActivity public, so
+        SharedWorkerScriptLoader can call them.
+
+        * dom/ActiveDOMObject.h:
+
+2009-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed a bit of the Windows build.
+
+        * workers/SharedWorker.idl: Declare a custom mark function. (I accidentally
+        removed this in my last patch.)
+        * WebCore.xcodeproj/project.pbxproj: Added JSSharedWorkerCustom.cpp back
+        to the build. (I accidentally removed this in my last patch.)
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        32-bit build fix: restore previous cast that I thought was unnecessary.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2009-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bring a little sanity to this crazy EventTarget world of ours
+        https://bugs.webkit.org/show_bug.cgi?id=29701
+
+        Lots of EventTarget refactoring to achieve a single shared implementation
+        that fixes some of the performance and correctness bugs of the many individual
+        implementations, and makes reasoning about EventTargets and EventListeners
+        much easier.
+        
+        The basic design is this:
+            - EventTarget manages a set of EventListeners.
+            - onXXX EventListener attributes forward to standard EventTarget APIs.
+            - Since the onXXX code is repetitive, it is usually done with macros
+              of the form DEFINE_ATTRIBUTE_EVENT_LISTENER(attributeName).
+            - EventTarget provides a shared implementation of dispatchEvent,
+              which subclasses with special event dispatch rules, like Node, override.
+            - To support Node, which lazily instantiates its EventTarget data,
+              EventTarget has no data members, and instead makes a virtual call
+              to get its data from wherever its subclass chose to store it.
+              
+        Code that used to call dispatchEvent, passing an ExceptionCode paratmeter,
+        even though no exception could be thrown, has been changed not to do so,
+        to improve clarity and performance.
+        
+        Code that used to call a special dispatchXXXEvent function, which just
+        turned around and called dispatchEvent, has been changed to call
+        dispatchEvent, to improve clarity and performance.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj: Another day in the life of a WebKit
+        engineer.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Updated for Node API change. Added
+        "is not in the document but is firing event listeners" as a condition
+        that makes a Node observable in the DOM, so that event listeners firing
+        on removed nodes are not destroyed midstream. (This was a long-standing
+        bug that was somewhat hidden by the old implementation's habit of
+        copying the RegisteredEventListener vector before firing events, which
+        would keep almost all the relevant objects from being destroyed.)
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent): Removed the isWindowEvent flag
+        because it was one of the most elaborately planned no-ops in the history
+        of software crime, and one of the reasons clients thought they needed more
+        than one dispatchEvent function even though they didn't.
+        * bindings/js/JSEventListener.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::markChildren):
+        (WebCore::JSMessagePort::markChildren):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren):
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        * bindings/js/JSEventSourceCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSSharedWorkerContextCustom.cpp: Removed.
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::markChildren):
+        * bindings/js/JSWorkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::markChildren):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::markChildren): EventListener marking is
+        now autogenerated. Classes that still have custom mark functions for other
+        reasons now call a shared EventTarget API to mark their EventListeners.
+
+        * bindings/objc/ObjCEventListener.h:
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::handleEvent): Bye bye isWindowEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogeneration support for
+        marking and invalidating event listeners.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::willRemoveChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchWindowLoadEvent):
+        (WebCore::Document::finishedParsing):
+        * dom/Document.h: Use dispatchEvent directly.
+
+        * dom/Element.h: Moved a few event listener attributes down from Node,
+        since they don't apply to all Nodes, only Elements.
+
+        * dom/EventListener.h: Removed isWindowEvent parameter.
+
+        * dom/EventNames.h: Added the "display" event name, so it works correctly
+        with attribute macros, and for performance.
+
+        * dom/EventTarget.cpp:
+        (WebCore::forbidEventDispatch):
+        (WebCore::allowEventDispatch):
+        (WebCore::eventDispatchForbidden): Made this code (embarrasingly) thread
+        safe, since it's now called on multiple threads. (Currently, we only forbid
+        event dispatch on the main thread. If we ever want to forbid event dispatch
+        on secondary threads, we can improve it then.)
+
+        (WebCore::EventTarget::addEventListener):
+        (WebCore::EventTarget::removeEventListener):
+        (WebCore::EventTarget::setAttributeEventListener):
+        (WebCore::EventTarget::getAttributeEventListener):
+        (WebCore::EventTarget::clearAttributeEventListener):
+        (WebCore::EventTarget::dispatchEvent):
+        (WebCore::EventTarget::fireEventListeners):
+        (WebCore::EventTarget::getEventListeners):
+        (WebCore::EventTarget::removeAllEventListeners):
+        * dom/EventTarget.h:
+        (WebCore::FiringEventEndIterator::FiringEventEndIterator):
+        (WebCore::EventTarget::ref):
+        (WebCore::EventTarget::deref):
+        (WebCore::EventTarget::markEventListeners):
+        (WebCore::EventTarget::invalidateEventListeners):
+        (WebCore::EventTarget::isFiringEventListeners):
+        (WebCore::EventTarget::hasEventListeners): The ONE TRUE IMPLEMENTATION of
+        EventTarget APIs, crafted from an amalgam of all the different versions
+        we used to have. The most significant change here is that we no longer
+        make a copy of an EventListener vector before firing the events in the
+        vector -- instead, we use a reference to the original vector, along with
+        a notification mechanism for the unlikely case when an EventListener is
+        removed from the vector. This substantially reduces malloc, copying, and
+        refcount overhead, and complexity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create): Use dispatchEvent directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::eventTargetData):
+        (WebCore::MessagePort::ensureEventTargetData):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        * dom/MessagePort.idl: Removed custom EventTarget implementation.
+
+        * dom/MutationEvent.h:
+        (WebCore::MutationEvent::create): Added some default values so callers
+        can construct MutationEvents more easily, without calling a custom dispatch
+        function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::eventTargetData):
+        (WebCore::Node::ensureEventTargetData):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        * dom/Node.h:
+        (WebCore::Node::preDispatchEventHandler):
+        (WebCore::Node::postDispatchEventHandler):
+        * dom/Node.idl:
+        * dom/NodeRareData.h:
+        (WebCore::NodeRareData::eventTargetData):
+        (WebCore::NodeRareData::ensureEventTargetData): Use the shared EventTarget
+        interface, and call dispatchEvent directly instead of custom dispatchXXXEvent
+        functions that just forwarded to dispatchEvent.
+
+        * dom/RegisteredEventListener.cpp:
+        * dom/RegisteredEventListener.h:
+        (WebCore::RegisteredEventListener::RegisteredEventListener):
+        (WebCore::operator==): This is just a simple struct now, since we no longer
+        do a complicated copy / refCount / isRemoved dance just to honor the rule
+        that an EventListener can be removed during event dispatch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Removed another custom dispatchEvent.
+
+        * html/HTMLBodyElement.cpp:
+        * html/HTMLBodyElement.h: Use the shared EventTarget API.
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        (WebCore::HTMLFormControlElement::checkValidity):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        * html/HTMLFormElement.h: Use the standard dispatchEvent API.
+
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h: Use the shared EventTarget API.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::errorEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished): Use the standard dispatchEvent API.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        * inspector/InspectorDOMStorageResource.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::HashChangeEventTask::performTask):
+        (WebCore::FrameLoader::pageHidden): No more isWindowEvent.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::CallCacheListenerTask::performTask):
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::notifyDOMApplicationCache):
+        * loader/appcache/ApplicationCacheHost.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::eventTargetData):
+        (WebCore::DOMApplicationCache::ensureEventTargetData):
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl: Switched to the standard
+        EventTarget API. As a part of this, I switched this class from using a
+        custom internal event name enumeration to using the standard EventNames.
+
+        * notifications/Notification.cpp:
+        (WebCore::Notification::eventTargetData):
+        (WebCore::Notification::ensureEventTargetData):
+        * notifications/Notification.h:
+        (WebCore::Notification::scriptExecutionContext):
+        * notifications/Notification.idl: Switched to the standard EventTarget API.
+
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::event):
+        (WebCore::windowsWithUnloadEventListeners):
+        (WebCore::windowsWithBeforeUnloadEventListeners):
+        (WebCore::allowsBeforeUnloadListeners):
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
+        (WebCore::DOMWindow::pendingUnloadEventListeners):
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Changed the "pending"
+        unload / beforeunload listener tracker just to track which windows had
+        such listeners, instead of actually keeping a copy of the listeners. Now,
+        this code can use the standard EventTarget API.
+
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        (WebCore::DOMWindow::eventTargetData):
+        (WebCore::DOMWindow::ensureEventTargetData):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl: Use the standard EventTarget APIs.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent): Use dispatchEvent directly.
+
+        * page/EventSource.cpp:
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::stop):
+        (WebCore::EventSource::createMessageEvent):
+        (WebCore::EventSource::eventTargetData):
+        (WebCore::EventSource::ensureEventTargetData):
+        * page/EventSource.h:
+        * page/EventSource.idl: Use the standard EventTarget APIs.
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocusedFrame):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged): Use dispatchEvent.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewritten for new EventTarget API.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::dummyEventTargetData):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::removeAllEventListeners):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::eventTargetData):
+        (WebCore::SVGElementInstance::ensureEventTargetData): Use the EventTarget API.
+
+        * svg/SVGElementInstance.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent): Use dispatchEvent directly.
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Updated for
+        new EventTarget API.
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::handleEvent): No more isWindowEvent.
+
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::eventTargetData):
+        (WebCore::WebSocket::ensureEventTargetData):
+        * websockets/WebSocket.h:
+        * websockets/WebSocket.idl:
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::eventTargetData):
+        (WebCore::AbstractWorker::ensureEventTargetData):
+        * workers/AbstractWorker.h:
+        * workers/AbstractWorker.idl:
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerConnectTask::performTask):
+        (WebCore::SharedWorkerScriptLoader::load):
+        (WebCore::SharedWorkerScriptLoader::notifyFinished):
+        * workers/SharedWorker.idl:
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::createConnectEvent):
+        * workers/SharedWorkerContext.h:
+        * workers/SharedWorkerContext.idl:
+        * workers/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::eventTargetData):
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::networkError):
+        (WebCore::XMLHttpRequest::abortError):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        (WebCore::XMLHttpRequest::eventTargetData):
+        (WebCore::XMLHttpRequest::ensureEventTargetData):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestProgressEvent.h:
+        (WebCore::XMLHttpRequestProgressEvent::create):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::eventTargetData):
+        (WebCore::XMLHttpRequestUpload::ensureEventTargetData):
+        * xml/XMLHttpRequestUpload.h:
+        * xml/XMLHttpRequestUpload.idl: Use new EventTarget API.
+
+2009-09-23  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - Support for maxLength of <textarea>
+        - Move numGraphemeClusters() and numCharactersInGraphemeClusters() from InputElement to String.
+        https://bugs.webkit.org/show_bug.cgi?id=29292
+
+        Test: fast/forms/textarea-maxlength.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::sanitizeUserInputValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
+        (WebCore::HTMLTextAreaElement::sanitizeUserInputValue):
+        (WebCore::HTMLTextAreaElement::maxLength):
+        (WebCore::HTMLTextAreaElement::setMaxLength):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::numGraphemeClusters):
+        (WebCore::String::numCharactersInGraphemeClusters):
+
+2009-09-23  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] REGRESSION: BitmapImage::getGdkPixbuf fails for non-square images
+        https://bugs.webkit.org/show_bug.cgi?id=29654
+
+        Give GDK_Backspace key events the proper text properties.
+
+        Instead of adding new tests, this change removes existing tests
+        from Gtk's skipped list.
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::keyIdentifierForGdkKeyCode):
+        (WebCore::singleCharacterString):
+
+2009-09-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26989
+        Should allow navigation of top-level openers
+        <rdar://problem/7034025>
+
+        Allow navigation of cross-origin window.opener if it is top-level frame.
+
+        Test: http/tests/security/frameNavigation/cross-origin-opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2009-09-23  Marshall Culpepper  <mculpepper@appcelerator.com>
+
+        Reviewed by Eric Seidel.
+
+        Added $(WebKitLibrariesDir)/include/cairo so cairo.h is found by
+        default when the necessary dependencies are extracted into the
+        WebKitLibrariesDir.
+        https://bugs.webkit.org/show_bug.cgi?id=29661
+
+        * WebCore.vcproj/WebCoreCairo.vsprops:
+
+2009-09-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Crash when website does a history.back() followed by an alert()
+        https://bugs.webkit.org/show_bug.cgi?id=29686
+        rdar://problem/6984996
+
+        When loading is deferred, we need to defer timer-based loads
+        too, not just networking-driven loads. Otherwise we can get
+        syncronouse navigation while running a script, which leads to
+        crashes and other badness.
+
+        This patch includes a manual test; an automated test may be
+        possible some time in the future.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Use scheduleLocationChange
+        instead of scheduleHTTPRedirection to implement the navigation
+        needed for x-frame-options.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader): Updated for data members with
+        new names and new data members.
+        (WebCore::FrameLoader::setDefersLoading): When turning deferral
+        off, call startRedirectionTimer and startCheckCompleteTimer, since
+        either of them might have been fired and ignored while defersLoading
+        was true.
+        (WebCore::FrameLoader::clear): Updated for replacement of the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer timers.
+        (WebCore::FrameLoader::allAncestorsAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Added code to set
+        m_shouldCallCheckCompleted to false. Changed code that calls
+        startRedirectionTimer to call it unconditionally, since that
+        function now knows when to do work and doesn't expect callers
+        to handle that any more.
+        (WebCore::FrameLoader::checkTimerFired): Added. Replaces the old
+        timer fired callbacks. Calls checkCompleted and checkLoadComplete
+        as appropriate, but not when defersLoading is true.
+        (WebCore::FrameLoader::startCheckCompleteTimer): Added. Replaces
+        the two different calls to start timers before. Only starts the
+        timers if they are needed.
+        (WebCore::FrameLoader::scheduleCheckCompleted): Changed to call
+        startCheckCompleteTimer after setting boolean.
+        (WebCore::FrameLoader::scheduleCheckLoadComplete): Ditto.
+        (WebCore::FrameLoader::scheduleHistoryNavigation): Removed
+        canGoBackOrForward check. The logic works more naturally when
+        we don't do anything until the timer fires.
+        (WebCore::FrameLoader::redirectionTimerFired): Do nothing if
+        defersLoading is true. Also moved canGoBackOrForward check here.
+        (WebCore::FrameLoader::scheduleRedirection): Changed code that
+        calls startRedirectionTimer to do so unconditionally. That
+        function now handles the rules about when to start the timer
+        rather than expecting the caller to do so.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to
+        handle the case where there is no redirection scheduled,
+        where the timer is already active, or where this is a classic
+        redirection and there is an ancestor that has not yet completed
+        loading.
+        (WebCore::FrameLoader::completed): Call startRedirectionTimer
+        here directly instead of calling a cover named parentCompleted.
+        Hooray! One less function in the giant FrameLoader class!
+        (WebCore::FrameLoader::checkLoadComplete): Added code to set
+        m_shouldCallCheckLoadComplete to false.
+
+        * loader/FrameLoader.h: Replaced the two functions
+        checkCompletedTimerFired and checkLoadCompleteTimerFired with
+        one function, checkTimerFired. Removed the parentCompleted
+        function. Added the startCheckCompleteTimer and
+        allAncestorsAreComplete functions. Replaced the
+        m_checkCompletedTimer and m_checkLoadCompleteTimer data
+        members with m_checkTimer, m_shouldCallCheckCompleted, and
+        m_shouldCallCheckLoadComplete.
+
+        * manual-tests/go-back-after-alert.html: Added.
+        * manual-tests/resources/alert-and-go-back.html: Added.
+
+2009-09-23  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/29660> Move "Generate 64-bit Export File" build phase script into DerivedSources.make
+
+        Reviewed by Mark Rowe.
+
+        The "Generate 64-bit Export File" build phase script generated
+        the WebCore.LP64.exp export file used to link 64-bit WebCore.
+        Instead of having a separate build phase script, move its
+        generation into DerivedSources.make where WebCore.exp is
+        generated.
+
+        * DerivedSources.make: Added a rule to make WebCore.LP64.exp.
+        Added code to append WebCore.PluginHostProcess.exp to
+        $(WEBCORE_EXPORT_DEPENDENCIES) when WTF_USE_PLUGIN_HOST_PROCESS
+        is set to 1.
+        * WebCore.PluginHostProcess.exp: Renamed from WebCore/WebCore.LP64.exp.
+        * WebCore.xcodeproj/project.pbxproj: Removed the "Generate
+        64-bit Export File" build phase script. Renamed WebCore.LP64.exp
+        to WebCore.PluginHostProcess.exp.
+
+2009-09-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29694
+        [Chromium] Eliminate dependency on gfx::Rect from ImageSkia.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::drawResampledBitmap):
+
+2009-09-22  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent scrolling multiple elements during latched wheel events.
+
+        Reviewed by Anders Carlsson.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/EventHandler.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scroll):
+        * rendering/RenderBox.h:
+
+2009-09-23  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29523
+        
+        Fixes an issue where a JavaScript URL that was URL-encoded twice can bypass the
+        XSSAuditor.
+        
+        The method FrameLoader::executeIfJavaScriptURL decodes the URL escape 
+        sequences in a JavaScript URL before it is eventually passed to the XSSAuditor.
+        Because the XSSAuditor also decodes the URL escape sequences as part of its
+        canonicalization, the double decoding of a JavaScript URL would
+        not match the canonicalization of the input parameters.
+
+        Tests: http/tests/security/xssAuditor/iframe-javascript-url-url-encoded.html
+               http/tests/security/xssAuditor/javascript-link-url-encoded.html
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Moved call to 
+        XSSAuditor::canEvaluateJavaScriptURL into FrameLoader::executeIfJavaScriptURL.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Modified to call 
+        XSSAuditor::canEvaluateJavaScriptURL on the JavaScript URL before it is
+        decoded.
+
+2009-09-22  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29657
+        Columns don't break properly in positioned elements with a fixed height.  Make sure that
+        a block is still considered to have columns even when the column count is 1 if the column
+        width is non-auto.
+    
+        Added fast/multicol/positioned-with-constrained-height.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+
+2009-09-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Add a null check for the Document*. In the mirror benchmarking
+        application a crash from a call from JavaScript was observed.
+
+        I was not able to come up with a test case for this issue.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::cookieJar):
+
+2009-09-23  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the Qt/Windows build, after the introduction of
+        the page client.
+
+        * plugins/win/PluginViewWin.cpp:
+        (windowHandleForPageClient):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] media tests failing after their rework
+        https://bugs.webkit.org/show_bug.cgi?id=29532
+
+        Correctly advertise the mime types used by the common formats used
+        in the tests.
+
+        Tests that regressed, and will pass again:
+
+           media/video-canvas-source.html
+           media/video-controls.html
+           media/video-currentTime-set2.html
+           media/video-dom-autoplay.html
+           media/video-dom-src.html
+           media/video-error-abort.html
+           media/video-load-networkState.html
+           media/video-load-readyState.html
+           media/video-muted.html
+           media/video-no-autoplay.html
+           media/video-pause-empty-events.html
+           media/video-play-empty-events.html
+           media/video-seekable.html
+           media/video-seeking.html
+           media/video-size.html
+           media/video-source-type-params.html
+           media/video-source-type.html
+           media/video-source.html
+           media/video-src-change.html
+           media/video-src-invalid-remove.html
+           media/video-src-remove.html
+           media/video-src-set.html
+           media/video-src-source.html
+           media/video-src.html
+           media/video-timeupdate-during-playback.html
+           media/video-volume.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mimeTypeCache):
+
+2009-09-22  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the crash problem with absolte positioned children in foreignobject
+        htts://bugs.webkit.org/show_bug.cgi?id=26342
+
+        Test: svg/custom/foreignobject-crash-with-absolute-positioned-children.svg
+
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::isSVGForeignObject):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGForeignObject):
+
+2009-09-22  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers "name" attribute is now optional.
+        https://bugs.webkit.org/show_bug.cgi?id=28897
+
+        Test: fast/workers/shared-worker-name.html
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        (WebCore::constructSharedWorker):
+        Default 'name' attribute to empty string if it is not provided.
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Default 'name' attribute to empty string if it is not provided.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::matches):
+        Now matches URLs if names are empty strings.
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        Pass URL in to SharedWorkerProxy::matches().
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another build fix.
+
+        [Chromium] Add another missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorController.cpp: Added DOMWindow.h include.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add missing include.
+        https://bugs.webkit.org/show_bug.cgi?id=29536
+
+        * inspector/InspectorDOMStorageResource.cpp: Added DOMWindow.h include.
+
+2009-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tighten up the ScheduledRedirection machinery to prepare for a bug fix
+        https://bugs.webkit.org/show_bug.cgi?id=29663
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a boolean,
+        initialized to false, to keep track if the redirection has been
+        communicated to the client.
+        (WebCore::FrameLoader::stopLoading): Tweaked a comment.
+        (WebCore::FrameLoader::cancelRedirection): Removed code to clear
+        m_scheduledRedirection.clear since stopRedirectionTimer does that now.
+        (WebCore::FrameLoader::allChildrenAreComplete): Added.
+        (WebCore::FrameLoader::checkCompleted): Use allChildrenAreComplete
+        function for clarity.
+        (WebCore::FrameLoader::checkCallImplicitClose): Ditto.
+        (WebCore::FrameLoader::scheduleRedirection): Changed to take a PassOwnPtr.
+        (WebCore::FrameLoader::startRedirectionTimer): Added code to set the
+        toldClient flag and not call clientRedirected a second time if it is set.
+        (WebCore::FrameLoader::stopRedirectionTimer): Changed so this can be safely
+        called multiple times and it will call clientRedirectCancelledOrFinished
+        only once.
+
+        * loader/FrameLoader.h: Changed scheduleRedirection to be a PassOwnPtr.
+        Added allChildrenAreComplete function.
+
+2009-09-22  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        DOMStorage interaction is now serialized into JSON messages
+        and doesn't require quarantined objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::getDOMStorageEntries):
+        (WebCore::InspectorBackend::setDOMStorageItem):
+        (WebCore::InspectorBackend::removeDOMStorageItem):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::selectDOMStorage):
+        (WebCore::InspectorController::getDOMStorageEntries):
+        (WebCore::InspectorController::setDOMStorageItem):
+        (WebCore::InspectorController::removeDOMStorageItem):
+        (WebCore::InspectorController::getDOMStorageResourceForId):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        (WebCore::InspectorDOMStorageResource::startReportingChangesToFrontend):
+        (WebCore::InspectorDOMStorageResource::handleEvent):
+        (WebCore::InspectorDOMStorageResource::operator==):
+        * inspector/InspectorDOMStorageResource.h:
+        (WebCore::InspectorDOMStorageResource::cast):
+        (WebCore::InspectorDOMStorageResource::id):
+        (WebCore::InspectorDOMStorageResource::domStorage):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::didGetDOMStorageEntries):
+        (WebCore::InspectorFrontend::didSetDOMStorageItem):
+        (WebCore::InspectorFrontend::didRemoveDOMStorageItem):
+        (WebCore::InspectorFrontend::updateDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMStorage.js:
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get id):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.getEntriesAsync):
+        (WebInspector.DOMStorage.prototype.setItemAsync):
+        (WebInspector.DOMStorage.prototype.removeItemAsync):
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._showDOMStorageEntries):
+        (WebInspector.DOMStorageItemsView.prototype._dataGridForDOMStorageEntries):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+        (WebInspector.StoragePanel.prototype.selectDOMStorage):
+        (WebInspector.StoragePanel.prototype.updateDOMStorage):
+        (WebInspector.StoragePanel.prototype._domStorageForId):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        (WebInspector.updateDOMStorage):
+
+2009-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for XMLHttpRequest.abort() should destroy the response text.
+        https://bugs.webkit.org/show_bug.cgi?id=29658
+        <rdar://problem/5301430>
+
+        Clearing the response text after calling XMLHttpRequest.abort() is necessary
+        per spec and matches Firefox. It is also a potential memory win.
+
+        Test: http/tests/xmlhttprequest/abort-should-destroy-responseText.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::abort): Clear the response text making sure to
+        keep the actual ResourceReponse around so that the response status and response
+        status text are kept around.
+
+2009-09-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        No review, rolling out r48639.
+        http://trac.webkit.org/changeset/48639
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Changing the transaction coordinator to (re-)allow multiple read
+        transactions on the same database to run concurrently (without
+        risking a deadlock this time).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29115
+
+        Tests: storage/read-and-write-transactions-dont-run-together.html
+               storage/read-transactions-running-concurrently.html
+
+        * storage/SQLTransaction.h:
+        (WebCore::SQLTransaction::isReadOnly): Returns the type of the
+        transaction.
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::releaseLock): Changed to
+        allow multiple read transactions on the same DB to run
+        concurrently.
+        (WebCore::SQLTransactionCoordinator::shutdown): Renamed the map.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29652
+        Support true system colors for CSS system colors in Chromium/Win.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeChromiumWin::systemColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-09-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6925121> SAP: Wrong width calculation in 
+        table with fixed layout
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29501
+
+        New Tests:
+        * fast/table/fixed-table-with-percent-inside-percent-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-auto-table.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-extra-large-div.html: Added.
+        * fast/table/fixed-table-with-percent-width-inside-fixed-width-table.html: Added.
+        * fast/table/fixed-table-with-small-percent-width.html: Added.
+
+        This new quirk is very similar to an existing one that was 
+        implemented in revision 4316.
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcPrefWidths):
+
+2009-09-22  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        List HTTP status code with response headers in resources tab of Web Inspector.
+        http://webkit.org/b/19945
+
+        This patch adds a new top level list in the resources tab, HTTP Information, that 
+        for now, contains the Request Method (GET, POST, etc.) and the Status Code (200, 404, etc.).
+        Additionally, it adds a colored dot next to the requested URL to show the status 
+        (green for success, orange for redirect, red for error).
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ImageView.js:
+        (WebInspector.ImageView):
+        * inspector/front-end/Images/errorRedDot.png: Added.
+        * inspector/front-end/Images/successGreenDot.png: Added.
+        * inspector/front-end/Images/warningOrangeDot.png: Added.
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.StatusTextForCode):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshHTTPInformation):
+        * inspector/front-end/inspector.css:
+
+2009-09-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Back list isn't properly updated for fragment changes after a redirect.
+        <rdar://problem/6142803> and https://bugs.webkit.org/show_bug.cgi?id=20355
+
+        Test: fast/loader/fragment-after-redirect-gets-back-entry.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Properly reset the policy FrameLoadType before
+          consulting the policy delegate for fragment scrolling.
+
+2009-09-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects get stuck in the non-visible state and cannot be opened.
+        https://bugs.webkit.org/show_bug.cgi?id=29645
+
+        All paths that lead to hiding the popup menu must call popupDidHide on
+        the PopupMenuClient.  This change makes it so by moving all of the
+        hiding logic to PopupListBox::hidePopup.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::hidePopup):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-09-22  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector.log() function not protected if console not yet created
+        https://bugs.webkit.org/show_bug.cgi?id=29336
+        
+        No new tests.  Only affects Web Inspector developers adding logging
+        to their code during development.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.log.isLogAvailable):
+        (WebInspector.log.flushQueue):
+        (WebInspector.log.flushQueueIfAvailable):
+        (WebInspector.log.logMessage):
+        (WebInspector.log):
+
+2009-09-22  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+
+        Ported chromium.org's webcore.gyp for the webkit chromium port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29617
+
+        * WebCore.gyp/WebCore.gyp: Added.
+
+2009-09-22  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Don't keep clean wrappers artificially alive        
+        We currently keep all DOM node wrappers alive, even when there are
+        no more references to them from JS, in case they have properties
+        that we need to keep around if new JS references are created.
+        This changes the policy to only keep wrappers artificially alive
+        if they have changed since they were created. Empty wrappers are
+        discarded and recreated as needed.
+        https://bugs.webkit.org/show_bug.cgi?id=29330
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::ObjectGrouperVisitor::visitDOMWrapper):
+
+2009-09-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: console.count and console.timeEnd
+        crash when inspector is opened.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29632
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+
+2009-09-22  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix bogus build fix I did last night.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI/Mac: Don't paint plugins if we don't have a CGContextRef
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-09-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reivewed by Simon Hausmann.
+
+        Fix the Qt/Mac build after r48604 (Implement new QWebPageClient class)
+
+        There's no QWidget::x11Info() on Mac, and setPlatformPluginWidget()
+        takes a QWidget*, not a QWebPageClient*
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Attempted fix for the V8 build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-09-21  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Don't re-enter JavaScript after performing access checks
+        https://bugs.webkit.org/show_bug.cgi?id=29531
+
+        Moved the access check slightly later in this functions to avoid
+        re-entering the JavaScript interpreter (typically via toString)
+        after performing the access check.
+
+        I can't really think of a meaningful test for this change.  It's more
+        security hygiene.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::if):
+        (CALLBACK_FUNC_DECL):
+        (V8Custom::WindowSetLocation):
+        (V8Custom::ClearTimeoutImpl):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-21  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make all write transaction start with a BEGIN IMMEDIATE command
+        instead of BEGIN.
+
+        We cannot test this change in a layout test, because in order to
+        test it we need to spawn two database threads and execute
+        transaction steps on these two threads in a very specific order,
+        which seems impossible to do when they share the same main thread
+        (as they would in a layout test). The SQLite docs and the case
+        described in the bug though should be enough proof that we do have
+        a problem here and that this patch will fix it.
+
+        Relevant SQLite documentation:
+        http://www.sqlite.org/lang_transaction.html
+        http://www.sqlite.org/lockingv3.html#locking
+
+        https://bugs.webkit.org/show_bug.cgi?id=29218
+
+        * platform/sql/SQLiteTransaction.cpp:
+        (WebCore::SQLiteTransaction::SQLiteTransaction): Added a readOnly
+        parameter.
+        (WebCore::SQLiteTransaction::begin): Changed to BEGIN IMMEDIATE
+        for write transactions.
+        * platform/sql/SQLiteTransaction.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::openTransactionAndPreflight): Passing
+        the read-only flag to the SQLiteTransaction instance.
+
+2009-09-21  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe.
+
+        * DerivedSources.make: Fix the Xcode build on SnowLeopard.
+
+2009-09-15  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Prevent sleeps in unload handlers.
+        https://bugs.webkit.org/show_bug.cgi?id=29193
+
+        Test: fast/dom/Window/slow_unload_handler.html
+
+        * WebCore.gypi:
+        * bindings/v8/DateExtension.cpp: Added.
+        (WebCore::DateExtension::DateExtension):
+        (WebCore::DateExtension::get):
+        (WebCore::DateExtension::setAllowSleep):
+        (WebCore::DateExtension::GetNativeFunction):
+        (WebCore::DateExtension::weakCallback):
+        (WebCore::DateExtension::GiveEnableSleepDetectionFunction):
+        (WebCore::DateExtension::OnSleepDetected):
+        * bindings/v8/DateExtension.h: Added.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createNewContext):
+        (WebCore::V8Proxy::registerExtensionWithV8):
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        * bindings/v8/V8Proxy.h:
+
+2009-09-21  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the
+        worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        The previous fix was partially reverted due to a reliability build break
+        in chromium. The break happens when an exception is thrown without
+        setting a message. We need to check for this scenario and handle it.
+
+        Tested by worker-close.html.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::reportException):
+
+2009-09-21  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser & Sam Weinig.
+
+        Add ENABLE(ORIENTATION_EVENTS)
+        https://bugs.webkit.org/show_bug.cgi?id=29508
+        
+        See documentation here:
+        http://developer.apple.com/safari/library/documentation/AppleApplications/Reference/SafariWebContent/HandlingEvents/HandlingEvents.html#//apple_ref/doc/uid/TP40006511-SW16
+
+        * DerivedSources.make: Use new WebCore.OrientationEvents.exp file if ENABLE_ORIENTATION_EVENTS.
+        Add ENABLE_ORIENTATION_EVENTS to the new ADDITIONAL_IDL_DEFINES variable that is passed to the IDL
+        code generator. This is because ENABLE_ORIENTATION_EVENTS is not in FEATURE_DEFINES.
+        * WebCore.OrientationEvents.exp: Added.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.OrientationEvents.exp.
+        * dom/EventNames.h: Add onorientationchange.
+        * html/HTMLAttributeNames.in: Ditto.
+        * html/HTMLBodyElement.cpp: Handle onorientationchange properly.
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        (WebCore::HTMLBodyElement::onorientationchange):
+        (WebCore::HTMLBodyElement::setOnorientationchange):
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLBodyElement.idl: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::onorientationchange):
+        (WebCore::HTMLFrameSetElement::setOnorientationchange):
+        * html/HTMLFrameSetElement.h: Ditto.
+        * html/HTMLFrameSetElement.idl: Ditto.
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::orientation): Calls up the to the Frame for the orientation value.
+        (WebCore::DOMWindow::onorientationchange):
+        (WebCore::DOMWindow::setOnorientationchange):
+        * page/DOMWindow.h: Handle onorientationchange properly.
+        * page/DOMWindow.idl: Ditto.
+        * page/Frame.cpp: Ditto.
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::sendOrientationChangeEvent):
+        * page/Frame.h: Ditto.
+        (WebCore::Frame::orientation):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: completions are always evaluated against
+        window (discarding call frames).
+
+        https://bugs.webkit.org/show_bug.cgi?id=29616
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.selectedCallFrameId):
+
+2009-09-21  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows (Cairo) target.
+
+        Add stubs for SocketStream classes added in @r47788, which
+        broke the WinCairo build.
+
+        No new tests. (Build failure).
+
+        * WebCore.vcproj/WebCore.vcproj:  Add references to new files
+          to Cairo build, exclude from standard Apple build.
+        * platform/network/curl/SocketStreamError.h: Added.
+        * platform/network/curl/SocketStreamHandle.h: Added.
+        * platform/network/curl/SocketStreamHandleCurl.cpp: Added.
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Expose InspectorResource fields.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29537
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::resourceData):
+        * inspector/InspectorResource.h:
+        (WebCore::InspectorResource::requestHeaderFields):
+        (WebCore::InspectorResource::responseHeaderFields):
+        (WebCore::InspectorResource::responseStatusCode):
+        (WebCore::InspectorResource::requestMethod):
+        (WebCore::InspectorResource::requestFormData):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: JS error drilling down childless node.
+        No need to dispatch double click twice - it is already handled
+        in TreeElement.treeElementDoubleClicked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22144
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline):
+
+2009-09-21  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement new QWebPageClient class and let our classes
+        QWebViewPrivate and QWebGraphicsItemPrivate inherit from it.
+
+        For Qt, platformPageClient() will now return a class derived from
+        the QWebPageClient, so the patch adapts our Qt hooks to go though
+        this class and not depend on the QWebView.
+
+        * WebCore.pro:
+        * platform/Widget.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/QWebPageClient.h: Added.
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Evaluating on call frame always returns "undefined".
+
+        https://bugs.webkit.org/show_bug.cgi?id=29613
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateAndWrap):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.evaluateInCallFrame):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Exception formatting is broken in console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29608
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleCommandResult):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript.createProxyObject):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Console object formatting is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29607
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy.wrapPrimitiveValue):
+
+2009-09-21  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: Crash When Logging an Element Before Opening Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=29514
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects):
+
+2009-09-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect clipping with accelerated compositing content, and position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29347
+        
+        Fix the compositing clipping logic to behave correctly when position:fixed
+        elements clip, by using the new backgroundClipRect() method to determine
+        when we need to clip, and to compute the clipping layer position.
+
+        Test: compositing/overflow/fixed-position-ancestor-clip.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+
+2009-09-21  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add back in a special case for window.top in the V8 bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29605
+
+        Fixes LayoutTests/fast/dom/Window/window-property-shadowing.html in the Chromium port.
+
+        * bindings/scripts/CodeGeneratorV8.pm: Ensure window.top is not marked as read only, as this breaks the shadowing disabling.
+
+2009-09-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        HTMLMediaElement: media file should not reload when page comes out of page cache
+        https://bugs.webkit.org/show_bug.cgi?id=29604
+
+        Test: media/restore-from-page-cache.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): Do nothing unless the element
+        is still loading. Only fire an 'emptied' event if the readyState is HAVE_NOTHING,
+        otherwise set the network state to NETWORK_IDLE.
+
+2009-09-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Sean/Shawn/Shaun" Garen.
+
+        Clarify two FIXMEs.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+
+2009-09-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Drop down selects fail to close when a value is selected
+        https://bugs.webkit.org/show_bug.cgi?id=29582
+
+        Implement PopupListBox::hidePopup, which was previously
+        declared but unimplemented.  Removes the declaration of
+        showPopup since that method is not implemented.
+
+        PopupListBox::hidePopup takes care of hiding the popup,
+        by invoking hidePopup on its parent PopupContainer, and
+        then informs the PopupMenuClient that popupDidHide.
+        This mimics the old behavior prior to r48370.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::hidePopup):
+
+2009-09-21  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt] Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=29535
+
+        * platform/network/qt/DnsPrefetchHelper.cpp: Missing #include "config.h"  added.
+
+2009-09-21  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make dist build fix. Missing files.
+
+        * GNUmakefile.am:
+
+2009-09-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Crash when clicking link in unload handler
+        https://bugs.webkit.org/show_bug.cgi?id=29525
+
+        Test that the first navigation always wins when the page tries to start
+        a new navigation in an unload handler.
+
+        Tests: fast/loader/unload-form-about-blank.html
+               fast/loader/unload-form-post-about-blank.html
+               fast/loader/unload-form-post.html
+               fast/loader/unload-form.html
+               fast/loader/unload-hyperlink.html
+               fast/loader/unload-javascript-url.html
+               fast/loader/unload-reload.html
+               fast/loader/unload-window-location.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+
+2009-09-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Sometimes crashes when a page is destroyed/loads another URL while playing video
+        https://bugs.webkit.org/show_bug.cgi?id=29496
+
+        Protect the video sink object, and destroy it in an idle callback
+        to hopefully avoid a race condition that leads to a crash.
+
+        This is already tested by media/video-seekable.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::idleUnref):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+
+2009-09-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix for GTK+ and a blind one for Qt after r48566.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29519
+        Remove JSNameNodeCollection and just use StaticNodeList
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp: Removed.
+        * bindings/js/JSNamedNodesCollection.h: Removed.
+
+2009-09-19  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29511
+        
+        Fixes an issue where script code that contains non-ASCII characters may bypass the 
+        XSSAuditor.
+        
+        Before performing a comparison between the script source code and input parameters, we
+        remove all non-ASCII characters, including non-printable ASCII characters from the
+        script source code and input parameters.
+
+        Tests: http/tests/security/xssAuditor/img-onerror-non-ASCII-char.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2-default-encoding.html
+               http/tests/security/xssAuditor/img-onerror-non-ASCII-char2.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::isNonCanonicalCharacter): Modified to remove all non-ASCII characters,
+        including non-printable ASCII characters.
+
+2009-09-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Incorrect animation with scale(0) transform (singular matrix)
+        https://bugs.webkit.org/show_bug.cgi?id=29465
+        
+        Make accelerated scale() and translate() animations go through the component animation
+        path (rather than just matrix animation) to avoid problems with singular scale matrices,
+        and be slightly more efficient.
+
+        Test: compositing/transitions/singular-scale-transition.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::getValueFunctionNameForTransformOperation):
+
+2009-09-19  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Adds CSS styling and basic DOM element support for MathML
+
+        * DerivedSources.make:
+          Added user stylesheet and tag factory generation
+
+        * WebCore.xcodeproj/project.pbxproj:
+          Added new DOM element code
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr):
+          Added check for document since stylesheet can be added before there is a document
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+          Added check to add MathML user agent stylesheet
+
+        * css/mathml.css: Added.
+          MathML user agent stylesheet
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+          Added support for creation of MathML DOM objects
+
+        * dom/Node.h:
+        (WebCore::Node::isMathMLElement):
+          Added check method for whether the node is a MathML node
+
+        * mathml: Added.
+        * mathml/MathMLElement.cpp: Added.
+        (WebCore::MathMLElement::MathMLElement):
+        (WebCore::MathMLElement::create):
+        (WebCore::MathMLElement::createRenderer):
+        * mathml/MathMLElement.h: Added.
+        (WebCore::MathMLElement::isMathMLElement):
+          MathML DOM base class
+
+
+        * mathml/MathMLInlineContainerElement.cpp: Added.
+        (WebCore::MathMLInlineContainerElement::MathMLInlineContainerElement):
+        (WebCore::MathMLInlineContainerElement::create):
+        (WebCore::MathMLInlineContainerElement::createRenderer):
+        * mathml/MathMLInlineContainerElement.h: Added.
+          Base class for non-text containers
+
+        * mathml/MathMLMathElement.cpp: Added.
+        (WebCore::MathMLMathElement::MathMLMathElement):
+        (WebCore::MathMLMathElement::create):
+        * mathml/MathMLMathElement.h: Added.
+          Root Math element
+
+        * mathml/mathtags.in: Added.
+          Element list mappings
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+          Added MathML name initialization
+2009-09-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Canvas drawn with data URL image raises SECURITY_ERR when toDataUrl() called.
+        https://bugs.webkit.org/show_bug.cgi?id=29305
+
+        We need to special-case data URLs when tainting a canvas because we
+        treat data URLs has having no security origin, unlike other
+        browsers.  The reason we do this is to help sites avoid XSS via data
+        URLs, but that consideration doesn't apply to canvas taint.
+
+        Also, we were previously incorrectly taking document.domain state
+        into account when tainting canvas.
+
+        Tests: http/tests/security/canvas-remote-read-data-url-image.html
+               http/tests/security/canvas-remote-read-data-url-svg-image.html
+               http/tests/security/canvas-remote-read-remote-image-document-domain.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/SecurityOrigin.h:
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix stylistic issue raised in code review for previous commit.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasNonZeroTransformOrigin):
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Element is misplaced during opacity transition with certain configuration of transform-origin and clipping
+        https://bugs.webkit.org/show_bug.cgi?id=29495
+        
+        If an element has zero size, but has a transform origin with absolute values,
+        then the transform origin would not be applied because it is implemented via
+        anchorPoint, which is expressed as a fraction of the layer size.
+        
+        Work around this by artificially inflating the size of the backing store when we need to.
+
+        Test: compositing/geometry/transfrom-origin-on-zero-size-layer.html
+
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        Init m_artificiallyInflatedBounds to false.
+        
+        (WebCore::hasNonZeroTransformOrigin):
+        Utility function that describes whether the transform-origin contains non-percentage
+        x or y offsets.
+        
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        New wrapper method around setCompositedBounds() that applies the size inflation
+        when necessary, setting the m_artificiallyInflatedBounds as appropriate.
+        
+        (WebCore::RenderLayerBacking::updateAfterLayout): Call updateCompositedBounds().
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry): Ditto
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree): Ditto
+        (WebCore::RenderLayerCompositor::updateCompositingDescendantGeometry): Ditto
+
+2009-09-18  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29512
+        Don't recalculate style when restoring from the page cache
+
+        FrameLoaderClient::forceLayout() also forces style recalc. Instead call FrameView::forceLayout() 
+        directly to update the scrollbars while keeping the existing style.
+        
+        Makes back/forward really fast on complex pages (in cases where page cache works).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2009-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement ES5 Object.defineProperty function
+        https://bugs.webkit.org/show_bug.cgi?id=29503
+
+        Override defineOwnProperty on JSDOMWindowShell to forward appropriately,
+        and then override defineOwnProperty on JSDOMWindow to disallow cross origin
+        defineOwnProperty usage.  We also override defineOwnProperty on QuarantinedObjectWrapper
+        to ensure correct wrapping semantics of quarantined objects.
+
+        One major caveat in this patch is that it currently disallows the use
+        of Object.defineProperty on DOMObjects other than the window due to
+        the significant work involved in correctly propagating attributes and
+        ensuring correct semantics on dom objects.
+
+        Tests: fast/js/Object-defineProperty.html
+               http/tests/security/xss-DENIED-defineProperty.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObject::defineOwnProperty):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        (WebCore::JSDOMWindow::defineSetter):
+        (WebCore::JSDOMWindow::defineOwnProperty):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::defineOwnProperty):
+        (WebCore::JSDOMWindowShell::defineGetter):
+        (WebCore::JSDOMWindowShell::defineSetter):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        (WebCore::JSQuarantinedObjectWrapper::defineOwnProperty):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29510
+        Active DOM objects should be suspended while a modal dialog is displayed
+
+        * manual-tests/js-timers-beneath-modal-dialog.html: Added a test for JS timers.
+
+        * page/PageGroupLoadDeferrer.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        Match other platforms, and make Mac also suspend active DOM objects. Since a page that
+        currently displays a modal dialog cannot go into page cache, there is no danger of suspending
+        an object twice.        
+
+2009-09-18  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Buildfix caused by http://trac.webkit.org/changeset/48513
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+
+        * bridge/qt/qt_instance.h: createRuntimeObject method renamed to newRuntimeObject.
+        * bridge/runtime.h: Visibility of newRuntimeObject method modified to protected.
+
+2009-09-18  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix parameter substitutions in console.log().
+
+        https://bugs.webkit.org/show_bug.cgi?id=29366
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._format):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getPrototypes):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/utilities.js:
+        ():
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Brady Eidson.
+
+        Temporarily remove an assertion that was getting hit when going
+        back to a page in the page cache while a banner in Safari was visible.
+        We should re-enable this once that is fixed. See <rdar://problem/7218118>
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Try fixing the build again.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix windows build.
+        
+        * platform/win/PopupMenuWin.cpp:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin 'BearClaw' Barraclough.
+
+        Convert another callback type object to store the global object
+        instead of the frame.
+
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::JSCustomXPathNSResolver):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+
+2009-09-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29332
+        <rdar://problem/7231652> 
+        REGRESSION (r48446): While a <select> popup menu is open, the
+        rest of the WebView doesn't respond to mouse move events.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::translatePoint):
+        New helper function that translates a point between HWND coordinates.
+        
+        (WebCore::PopupMenu::show):
+        Protect the PopupMenu if someone removes the <select> in response to a mouse
+        event. Handle WM_HOST_WINDOW_MOUSEMOVE events.
+        
+        (WebCore::PopupMenu::wndProc):
+        in the WM_MOUSEMOVE handler, if the mouse is not over the popup, post a 
+        WM_HOST_WINDOW_MOUSEMOVE event so that the host window (the WebView) gets the
+        mouse move event.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Compositing layers are incorrectly positioned after scrolling with position:fixed
+        https://bugs.webkit.org/show_bug.cgi?id=29262
+        
+        When scrolling a page with compositing layers inside a position:fixed element,
+        we need to update the compositing layer positions when the scroll position changes.
+
+        Test: compositing/geometry/fixed-position.html
+
+        * WebCore.base.exp:
+        Export FrameView::scrollPositionChanged()
+        
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollPositionChanged):
+        New method that sends the scroll event, and updates compositing layers positions if necessary.
+
+2009-09-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transformed elements inside position:fixed container are clipped incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=29346
+        
+        Fix clipping and hit testing on transformed elements inside a position:fixed element.
+        Previously, the code used the overflowClipRect of the parent clip rects, but
+        this is not correct for fixed postion elements. Instead, share code that is
+        already present in calculateRects() to get the correct rect.
+
+        Test: fast/overflow/position-fixed-transform-clipping.html
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        Call the new backgroundClipRect() to get the correct clipRect.
+        
+        (WebCore::RenderLayer::backgroundClipRect):
+        New method, factored out of calculateRects(), that computes the clip rect,
+        doing the right thing for fixed position elements.
+        
+        (WebCore::RenderLayer::calculateRects):
+        Call the new backgroundClipRect() method.
+        
+2009-09-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/7050773> REGRESSION (r40098) Crash at
+        WebCore::RenderBlock::layoutBlock()
+        https://bugs.webkit.org/show_bug.cgi?id=29498
+
+        Test: accessibility/nested-layout-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateBackingStore): Changed to
+            call Document::updateLayoutIgnorePendingStylesheets() instead of
+            calling RenderObject::layoutIfNeeded(). The latter requires that
+            there be no pending style recalc, which allows methods that call
+            Document::updateLayout() to be called during layout without risking
+            re-entry into layout.
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]): Null-check
+            m_object after calling updateBackingStore(), since style recalc may
+            destroy the renderer, which destroys the accessibility object and
+            detaches it from the wrapper.
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+             Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformIncrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformDecrementAction]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]): Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+            Ditto.
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+            Ditto.
+
+2009-09-18  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update Qt build system for Web Socket.
+        https://bugs.webkit.org/show_bug.cgi?id=29270
+
+        * WebCore.pro:
+        * platform/network/qt/SocketStreamError.h: Added.
+        * platform/network/qt/SocketStreamHandle.h: Added.
+        * platform/network/qt/SocketStreamHandleSoup.cpp: Added.
+
+2009-09-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        NULL check HTMLMediaElement::m_playedTimeRanges.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29494
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::addPlayedRange): New. Create m_playedTimeRanges if
+        necessary, add range specified.
+        (WebCore::HTMLMediaElement::seek): Use addPlayedRange. 
+        (WebCore::HTMLMediaElement::played): Use addPlayedRange. Change time comparison 
+        to be more readable.
+        (WebCore::HTMLMediaElement::updatePlayState): Ditto.
+        * html/HTMLMediaElement.h:
+
+2009-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Follow up fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Don't use Document.elementFromPoint since it returns null if the point
+        is outside the viewport.  Instead, just hit test ourselves.
+
+        Test: fast/events/drag-file-crash.html
+
+        * page/DragController.cpp:
+        (WebCore::elementUnderMouse):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Each wrapped Objective-C object should use a single RuntimeObjectImp
+        https://bugs.webkit.org/show_bug.cgi?id=29351
+        rdar://problem/7142294
+
+        * WebCore.base.exp: Added a newly-needed exported symbol.
+
+        * bindings/objc/DOMInternal.h: Eliminated unused
+        createWrapperCacheWithIntegerKeys; it has not been needed since the
+        RGBColor wrappers were reworked.
+        * bindings/objc/DOMInternal.mm: Ditto.
+
+        * bridge/objc/objc_instance.h: Made the create function non-inline.
+        * bridge/objc/objc_instance.mm:
+        (createInstanceWrapperCache): Added. Creates an appropriate map table.
+        (ObjcInstance::create): Moved here from header. Uses NSMapGet and
+        NSMapInsert to cache the instance in a map table.
+        (ObjcInstance::~ObjcInstance): Added a call to NSMapRemove to remove
+        the instance from the map table.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::~QtInstance): Remove unneeded code to remove
+        the instance from cachedObjects, which no longer exists.
+        (JSC::Bindings::QtInstance::newRuntimeObject): Renamed to overload new
+        bottleneck. Caching is now handled by the base class.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::Instance): Initialize m_runtimeObject to 0.
+        (JSC::Bindings::Instance::~Instance): Assert m_runtimeObject is 0.
+        (JSC::Bindings::Instance::createRuntimeObject): Use m_runtimeObject
+        if it's already set. Set m_runtimeObject and call addRuntimeObject
+        if it's not.
+        (JSC::Bindings::Instance::newRuntimeObject): Added. Virtual function,
+        used only by createRuntimeObject.
+        (JSC::Bindings::Instance::willDestroyRuntimeObject): Added.
+        Calls removeRuntimeObject and then clears m_runtimeObject.
+        (JSC::Bindings::Instance::willInvalidateRuntimeObject): Added.
+        Clears m_runtimeObject.
+
+        * bridge/runtime.h: Made createRuntimeObject non-virtual. Added
+        willDestroyRuntimeObject, willInvalidateRuntimeObject,
+        newRuntimeObject, and m_runtimeObject.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Removed addRuntimeObject
+        call, now handled by caller.
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp): Replaced removeRuntimeObject
+        call with willDestroyRuntimeObject call; the latter nows calls
+        removeRuntimeObject.
+        (JSC::RuntimeObjectImp::invalidate): Added willInvalidateRuntimeObject
+        call.
+
+        * bridge/runtime_object.h: Made invalidate non-virtual.
+
+2009-09-18  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make PlatformWindow return something else than PlatformWidget
+        https://bugs.webkit.org/show_bug.cgi?id=29085
+
+        Make platformWindow return a PlatformPageClient
+        (for now typedef'ed to PlatformWidget)
+
+        Also, change the name of platformWindow to platformPageClient()
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getPangoLayoutForAtk):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformPageClient):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformPageClient):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::wheelEvent):
+        (WebCore::EventHandler::currentPlatformMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::eventMayStartDrag):
+        * platform/HostWindow.h:
+        * platform/Widget.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::wndProc):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::paint):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::platformStart):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::platformStart):
+
+2009-09-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Web inspector UI adjustments specific to the Qt platform:
+        - Hide the close button
+        - Hide the dock button
+        - Disable the draggable toolbar
+
+        https://bugs.webkit.org/show_bug.cgi?id=29384
+
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.toolbarDragStart):
+
+2009-09-18  Joerg Bornemann  <joerg.bornemann@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        QtWebKit Windows CE compile fixes
+
+        Exclude certain pure-WINCE specific code paths from the Qt build.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/FontCache.h:
+        * platform/graphics/MediaPlayer.cpp:
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop): Guard this code block with NETSCAPE_PLUGIN_API as
+        the corresponding PluginViewWndProc has the same guard in the header file.
+
+2009-09-18  Steve Block  <steveblock@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Geolocation does not correctly handle Infinity for PositionOptions properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29099
+
+        * bindings/js/JSGeolocationCustom.cpp: Modified.
+        (WebCore::createPositionOptions): Modified. If timeout or maximumAge is positive infinity, applies these values as a special case.
+        * page/PositionOptions.h: Modified.
+        (WebCore::PositionOptions::hasMaximumAge): Added. Determines whether the object has a maximum age.
+        (WebCore::PositionOptions::maximumAge): Modified. Asserts that the object has a maximum age.
+        (WebCore::PositionOptions::clearMaximumAge): Added. Clears the maximum age.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Registers that the maximum age has been set.
+        (WebCore::PositionOptions::PositionOptions): Modified. Registers that the maximum age has been set.
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29276
+        REGRESSION(r48334): WebKit crashes on file select by drag
+
+        Document.elementFromPoint now takes point in client space, not page space.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::concludeEditDrag):
+
+2009-09-17  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        Reimplement default media UI for Mac Chromium to match the style
+        of the Windows and Linux versions.  Also breaks the dependency
+        on the internal wk* functions that were previously used to
+        render the media controller widgets.
+        https://bugs.webkit.org/show_bug.cgi?id=29161
+
+        No media layout tests are currently enabled in Mac Chromium, so
+        nothing needs rebaselineing, etc.
+
+        This is a recommit of r48438 with a compile fix and merges of
+        recent changes to the file.
+
+        * css/mediaControlsChromium.css:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+        (WebCore::mediaSliderThumbImage):
+        (WebCore::mediaVolumeSliderThumbImage):
+        (WebCore::RenderThemeChromiumMac::paintSliderTrack):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumMac::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize):
+
+2009-09-17  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The Console scope bar should have a divider between All and the other possible
+        values (Errors, Warnings, Logs). It will look something like:
+        
+        All | Errors Warnings Logs.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        (WebInspector.ConsoleView):
+        * inspector/front-end/inspector.css:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove additional references to JSVoidCallback which no longer exists.
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Remove commented out onhashchange attribute now that it is implemented.
+
+        * page/DOMWindow.idl:
+
+2009-09-17  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/7007541> 
+        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
+        
+        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
+        crashes while we're calling into it).
+        
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
+        (JSC::RuntimeObjectImp::invalidate):
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::RuntimeObjectImp::getCallData):
+        (JSC::RuntimeObjectImp::getConstructData):
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::getInternalInstance):
+
+2009-09-17  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Wrap primitive values (as objects) in InspectorController::wrap.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28983
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::wrapObject): objects of any type will be wrapped into proxies,
+         only object proxies will have objectId.
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions): there is InjectedScript.getCompletionsi
+         that accepts an expression and returns possible completions. This way we don't need to wrap
+         and unwrap the completions result into a proxy object.
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getCompletions):
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.createProxyObject):
+        * inspector/front-end/InjectedScriptAccess.js:
+
+2009-09-17  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Wrap PageTransitionEvents properly for V8's use.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29340
+
+        Fixes Chromium's failures for LayoutTests/fast/events/pageshow-pagehide.html.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object): Wrap PageTransitionEvents properly.
+
+2009-09-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Hardware-accelerated opacity transition on inline asserts
+        https://bugs.webkit.org/show_bug.cgi?id=29342
+        
+        Remove an erroneous toRenderBox() that could be called on a RenderInline; we can just
+        pass an empty size, because the box size is only required for transform animations.
+
+        Test: compositing/transitions/opacity-on-inline.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::startTransition):
+
+2009-09-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] OwnHandle might get a weak callback after destruction
+        https://bugs.webkit.org/show_bug.cgi?id=29172
+
+        Be sure to clear out weak reference so we don't get a weak callback
+        after we've destructed ourselves.  Also, removed some tricky methods
+        that had no clients.
+
+        * bindings/v8/OwnHandle.h:
+        (WebCore::OwnHandle::clear):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Partial roll out of http://trac.webkit.org/changeset/48455 to
+        fix crashes that started happening in V8Proxy::getEnteredContext().
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-09-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: labels of checkboxes should, when hit-tested, return the checkbox
+        https://bugs.webkit.org/show_bug.cgi?id=29335
+
+        When an accessibility hit test is done and it hits the label of a control element,
+        the control element should be returned instead of nothing, since the label
+        itself is usually ignored.
+
+        Test: accessibility/label-for-control-hittest.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::correspondingControlForLabelElement):
+        * accessibility/AccessibilityRenderObject.h:
+
+2009-09-17  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Dimitri Glazkov, build fix.
+
+        Change to make RenderThemeChromiumMac compile inside of non PLATFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+
+        Covered by existing tests.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+
+2009-09-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Accessing properties/methods of an object, created with document.implementation.createDocumentType
+        creates nodes that have no document (ScriptExecutionContext), which in turn produces NULL-ref crashes.
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+              fast/dom/doctype-event-listener-crash.html
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Added an extra NULL-check.
+
+2009-09-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        FontDescription.h includes RenderStyleConstants.h, which violates layering
+        https://bugs.webkit.org/show_bug.cgi?id=29327
+
+        * GNUmakefile.am: Added FontSmoothingMode.h.
+        * WebCore.gypi: Added FontSmoothingMode.h.
+        * WebCore.vcproj/WebCore.vcproj: Added FontSmoothingMode.h.
+        * WebCore.xcodeproj/project.pbxproj: Added FontSmoothingMode.h and made
+            it a private header.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Get the
+            font smoothing mode via the font description.
+        * css/CSSPrimitiveValueMappings.h: Include FontSmoothingMode.h
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Updated for the rename
+            of FontSmoothing to FontSmoothingMode.
+        (WebCore::CSSPrimitiveValue::operator FontSmoothingMode): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Get the font smoothing mode
+            via the font description.
+        * platform/graphics/FontDescription.h: Do not include
+            RenderStyleConstants.h.
+        (WebCore::FontDescription::fontSmoothing): Updated for the rename of
+            FontSmoothing to FontSmoothingMode.
+        (WebCore::FontDescription::setFontSmoothing): Ditto.
+        * platform/graphics/FontSmoothingMode.h: Added.
+        (WebCore::FontSmoothingMode): Moved the FontSmoothing enum from
+            RenderStyleConstants here and renamed it to this.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing): Removed this getter, since
+            this can be accessed via the font description.
+        * rendering/style/RenderStyleConstants.h: Moved the FontSmoothing enum
+            from here to FontSmoothingMode.h.
+
+2009-09-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx 2.9 build fix.
+
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Elements appear behind <video> when they should be in front sometimes
+        https://bugs.webkit.org/show_bug.cgi?id=29314
+        
+        r45598 added logic that tests for overlap with <video> to determine when to throw
+        a layer into compositing mode. That logic was incorrect in some cases, and this patch
+        fixes it. When testing overlap, the layer needs to be composited iff some previous layer
+        is composited (which adds a rect to the overlay map), and there is overlap.
+
+        Test: compositing/geometry/video-opacity-overlay.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2009-09-17  Avi Drissman  <avi@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Update the Chromium Mac theming files (RenderTheme and Theme) to be
+        up-to-date.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29243
+        http://crbug.com/19604
+
+        Covered by existing tests.
+
+        * WebCore.gypi:
+        * platform/chromium/ThemeChromiumMac.h: Added.
+        (WebCore::ThemeChromiumMac::ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::~ThemeChromiumMac):
+        (WebCore::ThemeChromiumMac::controlRequiresPreWhiteSpace):
+        * platform/chromium/ThemeChromiumMac.mm: Added.
+        (WebCore::):
+        (WebCore::platformTheme):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeChromiumMac::baselinePositionAdjustment):
+        (WebCore::ThemeChromiumMac::controlFont):
+        (WebCore::ThemeChromiumMac::controlSize):
+        (WebCore::ThemeChromiumMac::minimumControlSize):
+        (WebCore::ThemeChromiumMac::controlBorder):
+        (WebCore::ThemeChromiumMac::controlPadding):
+        (WebCore::ThemeChromiumMac::inflateControlPaintRect):
+        (WebCore::ThemeChromiumMac::paint):
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/FloatSize.h:
+        * platform/graphics/IntRect.h:
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsControlTints):
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        * rendering/RenderThemeChromiumMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]):
+        (-[RTCMFlippedView isFlipped]):
+        (-[RTCMFlippedView currentEditor]):
+        (WebCore::):
+        (WebCore::FlippedView):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemFont):
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        (WebCore::RenderThemeChromiumMac::isControlStyled):
+        (WebCore::RenderThemeChromiumMac::adjustRepaintRect):
+        (WebCore::RenderThemeChromiumMac::inflateRect):
+        (WebCore::RenderThemeChromiumMac::convertToPaintingRect):
+        (WebCore::RenderThemeChromiumMac::setFontFromControlSize):
+        (WebCore::RenderThemeChromiumMac::paintTextField):
+        (WebCore::RenderThemeChromiumMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeChromiumMac::paintTextArea):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::TopGradientInterpolate):
+        (WebCore::BottomGradientInterpolate):
+        (WebCore::MainGradientInterpolate):
+        (WebCore::TrackGradientInterpolate):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeChromiumMac::paintMenuListButton):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumMac::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderTrackStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbStyle):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::setSearchCellState):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeChromiumMac::adjustSliderThumbSize):
+        (WebCore::getMediaUIPartStateFlags):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintMediaRewindButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeChromiumMac::paintMediaTimeRemaining):
+        (WebCore::RenderThemeChromiumMac::extraMediaControlsStyleSheet):
+
+2009-09-16  Daniel Bates  <dbates@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29306
+        
+        Fixes an issue where an attack that contains accented characters can
+        bypass the XSSAuditor.
+        
+        XSSAuditor::decodeURL used the wrong length for the input string. 
+        When the input string was decoded, the decoded result was truncated.
+        Hence, XSSAuditor was comparing the source code of the script to the 
+        truncated input parameters.
+
+        Test: http/tests/security/xssAuditor/img-onerror-accented-char.html
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::decodeURL):
+
+2009-09-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Explore allowing pages with unload handlers into the Page Cache
+        https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        No new tests. (All previous tests continue to pass)
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): If the document is in the page cache, don't fire the unload event.
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Teach ScheduledAction::execute about isolated worlds
+        https://bugs.webkit.org/show_bug.cgi?id=27703
+
+        We now save a handle to the original context.  We use that handle to
+        call the timeout in the right context / world.
+
+        Tests: http/tests/security/isolatedWorld/window-setTimeout-function.html
+               http/tests/security/isolatedWorld/window-setTimeout-string.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval):
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add some groups to the xcode project to make the bindings/js/ group
+        a little nicer.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29320
+        JS callback objects should store the global object
+
+        This just changes the callback objects to store the global object instead
+        of the frame. A follow up patch will change them to store the 'current' 
+        global object instead of the lexical or dynamic.
+
+        * DerivedSources.make: Remove unused VoidCallback.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h:
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::JSCustomSQLStatementCallback):
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback):
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::Data::Data):
+        (WebCore::JSCustomSQLTransactionCallback::Data::globalObject):
+        (WebCore::JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback):
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback):
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::JSCustomVoidCallback):
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::createTransaction):
+        (WebCore::JSDatabase::transaction):
+        (WebCore::JSDatabase::readTransaction):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+
+2009-09-15  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <input maxlength=> should restrict only values specified by users.
+        https://bugs.webkit.org/show_bug.cgi?id=21271
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::sanitizeValue):
+        (WebCore::InputElement::sanitizeUserInputValue): Rename from constrainValue().
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::updateValueIfNeeded):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::value):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::sanitizeValue):
+        * html/HTMLInputElement.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::constrainValue):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::sanitizeValue):
+
+2009-09-16  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Reorganizing helper functions in htmlediting.h to group them by type of object they return/operate upon.
+        https://bugs.webkit.org/show_bug.cgi?id=29319
+
+        * editing/IndentOutdentCommand.cpp:
+        Removed implementation of isAtUnsplittableElement.
+
+        * editing/IndentOutdentCommand.h:
+        Removed member function isAtUnsplittableElement, because it was not class specific and belonged logically among the helper functions.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isAtUnsplittableElement): added. The code was taken from IndentOutdentCommand.
+
+        * editing/htmlediting.h:
+        Reordered functions to group them by type of object returned or operate upon.
+        Added comments.
+        Added isAtUnsplittableElement declaration.
+
+2009-09-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig and Anders Carlsson.
+
+        Removed some vestigial and potentially crashy code that makes consolidating
+        event listeners hard.
+
+        * dom/Node.cpp:
+        (WebCore::Node::addEventListener): No need to limit when event listeners
+        can be added. Other EventTargets don't do this.
+        
+        Also, check for null when accessing document(). Technically, the JS bindings
+        do this check for us, but let's not rely on that.
+
+2009-09-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened
+        
+        Redo the way we handle events when a popup menu is shown, based on
+        http://blogs.msdn.com/oldnewthing/archive/2004/08/20/217684.aspx
+        
+        Since a non-active window can't capture the mouse, we use the owning window 
+        (the WebView) as the capture window. We then run a recursive message pump that 
+        forwards all mouse and keyboard events to the popup menu.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::wndProc):
+
+2009-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Ada Chan.
+
+        Speculative fix for
+        <rdar://problem/6937089> Crashes at RenderWidget::destroy()
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Avoid calling renderArena() if node()
+        is null. Add two assertions that can help determine how this crash
+        happens (in particular, whether node() becomes null during destroy() or
+        it is null before destroy() is called).
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build fix.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-09-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/7083741> Implement a CSS extension to 
+        adjust sub-pixel anti-aliasing for text
+        -and corresponding-
+        https://bugs.webkit.org/show_bug.cgi?id=29291
+
+        Added tests:
+        * fast/css/font-smoothing.html: Added.
+        * fast/css/parsing-webkit-font-smoothing.html: Added.
+
+        This patch adds a new CSS property called -webkit-font-smoothing 
+        that accepts the following as valid input: auto | none | 
+        antialiased | subpixel-antialiased
+
+        Return appropriate computed style for -webkit-font-smoothing
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Add a case for CSSPropertyWebkitFontSmoothing, and accept valid 
+        input.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+        Add mappings for FontSmoothing to the right CSS values.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator FontSmoothing):
+
+        Add -webkit-font-smoothing
+        * css/CSSPropertyNames.in:
+
+        Set fontSmoothing on the FontDescription.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+        Add antialiased and subpixel-antialiased as possible new CSS 
+        values.
+        * css/CSSValueKeywords.in:
+        Store the font smoothing CSS value in the FontDescription.
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::FontDescription):
+        (WebCore::FontDescription::fontSmoothing):
+        (WebCore::FontDescription::setFontSmoothing):
+        (WebCore::FontDescription::operator==):
+
+        Call setShouldAntialias() and setShouldUseSmoothing() appropriately 
+        based on the CSS fontSmoothing() value.
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+        New function fontSmoothing()
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::fontSmoothing):
+
+        New enum FontSmoothing.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove style property if empty string is entered.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29163
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): fixed null pointer exception
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleText): if styletext to apply is empty it will return an array to confirm the property removal
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2009-09-16  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Always reset m_implicitShorthand to false after parsing
+        background-repeat style property otherwise properties
+        following after it may be erroneously marked as implicit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28972
+        https://bugs.webkit.org/show_bug.cgi?id=28973
+
+        Test: fast/backgrounds/repeat/margin-shorthand.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2009-09-16  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Incorrect behavior of XMLHttpRequest::getAllResponseHeaders and
+        XMLHttpRequest::getResponseHeader in the
+        HEADERS_RECEIVED readyState.
+        https://bugs.webkit.org/show_bug.cgi?id=29121
+
+        Tests: http/tests/xmlhttprequest/getAllResponseHeaders.html
+               http/tests/xmlhttprequest/getResponseHeader.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        Changed the minimum valid state from LOADING to HEADERS_RECEIVED.
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix style violation in V8AbstractEventListener.
+        https://bugs.webkit.org/show_bug.cgi?id=29303
+
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==):
+
+2009-09-16  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add Watch Expression support to inspector
+        https://bugs.webkit.org/show_bug.cgi?id=27514
+
+        Manual test added.
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype.evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype._enterKeyPressed):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertiesSection.CompareProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/WatchExpressionsSidebarPane.js: Added.
+        (WebInspector.WatchExpressionsSidebarPane):
+        (WebInspector.WatchExpressionsSidebarPane.prototype.refreshExpressions):
+        (WebInspector.WatchExpressionsSection):
+        (WebInspector.WatchExpressionsSection.prototype.update):
+        (WebInspector.WatchExpressionsSection.prototype.addExpression):
+        (WebInspector.WatchExpressionsSection.prototype.updateExpression):
+        (WebInspector.WatchExpressionsSection.prototype.findAddedTreeElement):
+        (WebInspector.WatchExpressionsSection.prototype.loadSavedExpressions):
+        (WebInspector.WatchExpressionsSection.prototype.saveExpressions):
+        (WebInspector.WatchExpressionsSection.CompareProperties):
+        (WebInspector.WatchExpressionTreeElement):
+        (WebInspector.WatchExpressionTreeElement.prototype.update):
+        (WebInspector.WatchExpressionTreeElement.prototype._deleteButtonClicked):
+        (WebInspector.WatchExpressionTreeElement.prototype.startEditing):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        (WebInspector.WatchExpressionTreeElement.prototype.applyExpression):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * manual-tests/inspector/debugger-watch-expressions.html: Added.
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(INSPECTOR)
+        https://bugs.webkit.org/show_bug.cgi?id=29260
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.Inspector.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Inspector only exports to WebCore.Inspector.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.Inspector.exp.
+        * bindings/js/JSDOMWindowBase.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSInspectedObjectWrapper.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * bindings/js/JSInspectorBackendCustom.cpp: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp: Ditto.
+        * bindings/js/ScriptObject.cpp: Use ENABLE(INSPECTOR) where applicable.
+        * bindings/js/ScriptObject.h: Ditto.
+        * bindings/js/ScriptObjectQuarantine.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * dom/Document.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        (WebCore::Document::scriptImported):
+        * dom/Document.h: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/ScriptExecutionContext.h: Ditto.
+        (WebCore::):
+        * html/HTMLDocument.cpp: Ditto.
+        (WebCore::HTMLDocument::createTokenizer):
+        * html/HTMLTokenizer.cpp: Ditto.
+        (WebCore::HTMLTokenizer::write):
+        * inspector/ConsoleMessage.cpp: Ditto.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/DOMDispatchTimelineItem.cpp: Wrap entire file in ENABLE(INSPECTOR).
+        * inspector/InspectorBackend.cpp: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/InspectorDOMAgent.cpp: Ditto.
+        * inspector/InspectorDOMStorageResource.cpp: Ditto.
+        * inspector/InspectorDatabaseResource.cpp: Ditto.
+        * inspector/InspectorFrontend.cpp: Ditto.
+        * inspector/InspectorResource.cpp: Ditto.
+        * inspector/InspectorTimelineAgent.cpp: Ditto.
+        * inspector/TimelineItem.cpp: Ditto.
+        * loader/FrameLoader.cpp: Use ENABLE(INSPECTOR) where applicable.
+        (WebCore::FrameLoader::detachFromParent):
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache):
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        (WebCore::FrameLoader::dispatchDidCommitLoad):
+        (WebCore::FrameLoader::dispatchAssignIdentifierToInitialRequest):
+        (WebCore::FrameLoader::dispatchWillSendRequest):
+        (WebCore::FrameLoader::dispatchDidReceiveResponse):
+        (WebCore::FrameLoader::dispatchDidReceiveContentLength):
+        (WebCore::FrameLoader::dispatchDidFinishLoading):
+        * page/Chrome.cpp: Ditto.
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/Console.cpp: Ditto.
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/ContextMenuController.cpp: Ditto.
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMWindow.cpp: Ditto.
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+        * page/EventHandler.cpp: Ditto.
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/FrameView.cpp: Ditto.
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        (WebCore::Page::~Page):
+        * page/Page.h: Ditto.
+        * platform/ContextMenu.cpp: Ditto.
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h: Ditto.
+        (WebCore::):
+        * storage/Database.cpp: Ditto.
+        (WebCore::Database::openDatabase):
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp: Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(CONTEXT_MENUS)
+        https://bugs.webkit.org/show_bug.cgi?id=29225
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.ContextMenus.exp file if ENABLE_CONTEXT_MENUS.
+        * WebCore.base.exp: Move ContextMenu only exports to WebCore.ContextMenus.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.ContextMenus.exp.
+        * dom/Node.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        (WebCore::Node::defaultEventHandler):
+        * loader/EmptyClients.h: Ditto.
+        * page/ContextMenuController.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * page/EventHandler.cpp: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/EventHandlerMac.mm: Ditto.
+        * page/mac/WebCoreViewFactory.h: Ditto.
+        * platform/ContextMenu.cpp: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/LocalizedStrings.h: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * platform/mac/ContextMenuItemMac.mm: Wrap entire file in ENABLE(CONTEXT_MENUS).
+        * platform/mac/ContextMenuMac.mm: Ditto.
+        * platform/mac/LocalizedStringsMac.mm: Use ENABLE(CONTEXT_MENUS) where applicable.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Clean up invalidation for repainting.  Hoist the dirty rect intersection test in ScrollViewMac up
+        into ScrollView so that all platforms do it.
+        
+        Patch deferred repaints in FrameView::repaintContentRectangle to only add the visible portion of
+        the rectangle for repainting.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2009-09-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Add ENABLE(DRAG_SUPPORT)
+        https://bugs.webkit.org/show_bug.cgi?id=29233
+
+        Reviewed by David Kilzer.
+
+        No new tests. (No change in default behavior.)
+
+        * DerivedSources.make: Use new WebCore.DragSupport.exp file if ENABLE_DRAG_SUPPORT.
+        * WebCore.base.exp: Move Drag Support only exports to WebCore.DragSupport.exp.
+        * WebCore.xcodeproj/project.pbxproj: Add WebCore.DragSupport.exp.
+        * dom/Clipboard.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * loader/EmptyClients.h: Ditto.
+        * page/DragController.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/EventHandler.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp: Ditto.
+        (WebCore::Page::Page):
+        * page/Page.h: Ditto.
+        * page/mac/DragControllerMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * page/mac/EventHandlerMac.mm: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        * platform/DragData.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/DragImage.cpp: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/ClipboardMac.h: Use ENABLE(DRAG_SUPPORT) where applicable.
+        * platform/mac/ClipboardMac.mm: Ditto.
+        * platform/mac/DragDataMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * platform/mac/DragImageMac.mm: Wrap entire file in ENABLE(DRAG_SUPPORT).
+        * rendering/RenderLayer.cpp: Use ENABLE(DRAG_SUPPORT) where applicable.
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderObject.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * svg/graphics/SVGImage.cpp: Ditto.
+        (WebCore::SVGImage::dataChanged):
+
+2009-09-16  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix after adding support for high resolution times in Win.
+
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2009-09-16  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Added operator==() to event listeners. This fixes V8 bindings
+        build broken in http://trac.webkit.org/changeset/48402.
+        https://bugs.webkit.org/show_bug.cgi?id=29298
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener): Now
+        uses JSEventListenerType.
+        * bindings/v8/V8AbstractEventListener.h:
+        (WebCore::V8AbstractEventListener::operator==): Only compares
+        pointers since we create at most one wrapper for a JS object.
+
+2009-09-16  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Crash when visiting http://flipper.googlelabs.com/
+        https://bugs.webkit.org/show_bug.cgi?id=29293
+
+        Check type for being null or empty before looking it up in the
+        hash of supported types.
+
+        Tested by http/tests/loading/redirect-with-no-location-crash.html
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::supportsType):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the notion of "disconnected nodes with event listeners" because
+        it was vestigial. The reference cycle it tried to solve was solved another
+        way in https://bugs.webkit.org/show_bug.cgi?id=21260.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::clearAttributeEventListener):
+
+2009-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        WAI-ARIA: add support for ranges, including the progressbar, slider, and spinbutton roles
+        https://bugs.webkit.org/show_bug.cgi?id=28841
+
+        Allow certain ARIA roles to change value with AXIncrement and AXDecrement. 
+        Consolidate increment/decrement/changeValue methods. 
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::increment):
+        (WebCore::AccessibilityRenderObject::decrement):
+        (WebCore::AccessibilityRenderObject::changeValueByPercent):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/AccessibilitySlider.cpp:
+        * accessibility/AccessibilitySlider.h:
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+
+2009-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed the jsEventListeners set from JSDOMGlobalObject, to simplify
+        creation and destruction of JSDOMGlobalObject and event listeners.
+        
+        Added an abstract operator==() to EventListener, to replace the
+        jsEventListeners set's role in determining if two event listeners are
+        equal from the DOM's perspective.
+        
+        Added a type field to EventListener, and casting operations, to support
+        operator==() and other abstract operations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAbstractWorkerCustom.cpp:
+        (WebCore::JSAbstractWorker::addEventListener):
+        (WebCore::JSAbstractWorker::removeEventListener):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDesktopNotificationsCustom.cpp:
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::reportError):
+        (WebCore::JSEventListener::operator==):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::cast):
+        * bindings/js/JSEventSourceCustom.cpp:
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/objc/ObjCEventListener.h:
+        (WebCore::ObjCEventListener::cast):
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::ObjCEventListener):
+        (WebCore::ObjCEventListener::operator==):
+        * dom/EventListener.h:
+        (WebCore::EventListener::):
+        (WebCore::EventListener::type):
+        (WebCore::EventListener::EventListener):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        * dom/Node.cpp:
+        (WebCore::Node::removeEventListener):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::mainFrameDocument):
+        (WebCore::InspectorDOMAgent::operator==):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::cast):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::cast):
+        (WebCore::ImageEventListener::ImageEventListener):
+        (WebCore::ImageEventListener::operator==):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        * notifications/Notification.cpp:
+        (WebCore::Notification::removeEventListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::removeEventListener):
+        * page/EventSource.cpp:
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::ConditionEventListener::cast):
+        (WebCore::ConditionEventListener::ConditionEventListener):
+        (WebCore::ConditionEventListener::operator==):
+        (WebCore::ConditionEventListener::handleEvent):
+        * workers/AbstractWorker.cpp:
+        (WebCore::AbstractWorker::addEventListener):
+        (WebCore::AbstractWorker::removeEventListener):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::addEventListener):
+        (WebCore::WorkerContext::removeEventListener):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+
+2009-09-15  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added ENABLE_MATHML to feature defines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-09-14  Andrew Richards  <randrew@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        Document.elementFromPoint() and Document.caretRangeFromPoint() erroneously returning null at points visible only after scrolling.
+        https://bugs.webkit.org/show_bug.cgi?id=29245
+
+        Use visibleContentRect() instead of boundsRect() when checking hit point bounds on viewport.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        http://bugs.webkit.org/show_bug.cgi?id=26660
+
+        Chromium Windows: When rotated, the baseline for a span of complex
+        script is completely misaligned with that of the adjacent 
+        simple script text. It's fixed by not applying the baseline offset for
+        the Skia code path.
+
+        Test: transforms/2d/hindi-rotated.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Pass the PopupMenu pointer to CreateWindowEx and then get it from the LPCREATESTRUCT in
+        the WM_CREATE handler. This way we don't have to first create an zero size window and then size it.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::PopupMenuWndProc):
+
+2009-09-15  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        MessageEvent should not be cancelable by default
+        https://bugs.webkit.org/show_bug.cgi?id=27846
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        Changed constructor to set cancelable=false by default, per the HTML5 spec.
+
+2009-09-15  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Fix SVG path parsing error if a command starts with dot '.'
+        https://bugs.webkit.org/show_bug.cgi?id=29123
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG):
+
+2009-09-15  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=28908
+
+        * English.lproj/localizedStrings.js:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Popup.js: Added.
+        (WebInspector.Popup):
+        (WebInspector.Popup.prototype.show):
+        (WebInspector.Popup.prototype.hide):
+        (WebInspector.Popup.prototype.get visible):
+        (WebInspector.Popup.prototype.set element):
+        (WebInspector.Popup.prototype.get element):
+        (WebInspector.Popup.prototype.positionElement):
+        (WebInspector.Popup.prototype.set anchor):
+        (WebInspector.Popup.prototype.get anchor):
+        (WebInspector.Popup.prototype.set autoHide):
+        (WebInspector.Popup.prototype._checkNotVisible):
+        (WebInspector.Popup.prototype._keyEventHandler):
+        (WebInspector.Popup.prototype._mouseDownEventHandler):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._documentContextMenu):
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.committed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition.dismissed):
+        (WebInspector.SourceFrame.prototype._editBreakpointCondition):
+        (WebInspector.SourceFrame.prototype._showBreakpointConditionPopup):
+        (WebInspector.SourceFrame.prototype._createPopupElement):
+        (WebInspector.SourceFrame.prototype._addBreakpointToSource):
+        (WebInspector.SourceFrame.prototype._removeBreakpointFromSource):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded.drawBreakpoint):
+        (WebInspector.SourceFrame.prototype._drawBreakpointImagesIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.set currentFocusElement):
+        (WebInspector.set currentPanel):
+        (WebInspector.loaded):
+        (WebInspector.contextMenu):
+        (WebInspector.elementDragStart):
+        (WebInspector.updateResource):
+        (WebInspector.drawLoadingPieChart):
+        (WebInspector.linkifyURLAsNode):
+        (WebInspector.startEditing.getContent):
+        (WebInspector.startEditing.editingCancelled):
+        (WebInspector.startEditing.editingCommitted):
+        * inspector/front-end/utilities.js:
+        (Element.prototype.positionAt):
+        (Element.prototype.offsetRelativeToWindow):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Page cache should support pages with unload handlers as an experiment.
+        <rdar://problem/7196485> and https://bugs.webkit.org/show_bug.cgi?id=29021
+
+        For the experiment, only allow pages with unload handlers into the Page Cache on
+        Mac and Windows.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the change in r48376 to do a null-check to fix a crashing test.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7047282> Safari crashes at WebCore::RenderMenuList::adjustInnerStyle() + 436
+        
+        Avoid a crash when a mouse event handler on a <select> changes the select from a popup
+        to a list (by setting the 'size' property) inside the event handler.
+
+        Test: fast/forms/select-change-popup-to-listbox-in-event-handler.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        More PopupMenu cleanup.
+        
+        * platform/PopupMenu.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Call registerClass.
+        
+        (WebCore::PopupMenu::registerClass):
+        Make this a private static member function so it can refer to PopupMenuWndProc.
+        
+        (WebCore::PopupMenu::PopupMenuWndProc):
+        Try to get the PopupMenu and call its wndProc member function.
+        
+        (WebCore::PopupMenu::wndProc):
+        Make this a member function.
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Not reviewed, maybe should've been:
+
+        Cleaning up more Windows-specific fallout from the fix for:
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load): Don't allow empty CFStrings as the stored credentials,
+          as related checks all look at nullity when they really mean to be looking for emptiness. 
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Speculative Qt build fix.
+        
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-09-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix RenderThemeChromiumWin::determineClassicState so that classic_state
+        matches the state values (and you get a single classic_state value
+        for a given {part,state} value. This change will be tested by a 
+        chromium patch that will land after this.
+
+        This will be tested by code landing downstream on Chromium.org; the
+        code does not execute on webkit.org.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29138
+        Simplify popup menu handling.
+
+        * platform/PopupMenuClient.h:
+        Rename hidePopup to popupDidHide.
+        
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleKeyEvent):        
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        Call popupDidHide instead of hidePopup.
+        
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::menuUnmapped):
+        Ditto.
+        
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::show):
+        Ditto.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::hide):
+        Call popupDidHide.
+        
+        (WebCore::PopupWndProc):
+        Call PopupMenu::hide.
+        
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::OnMenuItemSelected):
+        Call popupDidHide.
+        
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::hidePopup):
+        (WebCore::RenderMenuList::popupDidHide):
+        * rendering/RenderMenuList.h:
+        Set the "popup is visible" flag in popupDidHide.
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::popupDidHide):
+        * rendering/RenderTextControlSingleLine.h:
+        Ditto.
+
+2009-09-14  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        - Fix <rdar://problem/7182275>.
+
+        Make sure that the newly created scrollbar's style is up to date.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        Call setParent so that the scrollbar's parts are torn down correctly.
+        
+        (WebCore::PopupMenu::show):
+        Call styleChanged.
+
+2009-09-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/7197644> WebKit should broadcast an MSAA event when
+        jumping to a named anchor
+
+        https://bugs.webkit.org/show_bug.cgi?id=28899
+
+        Reviewed by Adam Roben.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        Added declaration for handleScrolledToAnchor(). Added a new entry to
+        the enum of accessibility notifications.
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::firstAccessibleObjectFromNode):
+        Code moved from AccessibilityRenderObject::internalLinkElement() and
+        refactored slightly; walks the tree until it finds a Node (with a
+        renderer) whose accessibility is not ignored.
+
+        * accessibility/AccessibilityObject.h:
+        Added a declaration for firstAccessibleObjectFromNode().
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        Code moved to AccessibilityObject::firstAccessibleObjectFromNode().
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        Add a default case that returns early for notifications that Mac
+        doesn't handle.
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Stubbed.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleScrolledToAnchor):
+        Post an AXScrolledToAnchor notification for the first accessible from
+        the anchor Node.
+        (WebCore::AXObjectCache::postPlatformNotification):
+        If the notification is AXFocusedUIElementChanged, fire an
+        EVENT_OBJECT_FOCUS. If the notification is AXScrolledToAnchor, fire
+        EVENT_SYSTEM_SCROLLINGSTART, matching Firefox.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Code moved to postPlatformNotification().
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollToAnchor):
+        Call AXObjectCache::handleScrolledToAnchor().
+
+2009-09-14  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Cookies are not inspectable after reloading a page
+        https://bugs.webkit.org/show_bug.cgi?id=29222
+
+        Create the cookieTreeElement on initialization instead of when the view is shown.
+        Reset the selected element of the sidebar on reset.
+
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        (WebInspector.StoragePanel.prototype.show):
+        (WebInspector.StoragePanel.prototype.reset):
+
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-09-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Safari 4 cannot be used to update firmware on Linksys routers.
+        <rdar://problem/7174050> and https://bugs.webkit.org/show_bug.cgi?id=29160
+
+        In http://trac.webkit.org/changeset/42483, we disabled CFNetwork's session credential storage and 
+        implemented our own in WebCore.
+
+        One feature we lost is that CFNetwork would automatically send previously authenticated credentials
+        with new connections when the paths match, as allowed by RFC 2617 for HTTP Basic and Digest Authentication.  
+
+        Even though it's optional for User Agents to do this, (some?) Linksys routers rely on this behavior for
+        HTTP Basic Authentication.  So now WebCore's CredentialStorage will track URL paths for Basic credentials.
+
+        We're not making this enhancement for Digest at this time, since we don't know of anything that broke
+        due to the change in Digest behavior.
+
+        Test: http/tests/loading/basic-credentials-sent-automatically.html
+              http/tests/loading/basic-auth-resend-wrong-credentials.html
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * platform/network/Credential.cpp:
+        (WebCore::Credential::isEmpty):
+        * platform/network/Credential.h:
+
+        Add a slightly more full featured CredentialStore that will track URL paths a credential belongs to:
+        * platform/network/CredentialStorage.cpp: Added.
+        (WebCore::protectionSpaceToCredentialMap):
+        (WebCore::originToDefaultCredentialMap):
+        (WebCore::originStringFromURL):
+        (WebCore::CredentialStorage::set):
+        (WebCore::CredentialStorage::get):
+        (WebCore::CredentialStorage::getDefaultAuthenticationCredential):
+        * platform/network/CredentialStorage.h: Added.
+
+        Allow ProtectionSpace to be a hash key:
+        * platform/network/ProtectionSpace.cpp:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        * platform/network/ProtectionSpace.h:
+        (WebCore::ProtectionSpace::ProtectionSpace):
+        (WebCore::ProtectionSpace::isHashTableDeletedValue):
+        * platform/network/ProtectionSpaceHash.h: Added.
+        (WebCore::ProtectionSpaceHash::hash):
+        (WebCore::ProtectionSpaceHash::equal):
+
+        Allow ResourceHandles to remember the initial credential they used:
+        * platform/network/ResourceHandleInternal.h:
+
+        Allow mutable ResourceRequests to update their platform object if HTTP header fields change:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+
+        Remove WebCoreCredentialStorage:
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        * platform/network/mac/AuthenticationMac.h:
+        * platform/network/mac/AuthenticationMac.mm:
+
+        Change ResourceHandleCFNet to try to use stored credentials on new connections, if appropriate:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::WebCoreSynchronousLoader::load):
+
+        Change ResourceHandleMac to try to use stored credentials on new connections, if appropriate:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Only try the ProtectionSpace key'ed
+          Credential if it does not match the initially used Credential.
+        (WebCore::ResourceHandle::receivedCredential):
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Only try the 
+          ProtectionSpace key'ed Credential if it does not match the initially used Credential.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+
+        Add base64-ability to CString:
+        * platform/text/CString.cpp:
+        (WebCore::CStringBuffer::base64Encode):
+        (WebCore::CString::base64Encode):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::CStringBuffer):
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6954546> Crashes in WebCore::RenderPart::setWidget below FrameLoader::loadPlugin.
+
+        The calls to FrameLoader::requestObject within RenderPartObject::updateWidget can result in a plug-in
+        being initialized.  This can run cause arbitrary JavaScript to run and may result in the RenderPartObject
+        being detached from the render tree and destroyed, causing a crash like <rdar://problem/6954546>.
+
+        No test is possible until <rdar://problem/7090444> is fixed.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ensure that we stay alive for the duration of plug-in initialization.
+
+2009-09-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add RenderWidgetProtector to simplify protecting a RenderWidget from destruction for the
+        duration of a function.  Deploy it within RenderWidget.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition): Use a RefPtr rather than explicitly
+        ref'ing and deref'ing the node.
+        * rendering/RenderWidget.h:
+        * rendering/RenderWidgetProtector.h:
+        (WebCore::RenderWidgetProtector::RenderWidgetProtector):
+        (WebCore::RenderWidgetProtector::~RenderWidgetProtector):
+
+2009-09-14  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        CodeGenerator.pm needs some cleaning up
+        https://bugs.webkit.org/show_bug.cgi?id=29238
+
+        * bindings/scripts/CodeGenerator.pm:
+        (FindParentsRecursively): Removed; its functionality is now handled in
+        AddMethodsConstantsAndAttributesFromParentClasses.
+        (ForAllParents): New function that visits an interface's ancestors and
+        invokes a callback for each one.
+        (AddMethodsConstantsAndAttributesFromParentClasses): Simplified by using
+        ForAllParents.
+        (GetMethodsAndAttributesFromParentClasses): Ditto.
+        (IDLFileForInterface): Factored out previous calls to ScanDirectory into
+        this new function, which returns the filename containing a given IDL
+        interface definition.
+        (ParseInterface): Simplified by using IDLFileForInterface.
+        (ScanDirectory): Removed in lieu of IDLFileForInterface.
+        * bindings/scripts/CodeGeneratorV8.pm: Drop call to
+        FindParentsRecursively and get the list of parents from the
+        AddMethodsConstantsAndAttributesFromParentClasses call instead.
+
+2009-09-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Assert hit when dropping a file in QtLauncher
+        https://bugs.webkit.org/show_bug.cgi?id=29242
+
+        Qt's implementation of DropData::asURL does not return a URL encoded string
+        as expected.
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, file was missed during TLS.cpp removal.
+
+        * page/wx/FrameWx.cpp: Added.
+        (WebCore::Frame::dragImageForSelection):
+
+2009-09-13  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Web Inspector: Add "New Style Rule" to the localizedStrings
+        https://bugs.webkit.org/show_bug.cgi?id=29237
+
+        * English.lproj/localizedStrings.js:
+
+2009-09-13  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Implement filesystem functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29196
+
+        * platform/wx/FileSystemWx.cpp:
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::homeDirectoryPath):
+        (WebCore::directoryName):
+
+2009-09-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx 2.9.
+
+        * platform/wx/ScrollbarThemeWx.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp:
+        (wxGetGdkWindowForDC):
+
+2009-09-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        [ES5] Implement Object.keys
+        https://bugs.webkit.org/show_bug.cgi?id=29170
+
+        Switch from getPropertyNames to getOwnPropertyNames, and provide custom
+        getPropertyNames to DOMWindow, DOMWindowShell and QuarantinedObjectWrapper
+        in order to ensure correct semantics are maintained.
+
+        Test: fast/js/Object-keys.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyNames):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getPropertyNames):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyNames):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getOwnPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getPropertyNames):
+        (JSC::RuntimeObjectImp::getOwnPropertyNames):
+        * bridge/runtime_object.h:
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29219
+        Document.elementFromPoint() should take page scroll into consideration
+
+        Test: fast/dom/elementFromPoint-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=29217
+        Document.caretRangeFromPoint should take the scroll offset into account before hit testing
+
+        In accordance with the CSSOM View Module spec, Document.caretRangeFromPoint should interpret
+        the point passed to it as relative to the viewport, not the document.
+
+        Test: fast/dom/Document/CaretRangeFromPoint/hittest-relative-to-viewport.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added some manual tests to show WebGL in action
+        https://bugs.webkit.org/show_bug.cgi?id=29215
+
+        * manual-tests/webgl: Added.
+        * manual-tests/webgl/Earth.html: Added.
+        * manual-tests/webgl/ManyPlanetsDeep.html: Added.
+        * manual-tests/webgl/SpinningBox.html: Added.
+        * manual-tests/webgl/TeapotPerPixel.html: Added.
+        * manual-tests/webgl/TeapotPerVertex.html: Added.
+        * manual-tests/webgl/resources: Added.
+        * manual-tests/webgl/resources/CanvasMatrix.js: Added.
+        * manual-tests/webgl/resources/earthmap1k.jpg: Added.
+        * manual-tests/webgl/resources/mars500x250.png: Added.
+        * manual-tests/webgl/resources/teapot.obj: Added.
+        * manual-tests/webgl/resources/utils3d.js: Added.
+ 
+2009-09-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        aria definition role spelled wrong "defintion"
+        https://bugs.webkit.org/show_bug.cgi?id=28840
+
+        Test: accessibility/aria-slider-value-change.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-09-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes an assert in Node::isFocusable which was causing crashes in certain cases.
+        https://bugs.webkit.org/show_bug.cgi?id=29210
+
+        * dom/Node.cpp:
+        (WebCore::Node::isFocusable):
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added variants to uniform* and vertexAttrib* calls which take sequence<> in place of CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29139
+        
+        I also added a data() call to each of the CanvasArray subclasses to give back a types pointer
+        to the baseAddress().
+
+        * Configurations/FeatureDefines.xcconfig:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::toArray):
+        (WebCore::):
+        (WebCore::dataFunctionf):
+        (WebCore::dataFunctioni):
+        (WebCore::dataFunctionMatrix):
+        (WebCore::JSCanvasRenderingContext3D::uniform1fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform1iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform2iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform3iv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4fv):
+        (WebCore::JSCanvasRenderingContext3D::uniform4iv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::JSCanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::JSCanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::data):
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::data):
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::data):
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::data):
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::data):
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::data):
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::data):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+
+2009-09-11  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ENABLE(WEB_SOCKETS) guards.
+        https://bugs.webkit.org/show_bug.cgi?id=29174
+
+        * bindings/v8/custom/V8WebSocketCustom.cpp:
+
+2009-09-11  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out r48229.
+        http://trac.webkit.org/changeset/48229
+
+        * WebCore.base.exp:
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+        (WebCore::Clipboard::sourceOperation):
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::startDrag):
+        * page/DragController.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Fix the build.
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27456
+        Added support for static validation of url in
+        ValidityState, for url state inputs.
+        From HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#url-state
+
+        Test: fast/forms/ValidityState-typeMismatch-url.html
+
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2009-09-11  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Revert r47992: Expose functions to change the focus ring color for
+        Linux Chromium.
+
+        As Darin Fisher has pointed out, there is a better way to do this.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29207
+        Add checks for using WebCore JS context on secondary threads
+
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        Set the new debug-only mainThreadOnly flag.
+
+2009-09-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        The inspector should have scope bars.
+        https://bugs.webkit.org/show_bug.cgi?id=14353
+        
+        Add scope bars to the console, so the user can choose which category
+        of messages they want to see (All, Errors, Warnings, Logs), and they
+        can choose from one or more of {Errors, Warnings, Logs}.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createFilterElement):
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype._updateFilter):
+        (WebInspector.ConsoleView.prototype.filter):
+        (WebInspector.ConsoleView.prototype.attach):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-09-11  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Added extra NULL checks for HDC. This is the second fix for issue 28707,
+        and the fix is similar to http://trac.webkit.org/changeset/45482.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make ElementTimeControl methods return void and not throw.
+        https://bugs.webkit.org/show_bug.cgi?id=28831
+
+        SVG 1.1 erratum:
+        http://www.w3.org/2003/01/REC-SVG11-20030114-errata#elementtimecontrol-interface
+
+        Test: svg/dom/smil-methods.svg
+
+        * svg/ElementTimeControl.h: Change return type from bool to void and remove exception argument.
+        * svg/ElementTimeControl.idl: Change return type from bool to void and remove raises claus.
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::beginElement): Change return type from bool to void and remove exception argument.
+        (WebCore::SVGAnimationElement::beginElementAt): Ditto.
+        (WebCore::SVGAnimationElement::endElement): Ditto.
+        (WebCore::SVGAnimationElement::endElementAt): Ditto.
+        * svg/SVGAnimationElement.h: Ditto.
+
+2009-09-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for texImage2D which takes CanvasArray
+        https://bugs.webkit.org/show_bug.cgi?id=29191
+
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::texImage2D):
+
+2009-09-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow WebKit clients to opt out of high resolution timers on Windows.
+        https://bugs.webkit.org/show_bug.cgi?id=29192
+
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldUseHighResolutionTimers): Added.
+        * page/Settings.h: Added getter/setter for shouldUseHighResolutionTimers.
+        (WebCore::Settings::shouldUseHighResolutionTimers): Added.
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime): Don't run high resolution timer code if it is disabled.
+
+2009-09-11  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        [v8] Share persistent context handles between events        
+        Change events to use a single ref-counted shared persistent handle
+        to the context in which to run, rather than create a new
+        persistent handle for each new event which puts pressure on the
+        gc.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=29077
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/SharedPersistent.h: Added.
+        (WebCore::SharedPersistent::set):
+        (WebCore::SharedPersistent::get):
+        (WebCore::SharedPersistent::disposeHandle):
+        (WebCore::SharedPersistent::create):
+        (WebCore::SharedPersistent::SharedPersistent):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::context):
+        (WebCore::V8IsolatedWorld::shared_context):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluateInNewContext):
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        (WebCore::V8Proxy::isContextInitialized):
+        (WebCore::V8Proxy::updateDocumentWrapperCache):
+        (WebCore::V8Proxy::clearDocumentWrapperCache):
+        (WebCore::V8Proxy::disposeContextHandles):
+        (WebCore::V8Proxy::clearForClose):
+        (WebCore::V8Proxy::clearForNavigation):
+        (WebCore::V8Proxy::setSecurityToken):
+        (WebCore::V8Proxy::updateDocument):
+        (WebCore::V8Proxy::initContextIfNeeded):
+        (WebCore::V8Proxy::shared_context):
+        (WebCore::V8Proxy::mainWorldContext):
+        (WebCore::V8Proxy::setContextDebugId):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::shared_context):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Create a real handle (one which would save an object from GC).
+        https://bugs.webkit.org/show_bug.cgi?id=29150
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ExternalString):
+
+2009-09-11  Anton Muhin  <antonm@chromium.org>
+
+        Reviewed by David Levin.
+
+        Inline WebCore::v8String as it only invokes WebCore::v8ExternalString.
+        https://bugs.webkit.org/show_bug.cgi?id=29152
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8String):
+
+2009-09-11  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed URLs from qtsoftware.com to qt.nokia.com, as part of a general
+        renaming.
+
+        * ChangeLog-2009-06-16:
+
+2009-09-11  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use LIBS_PRIVATE on Qt/Mac.
+
+        On the Mac, it means "-framework ApplicationServices -framework Carbon
+        -framework AppKit" are no longer part of the default LIBS in Qt
+        applications. This required a lot of fixes where we used Mac-specific
+        code in Qt.
+
+        * WebCore.pro:
+
+2009-09-11  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Remove duplicated WK_{u,l}cfirst subs from CodeGeneratorV8.pm
+        https://bugs.webkit.org/show_bug.cgi?id=29165
+
+        * bindings/scripts/CodeGeneratorV8.pm: Remove WK_ucfirst and
+        WK_lcfirst, and call the ones in CodeGenerator.pm instead.
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29132
+        Symbian winscw compiler fails compiling WebCore/text/RegularExpression.cpp.
+
+        Add RegularExpression class qualifier before Private.
+
+        * platform/text/RegularExpression.cpp:
+
+2009-09-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29131
+        Use a different variadic macro format for Symbian compiler.
+        
+        Use arg... instead of ellipsis in variadic macro.        
+
+        * platform/StaticConstructors.h:
+
+2009-09-11  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28806
+
+        [Qt] Make the WebInspector available as a QWidget.
+
+        * WebCore.pro:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed fix for the Web Inspector with the Qt build.
+
+        Re-generate the Qt resource file by running
+        WebKitTools/Scripts/generate-qt-inspector-resource
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-09-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, remove stray semicolon from function definition.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Detect mixed content
+        https://bugs.webkit.org/show_bug.cgi?id=29003
+
+        Detect some basic kinds of mixed content (HTTP content loaded into an
+        HTTPS context).  This new detection logic isn't perfect, but it's a
+        place to start.
+
+        Tests: http/tests/security/mixedContent/about-blank-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-iframe-in-main-frame.html
+               http/tests/security/mixedContent/data-url-script-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-iframe.html
+               http/tests/security/mixedContent/insecure-css-in-main-frame.html
+               http/tests/security/mixedContent/insecure-iframe-in-iframe.html
+               http/tests/security/mixedContent/insecure-iframe-in-main-frame.html
+               http/tests/security/mixedContent/insecure-image-in-iframe.html
+               http/tests/security/mixedContent/insecure-image-in-main-frame.html
+               http/tests/security/mixedContent/insecure-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-http-to-https-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-http-to-https-script-in-iframe.html
+               http/tests/security/mixedContent/redirect-https-to-http-iframe-in-main-frame.html
+               http/tests/security/mixedContent/redirect-https-to-http-script-in-iframe.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::checkCacheObjectStatus):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::isMixedContent):
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Windows build.
+
+        Restore platform/mock to the header search path after it was removed in r48270.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-09-08  Timothy Hatcher  <timothy@apple.com>
+
+        Web Inspector: Move the option to create a new style rule under the Styles' gear menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29039
+
+        Reviewed by Sam Weinig.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane): Add "New Style Rule" option to the gear menu.
+        (WebInspector.StylesSidebarPane.prototype._update): Check instanceof BlankStylePropertiesSection instead.
+        (WebInspector.StylesSidebarPane.prototype._changeSetting): Added. Keeps the color format setting selected
+        while calling the correct action.
+        (WebInspector.StylesSidebarPane.prototype._createNewRule): Creates a new section and edits the selector.
+        (WebInspector.StylesSidebarPane.prototype.addBlankSection): Insert the section in a cleaner way.
+        (WebInspector.StylesSidebarPane.prototype.removeSection): Added. Removes the passed in section.
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode): Return an empty string if there is no node.
+        (WebInspector.StylePropertiesSection.prototype.expand): Removed the check for _blank.
+        (WebInspector.StylePropertiesSection.prototype.startEditingSelector): No need for the context, the original selector
+        is remembered by the editing code.
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled): Do nothing. The original text is already
+        restored by the editing code.
+        (WebInspector.BlankStylePropertiesSection): Call the StylePropertiesSection constructor with appropriate data.
+        Remove event listener code.
+        (WebInspector.BlankStylePropertiesSection.prototype.expand): Added. Does nothing to prevent expanding.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted.callback): Correctly construct the
+        WebInspector.CSSStyleDeclaration. Call editingSelectorCancelled instead of editingCancelled.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCommitted): Renamed from editingCommitted to
+        override the base class.
+        (WebInspector.BlankStylePropertiesSection.prototype.editingSelectorCancelled): Remove the section.
+        (WebInspector.BlankStylePropertiesSection.prototype.makeNormal): Removed event listener code. Removed the delete lines
+        since they were doing nothing (deleting nonexistent properties that exist only on the prototype.) Change prototypes at
+        the end to correctly swtich to a real StylePropertiesSection.
+        * inspector/front-end/inspector.js:
+        (WebInspector.startEditing.editingCancelled): Ceck for null/undefined callbacks.
+        (WebInspector.startEditing.editingCommitted): Ditto.
+
+2009-09-10  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Fix comparison between signed and unsigned integer warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29162
+
+        No functional change.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::duration):
+        (WebCore::ImageDecoderQt::imageAtIndex):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2009-09-10  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Build fix for GTK+ after r48267.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-08  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unneeded define for ActiveX.
+        https://bugs.webkit.org/show_bug.cgi?id=29054
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap):
+        (WebCore::serviceTypeForClassId):
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-09-10  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Don't copy IDL files in to the built framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-09-10  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implment Range.expand().
+        https://bugs.webkit.org/show_bug.cgi?id=27632
+
+        Test: fast/dom/Range/range-expand.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::expand):
+        * dom/Range.h:
+        * dom/Range.idl:
+
+2009-09-10  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems for GNUmakefile.am, WebCore.xcodeproj and
+        WebCore.vcproj.
+        Add websockets directory and WebSocket.idl in qt build system.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, windows build fix only.
+        
+        Spurious semicolon causing parse error in chromium build on windows.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::buffered):
+
+2009-09-10  Albert J. Wong  <ajwong@chromium.org>
+
+        No review, build fix only.
+
+        Adding in a missed include from the last patch that is breaking the
+        chromium build.
+
+        * rendering/RenderThemeChromiumMac.mm: include TimeRanges.h
+
+2009-09-10  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        HTMLMediaElement buffered attribute should report a list of time ranges
+        https://bugs.webkit.org/show_bug.cgi?id=29041
+
+        Changed MediaPlayerPrivateInterface and MediaPlayer's definition to
+        report a list of buffered time ranges as WebCore::TimeRanges. This
+        change also got rid of the maxTimeBuffered() method.
+
+        No new tests since this is a API change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::percentLoaded):
+        Use MediaPlaier::buffered() instead of maxTimeBuffered().
+        (WebCore::HTMLMediaElement::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::buffered):
+        Use MediaPlayerPrivateInterface::buffered() instead of maxTimeBuffered().
+        (WebCore::MediaPlayer::buffered):
+        ditto.
+        * platform/graphics/MediaPlayer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/MediaPlayerPrivate.h:
+        ditto.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Implements PassRefPtr<TimeRanges> buffered();
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::buffered):
+        Implementation of buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        Implements PassRefPtr<TimeRanegs> buffered().
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        Implements PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        Removed maxTimeBuffered() and defines PassRefPtr<TimeRanges> buffered().
+        * platform/graphics/wince/MediaPlayerPrivateWince.h:
+        ditto.
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        Use buffered() instead of maxTimeBuffered().
+        * rendering/RenderThemeChromiumSkia.cpp:
+        ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        ditto.
+
+2009-09-10  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make bindings generators more aware of IDL dependencies
+        https://bugs.webkit.org/show_bug.cgi?id=29114
+
+        Make the JS and ObjC bindings generators able to output dependency
+        rules for DerivedSources.make to consume.  These rules make a given
+        generated binding class file header, JSWhatever.h, depend on Whatever's
+        ancestor interfaces.
+
+        * DerivedSources.make: Pass --write-dependencies to generate-bindings.pl
+        when generating JS and ObjC bindings.  Include dependency fies that are
+        generated due to that.
+        * bindings/scripts/CodeGenerator.pm: Make
+        AddMethodsConstantsAndAttributesFromParentClasses accumulate a list of
+        the ancestor interfaces that were visited.
+        * bindings/scripts/CodeGeneratorJS.pm: Optionally write out a dependency
+        file.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * bindings/scripts/generate-bindings.pl: Add a --write-dependencies
+        option.
+
+2009-09-10  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez and Dan Winship.
+
+        Give all requests to libsoup, to let it queue, and schedule them
+        itself, instead of throttling the number of requests in WebCore.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-09-10  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Make XMLHttpRequest.send handle File object.
+        https://bugs.webkit.org/show_bug.cgi?id=28924
+
+        Test: http/tests/local/send-dragged-file.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-10  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Use fastNew and fastDelete instead of operator new and delete for CSSSelector class. 
+        https://bugs.webkit.org/show_bug.cgi?id=25930
+
+        Change using of operator new to fastNew and operator delete to
+        fastDeleteSkippingDestructor for CSSSelector class to avoid mismatched function call.
+
+        This change fixes valgrind's 'mismatched free' notification.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+
+2009-09-10  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation does not correctly handle reentrant calls from callbacks.
+        https://bugs.webkit.org/show_bug.cgi?id=29040
+
+        Tests: fast/dom/Geolocation/reentrant-error.html
+               fast/dom/Geolocation/reentrant-success.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::handleError): Modified. Call sendError directly, clearing notifier lists before making callback.
+        (WebCore::Geolocation::makeSuccessCallbacks): Modified. Call sendPosition directly, clearing notifier lists before making callback.
+        * page/Geolocation.h: Modified. Deleted sendErrorToXX and sendPositionToXXX methods.
+
+2009-09-10  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes issue where focused elements did not get blur and focus events when the window was blurred and focused.
+        https://bugs.webkit.org/show_bug.cgi?id=27105
+
+        Test: fast/events/blur-focus-window-should-blur-focus-element.html
+
+        * page/FocusController.cpp:
+        (WebCore::dispatchEventsOnWindowAndFocusedNode):
+        (WebCore::FocusController::setFocused):
+        (WebCore::FocusController::setActive):
+
+2009-09-10  Adam Roben  <aroben@apple.com>
+
+        Make the play/pause button in <video> controls indicate the button's
+        action, not the movie state
+
+        This matches the Mac behavior, iTunes, and many other media players.
+
+        No test possible.
+
+        Fixes <http://webkit.org/b/29126> Play/pause button in <video>
+        controls shows the wrong image
+
+        Reviewed by Eric Carlson.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Reversed when
+        we show the play vs. pause artwork, so that the button reflects what
+        will happen when you click it, rather than the current state of the
+        movie.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Geolocation Coordinates::toString() prints bogus values for unspecified properties.
+        https://bugs.webkit.org/show_bug.cgi?id=29080
+
+        Test: fast/dom/Geolocation/position-string.html
+
+        * GNUmakefile.am: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.gypi: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.pro: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * WebCoreSources.bkl: Modified. Removes Geoposition.cpp and Coordinates.cpp.
+        * page/Coordinates.cpp: Removed.
+        * page/Coordinates.h: Modified. Removes toString method.
+        * page/Coordinates.idl: Modified. Removes toString method.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Modified. Removes toString method.
+        * page/Geoposition.idl: Modified. Removes toString method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Correctly applies the Geolocation timeout property.
+        https://bugs.webkit.org/show_bug.cgi?id=27256
+
+        If a timeout is specified, the timer is started as soon as the location acquistion process starts.
+        If a position fix is not obtained within the timeout interval, the position request is cancelled
+        and the error callback (if specified) is invoked. If a position fix is obtained within the timeout
+        interval, the timer is stopped. Permissions are then requested from the user if required. See
+        http://www.w3.org/TR/geolocation-API/#position-options.
+
+        Note that this logic means that the time required to obtain permissions from the user is not
+        included in the timeout interval.
+
+        Tests: fast/dom/Geolocation/timeout.html
+               fast/dom/Geolocation/timeout-zero.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Takes Geolocation object as parameter.
+        (WebCore::Geolocation::GeoNotifier::hasZeroTimeout): Added. Determines whether this request has a zero timeout.
+        (WebCore::Geolocation::GeoNotifier::startTimerIfNeeded): Renamed from startTimer. Starts the timer if a timeout was specified.
+        (WebCore::Geolocation::GeoNotifier::timerFired): Modified. Calls the error callback if specified, and reports the timeout to the Geolocation object.
+        (WebCore::Geolocation::getCurrentPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::watchPosition): Modified. Calls maybeStartTimer when starting the location acquisition process.
+        (WebCore::Geolocation::requestTimedOut): Added. Cancels a request when it times out.
+        (WebCore::Geolocation::setIsAllowed): Modified. No longer starts timers.
+        (WebCore::Geolocation::sendPosition): Modified. No longer stops timers.
+        (WebCore::Geolocation::stopTimer): Added. Stops the timers for a vector of notifiers.
+        (WebCore::Geolocation::stopTimersForOneShots): Added. Stops the timers for all one-shots.
+        (WebCore::Geolocation::stopTimersForWatchers): Added. Stops the timers for all watchers.
+        (WebCore::Geolocation::stopTimers): Added. Stops the timers for all requests.
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modfified. Stops the timers for all requests.
+        * page/Geolocation.h: Modified.
+        (WebCore::Geolocation::GeoNotifier::create): Modified. Takes Geolocation object as parameter.
+
+2009-09-09  Chris Fleizach  <cfleizach@apple.com>
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Build fix for Qt.
+
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+
+2009-09-08  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX notifications should be an ENUM type instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=28963
+
+        Moves AX notifications over to an ENUM type instead of
+        using the actual string values that are used on OS X.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * dom/Element.cpp:
+        (WebCore::Element::updateAfterAttributeChanged):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-09-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Missing checkout for getSVGDocument()
+        https://bugs.webkit.org/show_bug.cgi?id=29064
+
+        The V8 code generator didn't understand SVGCheckSecurityDocument.
+
+        Tests: http/tests/security/xss-DENIED-getSVGDocument-iframe.html
+               http/tests/security/xss-DENIED-getSVGDocument-object.html
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-09-09  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement inherit from SVGLangSpace
+        https://bugs.webkit.org/show_bug.cgi?id=29058
+
+        Required by SVG 1.1 Second Edition:
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/styling.html#InterfaceSVGStyleElement
+
+        Test: svg/dom/SVGStyleElement/style-langspace.html
+
+        * svg/SVGStyleElement.cpp: Drop methods xmlspace and setXmlspace.
+        (WebCore::SVGStyleElement::SVGStyleElement): Add SVGLangSpace()
+        initializer.
+        (WebCore::SVGStyleElement::parseMappedAttribute): Call
+        parseMappedAttribute on SVGLangSpace.
+        * svg/SVGStyleElement.h: Drop xmlspace and setXmlspace declarations.
+        * svg/SVGStyleElement.idl: Drop xmlspace attribute and add SVGLangSpace
+        as a superinterface.
+
+2009-09-09  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unnecessary includes and forward declarations in V8Proxy.h
+
+        https://bugs.webkit.org/show_bug.cgi?id=29111
+
+        * bindings/v8/V8Proxy.h:
+
+2009-07-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add more position constructors
+        positionBeforeNode, positionAfterNode
+        firstPositionInNode, lastPositionInNode
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        I also added a lastOffsetInNode and deployed it to a couple places.
+
+        There are no callers to these new constructors yet, but those
+        will be coming in future patches.
+
+        * dom/Position.cpp:
+        (WebCore::Position::computeOffsetInContainerNode):
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::lastOffsetInNode):
+        (WebCore::firstPositionInNode):
+        (WebCore::lastPositionInNode):
+        * editing/ApplyStyleCommand.cpp:
+        * editing/TextIterator.cpp:
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        * editing/htmlediting.cpp:
+        (WebCore::lastOffsetForEditing):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename positionBeforeNode to positionInParentBeforeNode
+        and positionAfterNode to positionInParentAfterNode
+        in preparation for adding a positionBeforeNode
+        which returns a neighbor-anchored position.
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        No functional changes, thus no tests.
+
+        * dom/PositionConstructors.h:
+        (WebCore::positionInParentBeforeNode):
+        (WebCore::positionInParentAfterNode):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::deleteTarget):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::updatePositionForNodeRemoval):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtStartOfInsertedContent):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::positionBeforeContainingSpecialElement):
+        (WebCore::positionAfterContainingSpecialElement):
+        (WebCore::positionBeforeTabSpan):
+
+2009-04-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Re-organize position creation functions in preparation for adding more
+        https://bugs.webkit.org/show_bug.cgi?id=25494
+
+        Make position functions inline to avoid ref-churn.
+        Remove startPosition/endPosition as they were only used in one place.
+
+        No functional changes, thus no tests.
+
+        * dom/Position.cpp:
+        * dom/Position.h:
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        * editing/TypingCommand.cpp:
+        * editing/htmlediting.cpp:
+        * editing/htmlediting.h:
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * rendering/RenderObject.cpp:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+        
+        [wx] Add wxSize conversions for IntSize.
+        https://bugs.webkit.org/show_bug.cgi?id=29104
+
+        * platform/graphics/IntSize.h:
+        * platform/graphics/wx/IntSizeWx.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator wxSize):
+
+2009-09-09  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by David Levin.
+        
+        Chromium uses its own config.h file that was forked from webkit's config.h.
+        By merging in Chromium's defines, Chromium would again be able to use webkit's
+        config.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28882 
+
+        * config.h: Added chromium-specific defines. 
+
+2009-09-09  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize DataTransfer's effectAllowed and dropEffect properties correctly
+        according to HTML5 spec (sec. 7.9.2-7.9.3).
+        https://bugs.webkit.org/show_bug.cgi?id=26700
+        - At the start of a drag operation, the value of effectAllowed should be
+          the string "uninitialized".
+        - At end of dragstart handler, if effectAllowed hasn't been set yet, it
+          should be set to "copy".
+        - on dragenter and dragover event, dropEffect should be initialized to a
+          default value based on the value of effectAllowed.
+        - at end of dragenter and dragover the dropEffect should be set to "none"
+          if the value set by the handler doesn't match the effectAllowed.
+        - on dragleave event, dropEffect should be "none".
+        - on drop event, dropEffect should be the previously negotiated value.
+
+        Test: fast/events/drag-dropeffect.html
+
+        * WebCore.base.exp:
+            Added a parameter to EventHandler::dragSourceMovedTo.
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::Clipboard):
+            Initialize m_effectAllowed to "uninitialized".
+        (WebCore::Clipboard::sourceOperation):
+            Treat "uninitialized" as meaning no value has been set.
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+            Initialize new member m_destinationDragOperation.
+        (WebCore::DragController::dragExited):
+            Set m_destinationDragOperation to none on dragExit.
+        (WebCore::DragController::performDrag):
+            Set m_destinationDragOperation to current dropEffect.
+        (WebCore::DragController::dragEnteredOrUpdated):
+            Make sure to clear the operation if drag source doesn't allow it.
+        (WebCore::DragController::tryDHTMLDrag):
+            Set a default value for the dst drag op before sending dragEnter/Over.
+        (WebCore::DragController::startDrag):
+            Clear m_destinationDragOperation at start of drag.
+        * page/DragController.h:
+        (WebCore::DragController::destinationDragOperation):
+            Added new member m_destinationDragOperation, and its public getter.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+            dropEffect should be 'none' during dropleave handler, per spec.
+        (WebCore::EventHandler::dragSourceMovedTo):
+            Added DragOperation parameter, so the handler sees the current dropEffect.
+        (WebCore::EventHandler::handleDrag):
+            Assume DragOperationEvery for non-DHTML drags.
+        * page/EventHandler.h:
+            Added DragOperation parameter to dragSourceMovedTo().
+
+2009-09-09  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        1. Adding support/bindings for read-only transactions.
+        2. Disallowing the SQLITE_*_VIEW and REINDEX operations in the
+        private browsing mode.
+        3. Adding an authorizer test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28918
+
+        Test: storage/test-authorizer.html
+
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::JSDatabase::transaction): Refactored to use
+        createTransaction().
+        (WebCore::JSDatabase::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * bindings/v8/custom/V8CustomBinding.h: Added the binding for
+        Database::readTransaction().
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::createTransaction): Parses all arguments and executes a
+        transaction.
+        (WebCore::transaction): Refactored to use createTransaction().
+        (WebCore::readTransaction): Added to execute read-only
+        transactions using createTransaction().
+        * storage/Database.cpp:
+        (WebCore::Database::transaction): Added support for read-only
+        transactions.
+        * storage/Database.h: Added support for read-only transactions.
+        * storage/Database.idl: Added support for read-only transactions.
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::createTempTable): Make it obvious
+        that the statement will be denied in private browsing mode and
+        read-only transactions.
+        (WebCore::DatabaseAuthorizer::dropTempTable): Same.
+        (WebCore::DatabaseAuthorizer::createTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::dropTempIndex): Same.
+        (WebCore::DatabaseAuthorizer::createTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::dropTempTrigger): Same.
+        (WebCore::DatabaseAuthorizer::createView): Deny in private
+        browsing mode and read-only transactions.
+        (WebCore::DatabaseAuthorizer::createTempView): Same.
+        (WebCore::DatabaseAuthorizer::dropView): Same.
+        (WebCore::DatabaseAuthorizer::dropTempView): Same.
+        (WebCore::DatabaseAuthorizer::allowReindex): Same.
+        * storage/DatabaseAuthorizer.h:
+        * storage/SQLTransaction.cpp: Added support for read-only
+        transactions.
+        (WebCore::SQLTransaction::create):
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::acquireLock):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp:
+        (WebCore::SQLTransactionCoordinator::acquireLock): Added a new
+        parameter in preparation for a change that will allow multiple
+        read-only transactions on the same DB to run concurrently.
+        * storage/SQLTransactionCoordinator.h:
+
+2009-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29102, add support for user stylesheet injection.  This is similar
+        to user script injection but allows for user stylesheets to be added.  The stylesheets are applied immediately
+        to all Frames in the PageGroup.
+
+        Added userscripts/simple-stylesheet.html test case.
+
+        * WebCore.base.exp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::attach):
+        (WebCore::Document::pageGroupUserSheets):
+        (WebCore::Document::clearPageGroupUserSheets):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::addUserStyleSheet):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userStyleSheets):
+        * page/UserStyleSheet.h: Added.
+        (WebCore::UserStyleSheet::UserStyleSheet):
+        (WebCore::UserStyleSheet::source):
+        (WebCore::UserStyleSheet::url):
+        (WebCore::UserStyleSheet::patterns):
+        (WebCore::UserStyleSheet::worldID):
+        * page/UserStyleSheetTypes.h: Added.
+
+2009-09-09  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] CSS Style -webkit-box-shadow is not rendered correctly on
+        Qt platform
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+         Added the ability to draw shadows for all these curves.
+
+2009-09-09  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add the qwebgraphicsitem.cpp to the build system.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28862
+
+        * WebCore.pro:
+
+2009-09-09  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx port] Move functions in TemporaryLinkStubs.cpp out to files where
+        they belong.
+
+        https://bugs.webkit.org/show_bug.cgi?id=29088
+
+        * editing/wx/EditorWx.cpp:
+        (WebCore::Editor::showColorPanel):
+        (WebCore::Editor::showFontPanel):
+        (WebCore::Editor::showStylesPanel):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        * platform/graphics/wx/IconWx.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        * platform/wx/CursorWx.cpp:
+        (WebCore::moveCursor):
+        * platform/wx/FileChooserWx.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/wx/KURLWx.cpp: Added.
+        (WebCore::KURL::fileSystemPath):
+        * platform/wx/SSLKeyGeneratorWx.cpp: Added.
+        (WebCore::getSupportedKeySizes):
+        (WebCore::signedPublicKeyAndChallengeString):
+        * platform/wx/SearchPopupMenuWx.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        (WebCore::SearchPopupMenu::enabled):
+        * platform/wx/SharedBufferWx.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/wx/SystemTimeWx.cpp: Added.
+        (WebCore::userIdleTime):
+        * platform/wx/TemporaryLinkStubs.cpp: Removed.
+        * platform/wx/TextBreakIteratorInternalICUWx.cpp: Added.
+        (WebCore::currentSearchLocaleID):
+        (WebCore::currentTextBreakLocaleID):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Geolocation incorrectly calls error callback in case of exception in success callback.
+        https://bugs.webkit.org/show_bug.cgi?id=27255
+
+        Test: fast/dom/Geolocation/callback-exception.html
+
+        * bindings/js/JSCustomPositionCallback.cpp: Modified.
+        (WebCore::JSCustomPositionCallback::handleEvent): Modified. Removed raisedException out param.
+        * bindings/js/JSCustomPositionCallback.h: Modified. Removed raisedException out param from handleEvent method and made handleEvent private.
+        * bindings/js/JSCustomPositionErrorCallback.h: Modified. Made handleEvent private.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::sendPosition): Modified. No longer call error callback in case of exception in success callback.
+        * page/PositionCallback.h: Modified. Removed raisedException out param from handleEvent method.
+
+2009-09-09  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        When Geolocation permission is denied, stops watches as well as one-shots.
+        https://bugs.webkit.org/show_bug.cgi?id=28305.
+
+        Tests: fast/dom/Geolocation/watch.html
+               fast/dom/Geolocation/permission-denied-stops-watches.html
+
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Marks the permission error as fatal.
+        (WebCore::Geolocation::handleError): Modified. If the error is fatal, stops watchers as well as one-shots.
+        * page/PositionError.h: Modified.
+        (WebCore::PositionError::setIsFatal): Added. Marks an error as fatal.
+        (WebCore::PositionError::isFatal): Added. Determines whether an error is fatal.
+
+2009-09-09  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 28964 -  [Chromium] ChromiumDataObject should have getter/setter interface
+
+        Added getter/setter methods and trivial inline implementations for each.
+        (Note that they are not yet actually used.)
+        Once the Chromium code is changed to use them instead of directly accessing the
+        member variables, the member variables should be made private and cleaned up.
+
+        No new tests (no functional behavior changed).
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::mainURL):
+        (WebCore::ChromiumDataObject::setMainURL):
+        (WebCore::ChromiumDataObject::mainURLTitle):
+        (WebCore::ChromiumDataObject::setMainURLTitle):
+        (WebCore::ChromiumDataObject::textPlain):
+        (WebCore::ChromiumDataObject::setTextPlain):
+        (WebCore::ChromiumDataObject::textHTML):
+        (WebCore::ChromiumDataObject::setTextHTML):
+        (WebCore::ChromiumDataObject::htmlBaseURL):
+        (WebCore::ChromiumDataObject::setHTMLBaseURL):
+        (WebCore::ChromiumDataObject::content):
+        (WebCore::ChromiumDataObject::releaseContent):
+        (WebCore::ChromiumDataObject::setContent):
+        (WebCore::ChromiumDataObject::contentFileExtension):
+        (WebCore::ChromiumDataObject::setContentFileExtension):
+        (WebCore::ChromiumDataObject::contentFileName):
+        (WebCore::ChromiumDataObject::setContentFileName):
+        (WebCore::ChromiumDataObject::fileNames):
+        (WebCore::ChromiumDataObject::setFileNames):
+        (WebCore::ChromiumDataObject::takeFileNames):
+
+2009-09-08  Pat Bradley  <vincent.bradley@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] locale date displays incorrect date format in symbian.
+        https://bugs.webkit.org/show_bug.cgi?id=29032
+
+        strftime() in Symbian does not support #
+        Layout tests cannot be run on Symbian yet, so they are not updated.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-09-09  Rohini Ananth <rohini.ananth@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        NPAPI Plugin NPP_AsFile not working on Qt Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=29068
+
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile)
+        Autoremove property of QTemporaryFile has been set to false. Hence closeFile() just closes and does not delete the file.
+        This solves the deletion of created temp file in PluginStream::destroyStream() before passing to plugin in NPP_AsFile.
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Remove a few incorrect changes I left in.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support numeric index getters in bindings
+        https://bugs.webkit.org/show_bug.cgi?id=29067
+
+        Add HasNumericIndexGetter to indicate a non-custom getter that
+        returns a number.  The numeric index getter also uses PropertySlot's
+        setValue rather than setCustomIndex to avoid an additional indirect
+        call.
+
+        * bindings/js/JSCanvasByteArrayCustom.cpp:
+        * bindings/js/JSCanvasFloatArrayCustom.cpp:
+        * bindings/js/JSCanvasIntArrayCustom.cpp:
+        * bindings/js/JSCanvasShortArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp:
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * html/canvas/CanvasByteArray.h:
+        (WebCore::CanvasByteArray::item):
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.h:
+        (WebCore::CanvasFloatArray::get):
+        (WebCore::CanvasFloatArray::item):
+        * html/canvas/CanvasFloatArray.idl:
+        * html/canvas/CanvasIntArray.h:
+        (WebCore::CanvasIntArray::get):
+        (WebCore::CanvasIntArray::item):
+        * html/canvas/CanvasIntArray.idl:
+        * html/canvas/CanvasPixelArray.idl:
+        * html/canvas/CanvasShortArray.h:
+        (WebCore::CanvasShortArray::get):
+        (WebCore::CanvasShortArray::item):
+        * html/canvas/CanvasShortArray.idl:
+        * html/canvas/CanvasUnsignedByteArray.h:
+        (WebCore::CanvasUnsignedByteArray::get):
+        (WebCore::CanvasUnsignedByteArray::item):
+        * html/canvas/CanvasUnsignedByteArray.idl:
+        * html/canvas/CanvasUnsignedIntArray.h:
+        (WebCore::CanvasUnsignedIntArray::get):
+        (WebCore::CanvasUnsignedIntArray::item):
+        * html/canvas/CanvasUnsignedIntArray.idl:
+        * html/canvas/CanvasUnsignedShortArray.h:
+        (WebCore::CanvasUnsignedShortArray::item):
+        * html/canvas/CanvasUnsignedShortArray.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Jens Alfke  <snej@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        In Mac Chromium, clicking below the last line of an editable area (textarea or
+        contenteditable) should put the caret at the end of the last line, as in Mac Safari.
+
+        Tests: LayoutTests/editing/selection/click-in-margins-inside-editable-div.html
+               LayoutTests/editing/selection/click-in-padding-with-multiple-line-boxes.html
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Change #if PLATFORM_MAC to be Mac-Chrome-inclusive.
+
+2009-09-08  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Make sure not to do an early return when a data URL stylesheet successfully loads.  We need to still
+        clear the old cached sheet out of all existing Frames.  Fixes the data URL stylesheet layout test failure.
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        More robust wx build fix for 2.9.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27046
+        Implement CSSOM DocumentView.caretRangeFromPoint
+
+        Tests: fast/dom/Document/CaretRangeFromPoint/basic.html
+               fast/dom/Document/CaretRangeFromPoint/replace-element.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/Document.h:
+        * dom/Document.idl:
+
+2009-09-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, generate derived sources earlier in order to make sure
+        they're found by the build system when generating the list of sources to build.
+
+        * wscript:
+
+2009-09-08  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        <iterator> include in V8Proxy.h is spurious and causing ObjC compile issues for Chromium.
+
+        Test: Chromium mac canary build is fixed.
+
+        * bindings/v8/V8Proxy.h: Remove <iterator> include.
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed attempt to fix the GTK+ build.
+
+        * GNUmakefile.am:
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28987, make the Document cache the page's user stylesheet in
+        parsed form.  Allows the sheet to survive across destruction/re-creation of the CSSStyleSelector.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        * css/CSSStyleSelector.h:
+        * dom/Document.cpp:
+        (WebCore::Document::attach):
+        (WebCore::Document::pageUserSheet):
+        (WebCore::Document::clearPageUserSheet):
+        (WebCore::Document::recalcStyleSelector):
+        * dom/Document.h:
+        * loader/PlaceholderDocument.cpp:
+        (WebCore::PlaceholderDocument::attach):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/Settings.cpp:
+        (WebCore::Settings::setUserStyleSheetLocation):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Unreviewed buildfix.
+
+        Fix Qt build after 48167, by adding the new cpp/h files
+        added to WebCore.gypi to WebCore.pro as well.
+
+        * WebCore.pro:
+
+2009-09-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        should not pass URI fragments to libsoup
+        https://bugs.webkit.org/show_bug.cgi?id=28687
+
+        Strip the fragment from the URI before passing it to soup, since
+        it forwards it to servers in some cases (like when using a proxy)
+        which confuses them and makes them return 403/404.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add QGraphicsScene events support to the Qt platform events.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::applyDelta):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-09-08  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Cleanup: remove a few deprecated methods.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests, just syntactic sugar.
+
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.h:
+
+2009-09-08  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28981
+
+        [Qt] make npapi.h compile in winscw compiler.
+
+        Add XP_SYMBIAN macro to identify Symbian OS; this macro should be used for Symbian
+        specific changes in npapi.h.
+        Undefine XP_WIN when building for Symbian to avoid including Windows specific code.
+
+        * bridge/npapi.h:
+
+2009-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Web Inspector assertion failure related to marking
+        https://bugs.webkit.org/show_bug.cgi?id=28997
+
+        When wrapping the callback the JSInspectorCallbackWrapper creator was using
+        inheritorID for the prototype structure which is unsafe for anything other
+        than a pure JS object.  Instead we now create a new structure, which while
+        inefficient is not problematic as this code is not hit frequently.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add missing extension to the file entry in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj: Added "cpp".
+
+2009-09-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        dataTransfer.types() should not return Files if file list is empty in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28891
+
+        We change the behavior to handle the empty file list in order to match the spec.
+
+        Tested by clipboard-file-access.html.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+
+2009-09-08  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-08  Kelly Norton  <knorton@google.com>
+
+        Reviewed by Eric Seidel.
+
+        WebInspector: Adds a timeline agent to InspectorController that collects
+        high-level timing data about event dispatch, layout, painting and HTML
+        parsing and makes it available to Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=25503
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        (WebCore::Document::inspectorTimelineAgent):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * inspector/DOMDispatchTimelineItem.cpp: Added.
+        (WebCore::DOMDispatchTimelineItem::DOMDispatchTimelineItem):
+        (WebCore::DOMDispatchTimelineItem::convertToScriptObject):
+        * inspector/DOMDispatchTimelineItem.h: Added.
+        (WebCore::DOMDispatchTimelineItem::~DOMDispatchTimelineItem):
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::enableTimeline):
+        (WebCore::InspectorBackend::disableTimeline):
+        (WebCore::InspectorBackend::timelineEnabled):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::enableTimeline):
+        (WebCore::InspectorController::disableTimeline):
+        (WebCore::InspectorController::timelineEnabled):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::timelineAgent):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::timelineWasEnabled):
+        (WebCore::InspectorFrontend::timelineWasDisabled):
+        (WebCore::InspectorFrontend::addItemToTimeline):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorTimelineAgent.cpp: Added.
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::willDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::didDispatchDOMEvent):
+        (WebCore::InspectorTimelineAgent::willLayout):
+        (WebCore::InspectorTimelineAgent::didLayout):
+        (WebCore::InspectorTimelineAgent::willRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::didRecalculateStyle):
+        (WebCore::InspectorTimelineAgent::willPaint):
+        (WebCore::InspectorTimelineAgent::didPaint):
+        (WebCore::InspectorTimelineAgent::willWriteHTML):
+        (WebCore::InspectorTimelineAgent::didWriteHTML):
+        (WebCore::InspectorTimelineAgent::reset):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::currentTimeInMilliseconds):
+        (WebCore::InspectorTimelineAgent::sessionTimeInMilliseconds):
+        * inspector/InspectorTimelineAgent.h: Added.
+        * inspector/TimelineItem.cpp: Added.
+        (WebCore::TimelineItem::TimelineItem):
+        (WebCore::TimelineItem::addToTimeline):
+        (WebCore::TimelineItem::convertToScriptObject):
+        (WebCore::TimelineItem::convertChildrenToScriptArray):
+        (WebCore::TimelineItem::addChildItem):
+        * inspector/TimelineItem.h: Added.
+        (WebCore::):
+        (WebCore::TimelineItem::~TimelineItem):
+        (WebCore::TimelineItem::previous):
+        (WebCore::TimelineItem::releasePrevious):
+        (WebCore::TimelineItem::setEndTime):
+        (WebCore::TimelineItem::type):
+        * inspector/front-end/TimelineAgent.js: Added.
+        (WebInspector.TimelineAgent):
+        (WebInspector.addItemToTimeline):
+        (WebInspector.timelineWasEnabled):
+        (WebInspector.timelineWasDisabled):
+        * inspector/front-end/inspector.html:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        (WebCore::FrameView::inspectorTimelineAgent):
+        * page/Page.cpp:
+        (WebCore::Page::inspectorTimelineAgent):
+        * page/Page.h:
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix unused variable warnings
+        https://bugs.webkit.org/show_bug.cgi?id=29018
+
+        No functional change, no tests.
+
+        * history/qt/HistoryItemQt.cpp:
+        (WebCore::HistoryItem::restoreState):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2009-09-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Use the declaration order in initializer lists
+        https://bugs.webkit.org/show_bug.cgi?id=29017
+
+        No functional change, no new tests.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+
+2009-09-08  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement ValidityState::typeMismatch() for <input type=number>.
+        https://bugs.webkit.org/show_bug.cgi?id=28934
+
+        Test: fast/forms/ValidityState-typeMismatch-number.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formStringToDouble):
+        * html/HTMLInputElement.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        * html/ValidityState.h:
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Another attempt of a buildfix.
+
+        * GNUmakefile.am: Modified. Remove some extra IDL files added in r48153.
+
+2009-09-08  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make cursor set cleaner in QtWebKit Api: eliminate SetCursorEvent hack.
+        https://bugs.webkit.org/show_bug.cgi?id=28865
+
+        Save the QCursor as a property in WidgetQt::setCursor
+        and actually change the cursor in QWebView::event() by making use
+        of the QEvent::DynamicPropertyChange event type.
+        When unsetCursor() is called on the QWidget we can fallback to
+        the cursor set by WebCore.
+
+        Patch by Kenneth Rohde Christiansen <kenneth@webkit.org> and
+                 Antonio Gomes <antonio.gomes@openbossa.org> on 2009-09-07
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setCursor):
+
+2009-09-08  Andras Becsi  <becsi.andras@stud.u-szeged.hu>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] Buildfix for build error introduced in r48150.
+
+        * GNUmakefile.am: Modified. Added missing IDL files.
+
+2009-09-08  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Buildfix. Build error caused by r48150.
+
+        * WebCore.pro: missing IDL files added
+
+2009-09-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Update Canvas 3D implementation to match spec
+        https://bugs.webkit.org/show_bug.cgi?id=29010
+
+        This adds several new CanvasXXXArray classes each of which has a custom constructor
+        and custom getters and setters. Also changed CanvasRenderingContext3D and GraphicsContext3D
+        to match the new and changed API.
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasArrayBufferConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayBufferConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasFloatArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::bufferData):
+        (WebCore::JSCanvasRenderingContext3D::bufferSubData):
+        (WebCore::JSCanvasRenderingContext3D::texImage2D):
+        (WebCore::JSCanvasRenderingContext3D::texSubImage2D):
+        * bindings/js/JSCanvasShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedByteArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedIntArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayConstructor.h: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSCanvasUnsignedShortArrayCustom.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::canvasArrayBuffer):
+        (WebCore::JSDOMWindow::canvasByteArray):
+        (WebCore::JSDOMWindow::canvasUnsignedByteArray):
+        (WebCore::JSDOMWindow::canvasIntArray):
+        (WebCore::JSDOMWindow::canvasUnsignedIntArray):
+        (WebCore::JSDOMWindow::canvasShortArray):
+        (WebCore::JSDOMWindow::canvasUnsignedShortArray):
+        (WebCore::JSDOMWindow::canvasFloatArray):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArray.idl: Added.
+        * html/canvas/CanvasArrayBuffer.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasArrayBuffer.idl: Added.
+        * html/canvas/CanvasByteArray.cpp:
+        * html/canvas/CanvasByteArray.h:
+        * html/canvas/CanvasByteArray.idl:
+        * html/canvas/CanvasFloatArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasFloatArray.idl: Added.
+        * html/canvas/CanvasIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasIntArray.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::CanvasRenderingContext3D):
+        (WebCore::CanvasRenderingContext3D::markContextChanged):
+        (WebCore::CanvasRenderingContext3D::beginPaint):
+        (WebCore::CanvasRenderingContext3D::endPaint):
+        (WebCore::CanvasRenderingContext3D::reshape):
+        (WebCore::CanvasRenderingContext3D::sizeInBytes):
+        (WebCore::CanvasRenderingContext3D::bindTexture):
+        (WebCore::CanvasRenderingContext3D::bufferData):
+        (WebCore::CanvasRenderingContext3D::bufferSubData):
+        (WebCore::CanvasRenderingContext3D::checkFramebufferStatus):
+        (WebCore::CanvasRenderingContext3D::clear):
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        (WebCore::CanvasRenderingContext3D::deleteBuffer):
+        (WebCore::CanvasRenderingContext3D::deleteFramebuffer):
+        (WebCore::CanvasRenderingContext3D::deleteProgram):
+        (WebCore::CanvasRenderingContext3D::deleteRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::deleteShader):
+        (WebCore::CanvasRenderingContext3D::deleteTexture):
+        (WebCore::CanvasRenderingContext3D::drawArrays):
+        (WebCore::CanvasRenderingContext3D::drawElements):
+        (WebCore::CanvasRenderingContext3D::getBoolean):
+        (WebCore::CanvasRenderingContext3D::getBooleanv):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getBufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getFloat):
+        (WebCore::CanvasRenderingContext3D::getFloatv):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::CanvasRenderingContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::CanvasRenderingContext3D::getInteger):
+        (WebCore::CanvasRenderingContext3D::getIntegerv):
+        (WebCore::CanvasRenderingContext3D::getProgrami):
+        (WebCore::CanvasRenderingContext3D::getProgramiv):
+        (WebCore::CanvasRenderingContext3D::getProgramInfoLog):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteri):
+        (WebCore::CanvasRenderingContext3D::getRenderbufferParameteriv):
+        (WebCore::CanvasRenderingContext3D::getShaderi):
+        (WebCore::CanvasRenderingContext3D::getShaderiv):
+        (WebCore::CanvasRenderingContext3D::getShaderInfoLog):
+        (WebCore::CanvasRenderingContext3D::getShaderSource):
+        (WebCore::CanvasRenderingContext3D::getTexParameterf):
+        (WebCore::CanvasRenderingContext3D::getTexParameterfv):
+        (WebCore::CanvasRenderingContext3D::getTexParameteri):
+        (WebCore::CanvasRenderingContext3D::getTexParameteriv):
+        (WebCore::CanvasRenderingContext3D::getUniformf):
+        (WebCore::CanvasRenderingContext3D::getUniformfv):
+        (WebCore::CanvasRenderingContext3D::getUniformi):
+        (WebCore::CanvasRenderingContext3D::getUniformiv):
+        (WebCore::CanvasRenderingContext3D::getUniformLocation):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribf):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribfv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribi):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribiv):
+        (WebCore::CanvasRenderingContext3D::getVertexAttribOffset):
+        (WebCore::CanvasRenderingContext3D::texImage2D):
+        (WebCore::CanvasRenderingContext3D::texParameterf):
+        (WebCore::CanvasRenderingContext3D::texParameteri):
+        (WebCore::CanvasRenderingContext3D::texSubImage2D):
+        (WebCore::CanvasRenderingContext3D::uniform1f):
+        (WebCore::CanvasRenderingContext3D::uniform1fv):
+        (WebCore::CanvasRenderingContext3D::uniform1i):
+        (WebCore::CanvasRenderingContext3D::uniform1iv):
+        (WebCore::CanvasRenderingContext3D::uniform2f):
+        (WebCore::CanvasRenderingContext3D::uniform2fv):
+        (WebCore::CanvasRenderingContext3D::uniform2i):
+        (WebCore::CanvasRenderingContext3D::uniform2iv):
+        (WebCore::CanvasRenderingContext3D::uniform3f):
+        (WebCore::CanvasRenderingContext3D::uniform3fv):
+        (WebCore::CanvasRenderingContext3D::uniform3i):
+        (WebCore::CanvasRenderingContext3D::uniform3iv):
+        (WebCore::CanvasRenderingContext3D::uniform4f):
+        (WebCore::CanvasRenderingContext3D::uniform4fv):
+        (WebCore::CanvasRenderingContext3D::uniform4i):
+        (WebCore::CanvasRenderingContext3D::uniform4iv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix2fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix3fv):
+        (WebCore::CanvasRenderingContext3D::uniformMatrix4fv):
+        (WebCore::CanvasRenderingContext3D::useProgram):
+        (WebCore::CanvasRenderingContext3D::validateProgram):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib1fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib2fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib3fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4f):
+        (WebCore::CanvasRenderingContext3D::vertexAttrib4fv):
+        (WebCore::CanvasRenderingContext3D::vertexAttribPointer):
+        (WebCore::CanvasRenderingContext3D::viewport):
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * html/canvas/CanvasShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasShortArray.idl: Added.
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::CanvasTexture):
+        * html/canvas/CanvasTexture.h:
+        (WebCore::CanvasTexture::isCubeMapRWrapModeInitialized):
+        (WebCore::CanvasTexture::setCubeMapRWrapModeInitialized):
+        * html/canvas/CanvasUnsignedByteArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedByteArray.h: Added with properties svn:eol-style and svn:mime-type.
+         * html/canvas/CanvasUnsignedByteArray.idl: Added.
+        * html/canvas/CanvasUnsignedIntArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedIntArray.idl: Added.
+        * html/canvas/CanvasUnsignedShortArray.cpp: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.h: Added with properties svn:eol-style and svn:mime-type.
+        * html/canvas/CanvasUnsignedShortArray.idl: Added.
+        * page/DOMWindow.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::beginPaint):
+        (WebCore::GraphicsContext3D::endPaint):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::getBoolean):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getFloat):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getInteger):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getBufferParameteri):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteri):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getProgrami):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteri):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderi):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getTexParameterf):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteri):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformf):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformi):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getVertexAttribf):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribi):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::sizeInBytes):
+
+2009-09-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Make m_windowVisible more consistent with the actual visibility of the inspector.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed speculative build fix for Snow Leopard.
+
+        * platform/GeolocationService.cpp:
+        (WebCore::createGeolocationServiceNull):
+
+2009-09-07  Steve Block  <steveblock@google.com>
+
+        Reviewed by Adam Barth.
+
+        Adds a mock Geolocation service. This will be used to provide predictable behavior of the
+        Geolocation API for use in LayoutTests. Later changes will integrate the the mock
+        Geolocation service with DumpRenderTree.
+        https://bugs.webkit.org/show_bug.cgi?id=28264
+
+        The mock Geolocation service returns a fixed position or error. This position or error can be
+        set through static methods on the GeolocationService class. The position or error is shared
+        between all instances of the mock Geolocation service.
+
+        Implementation details.
+        The GeolocationService object maintains a pointer to a factory function which it uses to create
+        Geolocation service instances. Each platform implementing Geolocation sets this pointer
+        to the factory function for their platform's implementation. When the mock Geolocation service
+        is activated, the factory function pointer is reset to the factory function for the mock service.
+
+        Test: fast/dom/Geolocation/error.html
+
+        * WebCore.base.exp: Modified. Exports GeolocationServiceMock methods.
+        * GNUMakefile.am: Modified. Added GeolocationServiceMock files.
+        * WebCore.gypi: Modified. Added GeolocationServiceMock files.
+        * WebCore.pro: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCore.vcproj: Modified. Added GeolocationServiceMock files.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Modified. Added mock directory to includes.
+        * WebCore.xcodeproj/project.pbxproj: Modified. Added GeolocationServiceMock files and exports some headers.
+        * WebCoreSources.bkl: Modified. Added GeolocationServiceMock files.
+        * page/ChromeClient.h: Modified. Fixed comment.
+        * page/Geolocation.cpp: Modified.
+        (WebCore::Geolocation::setIsAllowed): Modified. Fixed error string.
+        * platform/GeolocationService.cpp: Modified.
+        (WebCore::createGeolocationServiceNull): Added. Returns null in place of a Geolocation service. Used to avoid link errors on platforms where Geolocation is not implemented.
+        (WebCore::GeolocationService::create): Added. Uses the factory function pointer to create a Geolocation service implementation.
+        (WebCore::GeolocationService::useMock): Added. Configures the GeolocationServie to use the mock implementation.
+        * platform/GeolocationService.h: Modified.
+        * platform/mock: Added.
+        * platform/mock/GeolocationServiceMock.cpp: Added.
+        (WebCore::GeolocationServiceMock::create): Added. Creates a GeolocationServiceMock object.
+        (WebCore::GeolocationServiceMock::GeolocationServiceMock): Added. Constructor.
+        (WebCore::GeolocationServiceMock::~GeolocationServiceMock): Added. Destructor.
+        (WebCore::GeolocationServiceMock::setPosition): Added. Sets the position that will be returned by the object.
+        (WebCore::GeolocationServiceMock::setError): Added. Sets the error that will be returned by the object.
+        (WebCore::GeolocationServiceMock::startUpdating): Added. GeolocationService implementation. Starts the service.
+        (WebCore::GeolocationServiceMock::stopUpdating): Added. GeolocationService implementation. Stops the service.
+        (WebCore::GeolocationServiceMock::timerFired): Added. Used to provide an asynchronous callback when the service is started.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallbackFromAllInstances): Added. Used to call back when the position or error is updated.
+        (WebCore::GeolocationServiceMock::makeGeolocationCallback): Added. Used to call back when the service starts.
+        (WebCore::GeolocationServiceMock::initStatics): Added. Initializes statics members with constructors.
+        (WebCore::GeolocationServiceMock::cleanUpStatics): Added. Cleans up static members with constructors.
+        * platform/mock/GeolocationServiceMock.h: Added.
+        (WebCore::GeolocationServiceMock::lastPosition): Added. Returns the fixed position.
+        (WebCore::GeolocationServiceMock::lastError): Added. Returns the fixed error.
+        * platform/gtk/GeolocationServiceGtk.cpp: Modified.
+        (WebCore::GeolocationServiceGtk::create): Added. Creates an instance of GeolocationServiceGtk.
+        * platform/gtk/GeolocationServiceGtk.h: Modified.
+        * platform/mac/GeolocationServiceMac.h: Modified.
+        * platform/mac/GeolocationServiceMac.mm: Modified.
+        (WebCore::GeolocationServiceMac::create): Added. Creates an instance of GeolocationServiceMac.
+
+2009-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28985
+
+        We need to be slightly more careful about how we pick up a script
+        execution context.  In particular, we were getting the wrong document
+        for frames that had been navigated somewhere else.
+
+        In the long term, we should think about a better algorithm for
+        computing the script context.
+
+        Fixes LayoutTests/http/tests/xmlhttprequest/detaching-frame-2.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::retrieveFrame):
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for 2.8 compilation.
+
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Reverting r48121 to fix Windows build errors.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed speculative build fix.
+
+        Reverted previous build fix as it didn't fix the problem.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Fix build after SHARED_WORKERS are enabled by default (r48131)
+
+        * WebCore.pro:
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Unreviewed build fix.
+
+        Temporarily removed depenency between JSEventTarget.cpp and WebSocket.h in an attempt to fix a windows build break.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+
+2009-09-07  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Enable SHARED_WORKERS by default.
+        https://bugs.webkit.org/show_bug.cgi?id=28959
+
+        Tests (enabled in a separate patch):
+               fast/workers/shared-worker-constructor.html
+               fast/workers/shared-worker-context-gc.html
+               fast/workers/shared-worker-event-listener.html
+               fast/workers/shared-worker-exception.html
+               fast/workers/shared-worker-frame-lifecycle.html
+               fast/workers/shared-worker-gc.html
+               fast/workers/shared-worker-lifecycle.html
+               fast/workers/shared-worker-load-error.html
+               fast/workers/shared-worker-location.html
+               fast/workers/shared-worker-navigator.html
+               fast/workers/shared-worker-replace-global-constructor.html
+               fast/workers/shared-worker-replace-self.html
+               fast/workers/shared-worker-shared.html
+               fast/workers/shared-worker-simple.html
+               http/tests/workers/shared-worker-importScripts.html
+               http/tests/workers/shared-worker-redirect.html
+               http/tests/xmlhttprequest/workers/shared-worker-close.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods-async.html
+               http/tests/xmlhttprequest/workers/shared-worker-methods.html
+               http/tests/xmlhttprequest/workers/shared-worker-xhr-file-not-found.html
+
+        * config.h: Removed some whitespace/touched the file to force a full rebuild on the build-bots.
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * dom/DOMWindow.idl: Removed unnecessary whitespace to force a rebuild on the build-bots to pickup the flag change.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        Clean up bitrot in SharedWorker code - DenyCrossOriginRedirect is now DenyCrossOriginRequests.
+        * workers/SharedWorkerContext.cpp:
+        (WebCore::SharedWorkerContext::dispatchConnect):
+        Clean up bitrot - updated SharedWorker code to reflect new MessageEvent API.
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add new file to sources list.
+
+        * GNUmakefile.am:
+
+2009-09-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for wx SVN trunk. 
+
+        * config.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp:
+        (wxRenderer_DrawScrollbar):
+
+2009-09-07  Chris Hills <chaz@chaz6.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Use direct includes for Phonon, not the pretty ones
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+
+2009-09-07  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WebSocket API implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=28038
+        
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once the code is completed and functional.
+
+        * DerivedSources.cpp:
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::webSocket):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toWebSocket):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * websockets/WebSocket.cpp:
+        (WebCore::ProcessWebSocketEventTask::create):
+        (WebCore::ProcessWebSocketEventTask::performTask):
+        (WebCore::ProcessWebSocketEventTask::ProcessWebSocketEventTask):
+        (WebCore::isValidProtocolString):
+        (WebCore::WebSocket::connect):
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        (WebCore::WebSocket::bufferedAmount):
+        (WebCore::WebSocket::addEventListener):
+        (WebCore::WebSocket::removeEventListener):
+        (WebCore::WebSocket::dispatchEvent):
+        (WebCore::WebSocket::didConnect):
+        (WebCore::WebSocket::didReceiveMessage):
+        (WebCore::WebSocket::didClose):
+        (WebCore::WebSocket::dispatchOpenEvent):
+        (WebCore::WebSocket::dispatchMessageEvent):
+        (WebCore::WebSocket::dispatchCloseEvent):
+        * websockets/WebSocket.h:
+        (WebCore::WebSocket::create):
+        (WebCore::WebSocket::):
+        (WebCore::WebSocket::setOnopen):
+        (WebCore::WebSocket::onopen):
+        (WebCore::WebSocket::setOnmessage):
+        (WebCore::WebSocket::onmessage):
+        (WebCore::WebSocket::setOnclose):
+        (WebCore::WebSocket::onclose):
+        (WebCore::WebSocket::toWebSocket):
+        (WebCore::WebSocket::eventListeners):
+        (WebCore::WebSocket::refEventTarget):
+        (WebCore::WebSocket::derefEventTarget):
+        * websockets/WebSocketChannel.cpp: Added.
+        * websockets/WebSocketChannel.h: Added.
+        * websockets/WebSocketChannelClient.h: Added.
+        * websockets/WebSocketHandshake.cpp: Added.
+        * websockets/WebSocketHandshake.h: Added.
+
+2009-09-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26854
+        [GTK] Needs API to allow more control over outgoing requests
+
+        Add infrastructure required to provide the new
+        WebKitNetworkResponse object in our API.
+
+        * GNUmakefile.am: Add new files to the build.
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+        * platform/network/soup/ResourceResponse.h:
+        * platform/network/soup/ResourceResponseSoup.cpp: Added.
+        (WebCore::ResourceResponse::toSoupMessage):
+
+2009-09-07  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Cleanup document/frame null-checking in V8DOMWindowCustom.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=29009
+
+        Be consistent in document and frame null checks.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+
+2009-09-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [Soup] Limit the number of connections
+        https://bugs.webkit.org/show_bug.cgi?id=18431
+
+        Increase the maximum number of per host and total connections to
+        similar values than those used by the other modern browsers. Seems
+        to significantly improve page loading time in many cases.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Various minor chromium appcache modifications.
+        https://bugs.webkit.org/show_bug.cgi?id=28960
+
+        No new tests.
+
+        * bindings/v8/custom/V8DOMApplicationCacheCustom.cpp:
+          Fix a null pointer exception.
+        (WebCore::ACCESSOR_GETTER):
+        * platform/network/chromium/ResourceRequest.h:
+          Switch from appCache 'context' to 'host' terminology.
+          Note: leaving the old deprecated accessors in place until the matching
+          change in chrome is landed to use the new accessors.
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheHostID):
+        (WebCore::ResourceRequest::setAppCacheHostID):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+          Add an appCacheManifestURL getter/setter.
+          Drop the 'get' prefix from the appCacheID getter.
+          Note: leaving the old deprecated 'get' prefixed accessor in place until the matching
+          change in chrome is landed to use the new accessor.
+        (WebCore::ResourceResponse::appCacheID):
+        (WebCore::ResourceResponse::appCacheManifestURL):
+        (WebCore::ResourceResponse::setAppCacheManifestURL):
+        (WebCore::ResourceResponse::getAppCacheID):
+
+2009-09-07  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28359
+        Cleanup: Undo some accidental changes around DOMApplicationCache.
+        - Restore support for constructing a DOMApplicationCache object with a null frame ptr.
+        - Return a non-null object for window.applicationCache when the feature is disabled.
+        - Simplify the swapCache method.
+
+        Test: http/tests/appcache/disabled.html
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::DOMApplicationCache):
+        (WebCore::DOMApplicationCache::swapCache):
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::applicationCache):
+
+2009-09-06  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        handle the case of port 0.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+
+2009-09-06  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make hidden elements not focusable.
+
+        Clean up supportsFocus and isFocusable.
+        supportsFocus now strictly means that the node can be focused by default.
+        This is true for links, form controls and content editable elements for example.
+        isFocusable means that the user can actually focus it.
+        All (2) calls to supportsFocus have been updated to take this into account.
+        
+        Make a elements without href work correctly as well.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27099
+
+        Tests: fast/events/click-focus-anchor.html
+               fast/events/tab-focus-anchor.html
+               fast/events/tab-focus-hidden.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::focus):
+        * dom/Node.cpp:
+        (WebCore::Node::supportsFocus):
+        (WebCore::Node::isFocusable):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::supportsFocus):
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::supportsFocus):
+        * html/HTMLAreaElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::supportsFocus):
+        * html/HTMLElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::supportsFocus):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::supportsFocus):
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::supportsFocus):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::supportsFocus):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::supportsFocus):
+        (WebCore::HTMLOptGroupElement::isFocusable):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::supportsFocus):
+        (WebCore::HTMLOptionElement::isFocusable):
+        * html/HTMLOptionElement.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::supportsFocus):
+        (WebCore::SVGAElement::isFocusable):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::supportsFocus):
+        * wml/WMLAElement.h:
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::supportsFocus):
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+
+2009-09-06  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by Dimitri Glazkov.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        Default value is set to that of RenderTheme::caretBlankInterval().
+        Uses caretBlinkIntervalInternal to avoid overriding
+        RenderThemeChromiumSkia::caretBlankInterval to preserve the disabling
+        of blinking caret required for layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-06  Ada Chan  <adachan@apple.com>
+
+        Remove an extra </File> in WebCore.vcproj.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-06  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a persistent setting for color format in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28889
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * inspector/front-end/Color.js: Minor style fixes.
+        (WebInspector.Color.prototype.toString): Added. Replaces the individual
+        "toFoo" functions. Takes a optional arguments for the color format to return.
+        * inspector/front-end/Images/paneSettingsButtons.png: Added.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype._changeColorFormat): Update the sections to show
+        the new color format.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay):
+        Use the new toString function on Color.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Use the persistent setting
+        to format colors by default. Add a tooltip for the color swatch.
+        * inspector/front-end/inspector.css: New styles for the settings menu.
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded): Initilize the colorFormat preference.
+
+2009-09-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove Qt v4.6 check from the prefetchDNS implementation
+        https://bugs.webkit.org/show_bug.cgi?id=28993
+
+        * platform/network/qt/DnsPrefetchHelper.cpp:
+        * platform/network/qt/DnsPrefetchHelper.h:
+
+2009-09-06  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Drop <definition-src> support
+        https://bugs.webkit.org/show_bug.cgi?id=28991
+
+        http://dev.w3.org/SVG/profiles/1.1F2/publish/changes.html#FontsChapter
+
+        * DerivedSources.cpp: Remove references to definition-src.
+        * DerivedSources.make: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap): Ditto.
+        * bindings/objc/DOMSVG.h: Ditto.
+        * bindings/v8/DerivedSourcesAllInOne.cpp: Ditto.
+        * bindings/v8/V8DOMWrapper.cpp: Ditto.
+        * bindings/v8/V8Index.cpp: Ditto.
+        * bindings/v8/V8Index.h: Ditto.
+        * svg/SVGAllInOne.cpp: Ditto.
+        * svg/SVGDefinitionSrcElement.cpp: Removed.
+        * svg/SVGDefinitionSrcElement.h: Removed.
+        * svg/SVGDefinitionSrcElement.idl: Removed.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace): Don't search for
+        definition-src child.
+        * svg/svgtags.in: Remove definition-src.
+
+2009-09-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Roll out http://trac.webkit.org/changeset/48094, because the
+        logic of retrieving default caret blink interval was incorrect (non-existent)
+        and caused layout test flakiness.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (Chromium reliability build break).
+
+        Back up partial change in r48072 in order to fix chromium reliability build break.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2009-09-05  Nicolas Weber  <thakis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28975
+        Fix file upload on chrome/mac. Images that have "Hide Extension" set,
+        such as screenshots by default, can now be uploaded to sites such as
+        imgur.com.
+
+        * platform/FileSystem.h:
+        Add pathGetDisplayFileName().
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+        Call pathGetDisplayFileName() instead of pathGetFileName().
+        * platform/chromium/FileSystemChromiumLinux.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+        * platform/chromium/FileSystemChromiumMac.mm:
+        (WebCore::pathGetFileName):
+        Now returns a real filename instead of a presentational one, which
+        fixes the problem addressed by this change.
+        (WebCore::pathGetDisplayFileName):
+        New function that returns a presentational filename; does what
+        pathGetDisplayFileName() did prior to this patch.
+        * platform/chromium/FileSystemChromiumWin.cpp:
+        (WebCore::pathGetDisplayFileName):
+        Implement pathGetDisplayFileName() by delegating to pathGetFileName().
+
+2009-09-05  Joel Stanley  <joel@jms.id.au>
+
+        Reviewed by David Levin.
+
+        Expose functions to set the caret blink interval for Linux Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28931
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::setCaretBlinkInterval):
+        (WebCore::RenderThemeChromiumLinux::caretBlinkInterval):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Prevent UI freeze in case when too many timers are in the timer queue.
+        https://bugs.webkit.org/show_bug.cgi?id=23865
+
+        The fix measures the elapsed time while executing timers. If we have too many
+        timers and it takes significant time to fire, quit the loop and reschedule.
+        This lets the run loop process user input (close the window for example).
+
+        * platform/ThreadTimers.h:
+        * platform/ThreadTimers.cpp:
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        Removed functions and members used before to grab a list of all expired timers.
+        Now we fetch one by one, measuring time and quitting the loop if it takes too long.
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::setNextFireTime):
+        Since timers are now fired one by one, there is no need to keep track of updated timers.
+        * manual-tests/input-starved-by-timers.html: Manual test that attempts to freeze browser by
+        creating of enough timers. It then keeps UI frozen and after 10 seconds starts to drain the timers
+        so the browser un-freezes. This is instead of a regular layout test because we don't have a way
+        to inject an input events via regular run loop in DRT - instead they are directly dispatched by
+        eventSender, which does not reproduce the UI freeze that happens with real input.
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7201063>
+        
+        Detach any custom scrollbars before detaching the document.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+
+2009-09-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+                Unreviewed, build fix.
+
+                Remove remaining references to UserStyleSheetLoader after r48075.
+
+                * WebCore.gypi:
+                * WebCore.xcodeproj/project.pbxproj:
+                * page/qt/FrameQt.cpp:
+                * page/wince/FrameWince.cpp:
+
+2009-09-04  Michelangelo De Simone  <micdesim@gmail.com>
+
+                Reviewed by David Levin.
+
+                https://bugs.webkit.org/show_bug.cgi?id=28988
+                Minor fix: "novalidate" attribute renamed in "noValidate", according to
+                HTML5 specs:
+                http://www.whatwg.org/specs/web-apps/current-work/#dom-fs-novalidate
+
+                * html/HTMLFormElement.cpp:
+                (WebCore::HTMLFormElement::noValidate):
+                (WebCore::HTMLFormElement::setNoValidate):
+                * html/HTMLFormElement.h:
+                * html/HTMLFormElement.idl:
+
+2009-09-04  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused line of code from WorkerContext
+        https://bugs.webkit.org/show_bug.cgi?id=28990
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+
+2009-09-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix assertion seen when running buildbot.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObjectWithGlobalPointer::createStructure): Create the structure without
+        the HasDefaultMark bit since this has a custom mark function.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28984, remove the remote stylesheet loader on Mac/Qt.
+        Make sure the other code path (now used by everybody) can handle data URLs.
+
+        As per the post on webkit-dev, the ability to work remotely isn't working properly anyway (it doesn't
+        hold up the pending sheet count, so you'd just FOUC on every Web page), and it's extremely unlikely
+        that anybody is relying on this support.
+        
+        Tor Arne agreed it was ok to disable (he enabled it on the Qt side), and only Mac/Qt were using this
+        code.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::userStyleSheet):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * loader/UserStyleSheetLoader.cpp: Removed.
+        * loader/UserStyleSheetLoader.h: Removed.
+        * page/Frame.cpp:
+        (WebCore::Frame::reapplyStyles):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        (WebCore::Page::userStyleSheet):
+        * page/mac/FrameMac.mm:
+        * page/qt/FrameQt.cpp:
+
+2009-09-04  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add "sampling profiler" preference, simplify data display when it's set.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28969
+
+        * inspector/front-end/ProfileDataGridTree.js:
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        * inspector/front-end/inspector.js:
+
+2009-09-04  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Run-time exception in onmessage handler is not forwarded to the worker object.
+        https://bugs.webkit.org/show_bug.cgi?id=28980
+
+        Tested by worker-close.html.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::getScriptExecutionContext):
+        (WebCore::reportException):
+        * bindings/v8/V8Utilities.h:
+        (WebCore::getScriptExecutionContext):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SharedWorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove unused m_sheet variable and setCSSStyleSheet methods.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Adele Peterson.
+
+        (Based on a patch from Adele).
+        
+        Fix <rdar://problem/7185875>.
+        
+        * page/Frame.cpp:
+        (WebCore::Frame::setView):
+        Detach any custom scroll bars from the old view.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Simplify the check (and make it work when body is null) by just checking that the scroll bar owner is
+        not a RenderPart object.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        ASSERT that frame() is not null here and also add a null check so that release builds won't crash.
+
+2009-09-04  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Make m_userStyleSheetLoader in Frame an OwnPtr.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2009-09-04  Timothy Hatcher  <timothy@apple.com>
+
+        Show color swatches in the Web Inspector before the color text so clicking them will not
+        shift the swatch. Also makes multiple swatches in the single property toggle the color format.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28978
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle): Some refactoring to consolidate
+        the processing we do on the property value. This eliminated the old nickname code, since the new
+        WebInspector.Color class handles this. We could also simplify the color regex since more
+        is handled by the Color class. Also no longer uses innerHTML for the linkify code.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processValue): Helper function to
+        process a value given a regex and processor functions. 
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.linkifyURL): Make an anchor for the
+        URL with "url()" syntax surrounding it.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor): Makes a color, if
+        there was an exception just return a text node.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay.changeTo):
+        Moved from later in the file.
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle.processColor.changeColorDisplay): Ditto.
+        * inspector/front-end/inspector.css:
+
+2009-09-04  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Account for scrollbar state changes that occur during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+
+        Eliminate duplicated (and incorrect) scrollbar mode tracking between
+        FrameView and ScrollView.
+
+2009-09-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        hostname and host are mixed up when manipulating anchor elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28954
+
+        Swapped the implementation of host and hostname, and made sure not to return
+        the port number if it is default for the given protocol. 
+        FireFox also avoids returning the protocol number if it is default.
+
+        Test: fast/dom/Element/hostname-host.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::host):
+        (WebCore::HTMLAnchorElement::hostname):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::isDefaultPortForProtocol):
+        * page/SecurityOrigin.h:
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Steve Falkenburg.
+
+        Fix <rdar://problem/7192902>.
+
+        Add the necessary plumbing for having QTMovieWin use WebCore timers.
+        
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::TaskTimer::initialize):
+        Create the timer and call QTMovieWin::setTaskTimerFuncs.
+        
+        (WebCore::TaskTimer::setTaskTimerDelay):
+        Start the timer.
+        
+        (WebCore::TaskTimer::stopTaskTimer):
+        Stop the timer.
+        
+        (WebCore::TaskTimer::fired):
+        Call QTMovieWin::taskTimerFired().
+        
+        (WebCore::MediaPlayerPrivate::load):
+        Initialize the Task timer.
+        
+        * platform/graphics/win/QTMovieWin.cpp:
+        (updateTaskTimer):
+        Call the global stopTaskTimer function and setTaskTimerDelay.
+        
+        (QTMovieWin::taskTimerFired):
+        Make this a member function.
+        
+        (QTMovieWin::setTaskTimerFuncs):
+        Set the global function pointers.
+        
+        (QTMovieWin::initializeQuickTime):
+        (DllMain):
+        No need to use the QT shared timer.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix Chromium Win compile.  Missing return statement in
+        WebCore::RenderThemeChromiumSkia::paintSliderThumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28974
+
+        No new tests, build fix.
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+
+2009-09-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Rolling out http://trac.webkit.org/changeset/48035, because it broke
+        the build.
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+2009-09-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix vcproj file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-09-03  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28890, make simple user script injection work.
+        
+        This patch adds new API for adding and removing user scripts from page groups.  User scripts
+        are bundled together in isolated worlds (you can have multiple scripts together in the same
+        world).
+
+        Added userscripts/ directory for holding new tests (along with a simple test of script injection).
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInIsolatedWorld):
+        * bindings/v8/ScriptController.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+        (WebCore::FrameLoader::dispatchDocumentElementAvailable):
+        * page/Frame.cpp:
+        (WebCore::Frame::injectUserScripts):
+        (WebCore::Frame::injectUserScriptsForWorld):
+        * page/Frame.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::~PageGroup):
+        (WebCore::PageGroup::addUserScript):
+        (WebCore::PageGroup::removeUserContentForWorld):
+        (WebCore::PageGroup::removeAllUserContent):
+        * page/PageGroup.h:
+        (WebCore::PageGroup::userScripts):
+        * page/UserScript.h: Added.
+        (WebCore::UserScript::UserScript):
+        (WebCore::UserScript::source):
+        (WebCore::UserScript::url):
+        (WebCore::UserScript::patterns):
+        (WebCore::UserScript::worldID):
+        (WebCore::UserScript::injectionTime):
+        * page/UserScriptTypes.h: Added.
+        (WebCore::):
+
+2009-09-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26402
+        Crashes when using a detached DocumentType node
+
+        Test: fast/dom/DOMImplementation/detached-doctype.html
+
+        DocumentType nodes are the only one that can have null document(), and they can never have
+        children, so they are a degenerate case for NodeLists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Don't try register node list with document if there's no
+        document. Since there are no changes possible for a DocumentType's node list, this is not
+        necessary.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::unregisterDynamicNodeList): Ditto. I couldn't find a scenario where this
+        was invoked for a DocumentType node, but I also couldn't prove that it can't be (the
+        de-registration code path that I saw taken was via Node destructor, and that already has
+        a null check for document).
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener): Bail out if there is no document (just as we already do
+        if there is no window).
+        (WebCore::JSNode::removeEventListener): Ditto.
+
+2009-09-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] loadFinished never emitted
+        https://bugs.webkit.org/show_bug.cgi?id=28935
+
+        Do not report errors right away from
+        ResourceHandle::start. Instead return true and schedule an error
+        to be reported in the handle later. Otherwise WebCore gets
+        confused and thinks the resource never finished loading, making it
+        not emit the finished status.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::startHttp):
+        (WebCore::):
+
+2009-09-04  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] DOM Storage bindings: Event Handler should create StorageEvents
+        https://bugs.webkit.org/show_bug.cgi?id=28942
+        
+        Tests:
+        Causes the following tests that were failing with V8 to pass:
+        * storage/domstorage/localstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/localstorage/complex-keys.html
+        * storage/domstorage/localstorage/onstorage-attribute-markup.html
+        * storage/domstorage/localstorage/simple-events.html
+        * storage/domstorage/localstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/localstorage/index-get-and-set.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-setwindow.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-markup.html
+        * storage/domstorage/sessionstorage/simple-events.html
+        * storage/domstorage/sessionstorage/onstorage-attribute-set-attribute.html
+        * storage/domstorage/sessionstorage/index-get-and-set.html
+
+        Code changes:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventToV8Object):  Create StorageEvents.
+        * bindings/v8/custom/V8StorageCustom.cpp:
+        (WebCore::storageGetter): Check if we are retrieving the length property and return the number of items in the object rather than a property named length when invoking the getItem() member of local/sessionStorage.
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28911
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::dispatchOnInjectedScript):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._formatarray):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.dispatch):
+        * inspector/front-end/InjectedScriptAccess.js: Added.
+        (InjectedScriptAccess._installHandler.InjectedScriptAccess.methodName):
+        (InjectedScriptAccess._installHandler):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.html:
+
+2009-09-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement <input type="range"> for Chromium Linux by painting
+        the slider and the thumb using skia.
+        https://bugs.webkit.org/show_bug.cgi?id=28928
+
+        Covered by existing tests (we're currently hitting an assert for them).
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::adjustSliderThumbSize):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        * rendering/RenderThemeChromiumSkia.h:
+
+2009-09-04  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Implement <input type=color> as a text field.
+        - ValidityState::typeMismatch supports for type=color.
+        https://bugs.webkit.org/show_bug.cgi?id=28966
+
+        Tests: fast/forms/ValidityState-patternMismatch-unsupported.html
+               fast/forms/ValidityState-typeMismatch-color.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::patternMismatch):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::dataList):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+        (WebCore::ValidityState::isValidColorString):
+        * html/ValidityState.h:
+
+2009-09-04  Mads Ager  <ager@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Crash when updating document cache
+        https://bugs.webkit.org/show_bug.cgi?id=28965
+
+        Initialization of a V8 JavaScript context can fail.  When that
+        happens, do not attempt to update the document wrapper cache.
+
+        This code path is exercised by http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html.
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::updateDocument):
+
+2009-09-04  Yaar Schnitman  <yaar@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Two bugs:
+
+        https://bugs.webkit.org/show_bug.cgi?id=25489
+        CSS property background-position is now serialized in shorthand string as
+        background-position-x background-position-y, as the specification requires
+        (See http://www.w3.org/TR/2008/WD-css3-background-20080910/#the-background-position).
+        
+
+        https://bugs.webkit.org/show_bug.cgi?id=26541
+        CSS background-color is now be serialized before other background properties, 
+        as CSS specification requires (See http://dev.w3.org/csswg/cssom/#css-value).  
+
+        An existing layout test that accepted wrong order and skipped position test 
+        had to be modified.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add support for HTMLTextAreaElement.textLength
+        https://bugs.webkit.org/show_bug.cgi?id=28929
+
+        Test: fast/forms/textarea-textlength.html
+
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::textLength):
+        * html/HTMLTextAreaElement.idl:
+
+2009-09-03  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7180197>, https://bugs.webkit.org/show_bug.cgi?id=28822
+        REGRESSION(r31231): Creating document with current document's DOCTYPE causes crashes
+
+        Test: fast/dom/DOMImplementation/createDocument-with-used-doctype.html
+
+        * dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createDocument): Even though we
+        cannot raise an exception immediately out of fear of breaking Acid3, we shouldn't use a
+        DocumentType node in two documents.
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with Frames.
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached-with-frames.html
+               fast/loader/frames-with-unload-handlers-in-page-cache.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+
+2009-09-03  Steve VanDeBogart  <vandebo@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle middle click in Chromium like QT
+        https://bugs.webkit.org/show_bug.cgi?id=28696
+
+        Tested by middle-click-onpaste.html.
+
+        * platform/Pasteboard.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::isSelectionMode):
+        (WebCore::Pasteboard::setSelectionMode):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2009-09-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Fix a bug where subframes weren't asked if they were cacheable.
+
+        No new tests, especially since page caching for frames isn't turned on yet.
+        A layout test will come in my next patch, which enables frames in the page cache.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+
+2009-09-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by eric@webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24696
+
+        Added mixed content methods to FrameLoaderClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didDisplayInsecureContent):
+        (WebCore::EmptyFrameLoaderClient::didRunInsecureContent):
+        * loader/FrameLoaderClient.h:
+
+2009-09-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        [wx] Frames support
+        https://bugs.webkit.org/show_bug.cgi?id=19041
+
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::nativeWindowForRenderObject):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollbarThemeWx.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWx::~ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::scrollbarThickness):
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paintScrollCorner):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h: Added.
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/wxcode/gtk/scrollbar_render.cpp: Added.
+        (wxStyleForPart):
+        (GetButtonWidget):
+        (wxGetGdkWindowForDC):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/mac/carbon/scrollbar_render.cpp: Added.
+        (wxScrollbarPartToHIPressedState):
+        (wxRenderer_DrawScrollbar):
+        * platform/wx/wxcode/scrollbar_render.h: Added.
+        (calcThumbStartAndLength):
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/win/scrollbar_render.cpp: Added.
+        (GraphicsHDC::GraphicsHDC):
+        (GraphicsHDC::~GraphicsHDC):
+        (GraphicsHDC::operator HDC):
+        (getTSStateForPart):
+        (wxRenderer_DrawScrollbar):
+        * webcore-wx.bkl:
+
+2009-09-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Page content is not displayed in case of HTTP status error
+        https://bugs.webkit.org/show_bug.cgi?id=28949
+
+        If the server sent content, show it to the user instead of an error,
+        even if the HTTP status code is not success.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::resetState):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to update v8 bindings to support passing multiple ports to postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28839
+
+        Added support for passing MessagePortArray to v8 bindings.
+
+        New tests that now pass with V8:
+               fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * WebCore.gypi:
+        Added V8MessageEventCustom.cpp and V8MessagePortCustom.h
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added custom postMessage() handlers for various classes.
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::DOMWindowPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp:
+        (WebCore::DedicatedWorkerContextPostMessage):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessageEventCustom.cpp: Added.
+        (WebCore::MessageEventPorts):
+        Added getter for ports attribute.
+        (WebCore::MessageEventInitMessageEvent):
+        Added custom handler that supports MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::MessagePortPostMessage):
+        Added custom handler that supports MessagePortArray.
+        (WebCore::getMessagePortArray):
+        Added helper function that supports converting from a sequence-like object to a MessagePortArray.
+        * bindings/v8/custom/V8MessagePortCustom.h: Added.
+        Added declaration for getMessagePortArray().
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::WorkerPostMessage):
+        Added custom handler that supports MessagePortArray.
+
+2009-09-03  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to update JS bindings and IDL files to support multiple message ports in postMessage()
+        https://bugs.webkit.org/show_bug.cgi?id=28460
+
+        Added new toJSSequence() API which validates that a JSValue meets the WebIDL criteria for a sequence.
+
+        Tests: fast/events/message-port-multi.html
+               fast/workers/worker-context-multi-port.html
+               fast/workers/worker-multi-port.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSMessagePortCustom.h and JSMessageEventCustom.cpp.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toJSSequence):
+        Added toJSSequence() API to do validation on sequence-like objects per WebIDL.
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSDedicatedWorkerContextCustom.cpp:
+        (WebCore::JSDedicatedWorkerContext::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArrays.
+        * bindings/js/JSMessageEventCustom.cpp: Added.
+        (WebCore::JSMessageEvent::ports):
+        Added custom ports() getter that converts from MessagePortArray to JSArray.
+        (WebCore::JSMessageEvent::initMessageEvent):
+        Added support for passing a MessagePortArray.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        (WebCore::fillMessagePortArray):
+        New helper routine that validates/converts from a JS sequence o a WebCore::MessagePortArray.
+        * bindings/js/JSMessagePortCustom.h: Added.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::postMessage):
+        Added custom handler for postMessage() that handles being passed MessagePortArray.
+        * dom/MessageEvent.cpp:
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::ports):
+        Changed ports() to return a MessagePortArray* since this value can be null.
+        * dom/MessageEvent.idl:
+        Updated IDL to match HTML5 spec (now accepts MessagePortArrays instead of a solitary MessagePort).
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        * dom/MessagePort.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        * workers/DedicatedWorkerContext.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+        * workers/Worker.cpp:
+        * workers/Worker.h:
+        * workers/Worker.idl:
+        Updated IDL to match HTML5 spec (postMessage() now accepts MessagePortArrays instead of a solitary MessagePort).
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do not query non-function call frames for function name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28799
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+
+2009-09-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Crash after typing "clear" and pressing return in inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28684
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._clearConsoleMessages):
+        (InjectedScript._inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Squeezed out some performance from string conversion.
+        https://bugs.webkit.org/show_bug.cgi?id=28945
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::WebCoreStringResource::WebCoreStringResource):
+        (WebCore::WebCoreStringResource::~WebCoreStringResource):
+        (WebCore::WebCoreStringResource::data):
+        (WebCore::WebCoreStringResource::length):
+        (WebCore::WebCoreStringResource::atomicString):
+        (WebCore::WebCoreStringResource::string):
+        Avoid calling virtual length method. Be more explicit with
+        external memory computation. Avoid function calls in data and
+        length.
+        (WebCore::):
+        (WebCore::v8StringToWebCoreString):
+        (WebCore::v8StringToAtomicWebCoreString):
+        (WebCore::v8NonStringValueToWebCoreString):
+        (WebCore::v8NonStringValueToAtomicWebCoreString):
+        Avoid extra calls of WebCoreStringResource::toString. When
+        AtomicString is computed pass it immediately when constructing
+        WebCoreStringResource. Use inline buffer for small strings.
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToWebCoreString):
+        (WebCore::v8ValueToAtomicWebCoreString):
+        (WebCore::toString):
+        Inline dispatch of string vs. non-string values.
+
+2009-09-03  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Inlined common case of V8IsolatedWorld::getEntered to speed
+        up V8Proxy lookup.
+        https://bugs.webkit.org/show_bug.cgi?id=28946
+
+        * bindings/v8/V8IsolatedWorld.cpp:
+        (WebCore::V8IsolatedWorld::getEnteredImpl):
+        * bindings/v8/V8IsolatedWorld.h:
+        (WebCore::V8IsolatedWorld::getEntered):
+
+2009-09-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a regression bug that maxLength doesn't work for IME input.
+        https://bugs.webkit.org/show_bug.cgi?id=25253
+
+        Tests: fast/forms/input-maxlength-ime-completed.html
+               fast/forms/input-maxlength-ime-preedit.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-09-03  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        Make SVGStyleElement title/media/type setters do something
+        https://bugs.webkit.org/show_bug.cgi?id=28828
+
+        Test: svg/dom/style-reflect.html
+
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::setXmlspace): Actually change the attribute.
+        (WebCore::SVGStyleElement::setType): Ditto.
+        (WebCore::SVGStyleElement::setMedia): Ditto.
+        (WebCore::SVGStyleElement::setTitle): Ditto.
+
+2009-09-03  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28872
+        
+        Fixes a bug where handleEvent() in the V8 Custom SQL Statement Error binding would not return the correct result to WebCore after invoking the callback.
+
+        Test: storage/statement-error-callback.html
+
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent): Return true from handleEvent() if the callback raised an exception or the callback itself returned true.
+
+2009-09-03  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCustomPlatformData.cpp, FontCustomPlatformData.h,
+        and FontPlatformData.h
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/haiku/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/haiku/FontPlatformData.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::bold):
+        (WebCore::FontPlatformData::oblique):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading): Adopt the new enum form for FrameLoader::stopLoading().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Take an enum to decide whether to dispatch no unload events,
+          only unload, or unload and pagehide.
+        (WebCore::FrameLoader::closeURL):
+        (WebCore::FrameLoader::scheduleRedirection):
+        (WebCore::FrameLoader::cachePageForHistoryItem): Call pageHidden().
+        (WebCore::FrameLoader::pageHidden): Add to dispatch the pagehide event to all frames in the case
+          where a page is added to the PageCache.
+        * loader/FrameLoader.h:
+
+        * loader/FrameLoaderTypes.h: Add an UnloadEventPolicy enum.
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        - More CachedFrame destruction work.
+        - Including related Frame and FrameLoader changes and cleanup.
+
+        No new tests. (No change in behavior, current tests pass).
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore): Rebuild up the whole FrameTree when restoring.
+        (WebCore::CachedFrame::CachedFrame): Tear down the entire FrameTree when caching.
+        (WebCore::CachedFrame::destroy): For child frames that are being destroyed while in
+          the PageCache, do lightweight cleanup to:
+          A - Prevent referring to a stale Page object.
+          B - Prevent World Leaks of WebKit objects.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders): stopAllLoaders() should never be called on Frames that are
+          in the PageCache. ASSERT that fact.
+        (WebCore::FrameLoader::open): Remove a bogus release-build workaround, as the comment right above it
+          explains it is not effective, and it'd be better to see the crash locally instead of downstream.
+        (WebCore::FrameLoader::closeAndRemoveChild): Make sure the owner element has a page pointer before
+          referencing it.
+        (WebCore::FrameLoader::detachFromParent): Use the new detachViewsAndDocumentLoader() call
+        (WebCore::FrameLoader::detachViewsAndDocumentLoader): Does lightweight cleanup of client (WebKit) objects.
+        * loader/FrameLoader.h:
+
+        * page/Frame.cpp:
+        (WebCore::Frame::detachFromPage): Simply clear the Page pointer without doing any other work.
+        (WebCore::Frame::pageDestroyed): Use the new detachFromPage().
+        * page/Frame.h:
+
+2009-09-02  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        [Chromium] Add 'icu::' qualifier in preparation for ICU upgrade to 4.2
+        in Chromium. This is to fix a new file added in r28742 since the
+        last patch for this issue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Correct a typo to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Changed "Unpremultipled" to "Unmultiplied".
+
+2009-09-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [Chromium] Add a missing include to fix bustage, caused by r47991.
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added SkColorPriv include.
+
+2009-09-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Implement file support for DragData.
+        https://bugs.webkit.org/show_bug.cgi?id=28896
+
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsCompatibleContent):
+
+2009-09-02  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Protect libcurl shared data with Mutex objects via curl_set_share_opt.
+        https://bugs.webkit.org/show_bug.cgi?id=28920
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::sharedResourceMutex):
+        (WebCore::curl_lock_callback):
+        (WebCore::curl_unlock_callback):
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+
+2009-09-02  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Expose functions to change the focus ring color for Linux Chromium
+
+        https://bugs.webkit.org/show_bug.cgi?id=28887
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::setFocusRingColor):
+        (WebCore::RenderThemeChromiumLinux::platformFocusRingColor):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-09-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Patch to get premultiplied color support for Skia on getImageDate/putImageData.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Forget to rename openInFrameloader() to open(), which was requested in Darin's review of my last patch.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::open):
+        * history/CachedFrame.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        In http://trac.webkit.org/changeset/47943 I added new header dependencies to FrameLoader.h.
+        Removing them is a little trouble, but worth it going forward.
+        The pattern of creating a "CachedFrameBase" as the interface CachedFrame provides to FrameLoader
+        was suggested by Darin Adler.
+
+        No new tests. (No change in behavior)
+
+        Make CachedFrame inherit privately from CachedFrameBase, which becomes the interface FrameLoader uses:
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrameBase::CachedFrameBase):
+        (WebCore::CachedFrameBase::~CachedFrameBase):
+        (WebCore::CachedFrameBase::restore):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::openInFrameLoader):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrameBase::document):
+        (WebCore::CachedFrameBase::view):
+        (WebCore::CachedFrameBase::domWindow):
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::mousePressNode):
+
+        Call the new ::openInFrameLoader() method on the CachedFrame, as CachedFrameBase is now the only
+        thing capable of interacting with FrameLoader::open(CachedFrameBase):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::documentLoader):
+
+        Make ::open(CachedFrame) public, and change it to ::open(CachedFrameBase):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Cannot pres Enter to escape from bulleted list when <ul> is a child of <li>.
+        https://bugs.webkit.org/show_bug.cgi?id=24866
+
+        This patch modifies breakOutOfEmptyListItem to break out of a properly nested list
+        (a list to break out of is inside another list item).
+
+        When the empty list item appears at the end of another list item, WebKit breaks out of
+        the outer list item, and adds new item below the outer list item.
+        Otherwise, WebKit breaks out of the the inner list item and inserts new paragraph.
+
+        Test: editing/execCommand/break-out-of-empty-list-item.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More partial work towards "Page Cache should support pages with Frames"
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        This patch is primarily about the "CachedFrame tree" and making slightly different decisions
+        based on whether a CachedFrame is the main frame or a subframe.
+
+        - Store whether a CachedFrame represents the main frame or a subframe.
+        - "Chop off the frame tree" for the main frame when creating its CachedFrame, as main frames 
+          are reused and need to start new page loads with an empty frame tree.
+        - Reattach the frame tree to the main frame when restoring it.
+        - open() the cached subframes in their respective loaders when restoring.
+        - Properly clear() and destroy() cached subframes.
+        - When committing to a new page load, and after caching the previous page, only clear the
+          FrameView for the main frame.
+
+        Note that all of above will eventually be necessary as I continue to land this work in pieces,
+        but doesn't actually change any behavior right now because we still refuse to even *try* to
+        cache pages with frames.
+
+        No new tests. No change in behavior, and current tests continue to pass.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::destroy):
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::isMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::open):
+        * loader/FrameLoader.h:
+
+2009-09-02  Brady Eidson  <beidson@apple.com>
+
+        No review, build fix.
+
+        http://trac.webkit.org/changeset/47976 broke the build.  
+        Let's try compiling before we land things, shall we?
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Order the initialization list correctly.
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fixes for Windows/MSVC.
+
+        * wscript:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        Unreviewed build fix for Chromium.
+
+        Missed #including V8Proxy.h in WebCore/bindings/v8/V8Binding.cpp.
+
+        * bindings/v8/V8Binding.cpp: add V8Proxy.h as an include
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        waf build fix, don't define symbols we now grab from other sources.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+
+2009-09-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for PluginViewNone.cpp and a wx build fix for PluginView.cpp.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::stop):
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2009-09-02  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Eric Seidel.
+
+        Fix the build failure of WebKit for Linux/Qt when WML is enabled
+
+        No test cases needed since this just fixes the build problem.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::create):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::joinSuperflousColumns):
+        (WebCore::WMLTableElement::padWithEmptyColumns):
+
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: use shared buffer for custom font data
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        Refactored by Joe Mason <joe.mason@torchmobile.com>
+
+        * loader/CachedFont.cpp:
+        add WINCE to platforms using cached custom data
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::renameFont): implement for WinCE
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        build fixes
+        * platform/graphics/wince/FontCustomPlatformData.cpp:
+        (WebCore::setCustomFontCache): add accessor
+        (WebCore::createFontCustomPlatformData): change param to SharedBuffer
+        * platform/graphics/wince/FontCustomPlatformData.h:
+        update function signatures 
+ 
+2009-09-02 Yong Li <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: font-related build fixes and minor bugfixes
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * platform/graphics/FontCache.h: declare functions added in https://bugs.webkit.org/show_bug.cgi?id=27509
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage): fix ambiguous overload error in min/max on Windows
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): initialize member vars
+        * platform/graphics/SimpleFontData.h: disable unused members on Wince to save space 
+
+2009-09-02  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Another pass at releasing the storage mutex.
+        https://bugs.webkit.org/show_bug.cgi?id=28904
+
+        Another pass at releasing the storage mutex (when applicable) when we finish
+        executing JavaScript.  http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+        describes the required behavior.
+
+        As it turns out, https://bugs.webkit.org/show_bug.cgi?id=28789 didn't solve
+        the problem correctly.  First of all, I missed that events and timeouts go
+        through a different call path.  Second of all, I didn't consider recursion
+        correctly.  Third of all, my check to see if LocalStorage is alive actually
+        instantiates it if it isn't yet.  Fourth, I forgot DOM_STORAGE guards around
+        it.  So I'm reverting that change completely and doing it more cleanly.
+        Unfortunately, the solution isn't as portable (and thus I've left out the JSC
+        implementation for now).
+
+        NOTE: This change now tracks recursion on function callbacks in V8.  I ran this
+        by Mads Ager and Mike Belshe and they seemed to think adding the checks were
+        fine.  Most callbacks are asynchronous and thus wouldn't be nested.  The few
+        scenareos where you can have nested callbacks probably should have always been
+        protected by a recursion guard.
+
+        Unfortunately, this can't be tested without a hook added to the layout test
+        controllers since the lock is (by design) not supposed to be observable by
+        JavaScript.  https://bugs.webkit.org/show_bug.cgi?id=28906
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): revert
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::runScript):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::callFunction):
+            Add releaseStorageMutex call.  A small amount of clean up.
+        (WebCore::V8Proxy::releaseStorageMutex):
+            Check to see if localStorage has been instantiated.  If so, tell it to
+            unlock all storage areas.
+        * bindings/v8/V8Proxy.h:
+        * page/PageGroup.h:
+        (WebCore::PageGroup::hasLocalStorage):  Make hasLocalStorage public.
+
+2009-09-02  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Barth.
+
+        WINCE PORT: Implement ImageBuffer for WINCE
+        Implement Image interface with a light class BufferedImage
+        for rendering ImageBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=28167
+
+        * platform/graphics/wince/ImageBufferData.h: Added.
+        * platform/graphics/wince/ImageBufferWince.cpp: Added.
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Join the various PluginView destructors into one shared implementation
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The Qt port used to delete the platform plugin widget as the last step.
+        Now this is done before cleaning up the script objects and unloading the
+        plugin package, similar to how the Win port does it.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Share PluginView::init() between ports
+
+        https://bugs.webkit.org/show_bug.cgi?id=27706
+
+        The port-spesific bits are moved to platformStart(), which now returns
+        a bool based on the success of the platformStart.
+
+        m_hasPendingGeometryChange is now initialized in the initializer list
+        instead of in PluginViewQt's init()
+
+        PluginViewMac (currently used only by the Qt port) used to manually call
+        stop() in the case where an unsupported drawing or event model was detected.
+        This was wrong, as the m_status and m_isStarted fields should be used to
+        guard against doing operations on a plugin in this intermediate state.
+
+        * plugins/PluginView.cpp:
+        * plugins/PluginView.h:
+        * plugins/PluginViewNone.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2009-09-02  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28737
+        
+        Update JavaScript bindings in JSC and V8 for SQLTransaction to throw exceptions in the right places.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql): Throw an exception if no parameters are passed to executeSql().
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8ValueToWebCoreString): Catch an exception if thrown from toString().
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Allow "arrayish objects" to be passed to executeSql.
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate Databases tab to InjectedScript /
+        serialized interaction.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28873
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::handleEvent):
+        * inspector/front-end/Database.js:
+        (WebInspector.Database.prototype.isDB):
+        (WebInspector.Database.prototype.runWithTableNames.sortingCallback):
+        (WebInspector.Database.prototype.runWithTableNames):
+        (WebInspector.Database.prototype.executeSql):
+        (WebInspector.Database.prototype.executeSql.errorCallback):
+        (WebInspector.Database.prototype.executeSql.queryTransaction):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._enterKeyPressed):
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel.prototype.selectDatabase):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables.withTableNames):
+        (WebInspector.StoragePanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate.withTableNames):
+        (WebInspector.DatabaseSidebarTreeElement.prototype.onpopulate):
+
+2009-09-02  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (trivial followup fix). 
+        
+        Web Inspector: Trivial follow up fix to r47944.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::nodeForId):
+
+2009-09-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fixed a bug in handling of isReadOnly, where textareas were casted to HTMLInputElements.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2009-09-01  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28047
+        add utility method to enable logging messages for inspector development
+
+        manual test case added (see below)
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleMessage.prototype.toString):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.log):
+        * manual-tests/inspector/webinspector-log.html: Added.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h:
+        (WebCore::):
+
+2009-09-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21990
+        When a rare EUC-JP character is present, explicitly (and correctly) labelled EUC-JP document
+        is mistreated as Shift_JIS
+
+        <rdar://problem/5828506> Safari should not try auto-detecting if charset information exists
+
+        WebKit used to unconditionally auto-detect document encoding if it was one of Japanese ones.
+        This didn't really match any browser, and did cause problems on some sites.
+
+        Our detector is very quick to label an EUC-JP page as Shift_JIS if it notices a byte that
+        cannot be part of EUC-JP source. However, such bytes do appear in Web pages sometimes,
+        especially in comments. Also, some valid EUC-JP sequences are not known to it.
+
+        Some pages that are fixed by this change:
+
+        <rdar://problem/5934750> Encoding in incorrect at http://cocodeparis.blog45.fc2.com/. This
+        page has incorrect encoding in title, so no browser displays it 100% fine. We now match
+        Firefox and IE.
+
+        <rdar://problem/6007713> The web page http://www.sf.us.emb-japan.go.jp/top.htm is garbled
+        in Safari. There is a stray byte in comments that was makes charset detector think it can't
+        be EUC-JP.
+
+        <rdar://problem/6965711> A Japanese web page www.nippontv.studiolegend.tv is garbled in
+        Safari. Many comments on this page are encoded as Shift_JIS - IE magically displays that
+        fine in View Source mode (it doesn't seem to have an ability to switch between EUC-JP and
+        Shift_JIS in normal HTML view though).
+
+        Test: fast/encoding/japanese-encoding-mix.html
+
+        * loader/TextResourceDecoder.cpp: (WebCore::TextResourceDecoder::decode): Only invoke auto-
+        detection if there is no solid charset information yet.
+
+2009-09-01  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] FileList cannot be accessed via index in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=28883
+
+        Tested by clipboard-file-access.html.
+
+        * WebCore.gypi:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8FileListCustom.cpp: Added.
+
+2009-08-31  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove the workaround added in r47316.
+
+        Reviewed by Sam Weinig.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+
+        * accessibility/AXObjectCache.h:
+        Remove the Document argument to the AXObjectCache constructor and the
+        m_document member variable, and replace the no-parameter
+        handleFocusedUIElementChanged() with the two-parameter GTK function.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+        Don't pass a null Document when constructing the AXObjectCache.
+
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        Get the document from the RenderObject; m_document was removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Don't pass the Document when constructing the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Pass the old and new focused RenderObjects when calling
+        handleFocusedUIElementChanged().
+
+2009-09-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Check that InspectorDOMAgent and InspectorFrontend are not null
+        before accessing them in InspectorBackend. They may be null if
+        InspectorController is closed before an asynchronous operation is
+        started.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setAttribute):
+        (WebCore::InspectorBackend::removeAttribute):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        (WebCore::InspectorBackend::inspectorDOMAgent):
+        (WebCore::InspectorBackend::inspectorFrontend):
+        * inspector/InspectorBackend.h:
+
+2009-09-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Page Cache should support pages with frames
+        https://bugs.webkit.org/show_bug.cgi?id=13631
+
+        Things learned in the full task that this patch addresses:
+        - The notions of clearing a CachedFrame and destroying a CachedFrame were two concepts that 
+          needed to be managed separately.
+        - Once we start restoring pages with multiple CachedFrames, we'll have to be calling
+          FrameLoader::open(CachedFrame&) multiple times with different CachedFrames, and this process
+          will be guided by the CachedFrames themselves.
+
+        No new tests. (No change in behavior, current layout tests pass)
+        
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::clear): Only clear pointers out.
+        (WebCore::CachedFrame::destroy): Perform the destructive cleanup work here - Things that shouldn't
+          occur simply by navigating back to a page with a CachedFrame.
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::~CachedPage):
+        (WebCore::CachedPage::restore): Call clear() after restoring.
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::destroy):
+        * history/CachedPage.h:
+
+        * history/PageCache.cpp:
+        (WebCore::PageCache::releaseAutoreleasedPagesNow): destroy() CachedPages that are being pruned,
+          instead of clearing them.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let the CachedPage clear() itself after restoring.
+        (WebCore::FrameLoader::open): Don't ::open() the CachedFrame, as the CachedPage does that now.
+        * loader/FrameLoader.h:  Add the friending so CachedPage and CachedFrame can better guide the process.
+          Even though CachedFrame::restore() isn't used for now, it will be soon.
+
+2009-09-01  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by David Levin.
+
+        Add a "lowMemoryNotification" method to the V8 ScriptController class.
+        This is needed in order to allow the host application (Android Web browser in this case)
+        to call the v8::V8::LowMemoryNotification() method added to V8 in
+        http://code.google.com/p/v8/source/detail?spec=svn2777&r=2725
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28776
+
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::lowMemoryNotification):
+        * bindings/v8/ScriptController.h:
+
+2009-09-01  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        V8 Bindings for WebSocket API.
+        https://bugs.webkit.org/show_bug.cgi?id=28844
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertToV8Object):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8DOMWrapper.h:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8WebSocketCustom.cpp: Added.
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Missed a "." -> "->" conversion.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build, take 2.  The Qt code had what looks like a
+        broken virtual function override.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ReadContext::ReadContext):
+        (WebCore::ImageDecoderQt::setData):
+        * platform/graphics/qt/ImageDecoderQt.h:
+
+2009-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Uninitialized variable in XSSAuditor
+        https://bugs.webkit.org/show_bug.cgi?id=28874
+
+        One ought to initialize variables before use even when it doesn't
+        matter.  No behavior change.
+
+        * page/XSSAuditor.h:
+        (WebCore::XSSAuditor::CachingURLCanonicalizer::CachingURLCanonicalizer):
+
+2009-09-01  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix).
+
+        Try to fix Qt build.
+
+        * platform/graphics/ImageSource.cpp:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Eliminate most of ImageSourceQt.cpp in favor of ImageSource.cpp.
+
+        * WebCore.pro:
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Make InjectedScript self-contained (move necessary
+        methods from utilities.js into InjectedScript).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28871
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+        (Object.type):
+        (Object.hasProperties):
+        (Object.className):
+        (String.prototype.escapeCharacters):
+        * inspector/front-end/utilities.js:
+
+2009-09-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: console log message repeat count double.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28856
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._evaluateOn):
+
+2009-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Fix DATALIST build
+        https://bugs.webkit.org/show_bug.cgi?id=28826
+
+        Add ENABLE_DATALIST to FEATURE_DEFINES.
+
+        * GNUmakefile.am:
+
+2009-09-01  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        SVGSVGElement suspend methods argument/return types incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=28860
+
+        Also fix the style of the argument names.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::suspendRedraw):
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+
+2009-09-01  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix bug 28808:  [Skia] Fix flaky layout test svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html [DEBUG]
+        (https://bugs.webkit.org/show_bug.cgi?id=28808)
+
+        The bug fix adds an explicit check for the validity of the path when it is 
+        transformed into local coordinates. 
+        This was the most suitable place I could find that didn't cause an inordinate 
+        amount of refactoring. Also, it seems pertinent and may also catch other cases 
+        that are not limited to clipping paths.
+
+        TEST: existing svg/dynamic-updates/SVGClipPathElement-dom-clipPathUnits-attr.html
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: make isPathSkiaSafe accessible
+        (WebCore::):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::currentPathInLocalCoordinates): check Skia safety of path
+
+2009-09-01  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Combining Diacritical Marks (U+0300..) are not handled correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=28742 
+
+        Normalize (NFC) a TextRun when the run contains combining diacritical marks
+        so that Skia can pick a correct glyph without relying on GSUB table in a font.
+        This change is for Chromium Linux.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::getTextRun): Added.
+        (WebCore::TextRunWalker::getNormalizedTextRun): Added.
+
+        This function is called when the run contains U+0300..U+036F and converts characters in
+        the run to the combined form (NFC) using ICU.
+
+2009-09-01  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Inlined fast paths of V8DOMWrapper::convertNodeToV8Object and
+        V8Proxy::createWrapperFromCache.
+        https://bugs.webkit.org/show_bug.cgi?id=28848
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertDocumentToV8Object): Special
+        function for document wrapping.
+        (WebCore::V8DOMWrapper::convertNewNodeToV8Object): Slow case of
+        wrapping a new node.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertNodeToV8Object): Extracted fast
+        path from V8DOMWrapper.cpp.
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::createWrapperFromCacheSlowCase):
+        * bindings/v8/V8Proxy.h:
+        (WebCore::V8Proxy::createWrapperFromCache): Extracted fast path
+        from V8Proxy.cpp.
+
+2009-09-01  Eric Seidel  <eric@webkit.org>
+
+        No review, windows build fix only.  Clearly I should have read the patch closer. :(
+
+        Allow excluding certain plugins from loading
+        https://bugs.webkit.org/show_bug.cgi?id=28677
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::refresh):
+
+2009-09-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Implement conditional breakpoints in the Web Inspector backend
+        and add frontend JavaScript stubs.
+        https://bugs.webkit.org/show_bug.cgi?id=28846
+
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::profiles):
+        (WebCore::InspectorBackend::addBreakpoint):
+        (WebCore::InspectorBackend::updateBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::condition):
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::setCondition):
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::breakpointInfo):
+        (WebCore::JavaScriptDebugServer::updateBreakpoint):
+        (WebCore::JavaScriptDebugServer::updateBreakpointInfo):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::JavaScriptDebugServer::clearBreakpoints):
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::BreakpointInfo::BreakpointInfo):
+        * inspector/front-end/Breakpoint.js:
+        (WebInspector.Breakpoint):
+        (WebInspector.Breakpoint.prototype.get id):
+        (WebInspector.Breakpoint.prototype.get condition):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.addScript):
+
+2009-09-01  Marius Renn  <damarvy@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Added delegate to PluginDatabase to disable loading certain plugins.
+        This is useful when you want to load from the standard plugin
+        directory, but want to exclude certain plugins. Plugins may be
+        excluded early on by name, so that no plugin code is executed (which
+        may have caused a crash).
+
+        * plugins/PluginDatabase.cpp:
+        (WebCore::PluginDatabase::PluginDatabase):
+        (WebCore::PluginDatabase::refresh):
+        * plugins/PluginDatabase.h:
+        (WebCore::PluginDatabase::setClient):
+        * plugins/PluginDatabaseClient.h: Added.
+        (WebCore::PluginDatabaseClient::~PluginDatabaseClient):
+
+2009-08-31  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        * WebCore.base.exp: Removed an unneeded symbol export.
+
+2009-08-31  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28466
+        When downloading a file, two GET requests are sent to the HTTP server
+
+        Can't think of a way to test this.
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::releaseResources): only nullify the
+        handle's client when it is the ResourceLoader, to support the case
+        in which a download API uses a different client
+
+2009-08-31  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Text Fields and Text Areas are reported as read-only by inspect32.exe.
+        https://bugs.webkit.org/show_bug.cgi?id=28854
+
+        Added another case in AcccessibiltyRenderObject::isReadOnly to test if text fields
+        and texts areas are read-only.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+
+2009-08-31  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        fast/workers/worker-lifecycle.html crashes intermittently on snowleopard
+        https://bugs.webkit.org/show_bug.cgi?id=28795
+
+        Changed WorkerContext::close() to no longer stop the worker thread.
+        It is now the parent's responsibility to shut down the worker thread when it is notified that the context is closed.
+
+        * workers/AbstractWorker.cpp:
+        Updated dispatchScriptErrorEvent to pass-through the "handled" value from dispatchEvent(), to allow event handlers added with addEventListener() to mark events as handled.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        Now shuts down the worker thread when notified that the context is closed.
+        (WebCore::SharedWorkerProxy::close):
+        Now handles being invoked when the context is already in the process of shutting down.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        No longer calls WorkerThread::stop() to avoid race conditions with shutting down the thread while the parent is still interacting with it.
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::isClosing):
+        isClosing() is now public so WorkerRunLoop can call it to determine whether to process tasks.
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::performTask):
+        Error events should still be delivered even if the worker thread is closing.
+        Also fixed problem where error events were not dispatched if error handlers were added via addEventListener().
+        (WebCore::WorkerTerminateTask::create):
+        New task that invokes terminateWorkerContext() on the parent thread when the context is closed.
+        (WebCore::WorkerTerminateTask::WorkerTerminateTask):
+        (WebCore::WorkerTerminateTask::performTask):
+        (WebCore::WorkerMessagingProxy::workerContextClosed):
+        Now fires off a WorkerTerminateTask to shut down the thread when the context is closed.
+        * workers/WorkerMessagingProxy.h:
+        WorkerMessagingProxy now overrides workerContextClosed().
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::runInMode):
+        Now drops tasks on the floor if the WorkerContext is closing.
+
+2009-08-31  Ojan Vafai  <ojan@chromium.org>
+
+        Not reviewed (build fix)
+
+        Build fix for Chromium to match r49707.
+
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28858
+        Element.baseURI parses xml:base attribute incorrectly
+
+        Test: fast/dom/base-attribute-parsing.xhtml
+
+        * dom/Element.cpp: (WebCore::Element::baseURI): Avoid assertion failure (no change in
+        release mode).
+
+2009-08-31  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reverting http://trac.webkit.org/changeset/47904, because it caused
+        layout test failure.
+
+        Test: fast/dom/Window/new-window-opener.html
+
+2009-08-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28852
+        Rename KURL single argument constructor to avoid confusion
+
+        * platform/KURL.h: The constructor that used to be single argument should now be invoked
+        as KURL(ParsedURLString, myString).
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/NPV8Object.cpp:
+        (_NPN_EvaluateHelper):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::isSVGCursorIdentifier):
+        * css/CSSImageValue.cpp:
+        (WebCore::CSSImageValue::cachedImage):
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/StyleBase.cpp:
+        (WebCore::StyleBase::baseURL):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * dom/Element.cpp:
+        (WebCore::Element::baseURI):
+        * editing/markup.cpp:
+        (WebCore::completeURLs):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::url):
+        (WebCore::HistoryItem::originalURL):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createCached):
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::requestResource):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::resourceForURL):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::manifestURLs):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createResource):
+        (WebCore::LegacyWebArchive::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * notifications/NotificationCenter.h:
+        (WebCore::NotificationCenter::createHTMLNotification):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        (WebCore::blankURL):
+        * platform/KURLHash.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::setData):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie):
+        * platform/network/cf/ResourceErrorCF.cpp:
+        (WebCore::ResourceError::operator CFErrorRef):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::headerCallback):
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::operator NSError*):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+        (WebCore::ClipboardWin::setData):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged):
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::loadSheet):
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+        Adapt to the change everywhere the single argument constructor was used. I did a very
+        cursory check of whether these locations were using this constructor properly, and didn't
+        notice any obvious mistakes. The new explicit name will hopefully suggest checking this
+        better when refactoring any such code.
+
+2009-08-31  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28635 [CSS3 
+        Backgrounds and Borders] Add support for 2-keyword values for 
+        background-repeat
+
+        This patch allows background-repeat to take two values by making 
+        background-repeat just like background-position internally. There 
+        is a little extra legwork for background-repeat because the spec 
+        indicates that its computed value should be equivalent to how it 
+        was specified. I keep track of the specified thing by setting the 
+        implicit flag whenever background-repeat is defined with only one 
+        value (since internally, we now store this as 2 values.)
+        
+        Here we can't access the implicit flag, so for backwards-
+        compatibility's sake, we always return one value when that makes 
+        sense.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::fillRepeatToCSSValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Here we check for the implicit flag and return one value when it is 
+        set.
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        (WebCore::CSSMutableStyleDeclaration::getLayeredShorthandValue):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+
+        Add support for CSSPropertyBackgroundRepeatX and 
+        CSSPropertyBackgroundRepeatY
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillShorthand):
+        (WebCore::CSSParser::parseFillRepeat):
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSParser.h:
+
+        Get rid of mappings to RepeatXFill and RepeatYFill since we don't 
+        need those parts of the EFillRepeat enum anymore.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+
+        Add CSSPropertyBackgroundRepeatX and CSSPropertyBackgroundRepeatY
+        * css/CSSPropertyLonghand.cpp:
+        (WebCore::initShorthandMap):
+
+        Add background-repeat-x and -y.
+        * css/CSSPropertyNames.in:
+
+        Break repeat into x and y.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillRepeatX):
+        (WebCore::CSSStyleSelector::mapFillRepeatY):
+        * css/CSSStyleSelector.h:
+
+        There is no more RepeatXFill. Instead, look for 
+        fillLayer->repeatX() == RepeatFill
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+
+        Break m_repeat into m_repeatX and m_repeatY
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        (WebCore::FillLayer::cullEmptyLayers):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::repeatX):
+        (WebCore::FillLayer::repeatY):
+        (WebCore::FillLayer::isRepeatXSet):
+        (WebCore::FillLayer::isRepeatYSet):
+        (WebCore::FillLayer::setRepeatX):
+        (WebCore::FillLayer::setRepeatY):
+        (WebCore::FillLayer::clearRepeatX):
+        (WebCore::FillLayer::clearRepeatY):
+        (WebCore::FillLayer::initialFillRepeatX):
+        (WebCore::FillLayer::initialFillRepeatY):
+
+        Again, break backgroundRepeat into backgroundRepeatX and 
+        backgroundRepeatY
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundRepeatX):
+        (WebCore::InheritedFlags::backgroundRepeatY):
+        (WebCore::InheritedFlags::maskRepeatX):
+        (WebCore::InheritedFlags::maskRepeatY):
+
+        We don't need RepeatXFill or RepeatYFill. Now that we store two 
+        values, they are represented by Repeat-NoRepeat and NoRepeat-
+        Repeat, respectively.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-31  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Compositing layer size needs to take into account software reflections on children.
+        https://bugs.webkit.org/show_bug.cgi?id=28837
+        
+        When computing the bounds of a composited layer, take software-rendered
+        reflections into account.
+
+        Test: compositing/reflections/reflection-in-composited.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+
+2009-08-31  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28614
+
+        Perform a layout prior to checking whether the scrollbar modes are
+        off, on, or automatic.  The modes may change during layout.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-08-31  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Request Headers Should Show Data Sent With Request
+        https://bugs.webkit.org/show_bug.cgi?id=22920
+
+        Manual test added - see below.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateRequest):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        (WebInspector.ResourceView.prototype._refreshURL):
+        (WebInspector.ResourceView.prototype._refreshQueryString):
+        (WebInspector.ResourceView.prototype._refreshFormData):
+        (WebInspector.ResourceView.prototype._refreshRequestPayload):
+        (WebInspector.ResourceView.prototype._refreshParms):
+        (WebInspector.ResourceView.prototype._toggleURLdecoding):
+        (WebInspector.ResourceView.prototype._getHeaderValue):
+        (WebInspector.ResourceView.prototype._refreshRequestHeaders):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        * manual-tests/inspector/display-form-data.html: Added.
+
+2009-08-31  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: pass call frames into the frontend as a part of
+        pausedScript event.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28847
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didPause):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::pausedScript):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+
+2009-08-31  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Un-blacklist Silverlight on Mac
+
+        Does not seem to crash anymore, probably due to how we now handle
+        drawing and event model handshake better.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2009-08-31  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28827
+        SVGSVGElement.unsuspendRedraw() shouldn't throw
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::unsuspendRedraw):
+        * svg/SVGSVGElement.h:
+        * svg/SVGSVGElement.idl:
+
+2009-08-31  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        - Change the reutrn type of HTMLInputElement::list so that it
+          conforms to the standard.
+        - Add HTMLInputElement::dataList()
+        https://bugs.webkit.org/show_bug.cgi?id=28769
+
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::dataList):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-31  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Eric Seidel.
+
+        Remove ASSERT(frame) in ResourceHandle::start (ResourceHandleCurl.cpp)
+        https://bugs.webkit.org/show_bug.cgi?id=28802
+
+        Remove ASSERT because the frame could be null if the
+        ResourceHandle is not associated with any frame, e.g. if we are
+        downloading a file.
+        If the frame is not null but the page is null this must be an
+        attempted load from an onUnload handler, so let's just block it.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-08-31  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix for platforms which don't enable DOM_STORAGE.
+        https://bugs.webkit.org/show_bug.cgi?id=28834
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=28829
+        Crash in AccessibilityRenderObject::activeDescendant when trying to set aria-activedescendant to something without a renderer
+
+        Test: accessibility/aria-activedescendant-crash.html
+
+        * accessibility/AccessibilityRenderObject.cpp: (WebCore::AccessibilityRenderObject::activeDescendant): Nil check.
+
+2009-08-28  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk Build broken for OSX Quartz
+        https://bugs.webkit.org/show_bug.cgi?id=28727
+
+        Check for XP_UNIX instead of GTK or X11 to ease building of the Gtk
+        port in Mac and Unix/Linux.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix positioning error when a compositing, absolutely-positioned element has an ancestor with opacity.
+        https://bugs.webkit.org/show_bug.cgi?id=28754
+        
+        For absolutely-positioned layers, convertToLayerCoords() jumps to the positioned
+        ancestor, since the layer x and y are relative to that ancestor. However, this could
+        skip over the ancestorLayer, thus giving the wrong result.
+        
+        Fix by duplicating the enclosingPositionedAncestor() logic in convertToLayerCoords(),
+        and checking for ancestorLayer along the way. If found, compute offset of both to
+        the enclosingPositionedAncestor() and subtract.
+        
+        This also fixes a positioning bug with abs. positioned elements in reflections,
+        so there is a new reflection test with a pixel result.
+
+        Tests: compositing/geometry/abs-position-inside-opacity.html
+               fast/reflections/abs-position-in-reflection.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isPositionedContainer):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::convertToLayerCoords):
+
+2009-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Wrap WebkitCSSTransformValues in the correct class of DOM wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=27727
+
+        When fetching the DOM wrapper for a WebkitCSSTransformValue (which is a kind of 
+        CSSValueList), we need to ask the value list whether it's a WebkitCSSTransformValue,
+        because there is not a unique enum value for WebkitCSSTransformValue.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+        Fix some warnings introduced by r47381.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+
+2009-08-28  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21442
+        Make sure filesystemPathFromUrlOrTitle() returns a string with length
+        <= MAX_PATH - 1.
+
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::filesystemPathFromUrlOrTitle):
+
+2009-08-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Adding Chromium's VFS for Linux and Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28750
+
+        * WebCore.gypi:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/sql/chromium/SQLiteFileSystemChromium.cpp:
+        (WebCore::SQLiteFileSystem::openDatabase):
+        (WebCore::SQLiteFileSystem::deleteDatabaseFile):
+        * platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp: Removed.
+        * platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp: Added.
+        * platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp:
+
+2009-08-28  Vitaly Repeshko  <vitalyr@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Made bindings use Node::setOnEvent functions for Node descendants
+        instead of Node::setAttributeEventListener.
+
+        Node::setAttributeEventListener is an internal function and
+        doesn't do the forwarding to DOM window that is required for some
+        HTML elements.
+        https://bugs.webkit.org/show_bug.cgi?id=28709
+
+        Tests added in http://trac.webkit.org/changeset/47326 now pass with V8.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        Now generates EventListener accessors for Node descendants instead
+        of using custom callbacks.
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getEventListener): Moved from V8NodeCustom.cpp.
+        * bindings/v8/V8DOMWrapper.h:
+        (WebCore::V8DOMWrapper::convertEventListenerToV8Object): Fixed a bug in
+        signature.
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        Changed signature to accept Handle instead of Local.
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Removed custom callbacks for EventListener accessors.
+
+2009-08-28  Ben Murdoch  <benm@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=28803
+        
+        Implements V8CustomVoidCallback reporting any exceptions that were thrown from the callback function.
+
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::invokeCallback): Checks if the callback raised an exception and reports it to WebCore if so.
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Not reviewed (build fix).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp: Accidentally added some spaces.
+        (WebCore::ImageDecoder::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        * platform/graphics/qt/ImageDecoderQt.h: Make constructor public so factory function can access it (this seemed better than making ImageDecoder a friend).
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move ImageDecoder creation function to a factory function on
+        ImageDecoder.  This is arguably where it makes the most sense anyway,
+        and it will (soon) allow ImageSourceQt.cpp to have one less dedicated
+        function.
+
+        * platform/graphics/ImageSource.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoder::create):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp:
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-08-28  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Combine duplicated code from ImageDecoder*.cpp into the main
+        ImageDecoder.cpp.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+
+2009-08-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
+
+        Override setScrollbarModes to correctly forward scrollbar modes
+        policy changes to client code, via a new platform-specific method,
+        scrollbarsPolicyDidChange.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollbarsPolicyDidChange):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2009-08-28  Cédric Luthi <cedric.luthi@gmail.com>
+
+        Reviewed by Tor Arne Vestbø
+
+        [Qt/Mac] Un-blacklist the QuickTime plugin
+
+        https://bugs.webkit.org/show_bug.cgi?id=28768
+
+        Now that the drawing model is properly negotiated, there is no need the
+        blacklist the QuickTime plugin anymore.
+
+        This revealed a bug in PluginView::performRequest: it should not initiate a
+        request if the plugin has been stopped, which is what happens when a plugin
+        only supports the QuickDraw drawing model.
+
+        * plugins/PluginView.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+
+2009-08-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Set DOM agent document to 0 in InspectorController::close to
+        make DOM agent remove DOM listeners from the inspected document.
+
+        Replace windowVisible checks with m_frontend checks to as inspector
+        window lives in a different process in Chromium while frontend proxy
+        is in the inspected page process.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28800
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addProfile):
+        * inspector/InspectorController.h:
+
+2009-08-28  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove dependency of SummaryBar on WebInspector.resourceCategories.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28801
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.toolbarItemClass.get categories):
+        * inspector/front-end/SummaryBar.js:
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.update):
+
+2009-08-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed (patching in l18n change that was missing due to
+        the git binary diff format).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+
+2009-08-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make XSSAuditor go fast
+        https://bugs.webkit.org/show_bug.cgi?id=28667
+
+        Make the XSSAuditor go faster by implementing two optimizations:
+
+        1) We avoid canonicalizing scripts that are larger than the page's URL.
+           This saves a bunch of time for large inline scripts.
+
+        2) We memoize canonicalizing the page's URL because it's silly to
+           canonicalize repeated for each inline event listener.
+
+        These optimizations have a measurable affect on the intl1 page cycler.
+
+        No behavior change.
+
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::MemoizingURLCanonicalizer::canonicalizeURL):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canEvaluateJavaScriptURL):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::canSetBaseElementURL):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h:
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Removed ASSERT_NOT_REACHED, because indeed this ASSERT is reached in
+        fast/canvas/change-context.html. And it's alright to reach it.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Removed assertion.
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for http://trac.webkit.org/changeset/47840
+
+        Peter's change forgot one m_decoder->
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2009-08-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        [V8] Add NULL-check, since the context ain't changeable no more, and
+        thus getContext could return 0.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added NULL-check.
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        dataTransfer.types() should include type "Files" when files are present in the clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28780
+
+        Add dataTransfer type "Files" to the chromium port.  Add eseidel's
+        patch for same for the mac port.
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Removed GL_ from all constants, and gl prefix from all calls
+        https://bugs.webkit.org/show_bug.cgi?id=28773
+
+        This was done for the external API in CanvasRenderingContext3D and
+        the internal API in GraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.h:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+
+2009-08-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Qt and Gtk build fixes. Not reviewed.
+
+        Add CanvasRenderingContext3D.idl to the build scripts.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Release the storage mutex whenever leaving JavaScript execution.
+        https://bugs.webkit.org/show_bug.cgi?id=28789
+
+        http://dev.w3.org/html5/spec/Overview.html#storage-mutex describes the
+        required behavior.  After we leave JavaScript, we must be sure the storage
+        mutex has been released.  At the end of evaluate(), if localStorage has been
+        instantiated, tell it to release any locks that may be applicable.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28753
+        <rdar://problem/7173448> Excessive number of threads (and a crash)
+
+        Coalesce DNS prefetch requests to reduce strain on CFHost. Currently, the algorithm is as follows:
+        - when resolver is idle, the first few requests are sent immediately (they may or may not
+        hit the wire);
+        - if there are a few requests in flight already, coalesce all requests for one second;
+        - to avoid pathological cases with lots of links to different sites on a page, only ask
+        CFHost about a handful of names (dropping the rest).
+
+        Coalescing reduces the number of requests dramatically, as prefetchDNS is called for each
+        link, and these tend to have identical host name.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::DNSResolveQueue::DNSResolveQueue):
+        (WebCore::DNSResolveQueue::shared):
+        (WebCore::DNSResolveQueue::add):
+        (WebCore::DNSResolveQueue::decrementRequestCount):
+        (WebCore::DNSResolveQueue::fired):
+        (WebCore::clientCallback):
+        (WebCore::DNSResolveQueue::resolve):
+        (WebCore::prefetchDNS):
+
+2009-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Final patch for Canvas 3D support
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This hooks everything up and provides a working implementation of
+        Canvas 3D. I plumb the creation of the 3D canvas down to GraphicsLayer,
+        passing the opaque context and texture pointers so a Canvas3DLayer can be
+        created (more on that later). It also plumbs changes to the 3D canvas so
+        that Canvas3DLayer can recomposite the results.
+        
+        A 3D Canvas element needs a RenderLayer and compositing layer to render.
+        This is because it renders to an off-screen texture in the GPU and then
+        hands it to a Canvas3DLayer, which is a subclass of CAOpenGLLayer, to
+        render that texture as a 3D quad. This keeps everything in GPU memory to 
+        maximize performance. When a CanvasRenderingContext3D is created it 
+        forces a style recalc which creates the RenderLayer and compositing 
+        layer if needed. 
+        
+        I repurposed an existing flag which was put in place for animation to accomplish 
+        this. This flag is passed to setNeedsStyleRecalc(), and I renamed it from 
+        AnimationStyleChange to SyntheticStyleChange. It essentially says that you need
+        to do a complete style recalc, even though the style itself has not really
+        changed.
+        
+        This patch also fixes a couple of bugs discovered when testing with 3d-canvas
+        turned on. I also added a constructor DOMWindow.idl for CanvasRenderingContext3D.
+        This is needed when making a JS wrapper for the object so the prototype 
+        property can be set.
+
+        Test: fast/canvas/change-context.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext3D::glDrawElements):
+        * bindings/js/JSCanvasRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        * dom/Node.h:
+        (WebCore::):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::is3D):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasBuffer.cpp:
+        (WebCore::CanvasBuffer::create):
+        (WebCore::CanvasBuffer::CanvasBuffer):
+        (WebCore::CanvasBuffer::_deleteObject):
+        * html/canvas/CanvasBuffer.h:
+        * html/canvas/CanvasFramebuffer.cpp:
+        (WebCore::CanvasFramebuffer::create):
+        (WebCore::CanvasFramebuffer::CanvasFramebuffer):
+        (WebCore::CanvasFramebuffer::_deleteObject):
+        * html/canvas/CanvasFramebuffer.h:
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::CanvasObject):
+        (WebCore::CanvasObject::~CanvasObject):
+        (WebCore::CanvasObject::deleteObject):
+        * html/canvas/CanvasObject.h:
+        (WebCore::CanvasObject::context):
+        * html/canvas/CanvasProgram.cpp:
+        (WebCore::CanvasProgram::create):
+        (WebCore::CanvasProgram::CanvasProgram):
+        (WebCore::CanvasProgram::_deleteObject):
+        * html/canvas/CanvasProgram.h:
+        * html/canvas/CanvasRenderbuffer.cpp:
+        (WebCore::CanvasRenderbuffer::create):
+        (WebCore::CanvasRenderbuffer::CanvasRenderbuffer):
+        (WebCore::CanvasRenderbuffer::_deleteObject):
+        * html/canvas/CanvasRenderbuffer.h:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        (WebCore::CanvasRenderingContext3D::createBuffer):
+        (WebCore::CanvasRenderingContext3D::createFramebuffer):
+        (WebCore::CanvasRenderingContext3D::createTexture):
+        (WebCore::CanvasRenderingContext3D::createProgram):
+        (WebCore::CanvasRenderingContext3D::createRenderbuffer):
+        (WebCore::CanvasRenderingContext3D::createShader):
+        * html/canvas/CanvasRenderingContext3D.h:
+        (WebCore::CanvasRenderingContext3D::graphicsContext3D):
+        * html/canvas/CanvasShader.cpp:
+        (WebCore::CanvasShader::create):
+        (WebCore::CanvasShader::CanvasShader):
+        (WebCore::CanvasShader::_deleteObject):
+        * html/canvas/CanvasShader.h:
+        * html/canvas/CanvasTexture.cpp:
+        (WebCore::CanvasTexture::create):
+        (WebCore::CanvasTexture::CanvasTexture):
+        (WebCore::CanvasTexture::_deleteObject):
+        * html/canvas/CanvasTexture.h:
+        * page/DOMWindow.idl:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::cancelAnimations):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformTexture):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayer::setGraphicsContext3DNeedsDisplay):
+        * platform/graphics/mac/GraphicsContext3DMac.cpp:
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::reshape):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::GraphicsLayerCA):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateContentsGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setContentsToGraphicsContext3D):
+        (WebCore::GraphicsLayerCA::setGraphicsContext3DNeedsDisplay):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::requiresLayer):
+        * rendering/RenderHTMLCanvas.h:
+        (WebCore::RenderHTMLCanvas::isCanvas):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isCanvas):
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageDecoder*.cpp a bit.
+
+        * platform/image-decoders/ImageDecoder.cpp: Put functions in the same
+          order as in the header file.  Also, since there's already an anonymous
+          namespace in this file, use it to enclose the local helper functions.
+        (WebCore::):
+        (WebCore::ImageDecoder::upperBoundScaledX):
+        (WebCore::ImageDecoder::lowerBoundScaledX):
+        (WebCore::ImageDecoder::scaledY):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+        * platform/image-decoders/haiku/ImageDecoderHaiku.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData): Ensure m_size is set correctly.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Remove unneeded temp.
+        (WebCore::RGBA32Buffer::operator=): Simplify.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::asNewNativeImage): Try and collect spaced-out temps under loop comment to show they're all related.  Use size_t for iterating over elements of a Vector.
+        (WebCore::RGBA32Buffer::width): Style fix.
+        (WebCore::RGBA32Buffer::height): Style fix.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Clean up ImageSource.* in preparation for more fixes on bug 27965.
+
+        * platform/graphics/ImageSource.cpp: Put functions in the same order as in header file.
+        (WebCore::ImageSource::isSizeAvailable): Shorten.
+        (WebCore::ImageSource::size): Shorten.
+        (WebCore::ImageSource::frameSizeAtIndex): Shorten.
+        (WebCore::ImageSource::repetitionCount): Shorten.
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        * platform/graphics/ImageSource.h: Shorten #ifdef section a bit by sharing common typedefs.
+
+2009-08-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28785
+        Add ImageDecoder.cpp to various build files so platforms will be able to
+        use it.  Move an ENABLE to not cover the whole file, in preparation for
+        adding a bunch of code.  Simplify #ifdefs in ImageDecoder.h to be "Skia
+        vs. everyone else", which also gives new platforms a reasonable default
+        behavior.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28784
+        
+        Add an exported method to flush pending repaints.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        (WebCore::FrameView::flushDeferredRepaints):
+        * page/FrameView.h:
+
+2009-08-27  Noel Gordon  <noel.gordon@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [V8] Expose files from the pasteboard in drop events.
+        https://bugs.webkit.org/show_bug.cgi?id=28782
+
+        Update chromium port to expose dataTransfer.files() as per
+        HTML5 drag drop (Aug 2009 edition).
+
+        * platform/chromium/ClipboardChromium.cpp:
+
+2009-08-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Dmitry Glazkov.
+
+        ScriptState now keeps explicit Handle of devtools front-end
+        utility context instead of trying to retrieve it from inspected
+        Frame.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28772
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::ScriptState):
+        (WebCore::ScriptState::~ScriptState):
+        (WebCore::scriptStateFromPage):
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::context):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::~ScriptValue):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::frontendScriptState):
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Console won't close.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28778
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.isAncestor):
+
+2009-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Fix a typo in files() causing image drags to have junk file arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=28755
+
+        Test: editing/pasteboard/files-during-page-drags.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::files):
+
+2009-08-27  Jeremy Orlow  <jorlow@chromium.org>
+
+        Not reviewed.  Build fix for Chromium.
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+
+2009-08-27  Alexey Proskuryakov  <ap@apple.com>
+
+        Windows build fix.
+
+        * DerivedSources.cpp: Added JSPageTransitionEvent.cpp to DerivedSources.cpp.
+
+2009-08-26  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28758
+        <rdar://problem/6440869> Implement pageshow and pagehide events for b/f cache (28758)
+
+        Tests: fast/events/pageshow-pagehide-on-back-cached.html
+               fast/events/pageshow-pagehide-on-back-uncached.html
+               fast/events/pageshow-pagehide.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::stopLoading): Dispatch pagehide event
+        (this function is called both when a document goes away, and when it goes to b/f cache).
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Dispatch pagehide right before unload.
+        (WebCore::DOMWindow::dispatchPageTransitionEvent): Do what it takes to add a new event handler
+        that can be installed on Window object.
+        (WebCore::DOMWindow::onpagehide): Ditto.
+        (WebCore::DOMWindow::setOnpagehide): Ditto.
+        (WebCore::DOMWindow::onpageshow): Ditto.
+        (WebCore::DOMWindow::setOnpageshow): Ditto.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::restore): Dispatch pageshow for a page
+        that isn't being restored from cache.
+
+        * dom/PageTransitionEvent.cpp: Added.
+        (WebCore::PageTransitionEvent::PageTransitionEvent):
+        (WebCore::PageTransitionEvent::~PageTransitionEvent):
+        (WebCore::PageTransitionEvent::initPageTransitionEvent):
+        * dom/PageTransitionEvent.h: Added.
+        (WebCore::PageTransitionEvent::create):
+        (WebCore::PageTransitionEvent::isPageTransitionEvent):
+        (WebCore::PageTransitionEvent::persisted):
+        * dom/PageTransitionEvent.idl: Added.
+        Add event class implementation.
+
+        * html/HTMLBodyElement.cpp: (WebCore::HTMLBodyElement::parseMappedAttribute): Support
+        inline listener definition (note that adding listeners to document.body programmatically
+        is not supported, matching Firefox).
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Dispatch pageshow event right before load event.
+        (WebCore::Document::dispatchPageTransitionEvent): Do what it takes to add a new event for
+        Docuemnt.
+        (WebCore::Document::createEvent): Ditto.
+
+        * dom/Document.h: Added dispatchPageTransitionEvent.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventCustom.cpp: (WebCore::toJS):
+        * dom/Event.cpp: (WebCore::Event::isPageTransitionEvent):
+        * dom/Event.h:
+        * dom/EventNames.h:
+        * html/HTMLAttributeNames.in:
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Do what it takes to add a new event type.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Adding missing file from previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+
+2009-08-27  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Factor out Factor out summary bar from Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28740
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph):
+        (WebInspector.ResourcesPanel.prototype._updateDividersLabelBarPosition):
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction):
+        * inspector/front-end/SummaryBar.js: Added.
+        (WebInspector.SummaryBar):
+        (WebInspector.SummaryBar.prototype.get calculator):
+        (WebInspector.SummaryBar.prototype.set calculator):
+        (WebInspector.SummaryBar.prototype.reset):
+        (WebInspector.SummaryBar.prototype.update):
+        (WebInspector.SummaryBar.prototype._drawSwatch.drawSwatchSquare):
+        (WebInspector.SummaryBar.prototype._drawSwatch):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.var):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph):
+        (WebInspector.SummaryBar.prototype._drawSummaryGraph.drawPill):
+        (WebInspector.SummaryBar.prototype._fadeOutRect):
+        (WebInspector.SummaryBar.prototype._makeLegendElement):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-08-26  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Start adding heap profiler to Inspector (hidden behind a flag.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=28429
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.reset):
+        (WebInspector.ProfilesPanel.prototype.addProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        (WebInspector.ProfilesPanel.prototype._snapshotClicked):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js: added Preferences.heapProfilerPresent flag.
+
+2009-08-27  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar editing is broken.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+
+2009-08-27  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28767
+
+        Make KURLGoogle.cpp's decodeURLEscapeSequences decode %00 to match
+        KURL.cpp.  This makes the XSSAuditor tests pass when using KURLGoogle.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::decodeURLEscapeSequences):
+
+2009-08-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Build fix, missing functions after r47763.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+2009-08-26  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Removing trailing whitespaces from all storage classes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28075
+
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseDetails.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageTask.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+        * storage/Storage.cpp:
+        * storage/Storage.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaImpl.cpp:
+        * storage/StorageAreaImpl.h:
+        * storage/StorageAreaSync.cpp:
+        * storage/StorageAreaSync.h:
+        * storage/StorageEvent.cpp:
+        * storage/StorageEvent.h:
+        * storage/StorageMap.cpp:
+        * storage/StorageMap.h:
+        * storage/StorageNamespaceImpl.cpp:
+        * storage/StorageSyncManager.cpp:
+        * storage/StorageSyncManager.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28763, flickering when opacity changes.
+
+        Make opacity changes from < 1 to 1 and from 1 to < 1 cause a relayout to happen.  We need
+        to do this in order for overflow information to be properly recomputed.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+
+2009-08-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement sometimes loses events
+        https://bugs.webkit.org/show_bug.cgi?id=28762
+        <rdar://problem/7172437>
+
+        A media element triggers the resource selection algorithm if 
+        play() is called when the networkState attribute is NETWORK_EMPTY, but
+        it also immediately queues 'play' and either 'waiting' or 'playing' events.
+        One of the steps in preparing to load is to flush pending events, so those 
+        events were lost if the load timer fired quickly enough. Fixed by deleting
+        pending events before scheduling the load timer.
+
+        Test: media/audio-play-event.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::scheduleLoad):
+            Do nothing if the load timer is already scheduled. Call prepareForLoad so queue of 
+            pending events is flushed immediately.
+        (WebCore::HTMLMediaElement::scheduleNextSourceChild):
+            New, start the load timer without flushing pending events.
+        (WebCore::HTMLMediaElement::load):
+            Call prepareForLoad();
+        (WebCore::HTMLMediaElement::prepareForLoad):
+            New, load setup code moved from loadInternal.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Moved some setup code to prepareForLoad so it can be invoked immediately before
+            arming the load timer.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Call scheduleNextSourceChild instead of scheduleLoad as the later now clears
+            pending events.
+        * html/HTMLMediaElement.h:
+            Declare scheduleNextSourceChild.
+
+2009-08-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28751
+        Switch ICO decoder from a Vector of raw pointers to a Vector of
+        OwnPtrs now that that is possible.  Makes code slightly simpler.
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::decodeAtIndex):
+        (WebCore::ICOImageDecoder::processDirectory):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+
+2009-08-26  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28718, image inside relpositioned inline doesn't paint.
+        Make sure vertical overflow is still computed across self-painting layers, even though it isn't
+        propagated to parents.
+
+        Added fast/repaint/rel-positioned-inline-with-overflow.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+
+2009-08-26  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        ResourceRequestBase::*[Aa]llowHTTPCookies shouldn't mention http.
+        https://bugs.webkit.org/show_bug.cgi?id=28735
+
+        Renaming the method to imply its wider implications of affecting cookies
+        over any protocol that supports them.
+
+        No change in functionality so no new tests.
+
+        * WebCore.order:
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest):
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::allowCookies):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-08-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Made RenderInline::clippedOverflowRectForRepaint() actually include
+        overflow.
+
+        Test: fast/repaint/inline-overflow.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesVisibleOverflowBoundingBox): Added. Returns
+            the bounding box of all lines’ visible overflow boxes (under the
+            assumption that the first and last lines determine the top and
+            bottom, respectively).
+        (WebCore::RenderInline::clippedOverflowRectForRepaint): Changed to use
+            linesVisibleOverflowBoundingBox() instead of linesBoundingBox().
+        * rendering/RenderInline.h:
+
+2009-08-26  John Gregg  <johnnyg@google.com>
+
+        Reviewed by David Levin.
+
+        minor style correction and include fix for notifications
+        https://bugs.webkit.org/show_bug.cgi?id=28745
+
+        No change in behavior, so no tests.
+
+        * bindings/js/JSDesktopNotificationsCustom.cpp: add include of Error.h
+        * notifications/Notification.cpp: change enum style to InterCaps
+        (WebCore::Notification::Notification):
+        * notifications/NotificationPresenter.h:
+        (WebCore::NotificationPresenter::):
+
+2009-08-25  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        postMessage() spec now supports sending arrays of ports
+        https://bugs.webkit.org/show_bug.cgi?id=26902
+
+        Added support for sending multiple ports at once via postMessage(). JS bindings will be updated in an upcoming patch.
+
+        No new tests, since the new functionality is not exposed via new JS bindings yet, so the old tests suffice.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Mark MessagePort.h and MessagePortChannel.h as private since they are used by WebKit now.
+        * dom/MessageEvent.cpp:
+        Updated APIs to support passing MessagePortArrays.
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::MessageEvent::ports):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::disentanglePorts):
+        Added new static function to extract a MessagePortChannelArray from a MessagePortArray.
+        (WebCore::MessagePort::entanglePorts):
+        Added new static function to generate a MessagePortArray (entangled ports) from a MessagePortChannelArray.
+        * dom/MessagePort.h:
+        * dom/MessagePortChannel.cpp:
+        EventData now contains a MessagePortChannelArray field instead of a single MessagePortChannel.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        * dom/MessagePortChannel.h:
+        (WebCore::MessagePortChannel::EventData::channels):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        * page/DOMWindow.h:
+        * workers/DedicatedWorkerContext.cpp:
+        (WebCore::DedicatedWorkerContext::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::DedicatedWorkerContext::dispatchMessage):
+        * workers/DedicatedWorkerContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::postMessage):
+        Now accepts a MessagePortArray parameter instead of a single MessagePort.
+        (WebCore::Worker::dispatchMessage):
+        * workers/Worker.h:
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        Updated WorkerObjectProxy and WorkerContextProxy API implementations to support sending multiple MessagePorts.
+        (WebCore::MessageWorkerContextTask::create):
+        (WebCore::MessageWorkerContextTask::MessageWorkerContextTask):
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::create):
+        (WebCore::MessageWorkerTask::MessageWorkerTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+        Updated WorkerObjectProxy and WorkerContextProxy APIs to support sending multiple MessagePorts.
+
+2009-08-26  Fumitoshi Ukai  <ukai@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        SocketStreamHandle interface for WebSocket API
+        https://bugs.webkit.org/show_bug.cgi?id=28037
+
+        Add build systems only for GNUmakefile.am and WebCore.xcodeproj.now.
+        Other build systems will be updated once the code is functional.
+        Tests will be landed once this code is complete and functional.
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/SocketStreamErrorBase.cpp: Added.
+        * platform/network/SocketStreamErrorBase.h: Added.
+        * platform/network/SocketStreamHandleBase.cpp: Added.
+        * platform/network/SocketStreamHandleBase.h: Added.
+        * platform/network/SocketStreamHandleClient.h: Added.
+        * platform/network/cf/SocketStreamError.h: Added.
+        * platform/network/cf/SocketStreamHandle.h: Added.
+        * platform/network/cf/SocketStreamHandleCFNet.cpp: Added.
+        * platform/network/soup/SocketStreamError.h: Added.
+        * platform/network/soup/SocketStreamHandle.h: Added.
+        * platform/network/soup/SocketStreamHandleSoup.cpp: Added.
+
+2009-08-26  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] setTimeout does not convert non-string argument to string
+        https://bugs.webkit.org/show_bug.cgi?id=28739
+
+        Convert non-string argument to setTimeout to string in the V8
+        bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+
+2009-08-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement getOwnPropertyDescriptor
+        https://bugs.webkit.org/show_bug.cgi?id=28724
+
+        Implement the WebCore side of getOwnPropertyDescriptor.  This
+        requires a custom implementation of getOwnPropertyDescriptor
+        for every class with a custom implementation of getOwnPropertySlot.
+
+        The bindings generator has been updated to generate appropriate
+        versions of getOwnPropertyDescriptor for the general case where
+        a custom getOwnPropertyDescriptor is not needed.  ES5 is vague
+        about how getOwnPropertyDescriptor should work in the context of
+        "host" functions with polymorphic [[GetOwnProperty]], so it seems
+        okay that occasionally we "guess" what attributes -- eg. determining
+        whether a property is writable.
+
+        Test: fast/js/getOwnPropertyDescriptor.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getOwnPropertyDescriptor):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertyDescriptorDelegate):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::getOwnPropertyDescriptor):
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomGetOwnPropertyDescriptor):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertyDescriptor):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertyDescriptorDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcFallbackObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertyDescriptor):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::getOwnPropertyDescriptor):
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::getOwnPropertyDescriptor):
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
+        * bridge/runtime_object.h:
+
+2009-08-26  Vincent Untz <vuntz@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        GObject checks for NULL (and not 0) in g_object_get, so use that
+        as we were already doing elsewhere to make the compiler happy.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+
+2009-08-26  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        RenderThemeMac.mm has incorrect casting for media control element.
+        https://bugs.webkit.org/show_bug.cgi?id=28730
+
+        MediaControlMuteButtonElement was incorrectly casted to
+        MediaControlPlayButtonElement. This is corrected in this patch.
+
+        No new tests because this is code cleanup and is already covered by existing
+        media layout tests.
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+
+2009-08-26  Robert Sesek  <rsesek@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        [Chromium] Multi-value select boxes cannot do non-contiguous selection on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=28670
+
+        Change the condition regarding the key modifier check for non-contiguous
+        selection on a multi-value list from just PLATFORM(MAC) to
+        PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN)).
+
+        No new tests. This patch only changes the condition on which a certain mouse
+        event modifier key is used.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        r47744 causes media/video-controls-with-mutation-event-handler.html to crash
+        https://bugs.webkit.org/show_bug.cgi?id=28732
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+            Don't call setAttribute from the construtor, any registered mutation event 
+            listener will cause a crash.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createVolumeSlider):
+            Set the maxAttr here instead of in the constructor.
+
+2009-08-25  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Brady Eidson.
+
+        Timers from cached pages fire instantly rather than the after the specified timeout delay
+        https://bugs.webkit.org/show_bug.cgi?id=28683
+
+        Test: fast/dom/Window/timer-resume-on-navigation-back.html
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Remove duplicated Frame::restore() call, since
+            it should be done only once in FrameLoader::open(cachedFrame)
+        * page/DOMTimer.cpp: Added a debug-only flag and ASSERT to catch out-of-order suspense/restore.
+        (WebCore::DOMTimer::DOMTimer): Ditto.
+        (WebCore::DOMTimer::suspend): Ditto.
+        (WebCore::DOMTimer::resume): Ditto.
+        * page/DOMTimer.h: Ditto.
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Setting the volume of a media element has no effect if called too early
+        https://bugs.webkit.org/show_bug.cgi?id=28731
+
+        * manual-tests/audio-volume.html: 
+            Added.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setRate):
+            Don't bail if metadata hasn't been loaded, it is fine to set rate and/or
+            volume as soon as the movie has been created.
+
+2009-08-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        DocumentThreadableLoader::getShouldUseCredentialStorage should allow for synchronous callbacks from SubresourceLoader::create.
+        https://bugs.webkit.org/show_bug.cgi?id=28728
+
+        Test: This code path is exercised while running xhr layout tests in chromium.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): When called
+        back synchronously, the loader is 0, so the assert is changed to allow for that.
+        (WebCore::DocumentThreadableLoader::loadRequest): Synchronous callbacks may be
+        done before SubresourceLoader::create finishes, so ensure that any previous loader
+        -- from a preflight request -- is cleared before calling SubresourceLoader::create.
+
+2009-08-25  Mark Rowe  <mrowe@apple.com>
+
+        Stop installing IDL files in to the framework.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-08-25  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for HTMLInputElement::list and HTMLInputElement::selectedOption.
+        https://bugs.webkit.org/show_bug.cgi?id=27756
+
+        Tests: fast/forms/input-list.html
+               fast/forms/input-selectedoption.html
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::list):
+        (WebCore::HTMLInputElement::selectedOption):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-08-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <video> and <audio> controller should be accessible (edit)
+        https://bugs.webkit.org/show_bug.cgi?id=28081
+
+        Test: accessibility/media-element.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Add AccessibilityMediaControls.cpp/.h
+
+        * accessibility/AXObjectCache.cpp:
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::getOrCreate):
+            Create AccessibilityMediaControl. Update Copyright
+
+        * accessibility/AccessibilityMediaControls.cpp:
+        * accessibility/AccessibilityMediaControls.h:
+            Added.
+
+        * accessibility/AccessibilityObject.cpp:
+        * accessibility/AccessibilityObject.h:
+            Add isMediaTimeline. Update Copyright.
+
+        * accessibility/AccessibilitySlider.h:
+            Make constructor protected instead of private so AccessibilityMediaTimeline can
+            call it.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+            Add NSAccessibilityValueDescriptionAttribute to range attributes. 
+        (-[AccessibilityObjectWrapper subrole]):
+            Return NSAccessibilityTimelineSubrole for AccessibilityMediaTimeline.
+
+        * dom/Node.h:
+            add isMediaControlElement.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::localizedMediaControlElementString): 
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription): 
+            New, return localized media controller strings.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::mediaElementLoadingStateText):
+        (WebCore::mediaElementLiveBroadcastStateText):
+            Move inside of "#if ENABLE(VIDEO)"
+        (WebCore::localizedMediaControlElementString):
+        (WebCore::localizedMediaControlElementHelpText):
+        (WebCore::localizedMediaTimeDescription):
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlElement::MediaControlElement):
+            Initialize m_displayType.
+        (WebCore::MediaControlElement::MediaControlElement):
+        (WebCore::MediaControlStatusDisplayElement::MediaControlStatusDisplayElement):
+            Fix style.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            Set m_displayType based on pseudo style ID.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+            rename local "o" to "object".
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlRewindButtonElement::MediaControlRewindButtonElement):
+        (WebCore::MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+            Update for MediaControlInputElement constructor change.
+        (WebCore::MediaControlTimeDisplayElement::formatTime):
+            New, moved here from RenderMedia so AccessibilityMediaTimeDisplay can use it.
+        (WebCore::MediaControlTimeDisplayElement::setCurrentValue):
+            New, set text to current time.
+        * rendering/MediaControlElements.h:
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+            Create controls in tab order.
+        (WebCore::RenderMedia::formatTime):
+            Moved to MediaControlTimeDisplayElement::formatTime.
+        (WebCore::RenderMedia::updateTimeDisplay):
+            Call MediaControlTimeDisplayElement::setCurrentValue.
+        * rendering/RenderMedia.h:
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix Canvas layout test failures in Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=28720
+
+        The previous fix r47757 does not handle the V8 object conversion correctly.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        [V8] Fix compiling errors in Chromium build caused by Canvas3D changes from r47752.
+        https://bugs.webkit.org/show_bug.cgi?id=28717
+
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Implement media volume slider for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=28715
+
+        Provided the implementation of the volume slider and its container for
+        chromium port. With this change there will be a usable volume control
+        slider for chromium theme.
+
+        No new tests since this is covered by existing media layout tests.
+
+        * css/mediaControlsChromium.css: CSS style for the volume slider.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::mediaSliderThumbImage): Returns the image for slider thumb.
+        (WebCore::mediaVolumeSliderThumbImage): Returns the image for volume slider thumb.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack): Paints the track with one vertical white line.
+        (WebCore::RenderThemeChromiumSkia::adjustSliderThumbSize): Adjusts thumb sizes according to the images.
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb): Paints slider thumb image.
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb): Paints volume slider thumb image.
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missed checking in 2 Canvas3D files
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSCanvasRenderingContextCustom.cpp: Implements toJS to do proper subclass binding
+        * bindings/js/JSCanvasRenderingContext3DCustom.cpp: Argument marshaling for 3D calls
+
+2009-08-25  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [V8] Exception from JavaScript propagates to main script
+        https://bugs.webkit.org/show_bug.cgi?id=26433
+
+        Make sure that exceptions thrown both at compile time and at
+        runtime in javascript URLs are isolated from the main script.
+
+        Test: fast/dom/javascript-url-exception-isolation.html
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+
+2009-08-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Added all new Canvas3D files to the build
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This also hooks up CanvasRenderingContext as the common base class for
+        CanvasRenderingContext2D and CanvasRenderingContext3D. And it adds a bit
+        of logic throughout to support the new CanvasRenderingContext3D object.
+        But nothing is hooked up yet.
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore/GNUmakefile.am:
+        * WebCore/WebCore.gypi:
+        * WebCore/WebCoreSources.bkl:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSHTMLCanvasElementCustom.cpp:
+        (WebCore::JSHTMLCanvasElement::markChildren):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasContext):
+        * dom/Document.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::getContext):
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::reset):
+        (WebCore::HTMLCanvasElement::paint):
+        (WebCore::HTMLCanvasElement::is3D):
+        (WebCore::HTMLCanvasElement::context3D):
+        (WebCore::HTMLCanvasElement::texture3D):
+        * html/HTMLCanvasElement.h:
+        (WebCore::HTMLCanvasElement::renderingContext):
+        * html/canvas/CanvasObject.cpp:
+        (WebCore::CanvasObject::~CanvasObject):
+        * html/canvas/CanvasRenderingContext.idl:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        (WebCore::CanvasRenderingContext2D::is2d):
+        * html/canvas/CanvasRenderingContext2D.idl:
+        * html/canvas/CanvasRenderingContext3D.cpp:
+        * html/canvas/CanvasRenderingContext3D.idl:
+
+2009-08-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        REGRESSION (r47630): fast/repaint/background-generated.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=28704
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Handle SizeNone.
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer): Initialize the size type to SizeNone.
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize): Changed assignment to initialization and
+            removed redundant assignment to size.
+
+2009-08-25  Yusuke Sato  <yusukes@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Complex text doesn't show up with text stroking
+        https://bugs.webkit.org/show_bug.cgi?id=28707
+
+        Skip the NULL check of m_hdc if Windows GDI is not in use.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-08-25  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by David Levin.
+
+        Media controls panel does not have a volume control slider
+        https://bugs.webkit.org/show_bug.cgi?id=28241
+
+        Introduced "-webkit-media-controls-volume-slider",
+        "-webkit-media-controls-volume-slider-container" and the supporting
+        implementation. Also added appearances of "media-volume-slider" and
+        "media-volume-slider-container".
+
+        The implementation of the controls are in WebCore::MediaControlElements.
+        Logic to trigger the display of the volume controls are in WebCore::RenderMedia.
+
+        No new tests since this change doesn't have theme implementation and the
+        volume slider is disabled by default.
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Marks that volume slider is vertical.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added corresponding CSS values.
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): ditto.
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ditto.
+        * css/CSSValueKeywords.in: ditto.
+        * css/mediaControls.css: Makes the volume slider disabled by default.
+        * platform/ThemeTypes.h: Defines theme parts for volume slider and its container.
+        (WebCore::):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement):
+        (WebCore::MediaControlVolumeSliderContainerElement::styleForElement):
+        Adjust the CSS values for "display", "postion", "left" and "top" according to member variables.
+        (WebCore::MediaControlVolumeSliderContainerElement::setVisible): Affects the "display" CSS value.
+        (WebCore::MediaControlVolumeSliderContainerElement::setPosition): Affects the "left" and "top" CSS values.
+        (WebCore::MediaControlVolumeSliderContainerElement::hitTest): Hit testing this element.
+        (WebCore::MediaControlVolumeSliderElement::MediaControlVolumeSliderElement):
+        (WebCore::MediaControlVolumeSliderElement::defaultEventHandler): Modifies the volume using the slider value, allows dragging.
+        * rendering/MediaControlElements.h:
+        (WebCore::): Added definition for MediaControlVolumeSliderElement and MediaControlVolumeSliderContainerElement.
+        (WebCore::MediaControlVolumeSliderContainerElement::isVisible): Inline getter.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange): Updates styles for volume container and volume slider.
+        (WebCore::RenderMedia::createVolumeSliderContainer): Creates volume slider container and attach to panel.
+        (WebCore::RenderMedia::createVolumeSlider): Creates volume slider and attach to volume slider container.
+        (WebCore::RenderMedia::updateControls): Updates volume container and volume slider.
+        (WebCore::RenderMedia::updateVolumeSliderContainer): Sets the visibility and position of volume slider container and its child.
+        (WebCore::RenderMedia::forwardEvent):
+        Hit testing the volume slider container and volume slider to toggle the visibility and forward events to slider.
+        * rendering/RenderMedia.h:
+        Added definition for RenderMedia::updateVolumeSliderContainer().
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Not implemented.
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle): Makes volume slider vertical.
+        (WebCore::RenderSlider::thumbRect): ditto.
+        (WebCore::RenderSlider::mouseEventIsInThumb): ditto.
+        (WebCore::RenderSlider::setValueForPosition): ditto.
+        (WebCore::RenderSlider::positionForOffset): ditto.
+        (WebCore::RenderSlider::currentPosition): ditto.
+        (WebCore::RenderSlider::trackSize): ditto.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle): Adjust style for volume slider thumb.
+        (WebCore::RenderTheme::paint): Paints volume control parts using theme.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer): Naive implementation to be overridden.
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack): ditto.
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb): ditto.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::): Constants for volume control parts.
+
+2009-08-25  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt/Mac] Use CONFIG+=build_all only when building libraries
+
+        If no configuration is specified when building WebKit we pass the
+        debug_and_release option to QMake which results in Makefiles for
+        both configurations being generated.
+
+        Previously we built both of these configurations by default, for
+        all targets (both the QtWebKit framework/dyldlib and the various
+        executables such as QtLauncher and tests). This makes sense for
+        the libraries, which get the _debug suffix and can be loaded on
+        demand by setting the DYLD_IMAGE_SUFFIX, but for executables we
+        ended up building the same executable twice.
+
+        We now only build one instance of each executable, and since this
+        is a developer build we build the debug-version. Passing either
+        --debug or --release to build-webkit will override this, and
+        even in the default case the release version can still be built
+        by running 'make release' in the the build directory of each
+        target.
+
+        * WebCore.pro:
+
+2009-08-25  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28690
+        Build failure in webkitgtk+-1.1.3
+
+        Do not use deprecated function to unref a pixbuf.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Fix Bug 27827 "[Chromium] Functions Keys don't work in google spreadsheet".
+        <https://bugs.webkit.org/show_bug.cgi?id=27827>.
+
+        Because of the lack of mappings from GDK key-codes to WebKit key-codes,
+        Chromium cannot send valid key-codes to JavaScript when a user types
+        function keys. This change just copies the mappings from 'KeyEventGtk.cpp'.
+
+        To write layout tests for this issue, added mappings from function-key
+        names to platform-specific key-codes to EventSendingController objects
+        so that eventSender.keyDown() can send function-key events without using
+        platform-specific key codes. (Unfortunately, this eventSender.keyDown() change
+        is only for Mac. So this change adds this new test to Skipped tests for other
+        platforms to prevent this change from crashing the build trees.)
+
+        Test: fast/events/keydown-function-keys.html
+
+       * platform/chromium/KeyCodeConversionGtk.cpp: Add mappings from GDK key-codes
+        to WebKit key-code for function keys.
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-08-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28698
+        Avoid unnecessary transformations for the window resizer rect.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/7161900> REGRESSION: 100 MB membuster leak on windows due to 47391
+        (DNS prefetching support)
+
+        * platform/network/cf/DNSCFNet.cpp: (WebCore::prefetchDNS): Use a run loop from secondary
+        thread on Windows, because there isn't one on main one.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28374
+        Cross-scheme requests should not be blocked by appcache rules
+
+        Test: http/tests/appcache/different-scheme.html
+
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
+        Resources with different schemes can never be loaded from appcache.
+
+2009-08-24  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28688
+        REGRESSION(r24994): Cannot create a frame with a javascript URL
+
+        Test: http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html
+
+        * bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::setValue):
+        * bindings/js/JSElementCustom.cpp: (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp: (WebCore::allowSettingJavascriptURL):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: (WebCore::JSHTMLIFrameElement::setSrc):
+        Omit the checks if there is no document in frame yet.
+
+2009-08-24  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix crash in fast/css/rem-dynamic-scaling.html due to a freed
+        RenderStyle being accessed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28681
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle): Make currentStyle a RefPtr.
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/5743105> Long freezing during loading and selecting text
+        of a large table
+        https://bugs.webkit.org/show_bug.cgi?id=14918
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added calls to
+            beginDeferredRepaints() and endDeferredRepaints() around the
+            invalidation of the selection, in order to better coalesce multiple
+            invalid rectangles.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Simplify findTreeElement code, get rid of potential infinite loop.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28680
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.getCachedTreeElement):
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (isAncestorNode):
+        ():
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Do expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Make sure we use the current FrameView's frame rect when
+        going back to a cached page.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=28659
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-08-24  Cameron McCormack  <cam@mcc.id.au>
+
+        Reviewed by Darin Adler.
+
+        Modifying <text rotate=""> doesn't clear the corresponding SVGAnimatedNumberList
+        https://bugs.webkit.org/show_bug.cgi?id=28673
+
+        Test: svg/dom/text-rotate-live.html
+
+        * svg/SVGNumberList.cpp:
+        (WebCore::SVGNumberList::parse): Clear the list before adding the parsed
+        numbers.
+
+2009-08-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by NOBODY (build fix)
+
+        Turn off ENABLE_3D_CANVAS in the xconfig files.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Only expand local scope when hitting the break
+
+        https://bugs.webkit.org/show_bug.cgi?id=28678
+
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+
+2009-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        background-size fails to parse if a single length/percentage/auto is followed by a comma
+        https://bugs.webkit.org/show_bug.cgi?id=28674
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillSize): Added an allowComma parameter,
+            which is set to false when this method consumes a comma. Moved
+            handling of 'contain' and 'cover' from parseFillProperty into this
+            method.
+        (WebCore::CSSParser::parseFillProperty): Set allowComma to true before
+            processing the next value, and pass allowComma to parseFillSize.
+        * css/CSSParser.h:
+
+2009-08-17  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Support for cursors that are images
+        https://bugs.webkit.org/show_bug.cgi?id=28346
+
+        Added support for cursors which are images for CursorGtk. Added
+        a manual test for this.
+
+        * manual-tests/gtk/cursor-image.html: Added.
+        * manual-tests/gtk/resources/redcursor.cur: Added.
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-08-24  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Integrate GStreamer video with the graphics backend
+        https://bugs.webkit.org/show_bug.cgi?id=16356
+
+        Improves GStreamer backend implementation of MediaPlayerPrivate class.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback): Send proper MediaPlayer
+        error for different GStreamer errors to MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Move static
+        initialization boolean to a better place.
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::duration): Return if error occured, do not
+        consider the source as stream if duration query failed.
+        (WebCore::MediaPlayerPrivate::currentTime): Return if error occured, use
+        an early return.
+        (WebCore::MediaPlayerPrivate::seek): Return if error occured.
+        (WebCore::MediaPlayerPrivate::setEndTime): Remove implementation since this
+        function doesn't seem to be used anywhere in WebCore.
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate): Seek to current time when rate is set.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Return if error occured.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::totalBytesKnown):
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Return if error occured, update
+        after seek ended with a successful change
+        (WebCore::MediaPlayerPrivate::didEnd): Do not pause the playbin when end is reached.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Update network state with the given error.
+        (WebCore::mimeTypeCache): Gather supported mime types from GStreamer.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen): First step towards fullscreen
+        support.
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin): Use playbin2 instead of playbin,
+        do not set playbin's audio sink.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func): Use C++ casts, decrease reference count of async
+        queue at the end of the idle function.
+        (webkit_video_sink_render): Increase reference count of async queue.
+        (webkit_video_sink_stop): Remove any idle functions with the sink as data.
+
+2009-08-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Remaining new files for Canvas3D
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added Canvas3D method behind an ifdef
+        * html/canvas/CanvasByteArray.cpp: Added. Efficient array of bytes for passing to GL functions
+        * html/canvas/CanvasByteArray.h: Added.
+        * html/canvas/CanvasByteArray.idl: Added.
+        * html/canvas/CanvasNumberArray.cpp: Added. Efficient array of 32 bit floats for passing to GL functions
+        * html/canvas/CanvasNumberArray.h: Added.
+        * html/canvas/CanvasNumberArray.idl: Added.
+
+2009-08-24  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate call frames interaction to the InjectedScript-based schema.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28408
+
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.update):
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleTextMessage):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype.get domWindow):
+        (InspectorController.openInInspectedWindow):
+        (InspectorController.getCallFrames):
+        (InspectorController.evaluateInCallFrame):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.generateStylesheet):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+        (InjectedScript._evaluateOn):
+        (InjectedScript.openInInspectedWindow):
+        (InjectedScript.getCallFrames):
+        (InjectedScript.evaluateInCallFrame):
+        (InjectedScript._callFrameForId):
+        (InjectedScript._objectForId):
+        (InjectedScript.CallFrameProxy):
+        (InjectedScript.CallFrameProxy.prototype._wrapScopeChain):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype._update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.ondblclick):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane):
+        (WebInspector.ScopeChainSidebarPane.prototype.update):
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach):
+        (WebInspector.ScopeVariableTreeElement.prototype.onexpand):
+        (WebInspector.ScopeVariableTreeElement.prototype.oncollapse):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused.callback):
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+
+2009-08-24  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for the placeholder attribute and DOM property of the textarea element.
+        https://bugs.webkit.org/show_bug.cgi?id=21248
+
+        A DOM node for an INPUT element doesn't have a flag for placeholder
+        visibility anymore.  This patch also fixes a bug that a renderer
+        doesn't reflect a corresponding DOM value change.
+
+        Tests: fast/forms/textarea-placeholder-dom-property.html
+               fast/forms/textarea-placeholder-pseudo-style.html
+               fast/forms/textarea-placeholder-set-attribute.html
+               fast/forms/textarea-placeholder-set-value.html
+
+        * css/html.css: Add the default style for placeholder of textarea.
+        * dom/InputElement.cpp: Cleanup for m_placeholderShouldBeVisible removal
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::placeholderShouldBeVisible):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::setValue):
+        (WebCore::HTMLTextAreaElement::placeholderShouldBeVisible):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderVisibility):
+        (WebCore::HTMLTextAreaElement::dispatchFocusEvent):
+        (WebCore::HTMLTextAreaElement::dispatchBlurEvent):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTextAreaElement.idl:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::setInnerTextStyle):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        (WebCore::RenderTextControlMultiLine::textBaseStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::textBaseStyle):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+
+2009-08-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Code clean-up and build fix for filters enabled builds. Moved SVGNames.h
+        into #if ENABLE(SVG) for Document.cpp and added SVGNames.h to the other
+        files. They are needed there after r47688.
+
+        * dom/Document.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+
+2009-08-23  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed, build fix for make distcheck on GTK+.
+
+        * GNUmakefile.am: Added files needed for the build.
+        * bindings/js/JSDOMWindowCustom.cpp: Protect SharedWorker include
+        with #if clause.
+        * bindings/js/JSEventTarget.cpp: Dito.
+        * dom/Document.cpp: Dito.
+        * loader/FrameLoader.cpp: Dito.
+
+2009-08-23  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Throws an Error on "null"
+        https://bugs.webkit.org/show_bug.cgi?id=28665
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.evaluate):
+
+2009-08-23  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: REGRESSION Formatting Function in Console is Abbreviated Too Often
+
+        https://bugs.webkit.org/show_bug.cgi?id=28666
+
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.getProperties):
+        (InjectedScript.createProxyObject):
+
+2009-08-22  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] BitmapImage::getGdkPixbuf does not handle alpha channels properly
+        https://bugs.webkit.org/show_bug.cgi?id=28345
+
+        When doing the conversion between cairo_surface_t* and GdkPixbuf*
+        account for the differences in the respective formats' in-memory
+        image format.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::getCairoSurfacePixel):
+        (WebCore::getGdkPixbufPixel):
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-08-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        
+        Next step: Element, HTMLElement, HTMLAnchorElement, HTMLAppletElement,
+        HTMLAreaElement, HTMLEmbedElement, HTMLFrameElement, HTMLIFrameElement,
+        HTMLObjectElement, HTMLPlugInElement, HTMLPlugInImageElement.
+
+        * DerivedSources.make: Fix error seen every time we build by escaping the $
+        in the build rule, since you have to use $$ for that in make.
+
+        * WebCore.base.exp: Updated.
+
+        * bindings/objc/DOM.mm:
+        Added now-needed include of SVGNames.h.
+
+        * dom/Document.cpp: Added now-needed include of SVGNames.h.
+        (WebCore::Document::createElement): Use create instead of new.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Added ConstructionType argument so the caller
+        can determine whether this starts with a reference count of either 0 or 1.
+        Later we will remove this again once they are all 1.
+        (WebCore::Element::create): Added.
+
+        * dom/Element.h: Added create and made constructor protected.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::StyledElement): Added ConstructionType argument.
+        * dom/StyledElement.h: Made many functions protected or private, including
+        the constructor.
+
+        * dom/make_names.pl: Use create to create the base elements HTMLElement,
+        SVGElement, and WMLElement.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Use create instead of new.
+        * editing/UnlinkCommand.cpp:
+        (WebCore::UnlinkCommand::doApply): Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::create): Added.
+        * html/HTMLAnchorElement.h: Made constructor protected and added create.
+        Also made m_rootEditableElementForSelectionOnMouseDown a RefPtr.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::create): Added.
+        * html/HTMLAppletElement.h: Made constructor private and added create.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::create): Added.
+        * html/HTMLAreaElement.h: Made constructor private and added create.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::create): Added.
+        * html/HTMLElement.h: Made constructor protected and added create.
+        Made other functions protected and private. Also added inline
+        definition of constructor.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::create): Added.
+        * html/HTMLEmbedElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::create): Added.
+        (WebCore::HTMLFrameElement::parseMappedAttribute):
+        * html/HTMLFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLFrameElementBase.h: Made functions protected and private.
+
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Pass
+        CreateElement so reference count starts at 1.
+
+        * html/HTMLFrameOwnerElement.h: Made functions protected and private.
+
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::create): Added.
+        * html/HTMLIFrameElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::create): Added.
+        (WebCore::HTMLObjectElement::containsJavaApplet): Changed while loop
+        into a for loop and tweaked formatting.
+
+        * html/HTMLObjectElement.h: Made constructor private and added create.
+        Made other functions private.
+
+        * html/HTMLPlugInElement.h: Made constructor protected.
+        Made other functions protected and private.
+
+        * html/HTMLPlugInImageElement.h: Made constructor and another function
+        protected.
+
+        * html/HTMLTagNames.in: Removed createWithNew from all classes that
+        now have create functions. Moved conditional noscript to a separate
+        paragraph.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Use create.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::SVGElement::create): Added.
+        * svg/SVGElement.h: Added create, made constructor protected, and
+        made other functions protected and private. Removed unneeded
+        SVGNames.h include.
+
+        * svg/SVGExternalResourcesRequired.h: Added now-needed SVGNames.h
+        include.
+
+        * svg/SVGStopElement.h: Added now-needed SVGNames.h include.
+        Made functions private.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::WMLElement): Pass CreateElementZeroRefCount
+        so reference count still starts at 0. Will change this class later.
+        (WebCore::WMLElement::create): Added.
+        * wml/WMLElement.h: Added create and made constructor protected.
+
+        * wml/WMLTagNames.in: Removed createWithNew from WMLElement.
+
+2009-08-22  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/7161656> Crash in RenderObject::destroy when using custom scrollbars
+
+        Custom scrollbars normally get detached when a document gets detached.  In this case, a crash was happening when the document had gone into the page cache 
+        and then was getting destroyed without proper scrollbar teardown.  This change makes custom scrollbars get detached when the document enters the cache.
+
+        I couldn't figure out a way to reliably cause this to happen in DRT, since the reproducible case relies on the cache being purged at a particular time.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::CachedFrame): Detach custom scrollbars when the CachedFrame is created.  
+          They'll get reattached when the document comes out of the page cache.
+        * page/FrameView.cpp: (WebCore::FrameView::~FrameView): Added some asserts to catch this problem earlier in debug builds.
+
+2009-08-22  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Make sure self-collapsing blocks that clear floats are still able to collapse their bottom margins with
+        the bottom of their parent blocks.  The old code prevented all collapsing, but all CSS2.1 states is that:
+        "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin."
+        
+        The implication is that the bottom margin can still collapse, and the block-inside-inline form of
+        fast/block/margin-collapse/025.html (added as fast/block/margin-collapse/block-inside-inline/025.html) depends
+        on it to get comparable results.
+
+        Added block-inside-inline tests (a whole slew of them) in fast/block/margin-collapse/block-inside-inline/
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::canCollapseBottomWithChildren):
+
+2009-08-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Need to implement ARIA role="listitem" and role="list"
+        https://bugs.webkit.org/show_bug.cgi?id=28606
+
+        Test: platform/mac-snowleopard/accessibility/aria-list-and-listitem.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Clean up fill image geometry calculation
+        https://bugs.webkit.org/show_bug.cgi?id=28652
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Renamed
+            calculateBackgroundSize() to this. Replaced separate scaledWidth and
+            scaledHeight parameters with a single scaledSize parameter. Renamed
+            parameters and local variables.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Changed
+            to use CSS3 Backgrounds and Borders terminology in comments and
+            local variable names. Renamed, clarified and consolidated some local
+            variables.
+        * rendering/RenderBoxModelObject.h: Made calculateFillTileSize() private.
+
+2009-08-22  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47669
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Backing out http://trac.webkit.org/changeset/47671 in preparation of
+        rolling out http://trac.webkit.org/changeset/47669.
+
+2009-08-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        Build fix, add CanvasRenderingContext to build systems.
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * DerivedSources.make: Added CanvasRenderinContext.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files implementing GL buffer wrappers, and support to make them platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        * html/canvas/CanvasBuffer.cpp: Added. Wrapper around GL Buffer object
+        * html/canvas/CanvasBuffer.h: Added.
+        * html/canvas/CanvasBuffer.idl: Added.
+        * html/canvas/CanvasFramebuffer.cpp: Added. Wrapper around GL Framebuffer object
+        * html/canvas/CanvasFramebuffer.h: Added.
+        * html/canvas/CanvasFramebuffer.idl: Added.
+        * html/canvas/CanvasObject.h: Expose m_context
+        * html/canvas/CanvasProgram.cpp: Added. Wrapper around GL Program object
+        * html/canvas/CanvasProgram.h: Added.
+        * html/canvas/CanvasProgram.idl: Added.
+        * html/canvas/CanvasRenderbuffer.cpp: Added. Wrapper around GL Renderbuffer object
+        * html/canvas/CanvasRenderbuffer.h: Added.
+        * html/canvas/CanvasRenderbuffer.idl: Added.
+        * html/canvas/CanvasRenderingContext3D.cpp: Move m_objects hash table from GraphicsContext3D to here
+        * html/canvas/CanvasRenderingContext3D.h:
+        * html/canvas/CanvasShader.cpp: Added. Wrapper around GL Shader object
+        * html/canvas/CanvasShader.h: Added.
+        * html/canvas/CanvasShader.idl: Added.
+        * html/canvas/CanvasTexture.cpp: Added. Wrapper around GL Texture object
+        * html/canvas/CanvasTexture.h: Added.
+        * html/canvas/CanvasTexture.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Removed.
+        * platform/graphics/GraphicsContext3D.h: Move m_objects hash table from here to CanvasRenderingContext3D
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Implement platform dependent code for GL object creation/destruction
+
+2009-08-21  Darin Adler  <darin@apple.com>
+
+        * WebCore.vcproj/build-generated-files.sh:
+        * make-generated-sources.sh:
+        Removed obsolete code to set up CREATE_HASH_TABLE.
+
+2009-08-21  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/7162322> Custom style sheet ignored if UAC is enabled 
+
+        * platform/win/SharedBufferWin.cpp: (WebCore::SharedBuffer::createWithContentsOfFile): 
+        No need to open the file with write access.  Only read access is needed.
+
+2009-08-21  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7161454> Leaks seen during http/tests/xmlhttprequest/cross-origin-no-authorization.html
+
+        Also fixes leaks seen on appcache tests.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::cancel): Work around
+        something that's likely a CFNetwork issue. Note that on Windows, there is no matching API
+        to call, and we do not think that the leak occurs there anyway.
+
+2009-08-21  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28650
+        Remove cross-thread code from CrossOriginPreflightResultCache.
+        Removed mutexes, atomic initializer and string copy.
+
+        No new tests, the worker tests cover this.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        Buildfix after http://trac.webkit.org/changeset/47655.
+
+        * html/HTMLFormControlElement.h:
+
+2009-08-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+          Removed Custom Bindings
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+
+          Made Non-Custom Bindings in the Backend
+
+        (WebCore::InspectorBackend::getCookies):
+        (WebCore::InspectorBackend::deleteCookie):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::deleteCookie):
+        * inspector/InspectorController.h:
+
+          Build the Cookie ScriptObjects, handles using document.cookie in
+          case the platform hasn't implemented raw cookie access.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getCookies):
+        (WebCore::InspectorDOMAgent::buildObjectForCookie):
+        (WebCore::InspectorDOMAgent::buildArrayForCookies):
+        * inspector/InspectorDOMAgent.h:
+
+          Complete the Asynchronous Calls
+
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didGetCookies):
+        * inspector/InspectorFrontend.h:
+
+          Asynchronous Functions to get Cookie Data
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.getCookiesAsync):
+        (WebInspector.Cookies.buildCookiesFromString): fallback behavior
+
+          Refactor to use the Asynchronous Functions
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update.callback):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.simpleDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Cleaned/Commented Related Code
+
+        (InspectorController.searchCanceled):
+        * inspector/front-end/InjectedScript.js:
+        * platform/Cookie.h:
+        * English.lproj/localizedStrings.js: the new strings that were supposed to have gone in last time
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28145
+        Add support for novalidate/formnovalidate attribute, from HTML5 specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-fs-novalidate
+
+        Tests: fast/forms/formnovalidate-attribute.html
+               fast/forms/novalidate-attribute.html
+
+        * html/HTMLAttributeNames.in: added novalidate, formnovalidate
+        * html/HTMLButtonElement.idl: formnovalidate attribute exposed
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::formNoValidate): attribute getter
+        (WebCore::HTMLFormControlElement::setFormNoValidate): attribute setter
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::novalidate): attribute getter
+        (WebCore::HTMLFormElement::setNovalidate): attribute setter
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.idl: novalidate attribute exposed
+        * html/HTMLInputElement.idl: formNoValidate attribute exposed
+
+2009-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Rendering changes to complete
+        [CSS3 Backgrounds and Borders] Add support for the "contain" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27573
+        and
+        [CSS3 Backgrounds and Borders] Add support for the "cover" value for
+        background-size
+        https://bugs.webkit.org/show_bug.cgi?id=27574
+
+        Test: fast/backgrounds/size/contain-and-cover.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+2009-08-21  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27452
+        Add support for checkValidity() method and invalid event, from HTML5
+        specs:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-form-checkvalidity
+
+        Tests: fast/events/invalid-001.html
+               fast/events/invalid-002.html
+               fast/events/invalid-003.html
+               fast/events/invalid-004.html
+               fast/events/invalid-005.html
+               fast/forms/checkValidity-001.html
+               fast/forms/checkValidity-002.html
+               fast/forms/checkValidity-003.html
+               fast/forms/checkValidity-004.html
+
+        * dom/Document.idl: oninvalid event handler
+        * dom/Element.idl: ditto
+        * dom/EventNames.h: added invalid event
+        * dom/Node.cpp:
+        (WebCore::Node::oninvalid): ditto
+        (WebCore::Node::setOninvalid): ditto
+        * dom/Node.h: ditto
+        * html/HTMLAttributeNames.in: oninvalid attribute
+        * html/HTMLButtonElement.idl: added checkValidity() method
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute): parses oninvalid
+        * html/HTMLFieldSetElement.idl: added checkValidity() method
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::checkValidity): checkValidity()
+        implementation
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::checkValidity): checkValidity() implementation
+        for form elements
+        * html/HTMLFormElement.h: checkValidity() definition
+        * html/HTMLFormElement.idl: added checkValidity() method
+        * html/HTMLInputElement.idl: added checkValidity() method
+        * html/HTMLSelectElement.idl: added checkValidity() method
+        * html/HTMLTextAreaElement.idl: added checkValidity() method
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninvalid): oninvalid event handler
+        (WebCore::DOMWindow::setOninvalid): ditto
+        * page/DOMWindow.h: ditto
+        * page/DOMWindow.idl: ditto
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27571 [CSS3 
+        Backgrounds and Borders] Add support for the "round" value for 
+        background-repeat
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27570 [CSS3 Backgrounds and 
+        Borders] Add support for the "space" value for background-repeat
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillRepeat):
+        * css/CSSValueKeywords.in:
+        * rendering/style/FillLayer.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        New files for Canvas 3D feature
+        https://bugs.webkit.org/show_bug.cgi?id=28018
+
+        This is all the new files for implementing Canvas 3D. None of them are hooked up and
+        are not even included in the build yet. This incorporates the reviews from Simon
+        and Ollie for these files.
+
+        * bindings/js/JSCanvasNumberArrayCustom.cpp: Added. Custom JS binding to do implicit conversion from JS Array
+        * html/CanvasObject.cpp: Added. Base class for all GL object containers
+        * html/CanvasObject.h: Added.
+        * html/CanvasRenderingContext.cpp: Added. Base class for CanvasRenderingContext2D and CanvasRenderingContext3D
+        * html/CanvasRenderingContext.h: Added.
+        * html/CanvasRenderingContext.idl: Added.
+        * html/CanvasRenderingContext3D.cpp: Added. 3D context returned from Canvas.getContext()
+        * html/CanvasRenderingContext3D.h: Added.
+        * html/CanvasRenderingContext3D.idl: Added.
+        * platform/graphics/GraphicsContext3D.cpp: Added. Platform interface between CanvasRenderingContext3D and 3D graphics engine
+        * platform/graphics/GraphicsContext3D.h: Added.
+        * platform/graphics/mac/Canvas3DLayer.h: Added. CALayer subclass to composite 3D canvas
+        * platform/graphics/mac/Canvas3DLayer.mm: Added.
+        * platform/graphics/mac/GraphicsContext3DMac.cpp: Added. Mac specific interface (OpenGL based)
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Another Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::diffTextDecorations):
+
+2009-08-21  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28625, focus rings don't respect the non-strict mode
+        line box shrinking quirk.  Make sure outlines don't extend outside the lineTop and lineBottom
+        of the root line box.
+
+        Covered by existing tests.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        No Review.
+
+        Windows build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::setTextDecorationProperty): Made it static
+        (WebCore::diffTextDecorations): Made it static
+
+2009-08-21  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        execCommand("Underline") uses CSS even when styleWithCSS has been turned off
+        https://bugs.webkit.org/show_bug.cgi?id=23892
+
+        This patch adds support for u and s in StyleChange and addInlineStyleIfNeeded so that
+        WebKit does not use CSS to decorate texts when styleWithCSS is set to false.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::copy): Added.
+        * css/CSSValueList.h: Added copy.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applyUnderline):
+        (WebCore::StyleChange::applyLineThrough):
+        (WebCore::StyleChange::StyleChange): Added a boolean trimTextDecorations argument.
+        (WebCore::StyleChange::init): Ditto.
+        (WebCore::StyleChange::extractTextStyles): Handles text decorations.
+        (WebCore::getPropertiesNotInComputedStyle): Handles text decorations properly.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Adds u and s if needed.
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Rename "Databases" Panel as "Storage"
+        https://bugs.webkit.org/show_bug.cgi?id=28620
+
+          Updated enum from "DatabasesPanel" to "StoragePanel" and wherever it was used.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::specialPanelForJSName): string to display StoragePanel can be either "databases" or "storage"
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::showPanel):
+
+          Updated All Direct Access from WebInspector.panels.databases to WebInspector.panels.storage,
+          any DatabasesPanel constructors and appropriate function names.
+
+        * inspector/front-end/DOMStorageDataGrid.js:
+        (WebInspector.DOMStorageDataGrid.prototype._startEditingColumnOfDataGridNode):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryFinished):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels): updated string that comes from hiddenPanels to be "databases" or "storage"
+        (WebInspector.showStoragePanel):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+
+          Renamed some files and Updated Accordingly.
+
+        * inspector/front-end/StoragePanel.js: Renamed from WebCore/inspector/front-end/DatabasesPanel.js.
+        * inspector/front-end/Images/storageIcon.png: Renamed from WebCore/inspector/front-end/Images/databasesIcon.png.
+        * inspector/front-end/WebKit.qrc: use new file names
+        * inspector/front-end/inspector.css: use new images name and class names
+        * inspector/front-end/inspector.html: use new file name
+        * WebCore.gypi: use new file names
+
+          Miscellaneous Updates.
+
+        * English.lproj/localizedStrings.js: Updated Tooltip from "Databases" to "Storage"
+
+2009-08-21  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding three font-specific files to WebCore:
+        FontCacheHaiku.cpp, FontHaiku.cpp, and SimpleFontDataHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28131
+
+        * platform/graphics/haiku/FontCacheHaiku.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getTraitsInFamily):
+        * platform/graphics/haiku/FontHaiku.cpp: Added.
+        (charUnicodeToUTF8HACK):
+        (WebCore::Font::canReturnFallbackFontsForComplexText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/haiku/SimpleFontDataHaiku.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-08-21  Philippe Beauchamp  <philippe.beauchamp@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Middle click panning icon is offset by 3 pixels
+        https://bugs.webkit.org/show_bug.cgi?id=28611
+
+        * platform/ScrollView.cpp:
+        panIconSizeLength initialized to 20 instead of 16 to match icon dimension (2 pixels offset)
+        * platform/win/CursorWin.cpp:
+        (WebCore::middlePanningCursor):
+        Hotspot initialized to (8,8) instead of (7,7) (one pixel offset)
+        
+2009-08-21  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        [Qt] Remove inspector resources for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=28610
+
+        Based on an idea from Simon Hausmann.
+
+        * WebCore.pro:
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Inspector: Remove Unused Variable
+        https://bugs.webkit.org/show_bug.cgi?id=28616
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype._checkWarning):
+
+2009-08-21  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Array Formatter Shows Extra Properties
+        https://bugs.webkit.org/show_bug.cgi?id=28615
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray): do not ignore hasOwnProperties
+
+2009-08-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        The CSS part of https://bugs.webkit.org/show_bug.cgi?id=27574 [CSS3 
+        Backgrounds and Borders] Add support for the "contain" value for 
+        background-size
+        -and-
+        https://bugs.webkit.org/show_bug.cgi?id=27573 [CSS3 Backgrounds and 
+        Borders] Add support for the "cover" value for background-size
+
+        Return contain or cover when appropriate, and otherwise do what we 
+        used to do.
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+        Accept contain and cover as valid values for background-size.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+
+        Handle setting the size and the sizeLength if appropriate.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+
+        Added new keywords contain and cover.
+        * css/CSSValueKeywords.in:
+
+        Use just sizeLength instead of size to match old behavior.
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+
+        The variable m_sizeType is an EBackgroundSize, and m_sizeLength is 
+        a LengthSize (the equivalent of what m_size used to be). I got rid 
+        of m_sizeSet and made isSizeSet() dynamic. I also defined a new 
+        struct, FillSize that can be used to set or get m_size and 
+        m_sizeLength both at once. 
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::FillLayer):
+        (WebCore::FillLayer::operator=):
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::fillUnsetProperties):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillSize::FillSize):
+        (WebCore::FillSize::operator==):
+        (WebCore::FillSize::operator!=):
+        (WebCore::FillLayer::sizeLength):
+        (WebCore::FillLayer::size):
+        (WebCore::FillLayer::isSizeSet):
+        (WebCore::FillLayer::setSizeType):
+        (WebCore::FillLayer::setSizeLength):
+        (WebCore::FillLayer::setSize):
+        (WebCore::FillLayer::clearSize):
+        (WebCore::FillLayer::initialFillSizeType):
+        (WebCore::FillLayer::initialFillSizeLength):
+        (WebCore::FillLayer::initialFillSize):
+
+        This is all boiler-plate stuff to adjust to the new size() vs. 
+        sizeType() vs. sizeLength() distinction.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::backgroundSizeType):
+        (WebCore::InheritedFlags::backgroundSizeLength):
+        (WebCore::InheritedFlags::maskSize):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setBackgroundSizeLength):
+        (WebCore::InheritedFlags::setMaskSize):
+
+        Definition for EBackgroundSizeType.
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-21  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47580.
+
+        [Qt] Adjust the files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Enable various "grouping" ARIA roles
+        https://bugs.webkit.org/show_bug.cgi?id=28486
+
+        Test: platform/mac/accessibility/aria-grouping-roles.html
+
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Unreviewed trivial comment fix.
+
+        Update a bug link in a comment due to bugzilla amnesia.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+
+2009-08-20  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        HTML5 media elements do not fire waiting events correctly
+        https://bugs.webkit.org/show_bug.cgi?id=28335
+
+        Fire the waiting event before seeking, and fix a case where firing of
+        the seeked event is missed when the ready state is changed during
+        a seek.
+
+        Added video-waiting-seeking.html into manual tests because not
+        all platforms allow seeking into non-buffered ranges.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): add support for
+        waiting event when seeking.
+        (WebCore::HTMLMediaElement::finishSeek): send seeked event
+        whenever seeking finishes.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): dispatch to
+        new function.
+        * html/HTMLMediaElement.h:
+        * manual-tests/video-waiting-seeking.html: Added.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix more cases of
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        If the border box is empty, simply avoid painting instead of trying to
+        clip to the empty path.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-08-20  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot a svn add for a patch I landed.  :-(
+
+        * storage/SQLTransactionClient.cpp: Added.
+        (WebCore::SQLTransactionClient::didCommitTransaction):
+        (WebCore::SQLTransactionClient::didExecuteStatement):
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=24793>
+        Auto scroll speed is faster than in IE, Firefox.
+        
+        Changed pan scrolling speed to match Firefox's algorithm.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::adjustedScrollDelta):
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for assert in Chromium page cycler:  drawRect() was re-using
+        an SkPaint, but not resetting it before calling
+        PlatformGraphicsSkia::setupPaintForFilling() a second time.  This
+        CL fixes drawRect(), and re-enables the assert.
+        http://bugs.webkit.org/show_bug.cgi?id=28172
+        http://crbug.com/19797
+
+        Covered by Chromium page cycler tests.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/7159016> Popup menus don't disappear when you click outside the window.
+        
+        Revert r47535 which introduced this.
+        
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupWndProc):
+
+2009-08-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Crashes on sites with lots of images
+        https://bugs.webkit.org/show_bug.cgi?id=28473
+
+        The problem is that m_resourceToRevalidate::m_isBeingRevalidated is false while
+        CachedResource is still referring to it, so it may get deleted before
+        Cache::revalidationSucceeded calls CachedResource::clearResourceToRevalidate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Added assert to verify the resource
+        being revalidated is physically in the cache.
+        (WebCore::Cache::revalidationSucceeded): Changed to do one call to switch from the revalidating
+        resource to the revalidated resource.  This allows for proper lifetime management of the
+        revalidated resource. Added assert to verify that the revalidatingResource is in the cache.
+        (WebCore::Cache::pruneDeadResources): Don't remove items from the cache that are in the
+        process of being validated (or else they can get added twice: Once through the normal mechanism
+        and then again during revalidateResource).
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        Changed m_isBeingRevalidated to m_proxyResource to allow finding out
+        who the validating resource (or proxy) is.
+
+        (WebCore::CachedResource::~CachedResource): Removed code to handle m_resourceToRevalidate
+        being non-zero because this shouldn't be possible due to checks in canDelete. Added asserts
+        as well.
+        (WebCore::CachedResource::setResourceToRevalidate): Adjusted for the change to m_proxyResource
+        and added a comment about the assert.
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        Only clean up the resourceToRevalidate if it hasn't gotten a new proxy resource.
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): Don't clear m_proxyResource because the resource
+        is still being referred to by it and the code it robust to this being switched to a new proxy
+        resource without it being cleared first.
+        (WebCore::CachedResource::canDelete): Changed m_isBeingRevalidated to m_proxyResource.
+
+2009-08-20  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix "Chromium RTL autocomplete popup is not layout correctly".
+        https://bugs.webkit.org/show_bug.cgi?id=27889
+
+        The complete fix of the issue consists 2 parts: the patch in webkit
+        and the patch in Chromium's own code.
+
+        This webkit patch only affects Chromium autofill. It
+        1. introduces a new flag in WebCore::PopupContainerSettings to
+           distinguish whether the width of the drop-down should be restricted
+           or not.
+           For autofill, the width of the drop-down is restricted to
+           be the same as that of the input field (the new flag is set in
+           Chromium's own code). But width is not restricted for <select> (same as before).
+        2. introduce a new flag in WebCore::PopContainerSettings to
+           indicate what heuristics to use when displaying text in drop-down menu.
+           For autofill, use drop-down item's directionality to display drop-down items.
+           Previously, drop-down item is displayed in the its first strong
+           directional character's directionality.
+           (drop-down item's directionality is set in Chromium's own code.
+           It is set the same as the directionality of the element. 
+           For autofill, it is the same directionality as that of the input field.)
+           For <select>, still use the text's first strong directional character's
+           directionality to display the text.
+
+
+        Since the patch only affects the chromium client, not webcore part or
+        other clients. No automatic tests is possible.
+
+        * manual-tests/autofill-popup-width-and-item-direction.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::paintRow): If list box width is restricted and 
+        an item is longer to fit in a list box, truncate it and draw part of the text and append ellipses.
+        (WebCore::PopupListBox::layout): Restrict width of list box if applicable.
+        * platform/chromium/PopupMenuChromium.h: 
+        (WebCore::PopupItem::PopupItem): style change.
+        (WebCore::PopupContainerSettings::): Add 2 new flags in PopupContainerSetting to 
+        distinguish whether to restrict width of list box and 
+        in what directionality to display the text in drop-down.
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28504>. 
+        Pan Scrolling can scroll while showing the middlePanScroll icon.
+        
+        Fixed an off by one error between RenderLayer::panScrollFromPoint and EventHandler::updatePanScrollState. 
+        In RenderLayer::panScrollFromPoint, we were setting the icon to be an arrow if the difference between the start
+        of the pan scroll and the current mouseposition is > 15. However, in EventHandler::updatePanScrollState, we would
+        set our amount to scroll to 0 only if the difference in mouse position is < 15. I made this check a <= 15, to fix
+        the off by one error.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pull the code in layoutBlockChildren for handling a normal flow block child into a helper method,
+        layoutBlockChild.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+
+2009-08-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Made subframeForHitTargetNode a public static method, so WebView can call it
+        during hit testing.
+
+        * page/EventHandler.cpp:
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::subframeForTargetNode):
+        * page/EventHandler.h:
+
+2009-08-20  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubberstamped by Kevin Ollivier.
+
+        Check for null bundle before attempting to use it.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath): Add null check on return of
+          CFBundleGetBundleWithIdentifier.
+
+2009-08-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28497, images and inline replaced elements don't propagate overflow properly on a line.
+
+        Added fast/repaint/inline-block-overflow.html and updated another test.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        Make sure to still propagate the border box of the replaced element as layout overflow when overflow clip is set on the
+        replaced element.  Make sure to use the InlineBox x/y positions instead of the RenderBox x/y, since the position of the
+        RenderBox has not been updated to the new values yet.
+        
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        Don't use the root line box's overflow.  Use the actual line box overflow values instead.  In the case of an inline
+        with a layer, our overflow didn't propagate to the root line, so we always need to use our values.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        Make sure to clear shadow overflow when doing layout of replaced elements, so that we don't leave a stale overflow
+        value around if a box-shadow goes away.
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Another attempt to fix Chromium build.
+
+        * WebCore.gypi: now use the correct name of the image file.
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Make the Windows build even fixeder
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+
+2009-08-20  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        * WebCore.gypi: add new Webinspector image files (localStorage.png and sessionStorage.png)
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Windows build fix after the last change
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace many manually-released CFTypeRefs with RetainPtrs
+        https://bugs.webkit.org/show_bug.cgi?id=28498
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GradientCG.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setURLForRect):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        * platform/graphics/cg/PDFDocumentImage.cpp:
+        (WebCore::PDFDocumentImage::dataChanged):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::Path::contains):
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::BitmapImage::getTIFFRepresentation):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::cocoaTypeFromMIMEType):
+        (WebCore::MIMETypeFromCocoaType):
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::advanceCurrentStream):
+        (WebCore::setHTTPBody):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::encode):
+
+2009-08-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Output actual values of counters in showTree
+        https://bugs.webkit.org/show_bug.cgi?id=28481
+
+        No new tests because this patch just improves debugging outputs.
+
+        * rendering/CounterNode.cpp:
+        (WebCore::showTreeAndMark):
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Add file missed in last check-in.
+
+        * html/HTMLAttributeNames.in:
+
+2009-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Adds new icons to the Web Inspector for Local Storage,
+        Session Storage and Cookies.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28470
+
+        Reviewed by Eric Seidel.
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        * inspector/front-end/Images/cookie.png:
+        * inspector/front-end/Images/domStorage.png: Removed.
+        * inspector/front-end/Images/localStorage.png: Added.
+        * inspector/front-end/Images/sessionStorage.png: Added.
+        * inspector/front-end/inspector.css:
+
+2009-08-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        HTML5 media elements must fire 'loadend' progress event
+        https://bugs.webkit.org/show_bug.cgi?id=28419
+
+        * dom/EventNames.h:
+            Define loadend.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute):
+            Deal with onloadend.
+        (WebCore::HTMLMediaElement::loadInternal):
+            Post 'loadend' immediately after 'abort'.
+        (WebCore::HTMLMediaElement::noneSupported):
+            Post 'loadend' immediately after 'error'.
+        (WebCore::HTMLMediaElement::mediaEngineError):
+            Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Post 'loadend' immediately after 'load'.
+        (WebCore::HTMLMediaElement::userCancelledLoad):
+            Post 'loadend' immediately after 'abort'.
+
+2009-08-20  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGESSION(r45316), Crash: WebKit crashes in Google Sites when indenting a table
+        https://bugs.webkit.org/show_bug.cgi?id=28474
+
+        This patch fixes a crash when indenting at right after a table.
+        The bug was caused by Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+        where node() is equal to blockNode. Because blockNode is the enclosing block node, this patch changes it to
+        enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
+
+        Test: editing/execCommand/indent-right-after-table.html
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Fixed so that blockNode != endOfCurrentParagraph.deepEquivalent().node()
+
+2009-08-20  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by David Levin.
+
+        Render disabled mute button during an error or if no audio is present.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28475
+
+        Covered by existing layout tests:
+        media/video-controls-visible-audio-only.html
+        media/video-no-audio.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+
+2009-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7154605> Loading page with 1px wide <select> makes the
+        toolbar go blank
+        and
+        <rdar://problem/7154521> Lots of "<Error>: doClip: empty path." spew in
+        the console with certain content
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Return early
+        if the rectangle is empty. Use RenderStyle::getBorderRadiiForRect() to
+        adjust the radii in case the sides of the rectangle are smaller than sum
+        of the radii, so that the gradient background matches the border (which
+        already uses getBorderRadiiForRect()). Check if bottomGradient is empty
+        to avoid clipping to an empty path.
+        (WebCore::RenderThemeMac::paintMenuListButton): Moved a
+        GraphicContext::save() down to avoid a save/restore imbalance in the
+        early return case.
+
+        * rendering/RenderThemeSafari.cpp: Made the same changes.
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+
+2009-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk][REGRESSION] XHR test failures after r45558
+        https://bugs.webkit.org/show_bug.cgi?id=27143
+
+        Disable sniffing if it's explicitly requested. Updated patch
+        originally by Gustavo Noronha.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::statusWillBeHandledBySoup):
+        (WebCore::gotHeadersCallback):
+        (WebCore::contentSniffedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::startHttp):
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Swap the pixels since QImage expect ARGB while ImageData
+        stores them as RGBA.
+
+        This fixes the fast/canvas/canvas-copyPixels.html test.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::putImageData):
+
+2009-08-20  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by David Levin.
+
+        [v8] Use atomic string caching for createElement
+        Extend atomic string caching to createElement.  Fix a bug in idl
+        parser that caused incorrect parsing if a function argument
+        attribute list contained a comma.
+        https://bugs.webkit.org/show_bug.cgi?id=28449
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/IDLParser.pm:
+        * bindings/v8/V8Binding.h:
+        (WebCore::v8ValueToAtomicWebCoreStringWithNullCheck):
+        * dom/Document.idl:
+
+2009-08-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed, build fix after r47515.
+
+        [Qt] There is no Phonon::MediaObject::hasAudio() function.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio): Assume true.
+
+2009-08-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28483
+        The V8 ScriptController's cleanupScriptObjectsForPlugin should take a
+        Widget* instead of void* to avoid the need for manual casting to Widget*
+        at the callsite.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::cleanupScriptObjectsForPlugin):
+        * bindings/v8/ScriptController.h:
+
+2009-08-19  David Levin  <levin@chromium.org>
+
+        Unreviewed speculative build fix for qt.
+
+        * page/OriginAccessEntry.cpp:
+
+2009-08-19  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24853: Provide a way for WebKit clients to
+        specify a more granular policy for cross-origin XHR access.
+
+        Tests: http/tests/xmlhttprequest/origin-whitelisting-all.html
+               http/tests/xmlhttprequest/origin-whitelisting-exact-match.html
+               http/tests/xmlhttprequest/origin-whitelisting-https.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains.html
+               http/tests/xmlhttprequest/origin-whitelisting-ip-addresses.html
+               http/tests/xmlhttprequest/origin-whitelisting-subdomains.html
+
+        * WebCore.base.exp: Export methods to manipulate origin access whitelists to enable
+        testing via layout tests.
+
+        * WebCore.xcodeproj/project.pbxproj: Add OriginAccessEntry.*
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.blk: Ditto.
+
+        * page/SecurityOrigin.h: Implement origin access whitelists.
+        (WebCore::originAccessMap): Static getter for access whitelists.
+        (WebCore::SecurityOrigin::canRequest): Modify request checking logic to check whitelists.
+        (WebCore::SecurityOrigin::whiteListAccessFromOrigin): Add an entry to a whitelist.
+        (WebCore::SecurityOrigin::resetOriginAccessWhiteLists): Clear all the whitelists.
+
+        * page/OriginAccessEntry.h: Added. An entry in an origin access whitelist.
+        * page/OriginAccessEntry.cpp: Ditto.
+
+2009-08-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-precomp headers build fix.
+
+        * platform/image-decoders/ImageDecoder.cpp:
+
+2009-08-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Disable a bad SKIA assert
+        https://bugs.webkit.org/show_bug.cgi?id=28482
+
+        In http://trac.webkit.org/changeset/47386/ an assert was "fixed" in SKIA code. 
+        When this was pulled into Chromium, it started breaking the page cycler. 
+        Disable it again until we can figure out what's going on.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-19  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        queryCommandState('underline') returns false if the selected text is also bold and italic
+        https://bugs.webkit.org/show_bug.cgi?id=11022
+
+        This patch modifies stateStrikethrough and stateUnderline to use the value -webkit-text-decorations-in-effect
+        instead of text-decoration.  Because text-decoration only retrieves explicit styling at the node on which
+        the query was sent, we need to use -webkit-text-decorations-in-effect to include decorations added by ancestors
+        and also u, s, and strike tags.
+
+        Test: editing/style/text-decoration-state.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::stateStrikethrough): Use -webkit-test-decorations-in-effect instead of text-decoration.
+        (WebCore::stateUnderline): Ditto.
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - Fix <rdar://problem/7155710>
+        HTML selects on windows cause containing window to become inactive when opened.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        Pass SWP_NOACTIVATE to SetWindowPos, remove AW_ACTIVATE from AnimateWindow and pass
+        SW_SHOWNOACTIVATE to ShowWindow.
+        
+        (WebCore::PopupWndProc):
+        Prevent mouse activation from activating the window.
+
+2009-08-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Images flash as you hover them on http://www.atebits.com/scribbles/
+        <rdar://problem/7143958>
+        
+        Tag images with the device colorspace with the colorspace of the main display, rather than
+        GenericRGB, so that composited images color-match those rendered via Core Graphics.
+        
+        Covered by LayoutTests/compositing/color-matching/image-color-matching.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+
+2009-08-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152589> Stylable scrollbar corners aren't working.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        Initialize m_scrollCorner.
+
+        (WebCore::FrameView::~FrameView):
+        Assert that m_scrollCorner is null.
+
+        (WebCore::FrameView::detachCustomScrollbars):
+        Destroy m_scrollCorner.
+
+        (WebCore::FrameView::invalidateScrollCorner):
+        Invalidate the scroll corner.
+        
+        (WebCore::FrameView::updateScrollCorner):
+        Create/destroy the scroll corner.
+        
+        (WebCore::FrameView::paintScrollCorner):
+        Paint the scroll corner.
+        
+        * page/FrameView.h:
+        (WebCore::FrameView::isFrameViewScrollCorner):
+        Return whether a RenderScrollbarPart is the frame view scroll corner.
+        
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        Go ahead and update the scroll corner.
+        
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        Pass the scroll corner rect to invalidateRect.
+        
+        (WebCore::ScrollView::scrollCornerRect):
+        Return the scroll corner rect.
+        
+        * platform/ScrollView.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        If this scrollbar part is the frame view scroll corner, invalidate it.
+
+2009-08-19  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG feComponentTransfer needs to be implemented
+        [https://bugs.webkit.org/show_bug.cgi?id=27768]
+
+        Implementation of SVG Filter feComponentTransfer.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-comptran-01-b.svg
+
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::identity):
+        (WebCore::table):
+        (WebCore::discrete):
+        (WebCore::linear):
+        (WebCore::gamma):
+        (WebCore::FEComponentTransfer::apply):
+
+2009-08-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/7141522> Incorrect layout of product table at henry.com
+
+        Test: fast/block/basic/quirk-percent-height-table-cell.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcPercentageHeight): Tweak the quirk that allows
+        percentage-height children of auto-height blocks to look for an ancestor
+        with non-auto height and compute their height based on it. The change is
+        that if that ancestor is a table cell, it is ignored and the percent
+        height computes to zero (just like in strict mode). This matches Firefox
+        and IE.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add 'icu::' qualifier when refering to ICU C++ names to the other
+        file with this issue missed in the previous check-in.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::):
+
+2009-08-19  Peter Kasting  <pkasting@google.com>
+
+        Unreviewed (build fix for Skia).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] Remove setFont indirection
+        https://bugs.webkit.org/show_bug.cgi?id=28453
+
+        Remove the indirection and just set the font in Font::drawGlyphs.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::scaledFont):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: When adding style selector, generate default name based
+        on id / class / type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28468
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.appropriateSelectorForNode):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename combinedOverflow to visibleOverflow, since that's what it actually represents.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::topvisibleOverflow):
+        (WebCore::InlineFlowBox::bottomvisibleOverflow):
+        (WebCore::InlineFlowBox::leftvisibleOverflow):
+        (WebCore::InlineFlowBox::rightvisibleOverflow):
+        (WebCore::InlineFlowBox::visibleOverflowRect):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::visibleOverflowRect):
+        (WebCore::RenderBox::topvisibleOverflow):
+        (WebCore::RenderBox::bottomvisibleOverflow):
+        (WebCore::RenderBox::leftvisibleOverflow):
+        (WebCore::RenderBox::rightvisibleOverflow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderOverflow.h:
+        (WebCore::RenderOverflow::visibleOverflowRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+
+2009-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Sound button appears in controller with movies that have no audio
+        https://bugs.webkit.org/show_bug.cgi?id=28464
+
+        Test: media/video-no-audio.html
+
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayer::hasVideo):
+            Make const.
+        (WebCore::MediaPlayer::hasAudio):
+            Added hasAudio.
+
+        * platform/graphics/MediaPlayerPrivate.h:
+            Add hasAudio.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasAudio):
+            Ditto.
+
+        * platform/graphics/win/QTMovieWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasAudio):
+            Ditto.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::disabled):
+            New, return true if media element doesn't have audio.
+        (WebCore::MediaControlMuteButtonElement::rendererIsNeeded):
+            Renderer is not needed if element has no audio.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::disabled):
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::getMediaUIPartStateFlags):
+            Return MediaUIPartDisabledFlag if node is disabled.
+            
+
+2009-08-19  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Removed the two unnecessary overridden willValidate() methods introduced
+        in r47444.
+
+        * html/HTMLKeygenElement.h:
+        * html/HTMLObjectElement.h:
+
+2009-08-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Allow dumping dangling nodes to the console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28458
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.cpp:
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::releaseDanglingNodes):
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::bind):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::discardBindings):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::setDetachedRoot):
+        (WebCore::InspectorFrontend::childNodeCountUpdated):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatnode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._childNodeCountUpdated):
+        (WebInspector.setDetachedRoot):
+        (WebInspector.childNodeCountUpdated):
+        (InspectorController.pushNodeToFrontend):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.pushNodeToFrontend):
+        (InjectedScript.createProxyObject):
+
+2009-08-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27464
+        Implement application cache online whitelist wildcard flag
+
+        Test: http/tests/appcache/whitelist-wildcard.html
+
+        A "*" in NETWORK section means that network loading needn't be blocked.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::setAllowsAllNetworkRequests):
+        (WebCore::ApplicationCache::allowsAllNetworkRequests):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+
+2009-08-19  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/7042555> Loading certain pages on Tiger will start a spurious download
+        
+        Get rid of method swizzling entirely. This created problems when lower level
+        Foundation code would call into our own swizzled method.
+        
+        * platform/network/mac/ResourceHandleMac.mm: 
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): 
+        * platform/network/mac/WebCoreURLResponse.h:
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (-[NSURLResponse adjustMIMETypeIfNecessary]):
+
+2009-08-19  Adam Roben  <aroben@apple.com>
+
+        Fix linker warnings on Windows
+
+        Reviewed by Anders Carlsson.
+
+        Fixes <http://webkit.org/b/28462> WebCore causes linker warnings on
+        Windows about multiply-defined JSHTMLDataListElement symbols
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSHTMLDataListElement.cpp
+        from the build (just like we do for the other generated bindings
+        files) so that we don't get warnings about multiply-defined symbols in
+        JSHTMLDataListElement.cpp and DerivedSources.cpp. Also removed
+        duplicate versions of JSSVGElementWrapperFactory.cpp, and let VS
+        reorder a few files.
+
+2009-08-19  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel
+
+        Add 'icu::' qualifier when refering to ICU C++ names.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28410
+
+        No change in the test result.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
+
+2009-08-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Cleanup from my patch thet rewrote overflow.  Remove unused member variables from RenderTableSection and
+        move the addition of overflow from children into a separate pass after the height of the section has been
+        set.  This prevents the RenderOverflow struct from being aggressively allocated for all table sections.
+        (Not a a correctness issue, just a memory issue.)
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+
+2009-08-19  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Remove bogus dependency rules for built sources that derive
+        from HTMLTagNames.in, HTMLAttributeNames.in and xmlattrs.in. The
+        header files should be generated regardless of whether the source
+        file changed or not. We should only rely on the *.in files being
+        changed.
+
+        * GNUmakefile.am:
+
+2009-08-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        convert FormatBlock candidate tag list from if chain to hash lookup
+        https://bugs.webkit.org/show_bug.cgi?id=28448
+
+        No behavior change, just cleanup.
+
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2009-08-19  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Update GraphicsContextSkia's version of drawLine to make use of the shared
+        adjustLineToPixelBoundaries function and elimination overlapping code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-08-18  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28446
+        Custom request headers shouldn't be sent with cross-origin preflight request
+
+        Tests: http/tests/xmlhttprequest/access-control-preflight-headers-async.html
+               http/tests/xmlhttprequest/access-control-preflight-headers-sync.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight):
+        Don't copy headers to OPTIONS request. The spec is vague about this, but the intention was
+        that they shouldn't be sent, and Firefox doesn't send them.
+
+2009-08-18  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8 Bindings for Desktop Notifications feature.
+        https://bugs.webkit.org/show_bug.cgi?id=28271
+
+        * WebCore.gypi: 
+        added notification files to build (all still behind a flag that's not on)
+        * bindings/scripts/CodeGeneratorV8.pm:
+        added special case in DOMWindow/AppCache style for named event handlers
+        * bindings/v8/DOMObjectsInclude.h:
+        * bindings/v8/DerivedSourcesAllInOne.cpp:
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::getTemplate):
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+        * bindings/v8/V8Index.cpp:
+        * bindings/v8/V8Index.h:
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::convertToV8Object):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8NotificationCenterCustom.cpp: Added.
+        * notifications/Notification.h:
+        made event handler routines public (as they are in DOMWindow, eg) for
+        binding access.
+        * notifications/NotificationCenter.idl:
+        needed to make methods V8Custom to support different behaviors in 
+        worker/page context in chromium. 
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+        needed to make these methods public as well so chromium can inject
+        the notification presenter into the worker thread.
+
+2009-08-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - Implement HTML5 nav element
+        https://bugs.webkit.org/show_bug.cgi?id=27937
+
+        <nav> should behave essentially the same as <div> for parsing
+        etc. This is implemented by the changes below.
+        
+        Tests: fast/html/nav-element.html
+
+        * css/html.css:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::tagPriority):
+        (WebCore::blockTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        * html/HTMLTagNames.in:
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson, David Hyatt and Dan Bernstein.
+
+        - Fix <rdar://problem/7152727>
+
+        If a page has custom scroll bars, they will not update correctly when the window is activated/deactivated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hasCustomScrollbars):
+        Check if the frame view or any of its subviews have custom scroll bars.
+        
+        (WebCore::FrameView::updateControlTints):
+        Go ahead and update control tints if the frame view has custom scroll bars.
+        
+        * page/FrameView.h:
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Roll out r47477 as it introduced assertion failures and crashes on the build bots.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the SharedTimer file for WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28126
+
+        * platform/haiku/SharedTimerHaiku.cpp: Added.
+        (WebCore::):
+        (WebCore::SharedTimerHaiku::SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::~SharedTimerHaiku):
+        (WebCore::SharedTimerHaiku::instance):
+        (WebCore::SharedTimerHaiku::start):
+        (WebCore::SharedTimerHaiku::stop):
+        (WebCore::SharedTimerHaiku::Filter):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+
+2009-08-18  Mark Rowe  <mrowe@apple.com>
+
+        Release build fix.
+
+        * xml/XMLHttpRequest.cpp: Sprinkle some #ifndef NDEBUG around.
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+
+2009-08-18  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28412: Leak of WebCore::XMLHttpRequest object during layout tests.
+
+        No new tests: Already covered by existing tests.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Add instrumentation for this kind of leak.
+        (WebCore::XMLHttpRequest::~XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Only setPendingActivity() if we actually started a request. Also,
+        restore a call to nonCacheRequestInFlight() that got lost in a recent refactor.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Added a client to SQLTransaction. In addition to being a place to
+        get notifications about certain events in a transaction, it is
+        also an abstraction layer that allows us to plug in different
+        implementations for each port for how transactions interract with
+        the main DB. For example, WebCore's default implementation will
+        make direct calls to DatabaseTracker's methods. At the same time,
+        Chromium's implementation will send IPCs to the browser process
+        whenever a transaction needs something from the main DB.
+
+        All storage tests pass.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27967
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionClient):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionClient):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::runCurrentStatement):
+        (WebCore::SQLTransaction::deliverQuotaIncreaseCallback):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        * storage/SQLTransactionClient.cpp: Added.
+        * storage/SQLTransactionClient.h: Added.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Final change for v8 corresponding to http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added missing using statment
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+       More corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Julie Parent  <jparent@chromium.org>
+
+        Not reviewed, build fix for Chromium.
+
+        Make corresponding changes to V8 from http://trac.webkit.org/changeset/47469.
+
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Use srcAttr instead of the src function.
+
+2009-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Build fix.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getIdentifierValue):
+
+2009-08-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More work on making DOM classes start with reference count of 1
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        Some related clean-up and preparation steps so the subsequent
+        patches will be as small as possible.
+
+        * WebCore.base.exp: Sorted this file.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        Use nameAttr instead of the name function.
+
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        Use srcAttr instead of the src function.
+
+        * bindings/objc/DOM.mm: Sorted includes.
+        * dom/Document.cpp: Ditto.
+
+        * dom/StyledElement.cpp: Made invalidateStyleAttribute inline.
+        * dom/StyledElement.h: Ditto.
+
+        * dom/make_names.pl: Changed default of createWithNew to 0.
+        Eventually all elements will be created with create instead of new.
+
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+        * wml/WMLTagNames.in:
+        Added createWithNew for every tag. We'll remove it as we convert
+        element classes to use create.
+
+        * html/HTMLAppletElement.h: Removed unneeded forward declarations.
+        * html/HTMLFrameElement.h: Ditto.
+
+        * html/HTMLEmbedElement.cpp: Removed many attribute get and
+        set functions.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPlugInElement.h: Ditto.
+
+        * html/HTMLFrameElementBase.cpp: Removed many attribute get and
+        set functions.
+        (WebCore::HTMLFrameElementBase::location): Changed to use
+        srcAttr instead of src.
+        * html/HTMLFrameElementBase.h: Removed many attribute get and set
+        functions.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::replaceMediaElementTimerFired):
+        Use srcAttr and typeAttr instead of setSrc and setType.
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure): Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Use nameAttr instead
+        of name -- this avoids an extra AtomicString round trip and a little
+        ref count churn too.
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to support loading.
+        https://bugs.webkit.org/show_bug.cgi?id=28342
+
+        Added loader support to shared workers, and refactored worker tests to also test SharedWorkers
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::postTaskToLoader):
+        Forwards load requests to an arbitrary document from the list of worker's documents.
+        (WebCore::SharedWorkerProxy::postTaskForModeToWorkerContext):
+        Posts responses back to the shared worker thread.
+
+2009-08-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        StyleChange::init needs clean up before fixing the bug 23892
+        https://bugs.webkit.org/show_bug.cgi?id=27749
+
+        This patch simplifies StyleChange::init by removing the iteration on CSS properties,
+        and adding functions reconcileTextDecorationProperties and extractTextStyle to handle the style.
+
+        Because there is a bug in how text decorations are processes in getPropertiesNotInComputedStyle,
+        this patch simplifies the treatment in order to preserve the original behavior of WebKit.
+        However, the current implementation is not best (adds redundant text-decorations) and we should fix it later.
+
+        No test is added since there is no change in behavior.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init): Uses getPropertiesNotInComputedStyle instead of iterating through the properties
+        (WebCore::StyleChange::reconcileTextDecorationProperties): Removes -webkit-text-decorations-in-effects and redundant "none"
+        (WebCore::getIdentifierValue): Obtains the identifier of a CSSPrimitiveValue
+        (WebCore::StyleChange::extractTextStyles): Converts properties in style to m_apply* and removes the property
+        (WebCore::getPropertiesNotInComputedStyle): Fixed a bug with how text decorations are treated
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixing a DB file naming bug in Chromium. The origin should come
+        before the DB name in the file name.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28331
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::fullPathForDatabase):
+
+2009-08-18  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding four image-specific files to WebCore:
+        IconHaiku.cpp, ImageBufferData.h, ImageBufferHaiku.cpp, ImageHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/haiku/IconHaiku.cpp: Added.
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/haiku/ImageBufferData.h: Added.
+        * platform/graphics/haiku/ImageBufferHaiku.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::platformTransformColorSpace):
+        * platform/graphics/haiku/ImageHaiku.cpp: Added.
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::draw):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::getBBitmap):
+
+2009-08-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=27575 [CSS3 
+        Backgrounds and Borders] Drop the prefix from background-size
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::cssPropertyID):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::ensurePropertyMap):
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers need to forward exceptions to parent documents
+        https://bugs.webkit.org/show_bug.cgi?id=28320
+
+        Changed SharedWorkerProxy to have individual mutexes (so workers can interact with their parent documents without contention).
+
+        Updated SharedWorkerProxy to forward exceptions/console messages to all parent documents.
+
+        * bindings/js/JSSharedWorkerConstructor.cpp:
+        Cleaned up bitrot - added missing include.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::postExceptionTask):
+        Callback used to deliver exceptions to a document.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        Forwards exceptions to all parent documents for presentation to the user.
+        (WebCore::postConsoleMessageTask):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        Forwards console messages to all parent documents for presentation to the user.
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Grabs the mutex before accessing workerDocuments.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Grabs the mutex before accessing workerDocuments.
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7135588> HTMLMediaElement should ask WebPolicyLoadDelegate before loading resource
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::isSafeToLoadURL):
+        Call FrameLoaderClient::shouldLoadMediaElementURL.
+        
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldLoadMediaElementURL):
+        Return true by default.
+
+2009-08-18  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        openDatabase() should not execute any SQL statement on the
+        database it's trying to open, unless there are no other open
+        handles to the same database. Otherwise, we might run into a
+        deadlock.
+
+        Test: storage/open-database-while-transaction-in-progress.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=28207
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify):
+
+2009-08-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter feBlend implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=28133]
+
+        Implementation of SVG Filter feBlend.
+
+        FilterEffect.cp needed changes to optimize the rendering. With the old code
+        we drew a subEffect on the current FilterEffect by drawImage, got the PixelArray,
+        cleared the drawing area, drew the next FilterEffect with drawImage and picked this
+        PixelArray again. This was unefficient and slow. Now we calculate the requested area
+        of the subEffect and ask the FilterEffect's ImageBuffer for the PixelArray directly,
+        without any drawing operations on GraphicsContext.
+
+        There is already a test case
+        Test: svg/W3C-SVG-1.1/filters-blend-01-b.svg
+
+        * html/canvas/CanvasPixelArray.h:
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::unknown):
+        (WebCore::normal):
+        (WebCore::multiply):
+        (WebCore::screen):
+        (WebCore::darken):
+        (WebCore::lighten):
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingIntRect):
+        * platform/graphics/filters/FilterEffect.h:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter followup: node formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._format):
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Metrics sidebar broken
+
+        https://bugs.webkit.org/show_bug.cgi?id=28434
+
+        * inspector/front-end/MetricsSidebarPane.js:
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28432
+        String::createCFString() returns a non-retained empty string
+
+        No known change in functionality, so no test.
+
+        * platform/text/cf/StringCF.cpp: (WebCore::String::createCFString): Retain the CFSTR result.
+    
+2009-08-18  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix of <https://bugs.webkit.org/show_bug.cgi?id=28326> DRT on Windows doesn't support 
+        LayoutTestController::setQuota or print a callback on UIDelegate::exceededDatabaseQuota.
+        
+        Removed an early return that can cause deleteOrigin or deleteAllDatabases to fail when
+        it doesn't have to.
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::deleteOrigin):
+
+2009-08-18  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27357
+        Support for :valid and :invalid CSS selectors, from HTML5 specs.
+        http://www.whatwg.org/specs/web-apps/current-work/#selector-valid
+
+        Tests: fast/css/pseudo-invalid-001.html
+               fast/css/pseudo-invalid-002.html
+               fast/css/pseudo-valid-001.html
+               fast/css/pseudo-valid-002.html
+               fast/css/pseudo-valid-003.html
+               fast/css/pseudo-valid-004.html
+               fast/css/pseudo-valid-005.html
+               fast/css/pseudo-valid-006.html
+               fast/css/pseudo-valid-007.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): extracts new pseudo-classes
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Make sure we don't share style between
+form controls that have different validity states.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        style associated to new pseudo-classes
+        * dom/Element.h:
+        (WebCore::Element::willValidate): pushed up in hierarchy
+        (WebCore::Element::isValidFormControlElement): checks for valid form
+        control elements (wraps ValidityState::valid())
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::willValidate): minor clean up
+        (WebCore::HTMLFormControlElement::isValidFormControlElement): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLKeygenElement.h:
+        (WebCore::HTMLKeygenElement::willValidate): added
+        * html/HTMLObjectElement.h:
+        (WebCore::HTMLObjectElement::willValidate): added
+        * html/HTMLObjectElement.idl:
+
+2009-08-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Fix array formatter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28427
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._formatarray):
+
+2009-08-17  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos
+
+        Replace repeated string of PLATFORM(FOO) with a single define
+        https://bugs.webkit.org/show_bug.cgi?id=27734
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+
+2009-08-16  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20329, shadows and reflections incorrectly
+        considered part of scrollable overflow.
+
+        This patch takes the engine's concept of overflow and splits it into two types:
+        layout overflow and visual overflow.
+        
+        Layout overflow is about other boxes that spill out of an enclosing box,  For example,
+        in the inline flow case a tall image could spill out of a line box. Examples of 
+        visual overflow are shadows, text stroke (and eventually outline and
+        border-image).
+
+        Three objects tracked overflow before this patch: RenderBlock had 
+        m_overflowLeft/Top/Width/Height variables.  RootInlineBox had an Overflow*
+        that also had four overflow values.  Finally RenderReplaced elements tracked shadow/reflection
+        overflow using a map that cached four values.
+        
+        This patch takes all of these different overflow models and unifies them into a single
+        new class called RenderOverflow.   This class is now a member variable in RenderBox and
+        InlineFlowBoxes.  It is only allocated if overflow actually exists.  Instead of tracking
+        four values, it tracks eight: left/top/right/bottom for layout overflow and 
+        left/top/right/bottom for visual overflow.
+        
+        Overflow computation is now done after layout is finished rather than during layout
+        (when child objects can be churning and moving around).  A number of layout tests progressed
+        by deferring overflow computation to a separate pass.
+        
+        All inline flow boxes now track overflow (and not just the root line box).  This allows
+        repainting of line boxes to actually be tight and bail early if the overflow rect of a box
+        doesn't intersect.  The old code always visited all object on a line if the root line box
+        intersected at all.
+        
+        Line box overflow no longer propagates across self-painting layers.  This fixes a number of
+        issues with incorrect scrollbars appearing when relative positioned inlines were used in a page.
+        
+        Layer bounds have been modified to exclude visual overflow.  The width/height members only really
+        have one reason for continued existence, and that is that they happen to be used in repaint()
+        when an overflow clip object's height isn't accurate.  In this case, the bounds should exclude
+        visual overflow anyway, so this change tightens that repaint up.
+        
+        Root lines have renamed m_selectionTop/Bottom to m_lineTop/Bottom and positionForPoint methods have
+        been changed to use these instead of relying on overflow (which was totally wrong).
+
+        Significant changes have been made to the "almost strict mode" line box quirk where objects with no
+        text children have no effect on the height of a line.  Instead of making the height() of the objects
+        variable and dependent on overflow, the objects now have their full height and get placed on
+        the baseline properly.  They simply don't contribute to overflow above lineTop/Bottom.
+        
+        Reflections are no longer considered overflow of any kind.  Because reflections have their own layers,
+        it is not necessary to treat them as visual or layout overflow in the RenderObject tree.  The end result
+        of not incorporating them into RenderOverflow is that they have no effect on scrolling.  transparencyClipBox
+        has been extended to support fully reflecting the entire clip box when a reflection exists.  This fixes
+        numerous repaint bugs in transparent objects with reflections when the transparent objects had self-painting
+        sublayers.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        (WebCore::FrameView::adjustPageHeight):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustPosition):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::computeVerticalOverflow):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::topCombinedOverflow):
+        (WebCore::InlineFlowBox::bottomCombinedOverflow):
+        (WebCore::InlineFlowBox::leftCombinedOverflow):
+        (WebCore::InlineFlowBox::rightCombinedOverflow):
+        (WebCore::InlineFlowBox::combinedOverflowRect):
+        (WebCore::InlineFlowBox::topLayoutOverflow):
+        (WebCore::InlineFlowBox::bottomLayoutOverflow):
+        (WebCore::InlineFlowBox::leftLayoutOverflow):
+        (WebCore::InlineFlowBox::rightLayoutOverflow):
+        (WebCore::InlineFlowBox::layoutOverflowRect):
+        (WebCore::InlineFlowBox::topVisualOverflow):
+        (WebCore::InlineFlowBox::bottomVisualOverflow):
+        (WebCore::InlineFlowBox::leftVisualOverflow):
+        (WebCore::InlineFlowBox::rightVisualOverflow):
+        (WebCore::InlineFlowBox::visualOverflowRect):
+        (WebCore::InlineFlowBox::setHorizontalOverflowPositions):
+        (WebCore::InlineFlowBox::setVerticalOverflowPositions):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::addOverflowFromBlockChildren):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::addOverflowFromInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::addShadowAndReflectionOverflow):
+        (WebCore::RenderBox::addOverflowFromChild):
+        (WebCore::RenderBox::addLayoutOverflow):
+        (WebCore::RenderBox::addVisualOverflow):
+        (WebCore::RenderBox::clearLayoutOverflow):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::combinedOverflowRect):
+        (WebCore::RenderBox::topCombinedOverflow):
+        (WebCore::RenderBox::bottomCombinedOverflow):
+        (WebCore::RenderBox::leftCombinedOverflow):
+        (WebCore::RenderBox::rightCombinedOverflow):
+        (WebCore::RenderBox::layoutOverflowRect):
+        (WebCore::RenderBox::topLayoutOverflow):
+        (WebCore::RenderBox::bottomLayoutOverflow):
+        (WebCore::RenderBox::leftLayoutOverflow):
+        (WebCore::RenderBox::rightLayoutOverflow):
+        (WebCore::RenderBox::visualOverflowRect):
+        (WebCore::RenderBox::topVisualOverflow):
+        (WebCore::RenderBox::bottomVisualOverflow):
+        (WebCore::RenderBox::leftVisualOverflow):
+        (WebCore::RenderBox::rightVisualOverflow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderOverflow.h: Added.
+        (WebCore::RenderOverflow::RenderOverflow):
+        (WebCore::RenderOverflow::topLayoutOverflow):
+        (WebCore::RenderOverflow::bottomLayoutOverflow):
+        (WebCore::RenderOverflow::leftLayoutOverflow):
+        (WebCore::RenderOverflow::rightLayoutOverflow):
+        (WebCore::RenderOverflow::topVisualOverflow):
+        (WebCore::RenderOverflow::bottomVisualOverflow):
+        (WebCore::RenderOverflow::leftVisualOverflow):
+        (WebCore::RenderOverflow::rightVisualOverflow):
+        (WebCore::RenderOverflow::setTopLayoutOverflow):
+        (WebCore::RenderOverflow::setBottomLayoutOverflow):
+        (WebCore::RenderOverflow::setLeftLayoutOverflow):
+        (WebCore::RenderOverflow::setRightLayoutOverflow):
+        (WebCore::RenderOverflow::setTopVisualOverflow):
+        (WebCore::RenderOverflow::setBottomVisualOverflow):
+        (WebCore::RenderOverflow::setLeftVisualOverflow):
+        (WebCore::RenderOverflow::setRightVisualOverflow):
+        (WebCore::RenderOverflow::layoutOverflowRect):
+        (WebCore::RenderOverflow::visualOverflowRect):
+        (WebCore::RenderOverflow::combinedOverflowRect):
+        (WebCore::RenderOverflow::move):
+        (WebCore::RenderOverflow::addLayoutOverflow):
+        (WebCore::RenderOverflow::addVisualOverflow):
+        (WebCore::RenderOverflow::resetLayoutOverflow):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForPoint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::adjustPosition):
+        (WebCore::RootInlineBox::verticallyAlignBoxes):
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::nextRootBox):
+        (WebCore::RootInlineBox::prevRootBox):
+        (WebCore::RootInlineBox::lineTop):
+        (WebCore::RootInlineBox::lineBottom):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::selectionHeight):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        (WebCore::RootInlineBox::setLineTopBottomPositions):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-08-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28431
+        <rdar://problem/7137610> Application Cache doesn't work with HTTP authentication
+
+        Test: http/tests/appcache/auth.html
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::shouldUseCredentialStorage): If appcache is enabled,
+        always allow it to use stored credentials (we can't ask WebKit client, and maybe we
+        shouldn't ask it, because it's not a document that's loading these resources).
+
+2009-08-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan and David Hyatt.
+
+        Fix <rdar://problem/7147996>
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        Update the style of the scroll bars.
+        
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        Calculate the size of the scrollbar and set it as the frame size.
+
+2009-08-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        HTMLMediaElement should fire 'progress' event before 'load'
+        https://bugs.webkit.org/show_bug.cgi?id=28314
+
+        Test: media/progress-event-at-least-one.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState):
+            Schedule 'progress' event before 'load'.
+
+2009-08-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28415
+        Set svn:eol-style CRLF on all .sln and .vcproj files that don't already
+        have it.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-18  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Need to extend DumpRenderTree to expose number of worker threads
+        https://bugs.webkit.org/show_bug.cgi?id=28292
+
+        Expose WorkerThread::workerThreadCount() for DumpRenderTree so we can write worker lifecycle tests.
+
+        Tests: fast/workers/shared-worker-lifecycle.html-disabled
+               fast/workers/worker-lifecycle.html
+
+        * WebCore.base.exp:
+        Exported WorkerThread::workerThreadCount().
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerThread.cpp:
+        Added tracking of the number of worker threads.
+        (WebCore::threadCountMutex):
+        (WebCore::WorkerThread::workerThreadCount):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::~WorkerThread):
+        * workers/WorkerThread.h:
+
+2009-08-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed, build fix.
+
+        [Qt] Add new files I forgot to add in r47424.
+
+2009-08-18  Markus Goetz <Markus.Goetz@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement prefetchDNS() function.
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2009-08-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Support for parsing <datalist> element and generating HTMLDataListElement nodes.
+        https://bugs.webkit.org/show_bug.cgi?id=26915
+
+        Tests: fast/forms/datalist-nonoption-child.html
+               fast/forms/datalist.html
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html.css:
+        * html/CollectionType.h:
+        (WebCore::):
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::itemAfter):
+        * html/HTMLDataListElement.cpp: Added.
+        (WebCore::HTMLDataListElement::HTMLDataListElement):
+        (WebCore::HTMLDataListElement::~HTMLDataListElement):
+        (WebCore::HTMLDataListElement::checkDTD):
+        (WebCore::HTMLDataListElement::options):
+        * html/HTMLDataListElement.h: Added.
+        * html/HTMLDataListElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        -webkit-box-orient:horizontal doesn't work on <button> tag
+        https://bugs.webkit.org/show_bug.cgi?id=34445
+
+        Make a flexible button's anonymous child flexible and pass the
+        parent's box-orient to the anonymous child.
+
+        Also, added a renderName for anonymous flexible boxes.
+
+        Test: fast/flexbox/box-orient-button.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::renderName):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Render -webkit-mask via compositing layers when possible
+        https://bugs.webkit.org/show_bug.cgi?id=28414
+        
+        Implement accelerated compositing of -webkit-mask, when combined
+        with already-composited content.
+        
+        RenderLayerBacking now creates an additional GraphicsLayer for the mask contents,
+        and sets this as the mask on another GraphicsLayer via the setMaskLayer() method.
+        GraphicsLayerCA then applies the mask using -[CALayer setMask:].
+        
+        The enum values for GraphicsLayerPaintingPhase were renamed to avoid the
+        confusion with "mask", and a new value, GraphicsLayerPaintMask, was added which
+        indicates that just the mask is painting.
+        
+        When painting the composited mask, we need to paint with the normal compositing
+        mode rather than CompositeDestinationIn, so InlineFlowBox and RenderBox now consult
+        layer()->hasCompositedMask() to pick the mode. If the mask is composited, they no longer
+        need to make transparency layers.
+        
+        We no longer have to throw video rendering into software because of masks.
+        
+        When a masked element has composited descendants, that element needs to
+        become composited so that the mask can be applied via compositing.
+
+        Tests: compositing/masks/masked-ancestor.html
+               compositing/masks/simple-composited-mask.html
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::GraphicsLayer):
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::maskLayer):
+        (WebCore::GraphicsLayer::setMaskLayer):
+        (WebCore::GraphicsLayer::paintingPhase):
+        (WebCore::GraphicsLayer::setPaintingPhase):
+        * platform/graphics/GraphicsLayerClient.h:
+        (WebCore::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setMaskLayer):
+        (WebCore::GraphicsLayerCA::recursiveCommitChanges):
+        (WebCore::GraphicsLayerCA::commitLayerChanges):
+        (WebCore::GraphicsLayerCA::updateMaskLayer):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasCompositedMask):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::~RenderLayerBacking):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::updateMaskLayer):
+        (WebCore::RenderLayerBacking::paintingPhaseForPrimaryLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::hasMaskLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Layer content misplaced with compositing, z-index and overflow
+        https://bugs.webkit.org/show_bug.cgi?id=28361
+        
+        The foreground GraphicsLayer (used to render element foreground when the element has 
+        negative z-order children) was misplaced when there is a clipping layer (which clips
+        children). The foreground layer is parented under the clipping layer so that the foreground
+        depth-sorts with the layer's children, so its geometry needs to be computed relative to
+        that clipping layer.
+        
+        Also clarified some FIXME comments, and corrected a debug-only layer name.
+
+        Test: compositing/geometry/clipping-foreground.html
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::updateSublayerList):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix leaks of SVGElementInstance seen during regression tests.
+
+        r47313 made TreeShared types start with a ref-count of 1, but SVGElementInstance was mistakenly
+        not updated to have a create method that adopted the initial reference.  This lead to the instances
+        of SVGElementInstance allocated by SVGUseElement being leaked.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::create):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::handleDeepUseReferencing):
+
+2009-08-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Some cleanup towards https://bugs.webkit.org/show_bug.cgi?id=13631
+        Page Cache should support pages with frames.
+
+        - Re-factor all remaining page cache code out of DocumentLoader, as CachedPage/CacheFrame loads
+          are solely the responsibility of FrameLoader.
+        - Enhance some page cache related Logging to help development.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::identifierForInitialRequest):
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::continueLoadAfterWillSubmitForm):
+        (WebCore::FrameLoader::loadProvisionalItemFromCachedPage):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::isLoadingFromCachedPage):
+
+2009-08-17  Roland Steiner  <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Moved implementation of isAfterContent to RenderObject
+        (as inline method to avoid potential performance regressions).
+
+        BUG 28376 -  [Cleanup] isAfterContent() implemented twice, should be member of RenderObject
+        (https://bugs.webkit.org/show_bug.cgi?id=28376)
+
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAfterContent):
+
+2009-08-17  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Assertion failure in WebCore::RenderHTMLCanvas::layout
+        https://bugs.webkit.org/show_bug.cgi?id=12052
+
+        Don't handle run-in if the element is not a block element.
+
+        Test: fast/runin/nonblock-runin.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-08-17  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fix createImageData to raise the NOT_SUPPORTED_ERR exception when
+        either of the arguments are not finite.
+
+        According to
+        http://www.whatwg.org/specs/web-apps/current-work/#pixel-manipulation:
+        "If any of the arguments to createImageData() or getImageData() are
+        infinite or NaN, or if the createImageData()  method is invoked with
+        only one argument but that argument is null, the method must instead
+        raise a NOT_SUPPORTED_ERR  exception."
+
+        Test: http://philip.html5.org/tests/canvas/suite/tests/2d.imageData.create.nonfinite.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createImageData):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/CanvasRenderingContext2D.idl:
+
+2009-08-17  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add a way to release the storage lock
+        https://bugs.webkit.org/show_bug.cgi?id=28411
+
+        Two scripts within the same origin that are accessing LocalStorage must not do
+        it simultaneously, according to the spec.  There are some cases, however, where
+        a script might want to override this behavior.  navigator.getStorageUpdates()
+        was added for this reason:
+        http://dev.w3.org/html5/spec/Overview.html#manually-releasing-the-storage-mutex
+
+        Add this function to navigator and hook it up to DOM Storage.
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::getStorageUpdates):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * storage/StorageNamespace.h:
+        * storage/StorageNamespaceImpl.cpp:
+        (WebCore::StorageNamespaceImpl::unlock):
+        * storage/StorageNamespaceImpl.h:
+
+2009-08-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        CFNetwork isn't present in the framework search path on Mac OS X so we can't directly include its headers.
+        We include CoreServices.h, the umbrella framework that contains CFNetwork, from the prefix header which
+        results in the CFNetwork headers being included on Mac OS X.  CoreServices.h doesn't include CFNetwork.h on
+        Windows though so we explicitly include this header from the prefix header when on Windows.
+
+        * WebCorePrefix.h:
+        * platform/network/cf/DNSCFNet.cpp: Remove #include that is no longer needed.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying a better build fix (the previous one broke Leopard bots, although it did build for me).
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFNetwork.h instead.
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix Windows build.
+
+        * platform/network/cf/DNSCFNet.cpp: Include CFNetwork/CFHost.h.
+
+2009-08-17  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27323
+        Only add Cygwin to the path when it isn't already there.  This avoids
+        causing problems for people who purposefully have non-Cygwin versions of
+        executables like svn in front of the Cygwin ones in their paths.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/WebCoreGenerated.vcproj:
+
+2009-08-17  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28401
+        Add support for DNS prefetching with CFNetwork
+
+        This is just an optimization, no behavior change, so no tests.
+
+        * platform/network/cf/DNSCFNet.cpp:
+        (WebCore::clientCallback):
+        (WebCore::prefetchDNS):
+        Use async CFHostStartInfoResolution() for implementation.
+
+2009-08-17  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28313: Combine ThreadableLoaderOptions::crossOriginRequestPolicy and
+        ThreadableLoaderOptions::crossOriginRedirectPolicy since they are always set the same way.
+
+        Also, tightened up behavior of XMLHttpRequest with cross-origin redirects and access control. We have not implemented
+        redirects access control, so we should never redirect across origins. But in two edge cases, we were:
+
+        * Asynchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to a resource on origin A.
+        * Synchronous XHR: Script on origin A requests resource from origin B. Server redirects (without sending access control
+          authorization headers) to another resource on origin B (this time sending access control authorization headers).
+
+        Test: http/tests/xmlhttprequest/access-control-and-redirects.html
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::willSendRequest): Refactor redirect checking code into shared location.
+        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
+        (WebCore::DocumentThreadableLoader::isAllowedRedirect): Ditto.
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.h:
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Remove ThreadableLoaderOptions::crossOriginRedirectPolicy.
+        * page/EventSource.cpp:
+        (WebCore::EventSource::connect): Ditto.
+        * workers/Worker.cpp: Ditto.
+        (WebCore::Worker::Worker): Ditto.
+        * workers/WorkerContext.cpp: Ditto.
+        (WebCore::WorkerContext::importScripts): Ditto.
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously): Ditto.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
+        * workers/WorkerScriptLoader.h: 
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+
+2009-08-17  Adam Langley  <agl@google.com>
+
+        Reviewed by Dan Bernstein (relanding of r47157).
+
+        Fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        This was originally fixed in r47157, however it triggered a bug in
+        Skia which caused Chromium Linux to fail layout tests in debug mode.
+        It was reverted in r47189 while we sorted it out.
+
+        The Skia bug was fixed in Skia's r321 [1] and rolled into Chromium in
+        Chromium's r23523. This is a reland of the original patch.
+
+        No new tests because it's a just typo fix.
+
+        [1] http://code.google.com/p/skia/source/detail?r=321
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Protect ResourceHandle for g_file_query_info_async call, using the
+        same technique we already use for HTTP requests that take the soup
+        path.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::finishedCallback):
+        (WebCore::):
+
+2009-08-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r47255): MediaWiki's (including Wikipedia) navigation pane
+        appears below the main content
+        https://bugs.webkit.org/show_bug.cgi?id=28350
+
+        A particular version of the MediaWiki software detects WebKit through
+        user agent sniffing and imports a style sheet called KHTMLFixes.css,
+        which contains a single rule that was meant to work around some KHTML
+        bug, but currently has the sole effect of causing the float containing
+        the main article content to extend all the way to the left and thus push
+        down the left navigation pane.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): If site specific hacks are
+        enabled, check if the imported style sheet is the MediaWiki
+        KHTMLFixes.css. If so, remove the offending rule.
+
+2009-08-17  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct crash when processing local cancelled requests.
+
+        No new tests. Existing fast/images/favicon-as-image.html
+        displays the problem.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add check for m_cancelled after
+          performing local-file processing.
+        (WebCore::ResourceHandleManager::downloadTimerCallback): Add
+          check for m_cancelled after performing local-file processing.
+
+2009-08-17  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Reverts 47371, since it breaks GTK+.
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Removed.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Allow image decoders to down-sample the image directly
+        to scaled output buffer. This can be enabled/disabled by
+        macro ENABLE(IMAGE_DECODER_DOWN_SAMPLING).
+        Only JPEG and PNG decoders are modified to support it now.
+        https://bugs.webkit.org/show_bug.cgi?id=28308
+
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData):
+        * platform/image-decoders/ImageDecoder.cpp: Added.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::setMaxNumPixels):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::convertCMYKToRGBA):
+        (WebCore::convertRGBToRGBA):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: fix float literals to avoid casting warnings.
+
+        * rendering/MediaControlElements.cpp:
+
+2009-08-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Use OwnPtrs for GraphicsLayers
+        https://bugs.webkit.org/show_bug.cgi?id=28399
+
+        Convert RenderLayerBacking and RenderLayerCompositor to use OwnPtrs
+        for their references to GraphicsLayers.
+
+        * platform/graphics/GraphicsLayer.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::create):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::destroyGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::updateInternalHierarchy):
+        (WebCore::RenderLayerBacking::updateClippingLayers):
+        (WebCore::RenderLayerBacking::updateForegroundLayer):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::graphicsLayer):
+        (WebCore::RenderLayerBacking::clippingLayer):
+        (WebCore::RenderLayerBacking::ancestorClippingLayer):
+        (WebCore::RenderLayerBacking::foregroundLayer):
+        (WebCore::RenderLayerBacking::parentForSublayers):
+        (WebCore::RenderLayerBacking::childForSuperlayers):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::~RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::rootPlatformLayer):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Reset InjectedScript styles cache on document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28390
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::resetInjectedScript):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript._reset):
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/MediaControlElements.cpp: Removed unneeded include of CString.h,
+        resorted includes, renamed "doc" to "document" and fixed formatting.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed functions now unneeded due to use of Reflect to create
+        language bindings.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        Get at usemap attribute directly.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        Get at id attribute directly.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Ditto.
+
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::dir): Get at dir attribute of body directly.
+        (WebCore::HTMLDocument::setDir): Ditto.
+
+        * html/HTMLElement.cpp: Deleted unused functions.
+        * html/HTMLElement.h: Ditto.
+
+        * html/HTMLImageElement.cpp: Deleted unused functions.
+        (WebCore::HTMLImageElement::alt): Changed to return const AtomicString&.
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Changed to
+        get at usemap attribute directly, but added a FIXME because although
+        it is what the old code did, it looks to not be entirely correct.
+
+        * html/HTMLImageElement.h: Deleted unused functions.
+
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString): Get at alt attribute directly.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageMap): Get at usemap attribute directly.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer): Get at id attribute
+        directly.
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer): Removed
+        explicit HTMLNames namespace qualification.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Removed unneeded calls
+        to RefPtr::get.
+
+2009-08-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Discard DOM Node bindings on any document change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28389
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Improve Cookie DataGrid to Show Hidden Data
+        https://bugs.webkit.org/show_bug.cgi?id=28269
+
+        * English.lproj/localizedStrings.js: DataGrid Headers "Name", "Value", "Size", ...
+        * WebCore.gypi: added missing files
+
+          Implemented Bindings for InspectorController.deleteCookie(name)
+
+        * inspector/InspectorBackend.idl:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        (WebCore::JSInspectorBackend::deleteCookie):
+
+          v8 Bindings Stubs
+
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+          Removed WebInspector.Cookie
+
+        * inspector/front-end/Cookie.js: Removed.
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/WebKit.qrc:
+
+          Improved DataGrid and Kept Fallback Behavior for Platforms that don't
+          yet provide access to raw cookies.
+
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies):
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate.callback):
+        (WebInspector.CookieItemsView.prototype.fallbackUpdate):
+        (WebInspector.CookieItemsView.prototype.fallbackBuildCookiesFromString):
+        (WebInspector.CookieItemsView.prototype.fallbackDataGridForCookies):
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked):
+
+          Interaction with the page through Injected Script (for fallback behavior)
+
+        * inspector/front-end/DOMAgent.js:
+        (InspectorController.getCookies):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.setStyleProperty): style fix
+        (InjectedScript.getCookies):
+
+          Allow alignment of text inside DataGrids.
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGridNode.prototype.createCell):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        * inspector/front-end/inspector.css:
+
+          Added deleteCookie(., ., String name)
+          Modified getRawCookies to return a bool to know if its implemented
+
+        * platform/CookieJar.h:
+
+
+          Implemented deleteCookie for Macs
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+          Stub Implementations for Other Platforms
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+        (WebCore::deleteCookie):
+
+2009-08-17  Adam Treat  <adam.treat@torchmobile.com>
+
+        Blind build fix for Leopard.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::adjustLineToPixelBoundaries):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContextCG.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setCompositeOperation):
+
+2009-08-13  Mike Fenton  <mike.fenton@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Style fixes based on cpp_style.py and WebKit Style guide for
+        GraphicsContext.cpp/h, GraphicsContextCairo.cpp and GraphicsContextQt.cpp.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28268
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::save):
+        (WebCore::GraphicsContext::restore):
+        (GraphicsContext::drawText):
+        (GraphicsContext::initFocusRing):
+        (GraphicsContext::focusRingBoundingRect):
+        (GraphicsContext::drawImage):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::toCairoOperator):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change HTMLAreaElement to use OwnArrayPtr
+        https://bugs.webkit.org/show_bug.cgi?id=28386
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement): Removed unneeded initializer.
+        (WebCore::HTMLAreaElement::~HTMLAreaElement): Removed unneeded delete call.
+        (WebCore::HTMLAreaElement::parseMappedAttribute): Use the set function
+        instead of deletion followed by assignment.
+        * html/HTMLAreaElement.h: Use OwnArrayPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Fix Windows build.
+
+        * dom/make_names.pl: Add back cast to (void*) needed on Windows.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move noResize from HTMLFrameElementBase to HTMLFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=28384
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Initialize m_noResize.
+        (WebCore::HTMLFrameElement::parseMappedAttribute): Set m_noResize to true
+        here if noresizeAttr is changed. This code was moved here from
+        HTMLFrameElementBase, but I added some FIXME comments.
+        (WebCore::HTMLFrameElement::setNoResize): Set the attribute based on
+        boolean argument. Moved here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElement.h: Moved noResize, setNoResize, and m_noResize
+        here from HTMLFrameElementBase.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Removed m_noResize.
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Removed code to parse
+        noresizeAttr.
+
+        * html/HTMLFrameElementBase.h: Removed noResize, setNoResize, and m_noResize.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Tweak HTMLFrameElementBase so that m_URL can be private
+        https://bugs.webkit.org/show_bug.cgi?id=28385
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::rendererIsNeeded): Removed m_URL argument.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::isURLAllowed): Use m_URL instead of
+        taking an argument.
+        (WebCore::HTMLFrameElementBase::openURL): Removed m_URL argument.
+        * html/HTMLFrameElementBase.h: Removed argument from isURLAllowed function.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::rendererIsNeeded): Removed m_URL argument.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        HTMLViewSourceDocument should use smart pointers
+        https://bugs.webkit.org/show_bug.cgi?id=28378
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument): Don't initialize
+        pointers any more since RefPtr starts 0 by default.
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use more specific
+        types for local variables.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Return a PassRefPtr,
+        and use a RefPtr of a more specific type for a local variable.
+        (WebCore::HTMLViewSourceDocument::addLine): Use more specific types for local
+        variables, and use RefPtr as well.
+        (WebCore::HTMLViewSourceDocument::addLink): Return a PassRefPtr, and use a
+        RefPtr of a more specific type for a local variable.
+
+        * html/HTMLViewSourceDocument.h: Change return types to PassRefPtr and
+        data member types to RefPtr.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
+
+        Convert 4 more classes. These are classes I am going to make other changes
+        to soon, so it's good to have this use of Reflect in the IDL out of the way.
+
+        * html/HTMLEmbedElement.idl: Use Reflect for many attributes.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-08-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Script to create element factory needs changes to accommodate calling create
+        https://bugs.webkit.org/show_bug.cgi?id=28379
+
+        * dom/make_names.pl: Tweak formatting. Remove lots of unneeded quotes
+        around names used inside {}. Added new createWithNew property for tags
+        that makes the factory use a create function instead of calling new.
+        Renamed functions with initialize in their name to have default in their
+        name, since they return an array full of default values and don't themselves
+        initialize anything.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        StyledElement should use ASCIICType instead of having its own toHex function
+        https://bugs.webkit.org/show_bug.cgi?id=28377
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addCSSColor): Use isASCIIHexDigit and toASCIIHexValue.
+
+2009-08-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        execCommand("InsertHorizontalRule") inserts a broken <hr> element
+        https://bugs.webkit.org/show_bug.cgi?id=28375
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertHorizontalRule): Create an HTMLHRElement
+        instead of just an HTMLElement.
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] <option> element & 'onpick' events - history navigation is broken
+        https://bugs.webkit.org/show_bug.cgi?id=28371
+
+        After selecting an option element with an 'onpick' event associated with a 'go' task,
+        the navigation is executed. When going back in history, the same 'onpick' event is fired
+        again. Fix that problem, add wml/option-element-onpick-recursion.html covering the bug.
+
+        Test: wml/option-element-onpick-recursion.html
+
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLSelectElement.cpp:
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::selectInitialOptions):
+        * wml/WMLSelectElement.h:
+        (WebCore::WMLSelectElement::initialized):
+
+2009-08-16  Anthony Ricaud  <rik@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector Resource filtering: keyboard Navigation always uses ALL resources
+        https://bugs.webkit.org/show_bug.cgi?id=28231
+        
+        Determine if a resource is selectable on user action.
+        
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceSidebarTreeElement.prototype.get selectable):
+
+2009-08-16  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/28355> Replace MAX()/MIN() macros with type-safe std::max()/min() templates
+
+        Reviewed by Dan Bernstein.
+
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetSpelling): Changed MIN() to min().
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::Font::selectionRectForComplexText): Changed MAX() to
+        max() and MIN() to min().
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        * platform/graphics/mac/SimpleFontDataMac.mm: Added using
+        std::max statement.
+        (WebCore::SimpleFontData::platformInit): Changed MAX() to max().
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::TextCodecMac::decode): Changed MIN() to min().
+
+2009-08-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] Cleanup WMLIntrinsicEventHandling code
+        https://bugs.webkit.org/show_bug.cgi?id=28358
+
+        Remove superflous "Event* evt" parameter from executeTask() methods. It's a leftover from the initial WML merge.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h:
+        * wml/WMLTaskElement.h:
+
+2009-08-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: A handful of DOMAgent-related fixes and cleanups.
+
+        - renamed elementId to nodeId in operations on nodes.
+        - added load listeners to frame owners in InspectorDOMAgent.
+        - removed InspectorController::inspectedWindowScriptObjectCleared event.
+        - preserved isViaInspector flag for 'via inspector' marker to survive styles update.
+        - removed contentDocument-related logic from ElementsPanel since it is handled in
+            the InspectorDOMAgent.
+        - removed DOM listeners unregistration and corresponding events from InspectorController.
+        - made this.styles 'private' in ElementsPanel.
+        - added TODO for the handleCopy processing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28356
+
+        * WebCore.order:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::getChildNodes):
+        (WebCore::InspectorBackend::setTextNodeValue):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::startListening):
+        (WebCore::InspectorDOMAgent::stopListening):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::getChildNodes):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::setTextNodeValue):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentNode):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorFrontend.cpp:
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMDocument.prototype.addEventListener):
+        (WebInspector.DOMDocument.prototype.removeEventListener):
+        (WebInspector.DOMDocument.prototype._fireDomEvent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync.mycallback):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.childNodeInserted):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype.addStyleChange):
+        (WebInspector.ElementsPanel.prototype.removeStyleChange):
+        (WebInspector.ElementsPanel.prototype._updateModifiedNodes):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        (WebInspector.ElementsPanel.prototype.handleCopyEvent):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set rootDOMNode):
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement):
+        (WebInspector.ElementsTreeElement):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren.updateChildrenOfNode):
+        (WebInspector.ElementsTreeElement.prototype._updateChildren):
+        (WebInspector.ElementsTreeElement.prototype.onexpand):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._serializeRule):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        * inspector/front-end/inspector.js:
+        (WebInspector.set hoveredDOMNode):
+        * inspector/front-end/treeoutline.js:
+        (TreeOutline.prototype.findTreeElement):
+        * inspector/front-end/utilities.js:
+        (Node.prototype.enclosingNodeOrSelfWithNodeNameInArray):
+        (Node.prototype.enclosingNodeOrSelfWithClass):
+        (isAncestorNode):
+        (firstCommonNodeAncestor):
+        (traverseNextNode):
+        (traversePreviousNode):
+        ():
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::dispatchWindowObjectAvailable):
+        * page/android/InspectorControllerAndroid.cpp:
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Optimize updateFillImages() to not add/remove clients every time
+        https://bugs.webkit.org/show_bug.cgi?id=28334
+
+        Optimize the case where old and new just have a single layer pointing to the same (or no)
+        image.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Implement animations of multiple text-shadows and -webkit-box-shadows.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Test: transitions/multiple-shadow-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperShadow::equals):
+        (WebCore::PropertyWrapperShadow::blend):
+
+2009-08-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make transitions work for position and size of multiple backgrounds and masks.
+        https://bugs.webkit.org/show_bug.cgi?id=28266
+        
+        Make background-position, background-size, -webkit-mask-position and -webkit-mask-size
+        properties animatable with multiple backgrounds, rather than just animating the first one.
+
+        Tests: transitions/multiple-background-size-transitions.html
+               transitions/multiple-background-transitions.html
+               transitions/multiple-mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::FillLayerPropertyWrapperBase::FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperBase::~FillLayerPropertyWrapperBase):
+        (WebCore::FillLayerPropertyWrapperGetter::FillLayerPropertyWrapperGetter):
+        (WebCore::FillLayerPropertyWrapperGetter::equals):
+        (WebCore::FillLayerPropertyWrapper::FillLayerPropertyWrapper):
+        (WebCore::FillLayerPropertyWrapper::blend):
+        (WebCore::FillLayersPropertyWrapper::FillLayersPropertyWrapper):
+        (WebCore::FillLayersPropertyWrapper::equals):
+        (WebCore::FillLayersPropertyWrapper::blend):
+        (WebCore::ensurePropertyMap):
+        * rendering/style/FillLayer.h:
+        (WebCore::FillLayer::setXPosition):
+        (WebCore::FillLayer::setYPosition):
+        (WebCore::FillLayer::setSize):
+
+2009-08-15  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Jan Alonzo.
+
+        Don't crash in fieldset code when WML is enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=28012
+
+        Test: fast/wml/html-fieldset-crash.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend): ++brackets
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Try and enable EventSource on Windows.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Setting attribute event listeners to the body does not set them on the window
+        https://bugs.webkit.org/show_bug.cgi?id=28343
+
+        Tests: fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html
+               fast/dom/Window/HTMLFrameSetElement-window-eventListener-attributes.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setOnblur): Use setWindowAttributeEventListener instead of setAttributeEventListener.
+        (WebCore::HTMLBodyElement::setOnerror): Ditto.
+        (WebCore::HTMLBodyElement::setOnfocus): Ditto.
+        (WebCore::HTMLBodyElement::setOnload): Ditto.
+        (WebCore::HTMLBodyElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLBodyElement::setOnmessage): Ditto.
+        (WebCore::HTMLBodyElement::setOnoffline): Ditto.
+        (WebCore::HTMLBodyElement::setOnonline): Ditto.
+        (WebCore::HTMLBodyElement::setOnresize): Ditto.
+        (WebCore::HTMLBodyElement::setOnstorage): Ditto.
+        (WebCore::HTMLBodyElement::setOnunload): Ditto.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::setOnblur): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnerror): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnfocus): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnmessage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnoffline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnonline): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnresize): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnstorage): Ditto.
+        (WebCore::HTMLFrameSetElement::setOnunload): Ditto.
+
+2009-08-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix up some IDL comments.
+
+        * html/HTMLBodyElement.idl:
+        * html/HTMLFrameSetElement.idl:
+
+2009-08-15  Adam Bergkvist  <adam.bergkvist@ericsson.com>
+
+        Reviewed by Sam Weinig.
+
+        Added implementation of the EventSource object that enables
+        server-sent events from HTML5.
+        http://dev.w3.org/html5/eventsource/
+        https://bugs.webkit.org/show_bug.cgi?id=14997
+
+        Tests: fast/eventsource/eventsource-attribute-listeners.html
+               fast/eventsource/eventsource-constructor.html
+               http/tests/eventsource/eventsource-bad-mime-type.html
+               http/tests/eventsource/eventsource-parse-event-stream.html
+               http/tests/eventsource/eventsource-reconnect.html
+               http/tests/eventsource/eventsource-status-code-states.html
+               http/tests/eventsource/workers/eventsource-simple.html
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::eventSource):
+        * bindings/js/JSEventSourceConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventSourceConstructor::JSEventSourceConstructor):
+        (WebCore::constructEventSource):
+        (WebCore::JSEventSourceConstructor::getConstructData):
+        * bindings/js/JSEventSourceConstructor.h: Added.
+        (WebCore::JSEventSourceConstructor::classInfo):
+        * bindings/js/JSEventSourceCustom.cpp: Added.
+        (WebCore::JSEventSource::markChildren):
+        (WebCore::JSEventSource::addEventListener):
+        (WebCore::JSEventSource::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::eventSource):
+        * dom/EventNames.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toEventSource):
+        * dom/EventTarget.h:
+        * page/DOMWindow.idl:
+        * page/EventSource.cpp: Added.
+        (WebCore::EventSource::EventSource):
+        (WebCore::EventSource::~EventSource):
+        (WebCore::EventSource::connect):
+        (WebCore::EventSource::endRequest):
+        (WebCore::EventSource::scheduleReconnect):
+        (WebCore::EventSource::reconnectTimerFired):
+        (WebCore::EventSource::url):
+        (WebCore::EventSource::readyState):
+        (WebCore::EventSource::close):
+        (WebCore::EventSource::scriptExecutionContext):
+        (WebCore::EventSource::addEventListener):
+        (WebCore::EventSource::removeEventListener):
+        (WebCore::EventSource::dispatchEvent):
+        (WebCore::EventSource::didReceiveResponse):
+        (WebCore::EventSource::didReceiveData):
+        (WebCore::EventSource::didFinishLoading):
+        (WebCore::EventSource::didFail):
+        (WebCore::EventSource::didFailRedirectCheck):
+        (WebCore::EventSource::parseEventStream):
+        (WebCore::EventSource::parseEventStreamLine):
+        (WebCore::EventSource::dispatchGenericEvent):
+        (WebCore::EventSource::dispatchMessageEvent):
+        (WebCore::EventSource::stop):
+        * page/EventSource.h: Added.
+        (WebCore::EventSource::create):
+        (WebCore::EventSource::):
+        (WebCore::EventSource::setOnopen):
+        (WebCore::EventSource::onopen):
+        (WebCore::EventSource::setOnmessage):
+        (WebCore::EventSource::onmessage):
+        (WebCore::EventSource::setOnerror):
+        (WebCore::EventSource::onerror):
+        (WebCore::EventSource::toEventSource):
+        (WebCore::EventSource::eventListeners):
+        (WebCore::EventSource::refEventTarget):
+        (WebCore::EventSource::derefEventTarget):
+        * page/EventSource.idl: Added.
+        * workers/WorkerContext.idl:
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Minor DOMAgent bugfixes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::nodeForId):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMAgent):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+
+2009-08-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Evaluating objects while on a breakpoint dumps string
+        representation instead of live object. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=28280
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completions.this._evalInInspectedWindow):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame.delayedEvaluation):
+        (WebInspector.ScriptsPanel.prototype.doEvalInCallFrame):
+        (WebInspector.ScriptsPanel.prototype.variablesInSelectedCallFrame):
+
+2009-08-15  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding two new files to WebCore/platform/haiku:
+        LocalizedStringsHaiku.cpp and LoggingHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28129
+
+        * platform/haiku/LocalizedStringsHaiku.cpp: Added.
+        (WebCore::submitButtonDefaultLabel):
+        (WebCore::inputElementAltText):
+        (WebCore::resetButtonDefaultLabel):
+        (WebCore::defaultLanguage):
+        (WebCore::searchableIndexIntroduction):
+        (WebCore::fileButtonChooseFileLabel):
+        (WebCore::fileButtonNoFileSelectedLabel):
+        (WebCore::contextMenuItemTagOpenLinkInNewWindow):
+        (WebCore::contextMenuItemTagDownloadLinkToDisk):
+        (WebCore::contextMenuItemTagCopyLinkToClipboard):
+        (WebCore::contextMenuItemTagOpenImageInNewWindow):
+        (WebCore::contextMenuItemTagDownloadImageToDisk):
+        (WebCore::contextMenuItemTagCopyImageToClipboard):
+        (WebCore::contextMenuItemTagOpenFrameInNewWindow):
+        (WebCore::contextMenuItemTagCopy):
+        (WebCore::contextMenuItemTagGoBack):
+        (WebCore::contextMenuItemTagGoForward):
+        (WebCore::contextMenuItemTagStop):
+        (WebCore::contextMenuItemTagReload):
+        (WebCore::contextMenuItemTagCut):
+        (WebCore::contextMenuItemTagPaste):
+        (WebCore::contextMenuItemTagNoGuessesFound):
+        (WebCore::contextMenuItemTagIgnoreSpelling):
+        (WebCore::contextMenuItemTagLearnSpelling):
+        (WebCore::contextMenuItemTagSearchWeb):
+        (WebCore::contextMenuItemTagLookUpInDictionary):
+        (WebCore::contextMenuItemTagOpenLink):
+        (WebCore::contextMenuItemTagIgnoreGrammar):
+        (WebCore::contextMenuItemTagSpellingMenu):
+        (WebCore::contextMenuItemTagShowSpellingPanel):
+        (WebCore::contextMenuItemTagCheckSpelling):
+        (WebCore::contextMenuItemTagCheckSpellingWhileTyping):
+        (WebCore::contextMenuItemTagCheckGrammarWithSpelling):
+        (WebCore::contextMenuItemTagFontMenu):
+        (WebCore::contextMenuItemTagBold):
+        (WebCore::contextMenuItemTagItalic):
+        (WebCore::contextMenuItemTagUnderline):
+        (WebCore::contextMenuItemTagOutline):
+        (WebCore::contextMenuItemTagWritingDirectionMenu):
+        (WebCore::contextMenuItemTagDefaultDirection):
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+        (WebCore::contextMenuItemTagInspectElement):
+        (WebCore::searchMenuNoRecentSearchesText):
+        (WebCore::searchMenuRecentSearchesText):
+        (WebCore::searchMenuClearRecentSearchesText):
+        (WebCore::unknownFileSizeText):
+        (WebCore::AXWebAreaText):
+        (WebCore::AXLinkText):
+        (WebCore::AXListMarkerText):
+        (WebCore::AXImageMapText):
+        (WebCore::AXHeadingText):
+        (WebCore::imageTitle):
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+        (WebCore::AXButtonActionVerb):
+        (WebCore::AXTextFieldActionVerb):
+        (WebCore::AXRadioButtonActionVerb):
+        (WebCore::AXCheckedCheckBoxActionVerb):
+        (WebCore::AXUncheckedCheckBoxActionVerb):
+        (WebCore::AXLinkActionVerb):
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+        * platform/haiku/LoggingHaiku.cpp: Added.
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix GTK build.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject): Pass 0 for document. Should be OK at least for now.
+
+2009-08-15  Darin Adler  <darin@apple.com>
+
+        Fix Qt build.
+
+        * dom/XMLTokenizerQt.cpp: Use create functions instead of calling new
+        directly to make CDATASection and Comment nodes.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make DOM classes start with a reference count of 1, like all other RefCounted
+        https://bugs.webkit.org/show_bug.cgi?id=28068
+
+        First half, everything except for element classes.
+
+        * GNUmakefile.am: Removed DocPtr.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::Attr): Added a call to createTextChild here so callers don't
+        have to call it explicitly.
+        (WebCore::Attr::create): Added.
+        (WebCore::Attr::setValue): Changed to take AtomicString.
+        (WebCore::Attr::cloneNode): Use create.
+
+        * dom/Attr.h: Added a create function. Made the constructor private,
+        and a lot of other functions private as well.
+
+        * dom/Attribute.cpp:
+        (WebCore::Attribute::createAttrIfNeeded): Use Attr::create.
+
+        * dom/CDATASection.cpp:
+        (WebCore::CDATASection::create): Added.
+        (WebCore::CDATASection::cloneNode): Use create.
+        (WebCore::CDATASection::virtualCreate): Ditto.
+
+        * dom/CDATASection.h: Added a create function. Made everything private.
+        Removed unneeded destructor declaration.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData): Replaced the multiple constructors
+        with a single one that takes ConstructionType.
+
+        * dom/CharacterData.h: Made more functions be protected and private.
+        Made m_data be private.
+
+        * dom/Comment.cpp:
+        (WebCore::Comment::Comment): Got rid of an extra constructor.
+        (WebCore::Comment::create): Added.
+        (WebCore::Comment::cloneNode): Call create.
+
+        * dom/Comment.h: Added a create function. Made everything private.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Use RefPtr instead of DocPtr.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * dom/ContainerNode.h: Made the constructor protected and passed
+        ConstructionType instead of an isElement boolean.
+
+        * dom/DocPtr.h: Removed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::removedLastRef): Use explicit calls to selfOnlyRef
+        and selfOnlyDeref instead of a DocPtr in here.
+        (WebCore::Document::~Document): Simplified the code that sets m_document
+        since it's no longer a smart pointer.
+        (WebCore::Document::createDocumentFragment): Call create.
+        (WebCore::Document::createTextNode): Ditto.
+        (WebCore::Document::createComment): Ditto.
+        (WebCore::Document::createCDATASection): Ditto.
+        (WebCore::Document::createProcessingInstruction): Ditto.
+        (WebCore::Document::createEntityReference): Ditto.
+        (WebCore::Document::createEditingTextNode): Ditto.
+        (WebCore::Document::importNode): Call Attr::create.
+        (WebCore::Document::createAttributeNS): Ditto.
+
+        * dom/Document.h: Call adoptRef. Made a lot of functions private and
+        protected and sorted them so public functions come first.
+
+        * dom/DocumentFragment.cpp:
+        (WebCore::DocumentFragment::create): Added.
+        (WebCore::DocumentFragment::cloneNode): Call create.
+        * dom/DocumentFragment.h: Added create.
+
+        * dom/DocumentType.cpp:
+        (WebCore::DocumentType::DocumentType): Pass type to Node constructor.
+        (WebCore::DocumentType::cloneNode): Use create.
+        * dom/DocumentType.h:
+        (WebCore::DocumentType::create): Call adoptRef.
+
+        * dom/EditingText.cpp:
+        (WebCore::EditingText::create): Added.
+        * dom/EditingText.h: Added a create function. Made everything private.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element): Pass CreateElementZeroRefCount to preserve
+        the zero reference count behavior for classes derived from Element.
+
+        * dom/EntityReference.cpp:
+        (WebCore::EntityReference::create): Added.
+        (WebCore::EntityReference::cloneNode): Call create.
+        * dom/EntityReference.h: Added create. Made everything private.
+
+        * dom/Node.cpp:
+        (WebCore::Node::initialRefCount): Added. Inline helper function for
+        the constructor.
+        (WebCore::Node::isContainer): Ditto.
+        (WebCore::Node::isElement): Ditto.
+        (WebCore::Node::isText): Ditto.
+        (WebCore::Node::Node): Changed to take a construction type argument.
+        Since m_document is now a normal pointer, added a call to selfOnlyRef.
+        (WebCore::Node::~Node): Ditto, but selfOnlyDeref.
+        (WebCore::Node::setDocument): Added selfOnlyRef/Deref calls.
+        (WebCore::Node::appendTextContent): Use the data function instead of
+        calling nodeValue functions, which do the same thing in a roundabout way.
+
+        * dom/Node.h: Made the constructor protected and replaced the multiple
+        arguments iwth a single ConstructionType argument. Sorted the public
+        things first.
+
+        * dom/Notation.h: Made most things private.
+        * dom/Notation.cpp: Removed extra constructor.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::create): Added.
+        (WebCore::ProcessingInstruction::cloneNode): Call create.
+        * dom/ProcessingInstruction.h: Added create function. Made many other
+        members private.
+
+        * dom/Range.cpp:
+        (WebCore::Range::processContents): Use DocumentFragment::create.
+
+        * dom/Text.cpp:
+        (WebCore::Text::Text): Updated for base class change.
+        (WebCore::Text::create): Added.
+        (WebCore::Text::splitText): Changed to not require access to m_data.
+        (WebCore::Text::cloneNode): Call create.
+        (WebCore::Text::createRenderer): Call dataImpl.
+        (WebCore::Text::attach): Call data.
+        (WebCore::Text::recalcStyle): Call dataImpl.
+        (WebCore::Text::virtualCreate): Call create.
+        (WebCore::Text::createWithLengthLimit): Call create.
+        (WebCore::Text::formatForDebugger): Call data.
+
+        * dom/Text.h: Added a create function. Made many other members private.
+        Renamed createNew to virtualCreate.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::enterText): Call Text::create.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::cdataBlock): Call CDATASection::create.
+        (WebCore::XMLTokenizer::comment): Call Comment::create.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        Call data instead of string.
+
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply): Call Text::create.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertNode): Call DocumentFragment::create.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply): Call Text::create.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Call data instead of nodeValue.
+
+        * html/HTMLDocument.h:
+        (WebCore::HTMLDocument::create): Call adoptRef.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::createContextualFragment): Call DocumentFragment::create.
+        (WebCore::replaceChildrenWithFragment): Call data instead of string.
+        (WebCore::replaceChildrenWithText): Call Text::create.
+        (WebCore::HTMLElement::setInnerText): Call DocumentFragment::create and
+        Text::create.
+        (WebCore::HTMLElement::setOuterText): Call Text::create.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement): Call Text::create.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText): Call Text::create.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::textCreateErrorCheck): Call Text::create.
+        (WebCore::HTMLParser::commentCreateErrorCheck): Call Comment::create.
+        (WebCore::HTMLParser::handleIsindex): Call Text::create.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addText): Call Text::create.
+
+        * html/HTMLViewSourceDocument.h:
+        (WebCore::HTMLViewSourceDocument::create): Call adoptRef.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry): Call Text::create.
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename): Call Text::create.
+
+        * loader/FTPDirectoryDocument.h:
+        (WebCore::FTPDirectoryDocument::create): Call adoptRef.
+        * loader/ImageDocument.h:
+        (WebCore::ImageDocument::create): Ditto.
+        * loader/MediaDocument.h:
+        (WebCore::MediaDocument::create): Ditto.
+        * loader/PlaceholderDocument.h:
+        (WebCore::PlaceholderDocument::create): Ditto.
+        * loader/PluginDocument.h:
+        (WebCore::PluginDocument::create): Ditto.
+        * loader/TextDocument.h:
+        (WebCore::TextDocument::create): Ditto.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading): Use RefPtr instead of DocPtr.
+        (WebCore::Loader::Host::didFail): Ditto.
+
+        * platform/TreeShared.h:
+        (WebCore::TreeShared::TreeShared): Added an initialRefCount argument,
+        defaulting to 1. Node still sometimes initializes it to 0 instead for now.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText): Use dataImpl instead of string.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText): Use dataImpl instead of string.
+        (WebCore::RenderTextFragment::previousCharacter): Ditto.
+
+        * svg/SVGDocument.h:
+        (WebCore::SVGDocument::create): Use adoptRef.
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance): Updated to take a
+        PassRefPtr.
+
+        * svg/SVGElementInstance.h: Made everything private.
+
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::create): Called adoptRef.
+
+        * xml/XPathNamespace.cpp:
+        (WebCore::XPathNamespace::XPathNamespace): Take AtomicString arguments.
+        * xml/XPathNamespace.h: Made everything private.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Use DocumentFragment::create and
+        Text::create.
+
+2009-08-13  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Part of <rdar://problem/6218721> No MSAA focus events fired for Webkit
+        nightly (20866)
+
+        https://bugs.webkit.org/show_bug.cgi?id=20866
+
+        Reviewed by Oliver Hunt.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner document. This is used by
+        AXObjectCache::handleFocusedUIElementChanged().
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Code moved from AccessibilityRenderObject::focusedUIElement(). Modified
+        to be a static function and to take a pointer to a Page.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Moved the code to generate the next AXID from getAXID() to here. Added
+        a #if to make this non-WIN only, because Windows has its own
+        implementation.
+        (WebCore::AXObjectCache::getAXID):
+        Ensure that we generate a positive AXID, ranging from 1 to LONG_MAX.
+
+        * accessibility/AXObjectCache.h:
+        Add a declaration for Document and Page. Removed the declaration of
+        AccessibilityObject, because we include the header. Reordered the
+        declaration of Node alphabetically. Moved the typedef for AXID to
+        AccessibilityObject. Removed some trailing whitespace. Added a member
+        variable to hold a pointer to the owner Document.
+        (WebCore::AXObjectCache::AXObjectCache):
+        Changed to take a pointer to its owner Document.
+        (WebCore::AXObjectCache::focusedUIElementForPage):
+        Added; code moved from AccessiblityRenderObject::focusedUIElement().
+        Returns the focused element with respect to accessibility.
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Declare a function to generate an AXID.
+        (WebCore::AXObjectCache::objectFromAXID):
+        Return the AccessibilityObject with the given AXID.
+
+        * accessibility/AccessibilityObject.h:
+        Moved the typedef for AXID from AXObjectCache to here. Made the m_id
+        member use the typedef.
+        (WebCore::AccessibilityObject::axObjectID):
+        Changed the return type to use the typedef.
+        (WebCore::AccessibilityObject::setAXObjectID):
+        Changed the argument type to use the typedef.
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        Removed some unneeded #includes.
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        Moved the code to AXObjectCache::focusedUIElementForPage(), which we now
+        call.
+
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::platformGenerateAXID):
+        Ensure that we generate an AXID that is in the range 1 to LONG_MAX.
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        If the Document has no Page, return. If the Page has not focused
+        element (respecting accessibility), return. Assert that the
+        accessibility of the focused element is not ignored, and that the
+        object's AXID will be negative and fit into a LONG when negated.
+        Broadcast a focus event for the object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::axObjectCache):
+        Pass this when creating the AXObjectCache.
+        (WebCore::Document::setFocusedNode):
+        Call AXObjectCache::handleFocusedUIElementChanged() on Windows.
+
+2009-08-14  Jiahua Huang  <jhuangjiahua@gmail.com>
+
+        Reviewed by Jan Alonzo.
+
+        [gtk] Pasteboard/GtkClipboard can't handle the "text/html" target.
+        https://bugs.webkit.org/show_bug.cgi?id=27028
+
+        Remove the improper set of enum WebKitWebViewTargetInfo
+        by grabbing the target infos via m_helper.
+
+        * manual-tests/gtk/copy-htmltext.html: Added.
+        * platform/Pasteboard.h:
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::clipboard_get_contents_cb):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-08-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix an assertion when bringing up the Inspector.
+        https://bugs.webkit.org/show_bug.cgi?id=28318
+        
+        The fix for bug 28295 assumed that image clients count the number of times
+        addClient/removeClient is called. That was true for CachedResource clients,
+        but not StyleGeneratedImage clients, which pass the call onto CSSImageGeneratorValue.
+        
+        Fix by making CSSImageGeneratorValue count the number of times a client is
+        added/removed.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        (WebCore::CSSCanvasValue::canvasResized):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::addClient):
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+
+2009-08-14  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Kevin Ollivier.
+
+        Correct libcurl crash when downloading local files.
+        https://bugs.webkit.org/show_bug.cgi?id=28312
+
+        No new tests. Test is covered by fast/encoding/char-encoding-mac.html.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::handleLocalReceiveResponse): New static function that
+          performs the local setting of valid URL and firing didReceiveResponse.
+          This code was moved from writeCallback.
+        (WebCore::writeCallback): Move local file handling to static function
+          (above) and use the function instead.
+        (WebCore::readCallback): Add check
+          for responseFired, and handle as a local file if it was not.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Fix RenderThemeHaiku build.
+        https://bugs.webkit.org/show_bug.cgi?id=28307
+
+        * platform/haiku/RenderThemeHaiku.cpp: Included RenderThemeHaiku.h
+        instead of RenderTheme.h.
+        (WebCore::RenderThemeHaiku::paintCheckbox): Removed the wrong 'virtual'
+        before the function.
+        (WebCore::RenderThemeHaiku::paintRadio): Removed the wrong 'virtual'
+        before the function.
+        * platform/haiku/RenderThemeHaiku.h: Corrected wrong function definitions.
+
+2009-08-14  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Haiku] Adding SharedBufferHaiku to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28309
+
+        * platform/haiku/SharedBufferHaiku.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/haiku/TemporaryLinkStubs.cpp: Removed unnecessary headers
+        and functions.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+
+2009-08-14  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Ensure we're getting the right v8 context in the V8 DOMWindowEvent custom getter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28311
+
+        This should fix Chromium failing LayoutTests/fast/events/set-event-in-another-frame.html.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-08-14  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        BUG 28134: Move the remaining parts of Access Control from XMLHttpRequest to ThreadableDocumentLoader.
+        https://bugs.webkit.org/show_bug.cgi?id=28134
+
+        No new tests added since Access Control was already well tested and this is a pure refactor.
+
+        * loader/DocumentThreadableLoader.cpp: Move a lot of the access control code from XHR in, preserving its
+        basic strategy. Also, modify the synchronous path to not be a special case, but reuse more of the async
+        path.
+
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Go through the async path and pass additional flags.
+        (WebCore::DocumentThreadableLoader::create): Group enum params into an options struct.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Ditto.
+        (WebCore::DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest): Brought mostly from XHR.
+        (WebCore::DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight): Ditto.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Handle preflight case.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Ditto.
+        (WebCore::DocumentThreadableLoader::preflightSuccess): Preflight handling.
+        (WebCore::DocumentThreadableLoader::preflightFailure): Ditto.
+        (WebCore::DocumentThreadableLoader::loadRequest): Common request function that handles async/sync.
+        * loader/DocumentThreadableLoader.h: Group enum params into an options struct.
+        * loader/ThreadableLoader.cpp: Ditto.
+        (WebCore::ThreadableLoader::create): Ditto.
+        (WebCore::ThreadableLoader::loadResourceSynchronously): Ditto.
+        * loader/ThreadableLoader.h: Ditto.
+        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Ditto.
+        * loader/WorkerThreadableLoader.cpp: Ditto.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):Ditto.
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Ditto.
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader): Ditto.
+        * loader/WorkerThreadableLoader.h: Ditto.
+        (WebCore::WorkerThreadableLoader::create): Ditto.
+        * platform/CrossThreadCopier.h: Allow ThreadableLoaderOptions to be copied across threads.
+        (WebCore::):
+        * workers/WorkerScriptLoader.cpp: More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadSynchronously): More enum->struct grouping.
+        (WebCore::WorkerScriptLoader::loadAsynchronously): More enum->struct grouping.
+        * xml/XMLHttpRequest.cpp: Remove all the access control code and some supporting state.
+        (WebCore::XMLHttpRequest::XMLHttpRequest): Ditto.
+        (WebCore::XMLHttpRequest::createRequest): Ditto.
+        (WebCore::XMLHttpRequest::didFinishLoading): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveResponse): Ditto.
+        (WebCore::XMLHttpRequest::didReceiveData): Ditto.
+        * xml/XMLHttpRequest.h: Ditto.
+
+2009-08-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename the confusing isObject(<class>) to inherits(<class>).
+        It still works on non-objects, returning false.
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback):
+        (WebCore::createPositionErrorCallback):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        Updated to new name, inherits, from old name, isObject.
+
+2009-08-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow Qt API to list and to remove URL schemes that were registered as
+        local URL schemes.
+        [Qt] Allow applications to register their own local URL scheme.
+        https://bugs.webkit.org/show_bug.cgi?id=28240
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::removeURLSchemeRegisteredAsLocal):
+        (WebCore::SecurityOrigin::localURLSchemes):
+        * page/SecurityOrigin.h:
+
+2009-08-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Wrap console objects late (in the frontend) so that injected
+        script was already in place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28297
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        * inspector/InspectorFrontend.h:
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix logic in RenderObject::updateFillImages() that led to incorrect client
+        counts if an image was used twice in the background-image property.
+        https://bugs.webkit.org/show_bug.cgi?id=28295
+
+        Test: fast/backgrounds/multiple-backgrounds-assert.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateFillImages):
+        Simplify the logic to call addClient()/removeClient() for every background
+        image, but go through the new layers first to avoid removing all the
+        clients of an image.
+
+2009-08-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Devirtualise marking
+        https://bugs.webkit.org/show_bug.cgi?id=28294
+
+        Make sure we override the JSObject createStructure method on those
+        objects that have custom marking routines.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Follow-up to earlier work to remove dependencies on JavaScriptCore.
+
+        * ForwardingHeaders/parser/Parser.h: Removed.
+        * inspector/JavaScriptDebugServer.cpp: Removed now-unneeded includes
+        of Parser.h.
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        'box-orient: block-axis' behaves like 'box-orient: horizontal', causes
+        an assertion failure in debug builds
+        https://bugs.webkit.org/show_bug.cgi?id=28279
+
+        Test: fast/flexbox/block-axis.html
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::operator EBoxOrient): Map block-axis to
+        vertical.
+
+2009-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix crash when removing reflection on an absolutely-positioned image.
+        https://bugs.webkit.org/show_bug.cgi?id=28289
+        
+        Make sure we clean up the reflection layer when removing the reflection,
+        so that the RenderLayer tree does not contain pointers to deleted layers.
+
+        Test: fast/reflections/reflected-img-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::removeReflection):
+        * rendering/RenderLayer.h:
+
+2009-08-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        misalignment because of float:left of <div> tag
+        https://bugs.webkit.org/show_bug.cgi?id=15869
+
+        One section of http://edgar.sec.gov site draws to the right of the rest
+        of the content
+        <rdar://problem/7135951>
+
+        Tests: fast/block/float/avoidance-percent-width-compat.html
+               fast/block/float/avoidance-percent-width-strict.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getClearDelta): Changed to apply the same float
+            avoidance logic in strict mode and in compatibility mode, which
+            matches Firefox and IE. Changed to compute and use the computed
+            width of the child, instead of ignoring non-fixed widths.
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Geolocation PositionOptions does not use correct default values.
+        https://bugs.webkit.org/show_bug.cgi?id=27254
+
+        Sets the correct default values for the properties of the PositionOptions object
+        passed to Geolocation methods. See http://www.w3.org/TR/geolocation-API/.
+
+        Also adds checking to throw an exception if arguments of the incorrect type are
+        passed to Geolocation methods. Adds a layout test to test this. This test should
+        pass on all platforms where Geolocation is implemented.
+
+        Test: fast/dom/Geolocation/argument-types.html
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionCallback): Added. Creates the callback.
+        (WebCore::createPositionErrorCallback): Added. Creates the calback.
+        (WebCore::createPositionOptions): Added. Creates the PositionOptions object, setting defaults where required.
+        (WebCore::JSGeolocation::getCurrentPosition): Modified. Now uses above helper functions.
+        (WebCore::JSGeolocation::watchPosition): Modified. Now uses above helper functions.
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): Modified. Asserts that PositionOptions object is present.
+        (WebCore::Geolocation::GeoNotifier::startTimer): Modified. Only starts timer if timeout has been set.
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create): Modified. Creates object with default values.
+        (WebCore::PositionOptions::timeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::hasTimeout): Added. Determines whether a timeout has been set.
+        (WebCore::PositionOptions::setTimeout): Modified. Uses correct type.
+        (WebCore::PositionOptions::maximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::setMaximumAge): Modified. Uses correct type.
+        (WebCore::PositionOptions::PositionOptions): Modified. Creates object with default values.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed chromium build fix.
+
+        [Chromium] Let CodeGeneratorV8.pm know that RGBColor is ref-counted.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2009-08-13  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Merge error in SharedWorker code
+        https://bugs.webkit.org/show_bug.cgi?id=28277
+
+        Fixed merge error that prevents WebKit from compiling with SHARED_WORKERS enabled.
+        No new tests needed.
+
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Removed duplicated functions.
+
+2009-08-13  Kyle Prete  <kylep@chromium.org>
+
+        Reviewed by Dave Levin.
+
+        Chromium: Show a "Playback Disabled" button on media error.
+        https://bugs.webkit.org/show_bug.cgi?id=28196
+        Use a disabled play button when the media file cannot be played.
+
+        No new tests needed. Covered by LayoutTests/media/video-empty-source.html
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+
+2009-08-13  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Drag and drop support
+        https://bugs.webkit.org/show_bug.cgi?id=23642
+
+        Utilizes functions that are being called upon drag and drop actions.
+        Uses different GTK clipboards that hold different types
+        of drag data - images, HTML markup, text, URL, URL label.
+        Also clears each clipboard before setting new data to it.
+
+        No new tests - despite some implementations, no new functionality
+        is added until implementations of the GTK drag and drop protocol
+        in WebKit part.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::ClipboardGtk):
+        (WebCore::ClipboardGtk::~ClipboardGtk):
+        (WebCore::getCachedImage):
+        (WebCore::ClipboardGtk::declareAndWriteDragImage):
+        (WebCore::ClipboardGtk::writeURL):
+        (WebCore::ClipboardGtk::writeRange):
+        * platform/gtk/ClipboardGtk.h: ClipboardGdk -> ClipboardGtk
+
+2009-08-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Levin.
+
+        JavaScriptCore tweaks to get ready for the parser arena
+        https://bugs.webkit.org/show_bug.cgi?id=28243
+
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Removed.
+
+        * WebCore.xcodeproj/project.pbxproj: Exposed a couple header
+        files as Private that are now needed to compile Mac WebKit.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSLazyEventListener.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSWebSocketConstructor.cpp:
+        * bindings/js/JSWebSocketCustom.cpp:
+        * bindings/js/JSWorkerConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        Updated includes.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        Change to not assert if this is called with no listeners.
+        I don't think this was guaranteed before, and we now use
+        this code path when recompiling. Slightly less efficient,
+        but this is a one-time cost when turning on the debugger.
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Change to call Debugger::recompileAllJSFunctions.
+
+2009-08-13  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/7138591> and https://bugs.webkit.org/show_bug.cgi?id=28260
+        onhashchange property cannot be set from javascript.
+
+        Test: fast/loader/onhashchange-attribute-listeners.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onhashchange):
+        (WebCore::HTMLBodyElement::setOnhashchange):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::onhashchange):
+        (WebCore::HTMLFrameSetElement::setOnhashchange):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onhashchange):
+        (WebCore::DOMWindow::setOnhashchange):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below SVGColor::rgbColor.
+
+        * svg/SVGColor.cpp:
+        (WebCore::SVGColor::rgbColor): Return a PassRefPtr to ensure that the newly-allocated
+        RGBColor is cleaned up by the caller.
+        * svg/SVGColor.h:
+
+2009-08-13  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        WebInspector: Migrate to DOMAgent (serialized access to DOM).
+
+        https://bugs.webkit.org/show_bug.cgi?id=28177
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::highlightDOMNode):
+        (WebCore::JSInspectorBackend::nodeForId):
+        (WebCore::JSInspectorBackend::idForNode):
+        (WebCore::JSInspectorBackend::wrapObject):
+        (WebCore::JSInspectorBackend::unwrapObject):
+        (WebCore::JSInspectorBackend::pushNodePathToFrontend):
+        (WebCore::JSInspectorBackend::selectDatabase):
+        (WebCore::JSInspectorBackend::selectDOMStorage):
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isObject):
+        * bindings/js/ScriptValue.h:
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptObjectQuarantine.h:
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isObject):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::clearMessages):
+        (WebCore::InspectorBackend::loaded):
+        (WebCore::InspectorBackend::highlight):
+        (WebCore::InspectorBackend::nodeForId):
+        (WebCore::InspectorBackend::idForNode):
+        (WebCore::InspectorBackend::wrapObject):
+        (WebCore::InspectorBackend::unwrapObject):
+        (WebCore::InspectorBackend::pushNodePathToFrontend):
+        (WebCore::InspectorBackend::addNodesToSearchResult):
+        (WebCore::InspectorBackend::selectDatabase):
+        (WebCore::InspectorBackend::selectDOMStorage):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::clearConsoleMessages):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::setFrontendProxyObject):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::wrapObject):
+        (WebCore::InspectorController::unwrapObject):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDocument):
+        (WebCore::InspectorDOMAgent::handleEvent):
+        (WebCore::InspectorDOMAgent::pushDocumentToFrontend):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::nodeForId):
+        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::buildArrayForContainerChildren):
+        (WebCore::InspectorDOMAgent::innerParentElement):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::clearConsoleMessages):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setDocument):
+        (WebCore::InspectorFrontend::selectDatabase):
+        (WebCore::InspectorFrontend::selectDOMStorage):
+        (WebCore::InspectorFrontend::addNodesToSearchResult):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.clearMessages):
+        (WebInspector.ConsoleView.prototype.completions):
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        (WebInspector.ConsoleView.prototype._messagesClicked):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow.evalCallback):
+        (WebInspector.ConsoleView.prototype.doEvalInWindow):
+        (WebInspector.ConsoleView.prototype._format):
+        (WebInspector.ConsoleView.prototype._formatfunction):
+        (WebInspector.ConsoleView.prototype._formatdate):
+        (WebInspector.ConsoleView.prototype._formatregexp):
+        (WebInspector.ConsoleView.prototype._formatnode):
+        (WebInspector.ConsoleView.prototype._formatobject):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype._renumber):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent):
+        (WebInspector.DOMAgent.prototype.getChildNodesAsync):
+        (WebInspector.DOMAgent.prototype.setAttributeAsync):
+        (WebInspector.DOMAgent.prototype.removeAttributeAsync):
+        (WebInspector.DOMAgent.prototype.setTextNodeValueAsync):
+        (WebInspector.DOMAgent.prototype.nodeForId):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._setChildNodes):
+        (WebInspector.DOMAgent.prototype._bindNodes):
+        (WebInspector.DOMAgent.prototype._childNodeInserted):
+        (WebInspector.CSSStyleDeclaration):
+        (WebInspector.CSSStyleDeclaration.parseRule):
+        (WebInspector.setDocument):
+        (InspectorController.getStyles):
+        (InspectorController.getComputedStyle):
+        (InspectorController.getInlineStyle):
+        (InspectorController.applyStyleText):
+        (InspectorController.setStyleText):
+        (InspectorController.toggleStyleEnabled):
+        (InspectorController.applyStyleRuleText):
+        (InspectorController.addStyleSelector):
+        (InspectorController.setStyleProperty):
+        (InspectorController.getPrototypes):
+        (InspectorController.getProperties):
+        (InspectorController.setPropertyValue):
+        (InspectorController.evaluate):
+        (InspectorController.addInspectedNode):
+        (InspectorController.performSearch):
+        (InspectorController.searchCanceled):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.this.treeOutline.focusedNodeChanged):
+        (WebInspector.ElementsPanel.prototype.searchCanceled):
+        (WebInspector.ElementsPanel.prototype.performSearch):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCount):
+        (WebInspector.ElementsPanel.prototype._updateMatchesCountSoon):
+        (WebInspector.ElementsPanel.prototype.addNodesToSearchResult):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode.restoreHighlightToHoveredNode):
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        (WebInspector.ElementsTreeElement.prototype.updateChildren):
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+        * inspector/front-end/InjectedScript.js:
+        (InjectedScript.applyStyleRuleText):
+        (InjectedScript.addStyleSelector):
+        (InjectedScript._doesSelectorAffectNode):
+        (InjectedScript._serializeRule):
+        (InjectedScript._serializeStyle):
+        (InjectedScript.getProperties):
+        (InjectedScript.evaluate):
+        (InjectedScript.addInspectedNode):
+        (InjectedScript.performSearch.addNodesToResults):
+        (InjectedScript.performSearch.matchExactItems):
+        (InjectedScript.performSearch.matchExactId.addNodesToResults.call):
+        (InjectedScript.performSearch.matchExactId):
+        (InjectedScript.performSearch):
+        (InjectedScript.performSearch.matchExactTagNames):
+        (InjectedScript.performSearch.matchExactAttributeNames):
+        (InjectedScript.performSearch.matchPartialTagNames):
+        (InjectedScript.performSearch.matchStartOfTagNames):
+        (InjectedScript.performSearch.matchPartialTagNamesAndAttributeValues):
+        (InjectedScript.performSearch.matchPartialAttributeValues):
+        (InjectedScript.performSearch.matchStyleSelector):
+        (InjectedScript.performSearch.matchPlainText):
+        (InjectedScript.performSearch.matchXPathQuery):
+        (InjectedScript.performSearch.finishedSearching):
+        (InjectedScript.performSearch.processChunk):
+        (InjectedScript.searchCanceled):
+        (InjectedScript._ensureCommandLineAPIInstalled.inspectObject):
+        (InjectedScript._ensureCommandLineAPIInstalled):
+        (InjectedScript._resolveObject):
+        (InjectedScript._nodeForId):
+        (InjectedScript._objectForId):
+        (InjectedScript._createProxyObject):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.update):
+        * inspector/front-end/ObjectProxy.js:
+        (WebInspector.ObjectProxy):
+        (WebInspector.ObjectPropertyProxy):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.callback):
+        (WebInspector.PropertiesSidebarPane.prototype.update):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update.callback):
+        (WebInspector.StylesSidebarPane.prototype.update):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCommitted):
+        (WebInspector.StylePropertiesSection.prototype.editingSelectorCancelled):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted.callback):
+        (WebInspector.BlankStylePropertiesSection.prototype.editingCommitted):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/inspector.js:
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.loaded):
+        (WebInspector.clearConsoleMessages):
+        (WebInspector.selectDatabase):
+        (WebInspector.selectDOMStorage):
+        (WebInspector.updateFocusedNode):
+        (WebInspector.addNodesToSearchResult):
+        * inspector/front-end/utilities.js:
+        (Object.proxyType):
+        * storage/Storage.h:
+        (WebCore::Storage::frame):
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks of RGBColor instances from below CSSPrimitiveValue::getRGBColorValue.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::getRGBColorValue): Return a PassRefPtr to ensure that the
+        newly-allocated RGBColor is cleaned up by the caller.
+        * css/CSSPrimitiveValue.h:
+
+2009-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        wrong font size when css font-family includes monospace
+        https://bugs.webkit.org/show_bug.cgi?id=19161
+
+        Firefox only uses fixed-width default size for exactly "font-family: monospace;".
+        WebKit has historically used fixed-width default size any time a
+        font-family includes monospace in the fallback list.
+
+        This patch corrects WebKit's behavior to match Firefox.
+        I also had to fix a bug in WebKit's font-family fallback behavior where
+        child elements would inherit parts of their parents fallback lists.
+
+        This patch is mostly just replacing all cases where we used to check for:
+        fontDescription.genericFontFamily() == MonospaceFamily
+        with:
+        fontDescription.useFixedDefaultSize()
+
+        Tests: fast/css/getComputedStyle/computed-style-font-family-monospace.html
+               fast/css/getComputedStyle/font-family-fallback-reset.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+           Deploy useFixedDefaultSize().  Also fix the bug where child
+           FontDescriptions would carry part of the parent font-family fallback list.
+        (WebCore::CSSStyleSelector::checkForGenericFamilyChange):
+           It's no longer alright to just check genericFontFamily(),
+           we have to check to make sure the changed style has a matching useFixedDefaultSize().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::useFixedDefaultSize):
+           Only use the fixed default size if we have one font family and it is "monospace".
+           "-webkit-monospace" is the internal representation of the CSS identifier "monospace".
+
+2009-08-13  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [v8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-13  George Staikos  <george.staikos@torchmobile.com>
+
+        Rubberstamped by Darin Adler.
+
+        Use ASSERT_UNUSED instead of UNUSED_PARAM
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes a couple of bugs in SecurityOrigin::createFromDatabaseIdentifier.
+        https://bugs.webkit.org/show_bug.cgi?id=28262
+
+        No new tests possible.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-08-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        [CAIRO] getImageData fails on a given rect bigger than the image rect
+
+        The destination image and the source image was mixed up on creating the
+        imageData.
+
+        This is just a clean up and doesn't affect the current behavior. It's not
+        possible to test this failure in a LayoutTest. Only canvas uses getImageData
+        at the moment and returns before calling getImageData, if the image rect does
+        not contain the requested rect.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding RenderTheme to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=28258
+
+        * platform/haiku/RenderThemeHaiku.cpp: Added.
+        (WebCore::RenderThemeHaiku::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeHaiku::RenderThemeHaiku):
+        (WebCore::RenderThemeHaiku::~RenderThemeHaiku):
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeHaiku::supportsFocusRing):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeHaiku::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeHaiku::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeHaiku::systemFont):
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::setCheckboxSize):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::setRadioSize):
+        (WebCore::RenderThemeHaiku::adjustMenuListStyle):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h: Added.
+        (WebCore::RenderThemeHaiku::supportsHover):
+
+2009-08-13  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Remove the "m_point" code from ContextMenuHaiku.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28256
+
+        * platform/haiku/ContextMenuHaiku.cpp:
+        (WebCore::ContextMenuReceiver::ContextMenuReceiver):
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::insertItem):
+
+2009-08-13  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-13  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a new gesture in Web Inspector to remove breakpoints
+        https://bugs.webkit.org/show_bug.cgi?id=19131
+        
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._documentMouseDown):
+
+2009-08-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Symbian target components (library and executable files)
+        require Unique Identifiers (i.e., UID3).
+        These identifiers are defined in the respective project
+        file, conditionally for "symbian" platform.
+
+        * WebCore.pro:
+
+2009-08-13  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        wrong calculation of overflow size for flexbox and table
+        https://bugs.webkit.org/show_bug.cgi?id=28064
+
+        RenderFlexibleBox and RenderTable were using the width of overflow
+        to update height of overflow, so height became wrong value and
+        width was not updated. As the corresponding code of RenderBlock
+        was sane, I factored it out and used from RenderFlexibleBox and
+        RenderTable.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateOverflowWithShadowAndReflection): created from code of layoutBlock
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlexibleBox.cpp: use updateOverflowWithShadowAndReflection
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout): use updateOverflowWithShadowAndReflection
+
+2009-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Revert r47185, the fix for <https://bugs.webkit.org/show_bug.cgi?id=28185>, as it broke the
+        Windows build in a non-obvious manner.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        * inspector/InspectorBackend.idl:
+        * platform/Cookie.h: Removed.
+        * platform/CookieJar.h:
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        * platform/mac/CookieJar.mm:
+        * platform/network/chromium/CookieJarChromium.cpp:
+        * platform/network/curl/CookieJarCurl.cpp:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        * platform/network/win/CookieJarWin.cpp:
+        * platform/qt/CookieJarQt.cpp:
+
+2009-08-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Not reviewed: build fix (for r47192), adding new file from
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * inspector/front-end/StatusBarButton.js: Added.
+
+2009-08-13  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduced StatusBarButton class that encapsulates glyphs support.
+        Views updated accordingly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28174
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): Updated to retrieve DOM element from StatusBarButton instance (here and in similar getters below.)
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        (WebInspector.ElementsPanel.prototype.get statusBarItems):
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype._nodeSearchButtonClicked):
+        * inspector/front-end/Panel.js:
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.get statusBarItems):
+        (WebInspector.ProfileView.prototype._updatePercentButton):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems):
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile):
+        (WebInspector.ProfilesPanel.prototype._updateInterface):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        * inspector/front-end/StatusBarButton.js: Added.
+        (WebInspector.StatusBarButton):
+        (WebInspector.StatusBarButton.prototype._clicked):
+        (WebInspector.StatusBarButton.prototype.get disabled):
+        (WebInspector.StatusBarButton.prototype.set disabled):
+        (WebInspector.StatusBarButton.prototype.get title):
+        (WebInspector.StatusBarButton.prototype.set title):
+        (WebInspector.StatusBarButton.prototype.get toggled):
+        (WebInspector.StatusBarButton.prototype.set toggled):
+        (WebInspector.StatusBarButton.prototype.get visible):
+        (WebInspector.StatusBarButton.prototype.set visible):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css: For uniformity, class names are always used to identify status bar buttons. Also, fixed "Reload" button style to use glyphs.
+        * inspector/front-end/inspector.html:
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add shadow support in GraphicsContext::fillRect().
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRect): Paint shadow if necessary.
+        (WebCore::GraphicsContext::setPlatformShadow): Inverse y offset.
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for Chromium Linux.
+
+        Rollback r47157 as this broke debug tests of Chromium Linux.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-13  David Levin  <levin@chromium.org>
+
+        Unreviewed build fix for chromium.
+
+        The chromium build broke due to r47185 which added
+        a cookies array to inspector/InspectorBackend.idl.
+
+        * bindings/v8/custom/V8CustomBinding.h: Added the declaration for the cookies callback.
+        * bindings/v8/custom/V8InspectorBackendCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(InspectorBackendCookies)): Stubbed out an implementation
+         for the cookies callback.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Show Hidden Cookie Data
+        https://bugs.webkit.org/show_bug.cgi?id=28185
+
+          Added new file Cookie.h to the WebCore XCode
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+          InspectorController.cookies() binding
+
+        * bindings/js/JSInspectorBackendCustom.cpp:
+        (WebCore::JSInspectorBackend::cookies):
+        * inspector/InspectorBackend.idl:
+
+          Struct for static Cookie information
+          (name, value, path, domain, expires, httpOnly, secure, session)
+
+        * platform/Cookie.h: Added.
+        (WebCore::Cookie::Cookie):
+        
+          Getter for the a list of raw Cookies
+          getRawCookies(., ., out Vector<Cookie>)
+        
+        * platform/CookieJar.h:
+
+          Implementation of getRawCookies for the mac platform.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::getRawCookies):
+
+          Stub other CookieJar implementations to satisfy the interface.
+
+        * platform/haiku/CookieJarHaiku.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::getRawCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::getRawCookies):
+
+2009-08-08  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Cookies in Storage Panel
+        https://bugs.webkit.org/show_bug.cgi?id=27202
+
+          Data Structure for a Cookie. Just Key/Value for Now:
+
+        * inspector/front-end/Cookie.js: Added.
+        (WebInspector.Cookie):
+        (WebInspector.Cookie.prototype.get key):
+        (WebInspector.Cookie.prototype.set key):
+        (WebInspector.Cookie.prototype.get value):
+        (WebInspector.Cookie.prototype.set value):
+
+          A Storage View for Cookies.  Allows for Refresh/Delete:
+
+        * inspector/front-end/CookieItemsView.js: Added.
+        (WebInspector.CookieItemsView):
+        (WebInspector.CookieItemsView.prototype.get statusBarItems): refresh and delete buttons
+        (WebInspector.CookieItemsView.prototype.show):
+        (WebInspector.CookieItemsView.prototype.hide):
+        (WebInspector.CookieItemsView.prototype.update):
+        (WebInspector.CookieItemsView.prototype.buildCookies): parses the inspected window's document.cookie string
+        (WebInspector.CookieItemsView.prototype.dataGridForCookies): creates a datagrid for cookies
+        (WebInspector.CookieItemsView.prototype._deleteButtonClicked): attempt at deleting the cookie (not flawless)
+        (WebInspector.CookieItemsView.prototype._refreshButtonClicked): rebuild the datagrid
+
+          Include a SidebarSection Section in the Databases Panel:
+
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.show): calls populateInterface
+        (WebInspector.DatabasesPanel.prototype.populateInterface): adds cookies if they don't exist
+        (WebInspector.DatabasesPanel.prototype.reset): remove cookie specific parts
+        (WebInspector.DatabasesPanel.prototype.addCookies): add cookies sidebar tree element
+        (WebInspector.DatabasesPanel.prototype.showCookies): sets the visible view to a CookiesItemView
+        (WebInspector.CookieSidebarTreeElement):
+        (WebInspector.CookieSidebarTreeElement.prototype.onselect):
+        (WebInspector.CookieSidebarTreeElement.prototype.get mainTitle): just "Cookies" at the moment
+        (WebInspector.CookieSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.CookieSidebarTreeElement.prototype.get subtitle): no subtitle yet
+        (WebInspector.CookieSidebarTreeElement.prototype.set subtitle):
+
+          New "Cookies" Image for the Sidebar:
+
+        * inspector/front-end/Images/cookie.png: Added.
+        * inspector/front-end/inspector.css:
+
+          Include the Added Files where appropriate:
+
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add SQLTransactionCoordinator.[h,cpp] to WebCore.pro.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28246
+
+        * WebCore.pro:
+
+2009-08-12  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        Mark unused variables to avoid compile failures in -Werror.
+
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::deregisterTask):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::deregisterTask):
+
+2009-08-12  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        This is to add WCSS marquee support , which is defined by OMA and is an extension for CSS2, 
+        It extends CSS display with "display:-wap-marquee;-wap-marquee-dir:xxx;-wap-marquee-speed:xxx;-wap-marquee-style:xxx"
+        Minor fixes by Eric Seidel and George Staikos.
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+
+        No new tests, the tests have already been landed at LayoutTests/fast/wcss/
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * css/WCSSPropertyNames.in: Added.
+        * css/WCSSValueKeywords.in: Added.
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::start):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-08-12  George Wright  <george.wright@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Update the canvas renderer's intrinsic size with the zoomed
+        lengths and ensure the intrinsic size is correct when setting
+        an initial style.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26908
+
+        Test: fast/canvas/canvas-zoom.html
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+
+2009-08-12  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix regression for dragging the media controller thumb.
+        https://bugs.webkit.org/show_bug.cgi?id=28211
+
+        Modified the conditions for rejecting events on the media controller
+        to only rejecting mouse events not from the left button.
+
+        Test: media/controls-drag-timebar.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+
+2009-08-12  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixing a deadlock caused by two transactions that run on two
+        different database handles for the same DB. Adding a per-DB thread
+        transaction coordinator that allows the DB thread to run only one
+        transaction per DB file at any given time.
+
+        Adding a regression test for this bug.
+
+        Test: storage/multiple-transactions-on-different-handles.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=27966
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/Database.cpp:
+        (WebCore::Database::transactionCoordinator):
+        * storage/Database.h:
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        * storage/DatabaseThread.h:
+        (WebCore::DatabaseThread::transactionCoordinator):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::debugStepName):
+        (WebCore::SQLTransaction::performNextStep):
+        (WebCore::SQLTransaction::aquireLock):
+        (WebCore::SQLTransaction::lockAquired):
+        (WebCore::SQLTransaction::cleanupAfterSuccessCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionCoordinator.cpp: Added.
+        * storage/SQLTransactionCoordinator.h: Added.
+
+2009-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Custom properties on DOM objects are lost after GC (as demonstrated by the gc-9.html test)
+        https://bugs.webkit.org/show_bug.cgi?id=28194
+
+        * GNUmakefile.am: Added the two new source files.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCSSRuleListCustom.cpp: Added.
+        (WebCore::JSCSSRuleList::markChildren): Call markDOMObjectWrapper
+        on rules in the list.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::markChildren): Added. Call
+        markDOMObjectWrapper on the CSSValue objects that are owned by the
+        declaration as values of the properties.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM): Added code to handle some
+        cases where nodes are observable because they own objects that
+        in turn have custom properties.
+
+        * bindings/js/JSDOMBinding.h: Fix a typo in the header.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::markChildren): Added call to markDOMObjectWrapper
+        for implementation and styleSheets.
+
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::markChildren): Added. Calls markDOMObjectWrapper
+        for attributes and style.
+
+        * bindings/js/JSHTMLCanvasElementCustom.cpp: Added.
+        (WebCore::JSHTMLCanvasElement::markChildren): Call markDOMObjectWrapper
+        on the rendering context.
+
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::JSStyleSheet::markChildren): Call markDOMObjectWrapper on
+        items in the stylesheet.
+
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::markChildren): Added. Calls
+        markDOMObjectWrapper on stylesheets in the list.
+
+        * css/CSSRuleList.idl: Added CustomMarkFunction.
+        * css/CSSStyleDeclaration.idl: Ditto.
+        * css/StyleSheetList.idl: Ditto.
+        * dom/Element.idl: Ditto.
+        * html/HTMLCanvasElement.idl: Ditto.
+
+        * dom/Element.h: Made everything private that could be.
+        Added access to the attributeMap that does returns
+        the existing map without doing any of the lazy-updating work. This
+        is needed to get at the existing attributes during garbage collection
+        without having side effects.
+
+        * html/HTMLCanvasElement.h: Cleaned up the header a bit, making
+        members private. Added renderingContext2D function for use in
+        JSHTMLCanvasElement::markChildren.
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes two bugs about Pan Scrolling - Scrolling with middle mouse button doesn't 
+        work in Expanded view on reader.google.com, and Can enter auto scroll from a non-scrollable area.
+        https://bugs.webkit.org/show_bug.cgi?id=28023
+        https://bugs.webkit.org/show_bug.cgi?id=24794
+        
+        Added a new method to RenderBox seeing if the Box can be scrolled and actually has something to
+        scroll, and use that for pan scrolling.
+
+        Test: platform/win/fast/events/panScroll-nested-divs.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+
+2009-08-12  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix of <rdar://6728361> Mouse wheel scrolling on a page with expanded drop down 
+        list detaches drop down.
+
+        Added a function for Windows PopupMenu's to return their class name.
+
+         * platform/PopupMenu.h:
+         * platform/win/PopupMenuWin.cpp:
+         (WebCore::PopupMenu::popupClassName):
+
+2009-08-12  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        WINCE PORT: Color and Gradient
+        https://bugs.webkit.org/show_bug.cgi?id=27511
+
+        * platform/graphics/wince/ColorWince.cpp: Added.
+        * platform/graphics/wince/GradientWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        fix a typo in platform/graphics/skia/PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=28172
+
+        No new tests because it's a just typo fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::setupPaintCommon):
+
+2009-08-12  Michelangelo De Simone  <micdesim@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27458
+        Support for the :default CSS pseudoclass, as per HTML5 spec.
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/interactive-elements.html#selector-default
+
+        Tests: fast/css/pseudo-default-001.html
+               fast/css/pseudo-default-002.html
+               fast/css/pseudo-default-003.html
+               fast/css/pseudo-default-004.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): pseudoDefault
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): sharing stuff is
+        aware that only one default button can be present in a form
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): applies
+        the :default CSS pseudoclass
+        * dom/Element.h:
+        (WebCore::Element::isDefaultButtonForForm): new method to determine
+        whether a FormControl is a default button for a given form
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isDefaultButtonForForm): ditto
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::defaultButton): extracts the default button
+        from the form
+        * html/HTMLFormElement.h:
+
+2009-08-12  David Levin  <levin@chromium.org>
+
+        No review, rolling out r47106.
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This patch relied on a new version of v8 which is not available
+        in chromium yet.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Steve Block  <steveblock@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26993 : Geolocation::requestPermission()
+        https://bugs.webkit.org/show_bug.cgi?id=26993
+
+        Second patch to allow the Geolocation permission request to chrome to be asynchronous
+        or synchronous. Fixes a bug where callbacks were called twice when permissions
+        are granted synchronously.
+
+        No new tests required.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::setIsAllowed): Modified. Calls makeSuccessCallbacks() rather than geolocationServicePositionChanged().
+        (WebCore::Geolocation::geolocationServicePositionChanged): Modified. Updated logic to avoid repeated callbacks when permissions are granted synchronously.
+        (WebCore::Geolocation::makeSuccessCallbacks): Added. Calls success callbacks.
+        * page/Geolocation.h: Modified. Adds makeSuccessCallbacks().
+
+2009-08-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6952336>
+        CrashTracer: [USER] 3 crashes in Safari at com.apple.WebCore • WebCore::SecurityOrigin::canAccess const + 27
+
+        Make sure to set the security origin before calling dispatchWindowObjectAvailable.
+        
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+
+2009-08-12  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix [Chromium] drop down menu letter selection, skip selections
+        https://bugs.webkit.org/show_bug.cgi?id=28205
+
+        Not auto-testable since it is chromim platform specific code, and it involves sending a keyboard 
+        event to the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * manual-tests/keyboard_select_elements_with_same_beginning.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): style change.
+        (WebCore::PopupListBox::handleKeyEvent): typeAheadFind should be called only when the event is
+        a character type event to avoid calling twice for English.
+        (WebCore::PopupListBox::typeAheadFind): remove unnecessary checking of isCharacterTypeEvent() since the whole function is only called under that condition.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding GraphicsContext to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28130
+
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp: Added.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::origin):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setPlatformFont):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::getHaikuStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Modifying WebCore/platform/graphics files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/graphics/BitmapImage.h: Adding getBBitmap() function.
+        * platform/graphics/Color.h: rgb_color is the Color struct in Haiku.
+        * platform/graphics/FloatPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/FloatRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/GraphicsContext.cpp: 
+        * platform/graphics/GraphicsContext.h: BView is the PlatformGraphicsContext
+        class for Haiku. Adding getHaikuStrokeStyle() function.
+        * platform/graphics/Icon.h: Adding an empty Icon() constructor because
+        this class isn't implemented for the moment.
+        * platform/graphics/ImageSource.h: BBitmap is the native bitmap class 
+        for Haiku.
+        * platform/graphics/IntPoint.h: BPoint is the Point class in Haiku.
+        * platform/graphics/IntRect.h: BRect is the Rect class in Haiku.
+        * platform/graphics/IntSize.h: BSize is the Size class in Haiku.
+        * platform/graphics/Path.h: BRegion is the Path class in Haiku.
+        * platform/graphics/Pattern.h: Adding the GraphicsDef.h header and the 
+        native pattern type.
+        * platform/graphics/SimpleFontData.h: Adding Haiku's Font.h header.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding modification to the WebCore/platform/ files to allow
+        the Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * platform/ContextMenuItem.h: BMenu is the PlatformMenuItemDescription
+        class of Haiku.
+        * platform/Cursor.h: BCursor is the Cursor class of Haiku.
+        * platform/DragData.h: Use a BMessage as DragDataRef.
+        * platform/DragImage.h: Use a BBitmap as DragImageRef.
+        * platform/PlatformKeyboardEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformMenuDescription.h: BMenu is the 
+        PlatformMenuDescription class of Haiku.
+        * platform/PlatformMouseEvent.h: Use BMessage as event vehicle.
+        * platform/PlatformWheelEvent.h: Use BMessage as event vehicle.
+        * platform/PopupMenu.h: Adding a m_menu attribute for Haiku.
+        * platform/Widget.h: BView is the PlatformWidget class of Haiku.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Tiny modifications on WebCore files to allow Haiku port.
+        https://bugs.webkit.org/show_bug.cgi?id=28128
+
+        * bindings/js/ScriptControllerHaiku.cpp: Style cleanup.
+        * loader/CachedFont.cpp: Haiku behaves like Qt, Gtk, or Chromium,
+        so many PLATFORM(HAIKU) were added to these functions.
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * page/EventHandler.cpp: Like the mac and Qt port, Haiku doesn't need the
+        invertSenseOfTabsToLinks() function.
+        * page/haiku/DragControllerHaiku.cpp: Style cleanup.
+        * platform/image-decoders/ImageDecoder.h: For image decoding Haiku
+        behaves like Cairo or Wx, (not like Skia).
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/text/PlatformString.h: Adding the String(BString&) and BString()
+        methods specific to Haiku.
+        * platform/text/UnicodeRange.h: Haiku needs to include stdint.h.
+        * platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp:
+        (WebCore::currentSearchLocaleID): Missing function.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding the ScrollbarTheme files.
+        https://bugs.webkit.org/show_bug.cgi?id=28125
+
+        * platform/haiku/ScrollbarThemeHaiku.cpp: Added.
+        (buttonWidth):
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeHaiku::ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::~ScrollbarThemeHaiku):
+        (WebCore::ScrollbarThemeHaiku::scrollbarThickness):
+        (WebCore::ScrollbarThemeHaiku::hasButtons):
+        (WebCore::ScrollbarThemeHaiku::hasThumb):
+        (WebCore::ScrollbarThemeHaiku::backButtonRect):
+        (WebCore::ScrollbarThemeHaiku::forwardButtonRect):
+        (WebCore::ScrollbarThemeHaiku::trackRect):
+        (WebCore::ScrollbarThemeHaiku::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeHaiku::paintButton):
+        (WebCore::ScrollbarThemeHaiku::paintThumb):
+        * platform/haiku/ScrollbarThemeHaiku.h: Added.
+
+2009-08-12  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Adding eight simple files to WebCore/platform/graphics/haiku.
+        https://bugs.webkit.org/show_bug.cgi?id=28122
+
+        * platform/graphics/haiku/ColorHaiku.cpp: Added.
+        (WebCore::Color::Color):
+        (WebCore::Color::operator rgb_color):
+        (WebCore::focusRingColor):
+        * platform/graphics/haiku/FloatPointHaiku.cpp: Added.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator BPoint):
+        * platform/graphics/haiku/FloatRectHaiku.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator BRect):
+        * platform/graphics/haiku/GradientHaiku.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/haiku/IntPointHaiku.cpp: Added.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator BPoint):
+        * platform/graphics/haiku/IntRectHaiku.cpp: Added.
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator BRect):
+        * platform/graphics/haiku/IntSizeHaiku.cpp: Added.
+        (WebCore::IntSize::IntSize):
+        (WebCore::IntSize::operator BSize):
+        * platform/graphics/haiku/PathHaiku.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::hasCurrentPoint):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::debugString):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::strokeBoundingRect):
+
+2009-08-12  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Implement Keygen for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/KeygenWince.cpp: Added.
+
+2009-08-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Rubber-stamped by Kevin Ollivier.
+
+        Handle crash in wx due to null value passed to strlen in
+        the CString constructor.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificatePath):  Check for null return from getenv
+        and use default CString constructor instead.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: simple stubs to make it build for WINCE
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/DragDataWince.cpp: Added.
+        * platform/wince/DragImageWince.cpp: Added.
+        * platform/wince/EditorWince.cpp: Added.
+        * platform/wince/KURLWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCEPORT: FileSystem and FileChooser
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/FileChooserWince.cpp: Added.
+        * platform/wince/FileSystemWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        WINCE PORT: implement Cursor for WINCE. There's no real cursor on most
+        WinMob devices. We pass the cursor info to application, which so that 
+        can determine what to do.
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/CursorWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MIMETypeRegistry
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/MIMETypeRegistryWince.cpp: Added.
+
+2009-08-12  Joe Mason  <joe.mason@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Pasteboard and SearchPopupMenu
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/PasteboardWince.cpp: Added.
+        * platform/wince/SearchPopupMenuWince.cpp: Added.
+
+2009-08-12  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: Add SharedTimerWince.cpp and SystemTimeWince.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=27543
+
+        * platform/wince/SharedTimerWince.cpp: Added.
+        * platform/wince/SystemTimeWince.cpp: Added.
+
+2009-08-12  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28204
+        Allow C++ exceptions to be disabled in WebCore's V8 Mac build.
+
+        * WebCorePrefix.h:
+        Only undefine |try| and |catch| when building Objective-C[++],
+        leaving the C++ library definitions intact for C++.
+
+2009-08-12  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add a Custom Setter for DOMWindowEvent in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=27719
+
+        Tests: fast/events/set-event-in-another-frame.html
+               fast/events/set-event-to-null.html
+
+        * bindings/scripts/CodeGeneratorV8.pm: Clean up custom getter/setter code, 
+            as it currently doesn't support a custom getter 
+            and a v8-specific custom setter simultaneously.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * page/DOMWindow.idl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge wx/ImageSourceWx.cpp into ImageSource.cpp.  No changes to
+        ImageSource.cpp were needed, so this just deletes ImageSourceWx.cpp.
+
+        * WebCore.gypi:
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-08-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27933
+        Build fix after r47099.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::putImageData):
+
+2009-08-08  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Adam Treat.
+
+        WINCE PORT: Implement Path for WINCE. Most code can be
+        reused for other ports that don't have native path support
+        https://bugs.webkit.org/show_bug.cgi?id=28188
+
+        Written also by George Staikos (including quadCurve() and bezier())
+
+        * platform/graphics/wince/PathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.cpp: Added.
+        * platform/graphics/wince/PlatformPathWince.h: Added.
+        * platform/graphics/wince/WinceGraphicsExtras.h: Added.
+
+2009-08-12  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        "Double-click to add" new style button does not always show up [quick fix]
+        https://bugs.webkit.org/show_bug.cgi?id=28187
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-08-12  Crystal Zhang <crystal.zhang@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        WINCE PORT: MediaPlayerProxy and MediaPlayerPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=28178
+
+        * platform/graphics/wince/MediaPlayerPrivateWince.h: Added.
+        * platform/graphics/wince/MediaPlayerProxy.cpp: Added.
+        * platform/graphics/wince/MediaPlayerProxy.h: Added.
+
+2009-08-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        HTML 5 database and LocalStorage is not persistent on the Symbian port of QtWebKit
+        https://bugs.webkit.org/show_bug.cgi?id=28175
+
+        Call QDir::toNativeSeparators() before the path is passed to the OS.
+
+        Based on work by David Leong.
+        
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::pathByAppendingComponent):
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Minor build-fix for SVG Filter. Use getUnmultipliedImageData instead
+        of getImageData. This changed since r47099.
+
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+
+2009-08-12  Viet-Trung Luu  <viettrungluu@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Explicitly set control tints for Chromium/Mac, since the controls'
+        NSCell(s) lack an NSView and hence their tint isn't updated
+        automatically when the application is activated/deactivated.
+        https://bugs.webkit.org/show_bug.cgi?id=28108
+        http://crbug.com/18199
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::updateNSCellControlTint):
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintButton):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSliderThumb):
+        (WebCore::RenderThemeChromiumMac::paintSearchField):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-08-12  Christian Plesner Hansen  <christian.plesner.hansen@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Fix atomic string externalization crash.
+        Atomic string externalization assumes that all non-empty strings
+        can be externalized which is untrue on 64-bit.  This change fixed
+        that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28215
+
+        This bug causes loads of test crashes, no need to add new tests
+        specifically for this.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::v8StringToAtomicWebCoreString):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix box-shadow painting in r47103. The edge should not be blurry.
+        Also optimize by not having to save and restore painter state.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Adam Treat.
+
+        [Qt] Fix coding style in GraphicsContextQt.cpp
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+        (WebCore::toQtLineCap):
+        (WebCore::toQtLineJoin):
+        (WebCore::GraphicsContextPlatformPrivate::p):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::pen):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+
+2009-08-12  Szabo Carol  <carol.szabo@nokia.com>
+
+        Reviewed by Simon Hausmann and Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23291
+
+        [Qt] Partial support for -webkit-box-shadow. Blur is not support and
+        the shadow still does not go well with border radius.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+
+2009-08-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        Use AM_V_GEN in a few more places, for less noisy builds.
+
+        * GNUmakefile.am:
+
+2009-08-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        SVG Filter premultiplied color support for getImageDate/putImageData
+        [https://bugs.webkit.org/show_bug.cgi?id=27933]
+
+        Some SVG Filters need premultiplied ImageData for the calculation. Therefore getImageData
+        and putImageData of ImageBuffer need support for premultiplied colors.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::getImageData):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::getImageData):
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::putImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::getUnmultipliedImageData):
+        (WebCore::ImageBuffer::getPremultipliedImageData):
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+        (WebCore::ImageBuffer::putPremultipliedImageData):
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-08-12  Mikhail Naganov  <mnaganov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Changed Number.bytesToString to support low-resolution output.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28146
+
+        * inspector/front-end/utilities.js:
+        (Number.bytesToString):
+
+2009-08-12  Prasanth Ullattil  <prasanth.ullattil@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add support for hooking BeginPaint/EndPaint on 64Bit Windows
+
+        Webkit uses the runtime patching trick explained by "Feng Yuan" for
+        hooking these paint functions. It currently supports only 32bit assembly
+        code. This patch adds support for 64Bit version. Since inline-assemblies
+        are not supported for 64Bit, we have use a seperate .asm file.
+
+        * WebCore.pro:
+        * plugins/win/PaintHooks.asm: Added.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+
+2009-08-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Make it harder to misuse try* allocation routines
+        https://bugs.webkit.org/show_bug.cgi?id=27469
+
+        Add forwarding header for PossiblyNull type, and add missing null check
+        to ImageBuffer creation.
+
+        * ForwardingHeaders/wtf/PossiblyNull.h: Added.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+
+2009-08-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Restrict use of FuncDeclNode & FuncExprNode to the parser.
+        https://bugs.webkit.org/show_bug.cgi?id=28209
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+            Function signature change.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Merge skia/ImageSourceSkia.cpp into ImageSource.cpp.
+
+        * WebCore.gypi: Remove deleted file, plus a file that was deleted a while back.
+        * platform/graphics/ImageSource.cpp:
+        (WebCore::ImageSource::setData): Use slightly shorter syntax.
+        (WebCore::ImageSource::filenameExtension): Use shorter syntax.
+        (WebCore::ImageSource::createFrameAtIndex): Remove redundant call, clarify comments, reject all empty images.
+        (WebCore::ImageSource::frameHasAlphaAtIndex): Clarify comments, use shorter syntax.
+        * platform/graphics/skia/ImageSourceSkia.cpp: Removed.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        SharedWorkers do not exit when the last parent document exits
+        https://bugs.webkit.org/show_bug.cgi?id=28170
+
+        Prevents Documents from being suspended/placed in the page cache if they are associated with shared workers.
+
+        Added vector cache instead of nested hash tables for SharedWorker repository.
+
+        Added SharedWorkerRepository::documentDetached API.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Notifies SharedWorkerRepository when the document is closing.
+        * loader/FrameLoader.cpp:
+        Updated FrameLoader to not cache the Document if it is associated with a SharedWorker (since we can't suspend workers yet, we need to shut them down).
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerProxy::create):
+        (WebCore::SharedWorkerProxy::isClosing):
+        Renamed from closing().
+        (WebCore::SharedWorkerProxy::matches):
+        Added manual equality function to replace old hash lookup.
+        (WebCore::SharedWorkerProxy::isDocumentInWorkerDocuments):
+        Checks to see if a document is in the worker's list of documents. Used to determine if page is suspendable.
+        (WebCore::SharedWorkerProxy::SharedWorkerProxy):
+        (WebCore::SharedWorkerProxy::addToWorkerDocuments):
+        Added tracking of the worker's list of documents for lifecycle purposes.
+        (WebCore::SharedWorkerProxy::documentDetached):
+        Shuts down the proxy when the last associated document is detached.
+        (WebCore::SharedWorkerProxy::close):
+        Marks the proxy as closed so it is no longer shared with new instances.
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        Removes the proxy from the repository/frees the proxy when the associated SharedWorkerContext is destroyed.
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        closing()->isClosing()
+        (WebCore::SharedWorkerRepository::documentDetached):
+        (WebCore::SharedWorkerRepository::hasSharedWorkers):
+        Used by FrameLoader to determine if a page has shared workers and so cannot be suspended/cached.
+        (WebCore::DefaultSharedWorkerRepository::hasSharedWorkers):
+        (WebCore::DefaultSharedWorkerRepository::removeProxy):
+        Invoked by workerContextDestroyed() to remove a SharedWorkerProxy from the repository.
+        (WebCore::DefaultSharedWorkerRepository::documentDetached):
+        (WebCore::DefaultSharedWorkerRepository::connectToWorker):
+        (WebCore::DefaultSharedWorkerRepository::getProxy):
+        * workers/DefaultSharedWorkerRepository.h:
+        * workers/SharedWorkerRepository.h:
+
+2009-08-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 28200 - ListMarker should be included as part of the text value to parse
+        https://bugs.webkit.org/show_bug.cgi?id=28200
+
+        When returning text through the marker range attributes, the list marker text should
+        also be included. It isn't included by default because a TextIterator is used which
+        only looks at Nodes for text. A list marker does not have a corresponding node,
+        so its text is not returned through accessibility. That is, until now.
+
+        Test: platform/mac/accessibility/string-range-contains-listmarker.html
+
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::listMarkerTextForRange):
+        (WebCore::AccessibilityObject::stringForVisiblePositionRange):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        * rendering/RenderListItem.h:
+
+        Make markerText() public so that accessibility code can access it.
+
+2009-08-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=27965
+        Move cairo/ImageSourceCairo.cpp to ImageSource.cpp in preparation for
+        merging most of the other ImageSource*.cpp files with it.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/ImageSource.cpp: Copied from WebCore/platform/graphics/cairo/ImageSourceCairo.cpp.
+        * platform/graphics/cairo/ImageSourceCairo.cpp: Removed.
+
+2009-08-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Cairo-based Windows port does not handle the https protocol.
+        https://bugs.webkit.org/show_bug.cgi?id=28171.
+
+        No new tests needed.  Existing https tests show this failure
+        for WinCairo builds.
+
+        * WebCore.vcproj/WebCoreCURL.vsprops: Add a few preprocessor
+          definitions for SSL support in cURL.
+        * platform/network/curl/ResourceHandleManager.h: Add new
+          certificate path member variable.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::certificateBundlePath): New method to retrieve the
+          proper certificate resource bundle path.
+        (WebCore::ResourceHandleManager::initializeHandle): Check for
+          the resource bundle and use if available to activate SSL
+          support.
+
+2009-08-11  Maxime Simon  <simon.maxime@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        [Haiku] Use Clipboard::create() instead of the constructor of Clipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=28127
+
+        * editing/haiku/EditorHaiku.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/haiku/EventHandlerHaiku.cpp:
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/haiku/ClipboardHaiku.cpp: Style cleanup. There were many whitespace end of lines.
+        (WebCore::ClipboardHaiku::ClipboardHaiku):
+        (WebCore::ClipboardHaiku::clearAllData):
+        (WebCore::ClipboardHaiku::getData):
+        (WebCore::ClipboardHaiku::setData):
+        (WebCore::ClipboardHaiku::types):
+        (WebCore::ClipboardHaiku::dragLocation):
+        (WebCore::ClipboardHaiku::dragImage):
+        (WebCore::ClipboardHaiku::setDragImage):
+        (WebCore::ClipboardHaiku::dragImageElement):
+        (WebCore::ClipboardHaiku::createDragImage):
+        (WebCore::ClipboardHaiku::declareAndWriteDragImage):
+        (WebCore::ClipboardHaiku::writeURL):
+        (WebCore::ClipboardHaiku::writeRange):
+        (WebCore::ClipboardHaiku::hasData):
+        * platform/haiku/DragDataHaiku.cpp:
+        (WebCore::DragData::createClipboard):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative GTK build fix
+
+        * GNUmakefile.am:
+        Added missing .idl file, and added notifications directory to IDL_PATH.
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by NOBODY (build break).
+
+        Speculative Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Added missing build steps for non-debug targets.
+
+2009-08-11  Drew Wilson <atwilson@google.com>
+
+        Reviewed by NOBODY (build break)
+
+        Speculative build fix for Qt build.
+
+        * WebCore.pro: Added /notifications to include path
+
+2009-08-11  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Desktop Notifications API
+        https://bugs.webkit.org/show_bug.cgi?id=25463
+
+        Adds an implementation of desktop notifications, behind the compile-time
+        flag ENABLE(NOTIFICATIONS).  This code simply relays calls on the JavaScript
+        API through a NotificationProvider interface, which must provide the services
+        to actually notify the user and manage the desktop.  This provider is injected
+        into WebKit through the ChromeClient for normal page contexts and through the
+        WorkerThread for worker contexts.
+
+        A permissions API is defined on a per-origin basis, which allows a web page
+        to check if its origin is allowed to show desktop notifications, and to request
+        permission for its origin.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDesktopNotificationsCustom.cpp: Added.
+        (WebCore::JSNotificationCenter::requestPermission):
+        (WebCore::JSNotification::addEventListener):
+        (WebCore::JSNotification::removeEventListener):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNotification):
+        * dom/EventTarget.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::notificationPresenter):
+        * notifications: Added.
+        * notifications/Notification.cpp: Added.
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::~Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::ondisplay):
+        (WebCore::Notification::setOndisplay):
+        (WebCore::Notification::onerror):
+        (WebCore::Notification::setOnerror):
+        (WebCore::Notification::onclose):
+        (WebCore::Notification::setOnclose):
+        (WebCore::Notification::getAttributeEventListener):
+        (WebCore::Notification::setAttributeEventListener):
+        (WebCore::Notification::clearAttributeEventListener):
+        (WebCore::Notification::dispatchDisplayEvent):
+        (WebCore::Notification::dispatchErrorEvent):
+        (WebCore::Notification::dispatchCloseEvent):
+        (WebCore::Notification::addEventListener):
+        (WebCore::Notification::removeEventListener):
+        (WebCore::Notification::handleEvent):
+        (WebCore::Notification::dispatchEvent):
+        * notifications/Notification.h: Added.
+        (WebCore::Notification::create):
+        (WebCore::Notification::isHTML):
+        (WebCore::Notification::url):
+        (WebCore::Notification::contents):
+        (WebCore::Notification::scriptExecutionContext):
+        (WebCore::Notification::toNotification):
+        (WebCore::Notification::refEventTarget):
+        (WebCore::Notification::derefEventTarget):
+        * notifications/Notification.idl: Added.
+        * notifications/NotificationCenter.cpp: Added.
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        * notifications/NotificationCenter.h: Added.
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::createHTMLNotification):
+        (WebCore::NotificationCenter::createNotification):
+        (WebCore::NotificationCenter::context):
+        (WebCore::NotificationCenter::presenter):
+        * notifications/NotificationCenter.idl: Added.
+        * notifications/NotificationContents.h: Added.
+        (WebCore::NotificationContents::NotificationContents):
+        (WebCore::NotificationContents::icon):
+        (WebCore::NotificationContents::title):
+        (WebCore::NotificationContents::body):
+        * notifications/NotificationPresenter.h: Added.
+        (WebCore::NotificationPresenter::):
+        (WebCore::NotificationPresenter::~NotificationPresenter):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::notificationPresenter):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::getNotificationPresenter):
+        (WebCore::WorkerThread::setNotificationPresenter):
+
+2009-08-11  Joseph Pecoraro  <joepeck02@gmail.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Inspector: Console Drawer is Toggling instead of Staying Open
+        https://bugs.webkit.org/show_bug.cgi?id=28115
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.showView): ensures the drawer will be open and showing the provided view
+        * inspector/front-end/inspector.js:
+        (WebInspector.showConsole): usees the new showView to guarantee the Drawer will be open
+        (WebInspector.showChanges): uses the new showView guarantee the Drawer will be open
+
+2009-08-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        [WML] WMLPageState is not allowed to store the active card, it needs to be done per document
+        https://bugs.webkit.org/show_bug.cgi?id=28180
+
+        Don't store the active WMLCardElement in WMLPageState, but in WMLDocument.
+        Otherwhise this may lead to crashes related to intrinsic event exeuction.
+
+        Unfortunately select elements aren't testable by the layout tests, so adding
+        a new manual test reproducing the crash.
+
+        * manual-tests/wml/select-onpick-event-crash.wml: Added.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLDocument.h:
+        (WebCore::WMLDocument::activeCard):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+        * wml/WMLPageState.h:
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+
+2009-08-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28073
+        Treat icons with no bit count and no color count as 256-color for
+        purposes of quality ranking.  Also fix a couple cases of a style
+        violation.
+
+        Test: fast/images/icon-0colors.html
+
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+
+2009-08-11  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by David Levin.
+
+        Need to refactor WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=28136
+
+        Added WorkerReportingProxy for reporting worker state (exceptions, console messages, thread exited) to the parent.
+
+        Existing tests are sufficient, as this is only a refactoring.
+
+        * GNUmakefile.am:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.gypi:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.vcproj/WebCore.vcproj:
+        Added WorkerReportingProxy.h to build.
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerReportingProxy.h to build.
+        * workers/DedicatedWorkerContext.cpp:
+        * workers/DedicatedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/DedicatedWorkerThread.cpp:
+        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
+        Changed constructor to pass WorkerReportingProxy to base class.
+        * workers/DefaultSharedWorkerRepository.cpp:
+        Updated SharedWorkerProxy to implement WorkerReportingProxy interface.
+        (WebCore::SharedWorkerProxy::postExceptionToWorkerObject):
+        (WebCore::SharedWorkerProxy::postConsoleMessageToWorkerObject):
+        (WebCore::SharedWorkerProxy::workerContextClosed):
+        (WebCore::SharedWorkerProxy::workerContextDestroyed):
+        (WebCore::DefaultSharedWorkerRepository::workerScriptLoaded):
+        Now passes in WorkerReportingProxy when creating SharedWorkerThread.
+        * workers/SharedWorkerContext.cpp:
+        * workers/SharedWorkerContext.h:
+        Removed addMessage/forwardException() APIs - now handled by WorkerReportingProxy.
+        * workers/SharedWorkerThread.cpp:
+        (WebCore::SharedWorkerThread::create):
+        (WebCore::SharedWorkerThread::SharedWorkerThread):
+        Passes WorkerReportingProxy to base class constructor.
+        * workers/SharedWorkerThread.h:
+        Constructor now takes a WorkerReportingProxy.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        Moved code that calls workerContextDestroyed() into base class so shared workers share this functionality.
+        (WebCore::WorkerContext::close):
+        Now notifies WorkerReportingProxy when the thread is closing.
+        (WebCore::WorkerContext::reportException):
+        Reports exceptions via WorkerReportingProxy.
+        (WebCore::WorkerContext::addMessage):
+        Reports console messages via WorkerReportingProxy.
+        * workers/WorkerContext.h:
+        * workers/WorkerObjectProxy.h:
+        (WebCore::WorkerObjectProxy::workerContextClosed):
+        Default empty implementation for dedicated workers.
+        * workers/WorkerReportingProxy.h: Added.
+        Base interface that contains APIs moved from WorkerObjectProxy.
+        (WebCore::WorkerReportingProxy::~WorkerReportingProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        Updated constructor to accept a WorkerReportingProxy.
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerReportingProxy):
+
+2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Fix the Qt build after r47022.
+
+        Use the new markChildren() pattern for marking aggregate/child objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::markChildren):
+        (JSC::Bindings::QtInstance::markAggregate):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::markChildren):
+        * bridge/qt/qt_runtime.h:
+
 2009-08-11  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Holger Freyther.
@@ -191,7 +25661,7 @@
         * page/DOMWindow.cpp:
         (WebCore::DOMWindow::applicationCache):
 
-2009-08-10  Crystal Zhang  <crystal.zhang@staikos.net>
+2009-08-10  Crystal Zhang  <crystal.zhang@torchmobile.com>
 
         Reviewed by George Staikos.
 
diff --git a/WebCore/ChangeLog-2009-06-16 b/WebCore/ChangeLog-2009-06-16
index 1041c90..1f283d2 100644
--- a/WebCore/ChangeLog-2009-06-16
+++ b/WebCore/ChangeLog-2009-06-16
@@ -47996,7 +47996,7 @@
 
         Rubber-stamped by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=238662&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=238662&method=entry
 
         [Qt] Map function keys F1 to F24.
 
@@ -52735,7 +52735,7 @@
 
         Reviewed by Simon Hausmann.
 
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=211228&method=entry
+        http://qt.nokia.com/developer/task-tracker/index_html?id=211228&method=entry
 
         [Qt] Show focus rect when a button gets the focus for the first time.
         This is important at least for Windows style.
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 37d2df6..ed387aa 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -28,7 +28,9 @@
 
 // Set any ENABLE_FEATURE_NAME macro to an empty string to disable that feature.
 
-ENABLE_3D_CANVAS = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(MAC_OS_X_VERSION_MAJOR));
+ENABLE_3D_CANVAS_1050 = ENABLE_3D_CANVAS;
+ENABLE_3D_CANVAS_1060 = ENABLE_3D_CANVAS;
 
 ENABLE_3D_RENDERING = $(ENABLE_3D_RENDERING_$(MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_RENDERING_1050 = ENABLE_3D_RENDERING;
@@ -37,14 +39,18 @@ ENABLE_3D_RENDERING_1060 = ENABLE_3D_RENDERING;
 ENABLE_CHANNEL_MESSAGING = ENABLE_CHANNEL_MESSAGING;
 ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ENABLE_DATAGRID;
+ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
+ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ;
 ENABLE_GEOLOCATION = ;
 ENABLE_ICONDATABASE = ENABLE_ICONDATABASE;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_MATHML = ;
+ENABLE_NOTIFICATIONS = ;
 ENABLE_OFFLINE_WEB_APPLICATIONS = ENABLE_OFFLINE_WEB_APPLICATIONS;
 ENABLE_RUBY = ENABLE_RUBY;
-ENABLE_SHARED_WORKERS = ;
+ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SVG = ENABLE_SVG;
 ENABLE_SVG_ANIMATION = ENABLE_SVG_ANIMATION;
 ENABLE_SVG_AS_IMAGE = ENABLE_SVG_AS_IMAGE;
@@ -59,4 +65,4 @@ ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DOM_STORAGE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index d07d57f..66d574b 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 532;
-MINOR_VERSION = 0;
+MINOR_VERSION = 2;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index b0311e2..48a67e9 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -28,9 +28,14 @@
 #include "JSAbstractWorker.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
+#include "JSBeforeLoadEvent.cpp"
 #include "JSCanvasGradient.cpp"
 #include "JSCanvasPattern.cpp"
+#include "JSCanvasRenderingContext.cpp"
 #include "JSCanvasRenderingContext2D.cpp"
+#if ENABLE(3D_CANVAS)    
+#include "JSCanvasRenderingContext3D.cpp"
+#endif
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
 #include "JSClientRect.cpp"
@@ -73,6 +78,7 @@
 #include "JSErrorEvent.cpp"
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
+#include "JSEventSource.cpp"
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
@@ -92,6 +98,7 @@
 #include "JSHTMLDataGridCellElement.cpp"
 #include "JSHTMLDataGridColElement.cpp"
 #include "JSHTMLDataGridRowElement.cpp"
+#include "JSHTMLDataListElement.cpp"
 #include "JSHTMLDirectoryElement.cpp"
 #include "JSHTMLDivElement.cpp"
 #include "JSHTMLDListElement.cpp"
@@ -166,7 +173,10 @@
 #include "JSNodeIterator.cpp"
 #include "JSNodeList.cpp"
 #include "JSNotation.cpp"
+#include "JSNotificationCenter.cpp"
+#include "JSNotification.cpp"
 #include "JSOverflowEvent.cpp"
+#include "JSPageTransitionEvent.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
 #include "JSProcessingInstruction.cpp"
@@ -210,7 +220,6 @@
 #include "JSSVGColor.cpp"
 #include "JSSVGComponentTransferFunctionElement.cpp"
 #include "JSSVGCursorElement.cpp"
-#include "JSSVGDefinitionSrcElement.cpp"
 #include "JSSVGDefsElement.cpp"
 #include "JSSVGDescElement.cpp"
 #include "JSSVGDocument.cpp"
@@ -325,7 +334,6 @@
 #include "JSTreeWalker.cpp"
 #include "JSUIEvent.cpp"
 #include "JSValidityState.cpp"
-#include "JSVoidCallback.cpp"
 #include "JSWebKitAnimationEvent.cpp"
 #include "JSWebKitCSSKeyframeRule.cpp"
 #include "JSWebKitCSSKeyframesRule.cpp"
@@ -333,6 +341,7 @@
 #include "JSWebKitCSSMatrix.cpp"
 #include "JSWebKitPoint.cpp"
 #include "JSWebKitTransitionEvent.cpp"
+#include "JSWebSocket.cpp"
 #include "JSWheelEvent.cpp"
 #include "JSWorker.cpp"
 #include "JSWorkerContext.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index 788c5ee..157b01a 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -1,5 +1,6 @@
 # Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com> 
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -35,6 +36,7 @@ VPATH = \
     $(WebCore)/html/canvas \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
+    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
     $(WebCore)/storage \
@@ -50,6 +52,7 @@ DOM_CLASSES = \
     AbstractWorker \
     Attr \
     BarInfo \
+    BeforeLoadEvent \
     CDATASection \
     CSSCharsetRule \
     CSSFontFaceRule \
@@ -67,9 +70,26 @@ DOM_CLASSES = \
     CSSValueList \
     CSSVariablesRule \
     CSSVariablesDeclaration \
+    CanvasArray \
+    CanvasArrayBuffer \
+    CanvasBuffer \
+    CanvasByteArray \
+    CanvasFloatArray \
+    CanvasFramebuffer \
     CanvasGradient \
+    CanvasIntArray \
     CanvasPattern \
+    CanvasProgram \
+    CanvasRenderbuffer \
+    CanvasRenderingContext \
     CanvasRenderingContext2D \
+    CanvasRenderingContext3D \
+    CanvasShader \
+    CanvasShortArray \
+    CanvasTexture \
+    CanvasUnsignedByteArray \
+    CanvasUnsignedIntArray \
+    CanvasUnsignedShortArray \
     CharacterData \
     ClientRect \
     ClientRectList \
@@ -99,6 +119,7 @@ DOM_CLASSES = \
     Event \
     EventException \
     EventListener \
+    EventSource \
     EventTarget \
     File \
     FileList \
@@ -120,6 +141,7 @@ DOM_CLASSES = \
     HTMLDataGridCellElement \
     HTMLDataGridColElement \
     HTMLDataGridRowElement \
+    HTMLDataListElement \
     HTMLDListElement \
     HTMLDirectoryElement \
     HTMLDivElement \
@@ -194,7 +216,10 @@ DOM_CLASSES = \
     NodeIterator \
     NodeList \
     Notation \
+    Notification \
+    NotificationCenter \
     OverflowEvent \
+    PageTransitionEvent \
     Plugin \
     PluginArray \
     PositionError \
@@ -238,7 +263,6 @@ DOM_CLASSES = \
     SVGColor \
     SVGComponentTransferFunctionElement \
     SVGCursorElement \
-    SVGDefinitionSrcElement \
     SVGDefsElement \
     SVGDescElement \
     SVGDocument \
@@ -367,7 +391,6 @@ DOM_CLASSES = \
     TreeWalker \
     UIEvent \
     ValidityState \
-    VoidCallback \
     WebKitAnimationEvent \
     WebKitCSSKeyframeRule \
     WebKitCSSKeyframesRule \
@@ -396,8 +419,10 @@ DOM_CLASSES = \
 
 .PHONY : all
 
+JS_DOM_HEADERS=$(filter-out JSEventListener.h JSEventTarget.h,$(DOM_CLASSES:%=JS%.h))
+
 all : \
-    $(filter-out JSEventListener.h JSEventTarget.h,$(DOM_CLASSES:%=JS%.h)) \
+    $(JS_DOM_HEADERS) \
     \
     JSJavaScriptCallFrame.h \
     \
@@ -417,28 +442,50 @@ all : \
     UserAgentStyleSheets.h \
     XLinkNames.cpp \
     XMLNames.cpp \
+    MathMLElementFactory.cpp \
+    MathMLNames.cpp \
     XPathGrammar.cpp \
     tokenizer.cpp \
 #
 
 # --------
 
+ADDITIONAL_IDL_DEFINES :=
+
 ifeq ($(OS),MACOS)
 
-FRAMEWORK_FLAGS = $(shell echo $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
+FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
 
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
     ENABLE_DASHBOARD_SUPPORT = 1
 else
     ENABLE_DASHBOARD_SUPPORT = 0
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
+    ENABLE_ORIENTATION_EVENTS = 1
 else
+    ENABLE_ORIENTATION_EVENTS = 0
+endif
 
-ENABLE_DASHBOARD_SUPPORT = 0
+else
+
+ifndef ENABLE_DASHBOARD_SUPPORT
+    ENABLE_DASHBOARD_SUPPORT = 0
+endif
 
+ifndef ENABLE_ORIENTATION_EVENTS
+    ENABLE_ORIENTATION_EVENTS = 0
 endif
 
+endif # MACOS
+
+ifeq ($(ENABLE_ORIENTATION_EVENTS), 1)
+    ADDITIONAL_IDL_DEFINES := $(ADDITIONAL_IDL_DEFINES) ENABLE_ORIENTATION_EVENTS
+endif
+
+# --------
+
 # CSS property names and value keywords
 
 WEBCORE_CSS_PROPERTY_NAMES := $(WebCore)/css/CSSPropertyNames.in
@@ -458,14 +505,14 @@ endif
 # 2. Lines containing only whitespace
 # These two types of lines will be ignored by make{prop,values}.pl.
 CSSPropertyNames.h : $(WEBCORE_CSS_PROPERTY_NAMES) css/makeprop.pl
-	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$)'; then echo 'Duplicate value!'; exit 1; fi
+	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$$)'; then echo 'Duplicate value!'; exit 1; fi
 	cat $(WEBCORE_CSS_PROPERTY_NAMES) > CSSPropertyNames.in
 	perl "$(WebCore)/css/makeprop.pl"
 
 CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) css/makevalues.pl
 	# Lower case all the values, as CSS values are case-insensitive
 	perl -ne 'print lc' $(WEBCORE_CSS_VALUE_KEYWORDS) > CSSValueKeywords.in
-	if sort CSSValueKeywords.in | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$)'; then echo 'Duplicate value!'; exit 1; fi
+	if sort CSSValueKeywords.in | uniq -d | grep -E -v '(^#)|(^[[:space:]]*$$)'; then echo 'Duplicate value!'; exit 1; fi
 	perl "$(WebCore)/css/makevalues.pl"
 
 # --------
@@ -540,10 +587,14 @@ ifeq ($(findstring ENABLE_WML,$(FEATURE_DEFINES)), ENABLE_WML)
     USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/wml.css
 endif
 
+ifeq ($(findstring ENABLE_MATHML,$(FEATURE_DEFINES)), ENABLE_MATHML)
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mathml.css
+endif
+
 ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControls.css
 ifeq ($(OS),MACOS)
-    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControlsQT.css
+    USER_AGENT_STYLE_SHEETS := $(USER_AGENT_STYLE_SHEETS) $(WebCore)/css/mediaControlsQuickTime.css
 endif
 endif
 
@@ -554,6 +605,10 @@ UserAgentStyleSheets.h : css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
 
 # HTML tag and attribute names
 
+ifeq ($(findstring ENABLE_DATALIST,$(FEATURE_DEFINES)), ENABLE_DATALIST)
+    HTML_FLAGS := $(HTML_FLAGS) ENABLE_DATALIST=1
+endif
+
 ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
     HTML_FLAGS := $(HTML_FLAGS) ENABLE_VIDEO=1
 endif
@@ -677,13 +732,33 @@ WMLNames.cpp :
 
 endif
 
+# --------
+ 
+# MathML tag and attribute names, and element factory
+
+ifeq ($(findstring ENABLE_MATHML,$(FEATURE_DEFINES)), ENABLE_MATHML)
+
+MathMLElementFactory.cpp MathMLNames.cpp : dom/make_names.pl mathml/mathtags.in
+	perl -I $(WebCore)/bindings/scripts $< --tags $(WebCore)/mathml/mathtags.in --factory --wrapperFactory
+
+else
+
+MathMLElementFactory.cpp :
+	echo > $@
+
+MathMLNames.cpp :
+	echo > $@
+
+endif
+
+
 
 # --------
 
 # JavaScript bindings
 
 GENERATE_BINDINGS = perl -I $(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl \
-    --include dom --include html --include css --include page --include xml --include svg --outputDir .
+    --include dom --include html --include css --include page --include notifications --include xml --include svg --write-dependencies --outputDir .
 
 GENERATE_BINDINGS_SCRIPTS = \
     bindings/scripts/CodeGenerator.pm \
@@ -693,7 +768,9 @@ GENERATE_BINDINGS_SCRIPTS = \
 #
 
 JS%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
-	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS $<
+	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --generator JS $<
+
+-include $(JS_DOM_HEADERS:.h=.dep)
 
 # ------------------------
 
@@ -701,9 +778,11 @@ JS%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorJS.pm
 
 ifeq ($(OS),MACOS)
 
-all : $(filter-out DOMDOMWindow.h DOMMimeType.h DOMPlugin.h,$(DOM_CLASSES:%=DOM%.h))
+OBJC_DOM_HEADERS=$(filter-out DOMDOMWindow.h DOMMimeType.h DOMPlugin.h,$(DOM_CLASSES:%=DOM%.h))
+
+all : $(OBJC_DOM_HEADERS)
 
-all : CharsetData.cpp WebCore.exp
+all : CharsetData.cpp WebCore.exp WebCore.LP64.exp
 
 # --------
 
@@ -716,19 +795,42 @@ CharsetData.cpp : platform/text/mac/make-charset-table.pl platform/text/mac/char
 
 # export file
 
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_MAC_JAVA_BRIDGE | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_MAC_JAVA_BRIDGE | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.JNI.exp
 endif
 
-# See also "Generate 64-bit Export File" build phase script in WebCore.xcodeproj/project.pbxproj
-ifeq ($(shell gcc -E -P -dM -F $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_NETSCAPE_PLUGIN_API | cut -d' ' -f3), 1)
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_NETSCAPE_PLUGIN_API | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.NPAPI.exp
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_PLUGIN_HOST_PROCESS | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.PluginHostProcess.exp
+endif
+
+ifeq ($(findstring ENABLE_3D_RENDERING,$(FEATURE_DEFINES)), ENABLE_3D_RENDERING)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.3DRendering.exp
+endif
+
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_CONTEXT_MENUS | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.ContextMenus.exp
+endif
+
 ifeq ($(ENABLE_DASHBOARD_SUPPORT), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.DashboardSupport.exp
 endif
 
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DRAG_SUPPORT | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.DragSupport.exp
+endif
+
+ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_INSPECTOR | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Inspector.exp
+endif
+
+ifeq ($(ENABLE_ORIENTATION_EVENTS), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.OrientationEvents.exp
+endif
+
 ifeq ($(findstring 10.4,$(MACOSX_DEPLOYMENT_TARGET)), 10.4)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Tiger.exp
 endif
@@ -737,18 +839,28 @@ ifeq ($(findstring ENABLE_PLUGIN_PROXY_FOR_VIDEO,$(FEATURE_DEFINES)), ENABLE_PLU
      WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.VideoProxy.exp
 endif
 
+ifeq ($(findstring ENABLE_VIDEO,$(FEATURE_DEFINES)), ENABLE_VIDEO)
+     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.Video.exp
+endif
+
 WebCore.exp : WebCore.base.exp $(WEBCORE_EXPORT_DEPENDENCIES)
 	cat $^ > $@
 
+# Switch NSRect, NSSize and NSPoint with their CG counterparts for 64-bit.
+WebCore.LP64.exp : WebCore.exp
+	cat $^ | sed -e s/7_NSRect/6CGRect/ -e s/7_NSSize/6CGSize/ -e s/8_NSPoint/7CGPoint/ > $@
+
 # --------
 
 # Objective-C bindings
 
 DOM%.h : %.idl $(GENERATE_BINDINGS_SCRIPTS) bindings/scripts/CodeGeneratorObjC.pm bindings/objc/PublicDOMInterfaces.h
-	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) LANGUAGE_OBJECTIVE_C" --generator ObjC $<
+	$(GENERATE_BINDINGS) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_OBJECTIVE_C" --generator ObjC $<
+
+-include $(OBJC_DOM_HEADERS:.h=.dep)
 
 # --------
 
-endif
+endif # MACOS
 
 # ------------------------
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index a1c9dd6..3e6db09 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/ForwardingHeaders/parser/Parser.h b/WebCore/ForwardingHeaders/parser/Parser.h
deleted file mode 100644
index 863df59..0000000
--- a/WebCore/ForwardingHeaders/parser/Parser.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Parser_h
-#define WebCore_FWD_Parser_h
-#include <JavaScriptCore/Parser.h>
-#endif
diff --git a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
deleted file mode 100644
index fcfe26d..0000000
--- a/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CollectorHeapIterator_h
-#define WebCore_FWD_CollectorHeapIterator_h
-#include <JavaScriptCore/CollectorHeapIterator.h>
-#endif
diff --git a/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h b/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
new file mode 100644
index 0000000..661c61a
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ExceptionHelpers_h
+#define WebCore_FWD_ExceptionHelpers_h
+#include <JavaScriptCore/ExceptionHelpers.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/PossiblyNull.h b/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
new file mode 100644
index 0000000..d52a4a0
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PossiblyNull_h
+#define WebCore_FWD_PossiblyNull_h
+#include <JavaScriptCore/PossiblyNull.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index 5cc1fd6..c4ab425 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -26,6 +26,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/loader/appcache \
 	-I$(srcdir)/WebCore/loader/archive \
 	-I$(srcdir)/WebCore/loader/icon \
+	-I$(srcdir)/WebCore/notifications \
 	-I$(srcdir)/WebCore/page \
 	-I$(srcdir)/WebCore/page/animation \
 	-I$(srcdir)/WebCore/platform \
@@ -40,6 +41,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/platform/image-decoders/jpeg \
 	-I$(srcdir)/WebCore/platform/image-decoders/png \
 	-I$(srcdir)/WebCore/platform/image-decoders/xbm \
+	-I$(srcdir)/WebCore/platform/mock \
 	-I$(srcdir)/WebCore/platform/network \
 	-I$(srcdir)/WebCore/platform/text \
 	-I$(srcdir)/WebCore/plugins \
@@ -72,16 +74,12 @@ webcore_built_sources += \
 	DerivedSources/CSSPropertyNames.h \
 	DerivedSources/CSSValueKeywords.h \
 	DerivedSources/HTMLElementFactory.cpp \
-	DerivedSources/HTMLElementFactory.h \
 	DerivedSources/HTMLEntityNames.c \
 	DerivedSources/HTMLNames.cpp \
-	DerivedSources/HTMLNames.h \
 	DerivedSources/JSHTMLElementWrapperFactory.cpp \
-	DerivedSources/JSHTMLElementWrapperFactory.h \
 	DerivedSources/UserAgentStyleSheets.h \
 	DerivedSources/UserAgentStyleSheetsData.cpp \
-	DerivedSources/XMLNames.cpp \
-	DerivedSources/XMLNames.h
+	DerivedSources/XMLNames.cpp
 
 IDL_BINDINGS += \
 	WebCore/css/CSSCharsetRule.idl \
@@ -111,6 +109,7 @@ IDL_BINDINGS += \
 	WebCore/css/WebKitCSSMatrix.idl \
 	WebCore/css/WebKitCSSTransformValue.idl \
 	WebCore/dom/Attr.idl \
+	WebCore/dom/BeforeLoadEvent.idl \
 	WebCore/dom/CDATASection.idl \
 	WebCore/dom/CharacterData.idl \
 	WebCore/dom/ClientRect.idl \
@@ -141,6 +140,7 @@ IDL_BINDINGS += \
 	WebCore/dom/NodeList.idl \
 	WebCore/dom/Notation.idl \
 	WebCore/dom/OverflowEvent.idl \
+	WebCore/dom/PageTransitionEvent.idl \
 	WebCore/dom/ProcessingInstruction.idl \
 	WebCore/dom/ProgressEvent.idl \
 	WebCore/dom/Range.idl \
@@ -152,9 +152,20 @@ IDL_BINDINGS += \
 	WebCore/dom/WebKitAnimationEvent.idl \
 	WebCore/dom/WebKitTransitionEvent.idl \
 	WebCore/dom/WheelEvent.idl \
+	WebCore/html/canvas/CanvasArray.idl \
+	WebCore/html/canvas/CanvasArrayBuffer.idl \
+	WebCore/html/canvas/CanvasByteArray.idl \
+	WebCore/html/canvas/CanvasFloatArray.idl \
 	WebCore/html/canvas/CanvasGradient.idl \
+	WebCore/html/canvas/CanvasIntArray.idl \
 	WebCore/html/canvas/CanvasPattern.idl \
+	WebCore/html/canvas/CanvasRenderingContext.idl \
 	WebCore/html/canvas/CanvasRenderingContext2D.idl \
+	WebCore/html/canvas/CanvasRenderingContext3D.idl \
+	WebCore/html/canvas/CanvasShortArray.idl \
+	WebCore/html/canvas/CanvasUnsignedByteArray.idl \
+	WebCore/html/canvas/CanvasUnsignedIntArray.idl \
+	WebCore/html/canvas/CanvasUnsignedShortArray.idl \
 	WebCore/html/DataGridColumn.idl \
 	WebCore/html/DataGridColumnList.idl \
 	WebCore/html/File.idl \
@@ -175,6 +186,7 @@ IDL_BINDINGS += \
 	WebCore/html/HTMLDataGridCellElement.idl \
 	WebCore/html/HTMLDataGridColElement.idl \
 	WebCore/html/HTMLDataGridRowElement.idl \
+	WebCore/html/HTMLDataListElement.idl \
 	WebCore/html/HTMLDListElement.idl \
 	WebCore/html/HTMLDirectoryElement.idl \
 	WebCore/html/HTMLDivElement.idl \
@@ -234,11 +246,14 @@ IDL_BINDINGS += \
 	WebCore/html/VoidCallback.idl \
 	WebCore/inspector/JavaScriptCallFrame.idl \
 	WebCore/inspector/InspectorBackend.idl \
+	WebCore/notifications/Notification.idl \
+	WebCore/notifications/NotificationCenter.idl \
 	WebCore/page/BarInfo.idl \
 	WebCore/page/Console.idl \
 	WebCore/page/Coordinates.idl \
 	WebCore/page/DOMSelection.idl \
 	WebCore/page/DOMWindow.idl \
+	WebCore/page/EventSource.idl \
 	WebCore/page/Geolocation.idl \
 	WebCore/page/Geoposition.idl \
 	WebCore/page/History.idl \
@@ -285,6 +300,8 @@ webcore_sources += \
 	WebCore/accessibility/AccessibilityListBox.h \
 	WebCore/accessibility/AccessibilityListBoxOption.cpp \
 	WebCore/accessibility/AccessibilityListBoxOption.h \
+	WebCore/accessibility/AccessibilityMediaControls.cpp \
+	WebCore/accessibility/AccessibilityMediaControls.h \
 	WebCore/accessibility/AccessibilityObject.cpp \
 	WebCore/accessibility/AccessibilityObject.h \
 	WebCore/accessibility/AccessibilityRenderObject.cpp \
@@ -311,9 +328,13 @@ webcore_sources += \
 	WebCore/bindings/js/JSDataGridDataSource.cpp \
 	WebCore/bindings/js/JSDataGridDataSource.h \
 	WebCore/bindings/js/JSCSSRuleCustom.cpp \
+	WebCore/bindings/js/JSCSSRuleListCustom.cpp \
 	WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp \
 	WebCore/bindings/js/JSCSSStyleDeclarationCustom.h \
 	WebCore/bindings/js/JSCSSValueCustom.cpp \
+	WebCore/bindings/js/JSCallbackData.cpp \
+	WebCore/bindings/js/JSCallbackData.h \
+	WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp \
 	WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp \
 	WebCore/bindings/js/JSClipboardCustom.cpp \
 	WebCore/bindings/js/JSConsoleCustom.cpp \
@@ -342,6 +363,9 @@ webcore_sources += \
 	WebCore/bindings/js/JSEventCustom.cpp \
 	WebCore/bindings/js/JSEventListener.cpp \
 	WebCore/bindings/js/JSEventListener.h \
+	WebCore/bindings/js/JSEventSourceConstructor.cpp \
+	WebCore/bindings/js/JSEventSourceConstructor.h \
+	WebCore/bindings/js/JSEventSourceCustom.cpp \
 	WebCore/bindings/js/JSEventTarget.cpp \
 	WebCore/bindings/js/JSEventTarget.h \
 	WebCore/bindings/js/JSGeolocationCustom.cpp \
@@ -349,6 +373,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSHTMLAllCollection.h \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLAppletElementCustom.h \
+	WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLCollectionCustom.cpp \
 	WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLDocumentCustom.cpp \
@@ -384,11 +409,11 @@ webcore_sources += \
 	WebCore/bindings/js/JSMessageChannelConstructor.cpp \
 	WebCore/bindings/js/JSMessageChannelConstructor.h \
 	WebCore/bindings/js/JSMessageChannelCustom.cpp \
+	WebCore/bindings/js/JSMessageEventCustom.cpp \
 	WebCore/bindings/js/JSMessagePortCustom.cpp \
+	WebCore/bindings/js/JSMessagePortCustom.h \
 	WebCore/bindings/js/JSMimeTypeArrayCustom.cpp \
 	WebCore/bindings/js/JSNamedNodeMapCustom.cpp \
-	WebCore/bindings/js/JSNamedNodesCollection.cpp \
-	WebCore/bindings/js/JSNamedNodesCollection.h \
 	WebCore/bindings/js/JSNavigatorCustom.cpp \
 	WebCore/bindings/js/JSNodeCustom.cpp \
 	WebCore/bindings/js/JSNodeFilterCondition.cpp \
@@ -448,6 +473,8 @@ webcore_sources += \
 	WebCore/bindings/js/ScriptString.h \
 	WebCore/bindings/js/ScriptValue.cpp \
 	WebCore/bindings/js/ScriptValue.h \
+	WebCore/bindings/js/SerializedScriptValue.cpp \
+	WebCore/bindings/js/SerializedScriptValue.h \
 	WebCore/bindings/js/StringSourceProvider.h \
 	WebCore/bridge/IdentifierRep.cpp \
 	WebCore/bridge/IdentifierRep.h \
@@ -654,7 +681,6 @@ webcore_sources += \
 	WebCore/dom/DOMCoreException.h \
 	WebCore/dom/DOMImplementation.cpp \
 	WebCore/dom/DOMImplementation.h \
-	WebCore/dom/DocPtr.h \
 	WebCore/dom/Document.cpp \
 	WebCore/dom/Document.h \
 	WebCore/dom/DocumentFragment.cpp \
@@ -735,6 +761,8 @@ webcore_sources += \
 	WebCore/dom/OptionElement.h \
 	WebCore/dom/OverflowEvent.cpp \
 	WebCore/dom/OverflowEvent.h \
+	WebCore/dom/PageTransitionEvent.cpp \
+	WebCore/dom/PageTransitionEvent.h \
 	WebCore/dom/Position.cpp \
 	WebCore/dom/Position.h \
 	WebCore/dom/PositionIterator.cpp \
@@ -908,6 +936,8 @@ webcore_sources += \
 	WebCore/html/canvas/CanvasPattern.h \
 	WebCore/html/canvas/CanvasPixelArray.cpp \
 	WebCore/html/canvas/CanvasPixelArray.h \
+	WebCore/html/canvas/CanvasRenderingContext.cpp \
+	WebCore/html/canvas/CanvasRenderingContext.h \
 	WebCore/html/canvas/CanvasRenderingContext2D.cpp \
 	WebCore/html/canvas/CanvasRenderingContext2D.h \
 	WebCore/html/canvas/CanvasStyle.cpp \
@@ -958,6 +988,8 @@ webcore_sources += \
 	WebCore/html/HTMLDataGridColElement.h \
 	WebCore/html/HTMLDataGridRowElement.cpp \
 	WebCore/html/HTMLDataGridRowElement.h \
+	WebCore/html/HTMLDataListElement.cpp \
+	WebCore/html/HTMLDataListElement.h \
 	WebCore/html/HTMLDListElement.cpp \
 	WebCore/html/HTMLDListElement.h \
 	WebCore/html/HTMLDirectoryElement.cpp \
@@ -1127,6 +1159,8 @@ webcore_sources += \
 	WebCore/icu/unicode/uversion.h \
 	WebCore/inspector/ConsoleMessage.cpp \
 	WebCore/inspector/ConsoleMessage.h \
+	WebCore/inspector/DOMDispatchTimelineItem.cpp \
+	WebCore/inspector/DOMDispatchTimelineItem.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1142,6 +1176,8 @@ webcore_sources += \
 	WebCore/inspector/InspectorFrontend.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
+	WebCore/inspector/InspectorTimelineAgent.cpp \
+	WebCore/inspector/InspectorTimelineAgent.h \
 	WebCore/inspector/JavaScriptCallFrame.cpp \
 	WebCore/inspector/JavaScriptCallFrame.h \
 	WebCore/inspector/JavaScriptDebugListener.h \
@@ -1151,6 +1187,8 @@ webcore_sources += \
 	WebCore/inspector/JavaScriptProfile.h \
 	WebCore/inspector/JavaScriptProfileNode.cpp \
 	WebCore/inspector/JavaScriptProfileNode.h \
+	WebCore/inspector/TimelineItem.cpp \
+	WebCore/inspector/TimelineItem.h \
 	WebCore/loader/Cache.cpp \
 	WebCore/loader/Cache.h \
 	WebCore/loader/CachePolicy.h \
@@ -1209,8 +1247,14 @@ webcore_sources += \
 	WebCore/loader/PlaceholderDocument.h \
 	WebCore/loader/PluginDocument.cpp \
 	WebCore/loader/PluginDocument.h \
+	WebCore/loader/PolicyCallback.cpp \
+	WebCore/loader/PolicyCallback.h \
+	WebCore/loader/PolicyChecker.cpp \
+	WebCore/loader/PolicyChecker.h \
 	WebCore/loader/ProgressTracker.cpp \
 	WebCore/loader/ProgressTracker.h \
+	WebCore/loader/RedirectScheduler.cpp \
+	WebCore/loader/RedirectScheduler.h \
 	WebCore/loader/Request.cpp \
 	WebCore/loader/Request.h \
 	WebCore/loader/ResourceLoader.cpp \
@@ -1253,7 +1297,6 @@ webcore_sources += \
 	WebCore/page/ContextMenuController.cpp \
 	WebCore/page/ContextMenuController.h \
 	WebCore/page/Coordinates.h \
-	WebCore/page/Coordinates.cpp \
 	WebCore/page/DOMSelection.cpp \
 	WebCore/page/DOMSelection.h \
 	WebCore/page/DOMTimer.cpp \
@@ -1267,6 +1310,8 @@ webcore_sources += \
 	WebCore/page/EditorClient.h \
 	WebCore/page/EventHandler.cpp \
 	WebCore/page/EventHandler.h \
+	WebCore/page/EventSource.cpp \
+	WebCore/page/EventSource.h \
 	WebCore/page/FocusController.cpp \
 	WebCore/page/FocusController.h \
 	WebCore/page/FocusDirection.h \
@@ -1279,8 +1324,8 @@ webcore_sources += \
 	WebCore/page/FrameView.h \
 	WebCore/page/Geolocation.cpp \
 	WebCore/page/Geolocation.h \
-	WebCore/page/Geoposition.cpp \
 	WebCore/page/Geoposition.h \
+	WebCore/page/HaltablePlugin.h \
 	WebCore/page/History.cpp \
 	WebCore/page/History.h \
 	WebCore/page/Location.cpp \
@@ -1291,12 +1336,17 @@ webcore_sources += \
 	WebCore/page/Navigator.h \
 	WebCore/page/NavigatorBase.cpp \
 	WebCore/page/NavigatorBase.h \
+	WebCore/page/OriginAccessEntry.cpp \
+	WebCore/page/OriginAccessEntry.h \
 	WebCore/page/Page.cpp \
 	WebCore/page/Page.h \
 	WebCore/page/PageGroup.cpp \
 	WebCore/page/PageGroup.h \
   WebCore/page/PageGroupLoadDeferrer.cpp \
   WebCore/page/PageGroupLoadDeferrer.h \
+	WebCore/page/PluginHalter.cpp \
+	WebCore/page/PluginHalter.h \
+	WebCore/page/PluginHalterClient.h \
 	WebCore/page/PositionCallback.h \
 	WebCore/page/PositionError.h \
 	WebCore/page/PositionErrorCallback.h \
@@ -1310,6 +1360,12 @@ webcore_sources += \
 	WebCore/page/SecurityOriginHash.h \
 	WebCore/page/Settings.cpp \
 	WebCore/page/Settings.h \
+	WebCore/page/UserContentURLPattern.cpp \
+	WebCore/page/UserContentURLPattern.h \
+	WebCore/page/UserScript.h \
+	WebCore/page/UserScriptTypes.h \
+	WebCore/page/UserStyleSheet.h \
+	WebCore/page/UserStyleSheetTypes.h \
 	WebCore/page/WebKitPoint.h \
 	WebCore/page/WindowFeatures.cpp \
 	WebCore/page/WindowFeatures.h \
@@ -1334,6 +1390,7 @@ webcore_sources += \
 	WebCore/platform/ContextMenu.cpp \
 	WebCore/platform/ContextMenu.h \
 	WebCore/platform/ContextMenuItem.h \
+	WebCore/platform/Cookie.h \
 	WebCore/platform/CookieJar.h \
 	WebCore/platform/CrossThreadCopier.cpp \
 	WebCore/platform/CrossThreadCopier.h \
@@ -1369,6 +1426,8 @@ webcore_sources += \
 	WebCore/platform/Logging.h \
 	WebCore/platform/MIMETypeRegistry.cpp \
 	WebCore/platform/MIMETypeRegistry.h \
+	WebCore/platform/mock/GeolocationServiceMock.cpp \
+	WebCore/platform/mock/GeolocationServiceMock.h \
 	WebCore/platform/NotImplemented.h \
 	WebCore/platform/Pasteboard.h \
 	WebCore/platform/PlatformKeyboardEvent.h \
@@ -1444,6 +1503,7 @@ webcore_sources += \
 	WebCore/platform/graphics/FontFastPath.cpp \
 	WebCore/platform/graphics/FontRenderingMode.h \
 	WebCore/platform/graphics/FontSelector.h \
+	WebCore/platform/graphics/FontSmoothingMode.h \
 	WebCore/platform/graphics/FontTraitsMask.h \
 	WebCore/platform/graphics/GeneratedImage.cpp \
 	WebCore/platform/graphics/GeneratedImage.h \
@@ -1466,6 +1526,7 @@ webcore_sources += \
 	WebCore/platform/graphics/ImageBuffer.cpp \
 	WebCore/platform/graphics/ImageBuffer.h \
 	WebCore/platform/graphics/ImageObserver.h \
+	WebCore/platform/graphics/ImageSource.cpp \
 	WebCore/platform/graphics/ImageSource.h \
 	WebCore/platform/graphics/IntPoint.h \
 	WebCore/platform/graphics/IntRect.cpp \
@@ -1602,6 +1663,7 @@ webcore_sources += \
 	WebCore/plugins/PluginData.h \
 	WebCore/plugins/PluginDatabase.cpp \
 	WebCore/plugins/PluginDatabase.h \
+	WebCore/plugins/PluginDatabaseClient.h \
 	WebCore/plugins/PluginDebug.cpp \
 	WebCore/plugins/PluginDebug.h \
 	WebCore/plugins/PluginInfoStore.cpp \
@@ -1696,6 +1758,7 @@ webcore_sources += \
 	WebCore/rendering/RenderObject.h \
 	WebCore/rendering/RenderObjectChildList.cpp \
 	WebCore/rendering/RenderObjectChildList.h \
+	WebCore/rendering/RenderOverflow.h \
 	WebCore/rendering/RenderPart.cpp \
 	WebCore/rendering/RenderPart.h \
 	WebCore/rendering/RenderPartObject.cpp \
@@ -1743,6 +1806,7 @@ webcore_sources += \
 	WebCore/rendering/RenderView.h \
 	WebCore/rendering/RenderWidget.cpp \
 	WebCore/rendering/RenderWidget.h \
+	WebCore/rendering/RenderWidgetProtector.h \
 	WebCore/rendering/RenderWordBreak.cpp \
 	WebCore/rendering/RenderWordBreak.h \
 	WebCore/rendering/RootInlineBox.cpp \
@@ -1857,7 +1921,6 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
 	WebCore/platform/graphics/cairo/ImageBufferData.h \
 	WebCore/platform/graphics/cairo/ImageCairo.cpp \
-	WebCore/platform/graphics/cairo/ImageSourceCairo.cpp \
 	WebCore/platform/graphics/cairo/PathCairo.cpp \
 	WebCore/platform/graphics/cairo/PatternCairo.cpp \
 	WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
@@ -1911,6 +1974,7 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/gtk2drawing.c \
 	WebCore/platform/gtk/gtkdrawing.h \
 	WebCore/platform/image-decoders/ImageDecoder.h \
+	WebCore/platform/image-decoders/ImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
 	WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
@@ -1935,6 +1999,7 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/ResourceError.h \
 	WebCore/platform/network/soup/ResourceHandleSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequestSoup.cpp \
+	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
 	WebCore/platform/network/soup/ResourceResponse.h \
 	WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp
@@ -2111,6 +2176,10 @@ webcore_sources += \
 	WebCore/storage/SQLTransaction.cpp \
 	WebCore/storage/SQLTransaction.h \
 	WebCore/storage/SQLTransactionCallback.h \
+	WebCore/storage/SQLTransactionClient.cpp \
+	WebCore/storage/SQLTransactionClient.h \
+	WebCore/storage/SQLTransactionCoordinator.h \
+	WebCore/storage/SQLTransactionCoordinator.cpp \
 	WebCore/storage/SQLTransactionErrorCallback.h
 
 else
@@ -2119,6 +2188,31 @@ webcore_cppflags += -DENABLE_DATABASE=0
 endif # END ENABLE_DATABASE
 
 # ----
+# HTML5 datalist Support
+# ----
+if ENABLE_DATALIST
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATALIST=1
+HTML_FEATURES += ENABLE_DATALIST=1
+
+webcore_cppflags += -DENABLE_DATALIST=1
+
+endif # END ENABLE_DATALIST
+
+# ----
+# HTML5 server-sent events
+# ----
+if !ENABLE_EVENTSOURCE
+global_cppflags += -DENABLE_EVENTSOURCE=0
+endif
+
+if ENABLE_EVENTSOURCE
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+
+webcore_cppflags += \
+	-DENABLE_EVENTSOURCE=1
+endif # ENABLE_EVENTSOURCE
+
+# ----
 # HTML5 client-side session and persistent storage
 # ----
 if ENABLE_DOM_STORAGE
@@ -2146,6 +2240,7 @@ webcore_sources += \
 	WebCore/storage/StorageAreaSync.cpp \
 	WebCore/storage/StorageAreaSync.h \
 	WebCore/storage/StorageEvent.cpp \
+	WebCore/storage/StorageEventDispatcher.cpp \
 	WebCore/storage/StorageEvent.h \
 	WebCore/storage/StorageMap.cpp \
 	WebCore/storage/StorageMap.h \
@@ -2181,6 +2276,17 @@ webcore_cppflags += -DENABLE_ICONDATABASE=0
 endif # END ENABLE_ICONDATABASE
 
 # ----
+# Orientation Events
+# ----
+if ENABLE_ORIENTATION_EVENTS
+
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+
+webcore_cppflags += -DENABLE_ORIENTATION_EVENTS=1
+
+endif # END ENABLE_ORIENTATION_EVENTS
+
+# ----
 # Video Support
 # ----
 if ENABLE_VIDEO
@@ -2221,11 +2327,14 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp \
 	WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h \
 	WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp \
-	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h
+	WebCore/platform/graphics/gtk/VideoSinkGStreamer.h \
+	WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp \
+	WebCore/platform/graphics/gtk/DataSourceGstreamer.h
 
 webcore_libadd += \
 	-lgstinterfaces-0.10 \
-	-lgstvideo-0.10
+	-lgstvideo-0.10 \
+	-lgstpbutils-0.10
 
 endif # END ENABLE_VIDEO
 
@@ -2318,13 +2427,16 @@ FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
 webcore_cppflags += -DENABLE_XSLT=1
 
 webcore_sources += \
+	WebCore/dom/TransformSourceLibxslt.cpp \
+	WebCore/dom/TransformSource.h \
 	WebCore/xml/XSLImportRule.cpp \
 	WebCore/xml/XSLImportRule.h \
-	WebCore/xml/XSLStyleSheet.cpp \
+	WebCore/xml/XSLStyleSheetLibxslt.cpp \
 	WebCore/xml/XSLStyleSheet.h \
 	WebCore/xml/XSLTExtensions.cpp \
 	WebCore/xml/XSLTExtensions.h \
 	WebCore/xml/XSLTProcessor.cpp \
+	WebCore/xml/XSLTProcessorLibxslt.cpp \
 	WebCore/xml/XSLTProcessor.h \
 	WebCore/xml/XSLTUnicodeSort.cpp \
 	WebCore/xml/XSLTUnicodeSort.h
@@ -2370,6 +2482,7 @@ webcore_sources += \
 	WebCore/workers/WorkerMessagingProxy.cpp \
 	WebCore/workers/WorkerMessagingProxy.h \
 	WebCore/workers/WorkerObjectProxy.h \
+	WebCore/workers/WorkerReportingProxy.h \
 	WebCore/workers/WorkerRunLoop.cpp \
 	WebCore/workers/WorkerRunLoop.h \
 	WebCore/workers/WorkerScriptLoader.cpp \
@@ -2391,7 +2504,6 @@ webcore_cppflags += \
 webcore_built_sources += \
 	WebCore/bindings/js/JSSharedWorkerConstructor.cpp \
 	WebCore/bindings/js/JSSharedWorkerConstructor.h \
-	WebCore/bindings/js/JSSharedWorkerContextCustom.cpp \
 	WebCore/bindings/js/JSSharedWorkerCustom.cpp \
 	WebCore/workers/DefaultSharedWorkerRepository.cpp \
 	WebCore/workers/DefaultSharedWorkerRepository.h \
@@ -2461,7 +2573,7 @@ webcore_sources += \
 DerivedSources/WMLNames.cpp: DerivedSources/WMLElementFactory.cpp;
 
 DerivedSources/WMLElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/wml/WMLTagNames.in $(WebCore)/wml/WMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 endif # END ENABLE_WML
 
 # ----
@@ -2509,6 +2621,24 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/GeolocationServiceGtk.h
 endif # END ENABLE_GEOLOCATION
 
+# ----
+# Notifications support
+# ----
+if ENABLE_NOTIFICATIONS
+FEATURE_DEFINES_JAVASCRIPT += ENABLE_NOTIFICATIONS=1
+
+webcore_cppflags += \
+	-DENABLE_NOTIFICATIONS=1
+
+webcore_sources += \
+	WebCore/notifications/Notification.cpp \
+	WebCore/notifications/Notification.h \
+	WebCore/notifications/NotificationCenter.cpp \
+	WebCore/notifications/NotificationCenter.h \
+	WebCore/notifications/NotificationPresenter.h \
+	WebCore/notifications/NotificationContents.h
+
+endif # END ENABLE_NOTIFICATIONS
 
 # ----
 # SVG Support
@@ -2555,7 +2685,6 @@ IDL_BINDINGS += \
 	WebCore/svg/SVGColor.idl \
 	WebCore/svg/SVGComponentTransferFunctionElement.idl \
 	WebCore/svg/SVGCursorElement.idl \
-	WebCore/svg/SVGDefinitionSrcElement.idl \
 	WebCore/svg/SVGDefsElement.idl \
 	WebCore/svg/SVGDescElement.idl \
 	WebCore/svg/SVGDocument.idl \
@@ -2782,8 +2911,6 @@ webcore_sources += \
 	WebCore/svg/SVGComponentTransferFunctionElement.h \
 	WebCore/svg/SVGCursorElement.cpp \
 	WebCore/svg/SVGCursorElement.h \
-	WebCore/svg/SVGDefinitionSrcElement.cpp \
-	WebCore/svg/SVGDefinitionSrcElement.h \
 	WebCore/svg/SVGDefsElement.cpp \
 	WebCore/svg/SVGDefsElement.h \
 	WebCore/svg/SVGDescElement.cpp \
@@ -3121,10 +3248,10 @@ DerivedSources/JSSVGElementWrapperFactory.cpp: DerivedSources/SVGElementFactory.
 
 if SVG_FLAGS
 DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 else
 DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 
 endif # SVG_FLAGS
 
@@ -3133,7 +3260,7 @@ endif # SVG_FLAGS
 DerivedSources/XLinkNames.h: DerivedSources/XLinkNames.cpp;
 
 DerivedSources/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/svg/xlinkattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES)"
 
 endif # END ENABLE_SVG
 
@@ -3154,8 +3281,23 @@ webcore_sources += \
 	WebCore/bindings/js/JSWebSocketConstructor.cpp \
 	WebCore/bindings/js/JSWebSocketConstructor.h \
 	WebCore/bindings/js/JSWebSocketCustom.cpp \
+	WebCore/platform/network/SocketStreamErrorBase.cpp \
+	WebCore/platform/network/SocketStreamErrorBase.h \
+	WebCore/platform/network/SocketStreamHandleBase.cpp \
+	WebCore/platform/network/SocketStreamHandleBase.h \
+	WebCore/platform/network/SocketStreamHandleClient.h \
 	WebCore/websockets/WebSocket.cpp \
-	WebCore/websockets/WebSocket.h
+	WebCore/websockets/WebSocket.h \
+	WebCore/websockets/WebSocketChannel.cpp \
+	WebCore/websockets/WebSocketChannel.h \
+	WebCore/websockets/WebSocketChannelClient.h \
+	WebCore/websockets/WebSocketHandshake.cpp \
+	WebCore/websockets/WebSocketHandshake.h
+
+webcoregtk_sources += \
+	WebCore/platform/network/soup/SocketStreamError.h \
+	WebCore/platform/network/soup/SocketStreamHandle.h \
+	WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
 
 else
 webcore_cppflags += -DENABLE_WEB_SOCKETS=0
@@ -3177,20 +3319,20 @@ DerivedSources/CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) $(WebCore)/css
 
 # DOCTYPE strings
 DerivedSources/DocTypeStrings.cpp : $(WebCore)/html/DocTypeStrings.gperf
-	$(GPERF) -CEot -L ANSI-C -k "*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards $(WebCore)/html/DocTypeStrings.gperf > $@
+	$(AM_V_GEN)$(GPERF) -CEot -L ANSI-C -k "*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards $(WebCore)/html/DocTypeStrings.gperf > $@
 
 # HTML entity names
 DerivedSources/HTMLEntityNames.c : $(WebCore)/html/HTMLEntityNames.gperf
-	$(GPERF) -a -L ANSI-C -C -G -c -o -t -k '*' -N findEntity -D -s 2 \
+	$(AM_V_GEN)$(GPERF) -a -L ANSI-C -C -G -c -o -t -k '*' -N findEntity -D -s 2 \
 	$(WebCore)/html/HTMLEntityNames.gperf > $@
 
 # color names
 DerivedSources/ColorData.c: $(WebCore)/platform/ColorData.gperf
-	$(GPERF) -CDEot -L ANSI-C -k '*' -N findColor -D -s 2 $< > $@
+	$(AM_V_GEN)$(GPERF) -CDEot -L ANSI-C -k '*' -N findColor -D -s 2 $< > $@
 
 # CSS tokenizer
 DerivedSources/tokenizer.cpp : $(WebCore)/css/tokenizer.flex $(WebCore)/css/maketokenizer
-	$(FLEX) -t $< | $(PERL) $(WebCore)/css/maketokenizer > $@
+	$(AM_V_GEN)$(FLEX) -t $< | $(PERL) $(WebCore)/css/maketokenizer > $@
 
 # CSS grammar
 
@@ -3227,27 +3369,21 @@ SCRIPTS_BINDINGS = \
 DerivedSources/UserAgentStyleSheetsData.cpp: DerivedSources/UserAgentStyleSheets.h;
 
 DerivedSources/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
-	$(PERL) $< $@ DerivedSources/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
+	$(AM_V_GEN)$(PERL) $< $@ DerivedSources/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
 
 # HTML tag and attribute names
-DerivedSources/HTMLElementFactory.cpp: DerivedSources/HTMLNames.cpp;
-DerivedSources/HTMLElementFactory.h: DerivedSources/HTMLElementFactory.cpp;
-DerivedSources/HTMLNames.h: DerivedSources/HTMLNames.cpp;
-DerivedSources/JSHTMLElementWrapperFactory.cpp: DerivedSources/HTMLNames.cpp;
-DerivedSources/JSHTMLElementWrapperFactory.h: DerivedSources/JSHTMLElementWrapperFactory.cpp;
-
 if HTML_FLAGS
-DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 else
-DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
 endif # HTML_FLAGS
 
-DerivedSources/XMLNames.h: DerivedSources/XMLNames.cpp;
+DerivedSources/JSHTMLElementWrapperFactory.cpp: DerivedSources/HTMLNames.cpp;
 
 DerivedSources/XMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
-	$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES)"
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES)"
 
 IDL_PATH := \
     $(WebCore)/bindings/js \
@@ -3257,6 +3393,7 @@ IDL_PATH := \
     $(WebCore)/html/canvas \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
+    $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/storage \
     $(WebCore)/svg \
@@ -3271,7 +3408,7 @@ DerivedSources/JS%.h: DerivedSources/JS%.cpp;
 
 .SECONDARY:
 DerivedSources/JS%.cpp: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm
-	$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES)" --defines "$(FEATURE_DEFINES_JAVASCRIPT)" --generator JS $<
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES)" --defines "$(FEATURE_DEFINES_JAVASCRIPT)" --generator JS $<
 
 IDL_BINDINGS_JS_PURE := \
 	WebCore/svg/ElementTimeControl.idl \
@@ -3381,4 +3518,3 @@ dist_webresources_DATA = \
 
 CLEANFILES += \
 	libWebCoreJS.la
-
diff --git a/WebCore/WebCore.3DRendering.exp b/WebCore/WebCore.3DRendering.exp
new file mode 100644
index 0000000..4a84c63
--- /dev/null
+++ b/WebCore/WebCore.3DRendering.exp
@@ -0,0 +1 @@
+_WebCoreHas3DRendering
diff --git a/WebCore/WebCore.ContextMenus.exp b/WebCore/WebCore.ContextMenus.exp
new file mode 100644
index 0000000..62b2c1f
--- /dev/null
+++ b/WebCore/WebCore.ContextMenus.exp
@@ -0,0 +1,5 @@
+__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
+__ZN7WebCore12EventHandler20sendContextMenuEventEP7NSEvent
+__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
+__ZN7WebCore21ContextMenuController16clearContextMenuEv
+__ZNK7WebCore11ContextMenu19platformDescriptionEv
diff --git a/WebCore/WebCore.DragSupport.exp b/WebCore/WebCore.DragSupport.exp
new file mode 100644
index 0000000..2cfd076
--- /dev/null
+++ b/WebCore/WebCore.DragSupport.exp
@@ -0,0 +1,10 @@
+__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
+__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
+__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
+__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
+__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
+__ZN7WebCore14DragController11performDragEPNS_8DragDataE
+__ZN7WebCore14DragController14placeDragCaretERKNS_8IntPointE
+__ZN7WebCore14DragController9dragEndedEv
+__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
diff --git a/WebCore/WebCore.Inspector.exp b/WebCore/WebCore.Inspector.exp
new file mode 100644
index 0000000..576994f
--- /dev/null
+++ b/WebCore/WebCore.Inspector.exp
@@ -0,0 +1,18 @@
+__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
+__ZN7WebCore19InspectorController12attachWindowEv
+__ZN7WebCore19InspectorController12detachWindowEv
+__ZN7WebCore19InspectorController14enableDebuggerEv
+__ZN7WebCore19InspectorController14enableProfilerEbb
+__ZN7WebCore19InspectorController15disableDebuggerEb
+__ZN7WebCore19InspectorController15disableProfilerEb
+__ZN7WebCore19InspectorController16setWindowVisibleEbb
+__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
+__ZN7WebCore19InspectorController4showEv
+__ZN7WebCore19InspectorController5closeEv
+__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
+__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
+__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
+__ZNK7WebCore19InspectorController7enabledEv
+__ZNK7WebCore19InspectorController7settingERKNS_6StringE
diff --git a/WebCore/WebCore.OrientationEvents.exp b/WebCore/WebCore.OrientationEvents.exp
new file mode 100644
index 0000000..ec0978d
--- /dev/null
+++ b/WebCore/WebCore.OrientationEvents.exp
@@ -0,0 +1 @@
+__ZN7WebCore5Frame26sendOrientationChangeEventEi
diff --git a/WebCore/WebCore.LP64.exp b/WebCore/WebCore.PluginHostProcess.exp
index cc04718..cce951f 100644
--- a/WebCore/WebCore.LP64.exp
+++ b/WebCore/WebCore.PluginHostProcess.exp
@@ -1,4 +1,4 @@
-# This file gets appended to WebCore.exp, only for 64-bit architectures.
+# This file gets appended to WebCore.exp when USE(PLUGIN_HOST_PROCESS) is 1.
 
 __ZN3JSC16RuntimeObjectImp6s_infoE
 __ZN3JSC8Bindings10RootObjectD1Ev
diff --git a/WebCore/WebCore.Video.exp b/WebCore/WebCore.Video.exp
new file mode 100644
index 0000000..596fb4b
--- /dev/null
+++ b/WebCore/WebCore.Video.exp
@@ -0,0 +1,12 @@
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore16HTMLMediaElement6rewindEf
+__ZN7WebCore16HTMLMediaElement10screenRectEv
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement13platformMediaEv
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement14exitFullscreenEv
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index aac7c80..51d8ca0 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -133,6 +133,7 @@ __Z4coreP19DOMDocumentFragment
 __Z4coreP22DOMCSSStyleDeclaration
 __Z4coreP7DOMNode
 __Z4coreP8DOMRange
+__ZN3JSC8Bindings8Instance16newRuntimeObjectEPNS_9ExecStateE
 __ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
@@ -146,7 +147,6 @@ __ZN7WebCore10handCursorEv
 __ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
 __ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
 __ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
-__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
 __ZN7WebCore11EditCommand7reapplyEv
 __ZN7WebCore11EditCommand7unapplyEv
 __ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
@@ -155,7 +155,6 @@ __ZN7WebCore11FileChooserD1Ev
 __ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
 __ZN7WebCore11FrameLoader11loadArchiveEN3WTF10PassRefPtrINS_7ArchiveEEE
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
-__ZN7WebCore11FrameLoader11stopLoadingEbNS_14DatabasePolicyE
 __ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
 __ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
 __ZN7WebCore11FrameLoader14detachChildrenEv
@@ -165,8 +164,6 @@ __ZN7WebCore11FrameLoader16detachFromParentEv
 __ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
 __ZN7WebCore11FrameLoader17stopForUserCancelEb
 __ZN7WebCore11FrameLoader18currentHistoryItemEv
-__ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
-__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
 __ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
 __ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
@@ -180,7 +177,6 @@ __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_6StringEb
 __ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
 __ZN7WebCore11FrameLoader6reloadEb
 __ZN7WebCore11FrameLoader7addDataEPKci
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
 __ZN7WebCore11Geolocation12setIsAllowedEb
 __ZN7WebCore11HistoryItem10targetItemEv
 __ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
@@ -224,12 +220,8 @@ __ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
 __ZN7WebCore12EventHandler14currentNSEventEv
 __ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
 __ZN7WebCore12EventHandler15sendScrollEventEv
-__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler17eventMayStartDragEP7NSEvent
 __ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
 __ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbbNS_17HitTestScrollbarsE
-__ZN7WebCore12EventHandler20sendContextMenuEventEP7NSEvent
 __ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler8keyEventEP7NSEvent
@@ -270,6 +262,7 @@ __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
 __ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore12WorkerThread17workerThreadCountEv
 __ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
 __ZN7WebCore12cacheStorageEv
 __ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
@@ -301,18 +294,18 @@ __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
 __ZN7WebCore14DocumentLoaderD2Ev
-__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
-__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
-__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
-__ZN7WebCore14DragController11performDragEPNS_8DragDataE
-__ZN7WebCore14DragController14placeDragCaretERKNS_8IntPointE
-__ZN7WebCore14DragController9dragEndedEv
 __ZN7WebCore14ResourceHandle12releaseProxyEv
 __ZN7WebCore14ResourceHandle20forceContentSniffingEv
 __ZN7WebCore14ResourceLoader14cancelledErrorEv
 __ZN7WebCore14ResourceLoader19setShouldBufferDataEb
+__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
+__ZN7WebCore14SecurityOrigin18setLocalLoadPolicyENS0_15LocalLoadPolicyE
+__ZN7WebCore14SecurityOrigin18shouldHideReferrerERKNS_4KURLERKNS_6StringE
 __ZN7WebCore14SecurityOrigin24registerURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCore14SecurityOrigin25whiteListAccessFromOriginERKS0_RKNS_6StringES5_b
+__ZN7WebCore14SecurityOrigin27resetOriginAccessWhiteListsEv
 __ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
+__ZN7WebCore14SecurityOrigin7canLoadERKNS_4KURLERKNS_6StringEPNS_8DocumentE
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15BackForwardList10removeItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList10setEnabledEb
@@ -337,7 +330,6 @@ __ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
 __ZN7WebCore15BackForwardList9goForwardEv
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
 __ZN7WebCore15BackForwardListD1Ev
-__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKNS_6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -393,28 +385,18 @@ __ZN7WebCore16createFullMarkupEPKNS_5RangeE
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore16threadGlobalDataEv
+__ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
 __ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
 __ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZN7WebCore17HTMLPlugInElement11getNPObjectEv
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
 __ZN7WebCore18deprecatedParseURLERKNS_6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
 __ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
 __ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
-__ZN7WebCore19InspectorController10setSettingERKNS_6StringERKNS0_7SettingE
-__ZN7WebCore19InspectorController12attachWindowEv
-__ZN7WebCore19InspectorController12detachWindowEv
-__ZN7WebCore19InspectorController14enableDebuggerEv
-__ZN7WebCore19InspectorController14enableProfilerEbb
-__ZN7WebCore19InspectorController15disableDebuggerEb
-__ZN7WebCore19InspectorController15disableProfilerEb
-__ZN7WebCore19InspectorController16setWindowVisibleEbb
-__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
-__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
-__ZN7WebCore19InspectorController4showEv
-__ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
 __ZN7WebCore19SelectionController10setFocusedEb
 __ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
 __ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
@@ -429,7 +411,6 @@ __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
 __ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
 __ZN7WebCore20ResourceResponseBaseC2Ev
-__ZN7WebCore21ContextMenuController16clearContextMenuEv
 __ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
 __ZN7WebCore21JavaScriptDebugServer6sharedEv
 __ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
@@ -438,13 +419,15 @@ __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCore22GeolocationServiceMock11setPositionEN3WTF10PassRefPtrINS_11GeopositionEEE
+__ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErrorEEE
 __ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
 __ZN7WebCore22applicationIsAppleMailEv
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
 __ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
-__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore23ApplicationCacheStorage16storeCopyOfCacheERKNS_6StringEPNS_20ApplicationCacheHostE
+__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ApplicationCacheStorage5emptyEv
 __ZN7WebCore23ApplicationCacheStorage14setMaximumSizeEx
@@ -452,7 +435,6 @@ __ZN7WebCore23ApplicationCacheStorage18vacuumDatabaseFileEv
 __ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
-__ZN7WebCore24WebCoreCredentialStorage9m_storageE
 __ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
 __ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
 __ZN7WebCore24notifyHistoryItemChangedE
@@ -477,6 +459,7 @@ __ZN7WebCore31applicationIsMicrosoftMessengerEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
+__ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore4Font11setCodePathENS0_8CodePathE
 __ZN7WebCore4Font18shouldUseSmoothingEv
@@ -486,8 +469,8 @@ __ZN7WebCore4FontC1Ev
 __ZN7WebCore4FontD1Ev
 __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore4KURL10invalidateEv
+__ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKNS_6StringE
 __ZN7WebCore4KURLC1EP5NSURL
-__ZN7WebCore4KURLC1ERKNS_6StringE
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
@@ -508,13 +491,14 @@ __ZN7WebCore4Page6goBackEv
 __ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
 __ZN7WebCore4Page9goForwardEv
 __ZN7WebCore4Page9initGroupEv
-__ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientEPNS_18PluginHalterClientE
 __ZN7WebCore4PageD1Ev
+__ZN7WebCore4coreEP20NSURLProtectionSpace
 __ZN7WebCore5Cache11setDisabledEb
 __ZN7WebCore5Cache13getStatisticsEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
-__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore5Frame11shouldCloseEv
 __ZN7WebCore5Frame13reapplyStylesEv
 __ZN7WebCore5Frame13setZoomFactorEfb
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
@@ -620,7 +604,6 @@ __ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document24setShouldCreateRenderersEb
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
 __ZN7WebCore8Document4headEv
-__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
 __ZN7WebCore8FormDataD1Ev
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
@@ -657,6 +640,7 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
 __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
+__ZN7WebCore8Settings15setWebGLEnabledEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings27setLoadsImagesAutomaticallyEb
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
@@ -666,10 +650,12 @@ __ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings32setAcceleratedCompositingEnabledEb
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
+__ZN7WebCore8Settings32setExperimentalWebSocketsEnabledEb
 __ZN7WebCore8Settings33setDownloadableBinaryFontsEnabledEb
 __ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore8Settings34setLocalFileContentSniffingEnabledEb
 __ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
+__ZN7WebCore8Settings35setExperimentalNotificationsEnabledEb
 __ZN7WebCore8Settings35setTreatsAnyTextCSSLinkAsStylesheetEb
 __ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
@@ -677,7 +663,6 @@ __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirecti
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
 __ZN7WebCore8blankURLEv
 __ZN7WebCore8makeRGBAEiiii
-__ZN7WebCore9DOMWindow16hasEventListenerERKNS_12AtomicStringE
 __ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
 __ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore9FloatRectC1ERK7_NSRect
@@ -690,20 +675,21 @@ __ZN7WebCore9FrameTree9clearNameEv
 __ZN7WebCore9FrameView11forceLayoutEb
 __ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
 __ZN7WebCore9FrameView14adjustViewSizeEv
-__ZN7WebCore9FrameView14initScrollbarsEv
 __ZN7WebCore9FrameView14setMarginWidthEi
 __ZN7WebCore9FrameView14setNeedsLayoutEv
 __ZN7WebCore9FrameView14setTransparentEb
 __ZN7WebCore9FrameView15setMarginHeightEi
 __ZN7WebCore9FrameView16adjustPageHeightEPffff
 __ZN7WebCore9FrameView18updateControlTintsEv
+__ZN7WebCore9FrameView21flushDeferredRepaintsEv
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
 __ZN7WebCore9FrameView23layoutIfNeededRecursiveEv
-__ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
 __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
+__ZN7WebCore9FrameView29syncCompositingStateRecursiveEv
 __ZN7WebCore9FrameView6createEPNS_5FrameE
 __ZN7WebCore9FrameView6createEPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore9FrameView21scrollPositionChangedEv
 __ZN7WebCore9HTMLNames10listingTagE
 __ZN7WebCore9HTMLNames11textareaTagE
 __ZN7WebCore9HTMLNames13blockquoteTagE
@@ -735,14 +721,21 @@ __ZN7WebCore9HTMLNames7srcAttrE
 __ZN7WebCore9HTMLNames8frameTagE
 __ZN7WebCore9HTMLNames8hrefAttrE
 __ZN7WebCore9HTMLNames8inputTagE
+__ZN7WebCore9HTMLNames8videoTagE
 __ZN7WebCore9HTMLNames9iframeTagE
 __ZN7WebCore9HTMLNames9scriptTagE
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore9PageGroup17addUserStyleSheetERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_j
+__ZN7WebCore9PageGroup13addUserScriptERKNS_6StringERKNS_4KURLEN3WTF10PassOwnPtrINS7_6VectorIS1_Lm0EEEEESB_jNS_23UserScriptInjectionTimeE
 __ZN7WebCore9PageGroup14addVisitedLinkEPKtm
 __ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup20removeAllUserContentEv
 __ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore9PageGroup32removeUserContentWithURLForWorldERKNS_4KURLEj
+__ZN7WebCore9PageGroup25removeUserContentForWorldEj
 __ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase5startEdd
 __ZN7WebCore9TimerBaseC2Ev
@@ -764,7 +757,6 @@ __ZNK7WebCore10ScrollView12documentViewEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
 __ZNK7WebCore10ScrollView18visibleContentRectEb
 __ZNK7WebCore11CachedImage5imageEv
-__ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZNK7WebCore11FrameLoader10isCompleteEv
 __ZNK7WebCore11FrameLoader14frameHasLoadedEv
 __ZNK7WebCore11FrameLoader15containsPluginsEv
@@ -854,9 +846,6 @@ __ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
 __ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
 __ZNK7WebCore17ResourceErrorBase8lazyInitEv
 __ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
-__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
-__ZNK7WebCore19InspectorController7enabledEv
-__ZNK7WebCore19InspectorController7settingERKNS_6StringE
 __ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase3urlEv
 __ZNK7WebCore19ResourceRequestBase7isEmptyEv
@@ -983,6 +972,10 @@ __ZTVN7WebCore12ChromeClientE
 __ZTVN7WebCore17FileChooserClientE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
+__ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
+__ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
+__ZN7WebCore8Settings23setPluginAllowedRunTimeEj
+__ZN7WebCore8Settings22setPluginHalterEnabledEb
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
 _hasCaseInsensitiveSuffix
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
new file mode 100644
index 0000000..4a0c540
--- /dev/null
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -0,0 +1,793 @@
+#
+# Copyright (C) 2009 Google Inc. All rights reserved.
+# 
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+# 
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+# 
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+
+{
+  'includes': [
+    # FIXME: Sense whether upstream or downstream build, and
+    # include the right features.gypi
+    '../../WebKit/chromium/features.gypi',
+    '../WebCore.gypi',
+  ],
+  # Location of the chromium src directory.
+  'conditions': [
+    ['inside_chromium_build==0', {
+      # Webkit is being built outside of the full chromium project.
+      'variables': {'chromium_src_dir': '../../WebKit/chromium'},
+    },{
+      # WebKit is checked out in src/chromium/third_party/WebKit
+      'variables': {'chromium_src_dir': '../../../..'},
+    }],
+  ],  
+
+  'variables': {
+    # If set to 1, doesn't compile debug symbols into webcore reducing the
+    # size of the binary and increasing the speed of gdb.  gcc only.
+    'remove_webcore_debug_symbols%': 0,
+  
+    'webcore_include_dirs': [
+      '../',
+      '../accessibility',
+      '../accessibility/chromium',
+      '../bindings/v8',
+      '../bindings/v8/custom',
+      '../bridge',
+      '../css',
+      '../dom',
+      '../dom/default',
+      '../editing',
+      '../history',
+      '../html',
+      '../html/canvas',
+      '../inspector',
+      '../loader',
+      '../loader/appcache',
+      '../loader/archive',
+      '../loader/icon',
+      '../notifications',
+      '../page',
+      '../page/animation',
+      '../page/chromium',
+      '../platform',
+      '../platform/animation',
+      '../platform/chromium',
+      '../platform/graphics',
+      '../platform/graphics/chromium',
+      '../platform/graphics/opentype',
+      '../platform/graphics/skia',
+      '../platform/graphics/transforms',
+      '../platform/image-decoders',
+      '../platform/image-decoders/bmp',
+      '../platform/image-decoders/gif',
+      '../platform/image-decoders/ico',
+      '../platform/image-decoders/jpeg',
+      '../platform/image-decoders/png',
+      '../platform/image-decoders/skia',
+      '../platform/image-decoders/xbm',
+      '../platform/image-encoders/skia',
+      '../platform/mock',
+      '../platform/network',
+      '../platform/network/chromium',
+      '../platform/sql',
+      '../platform/text',
+      '../plugins',
+      '../rendering',
+      '../rendering/style',
+      '../storage',
+      '../svg',
+      '../svg/animation',
+      '../svg/graphics',
+      '../websockets',
+      '../workers',
+      '../xml',
+    ],
+    'conditions': [
+      ['OS=="mac"', {
+        'webcore_include_dirs+': [
+          # platform/graphics/cg and mac needs to come before
+          # platform/graphics/chromium so that the Mac build picks up the
+          # version of ImageBufferData.h in the cg directory and
+          # FontPlatformData.h in the mac directory.  The + prepends this
+          # directory to the list.
+          # FIXME: This shouldn't need to be prepended.
+          # FIXME: Eliminate dependency on platform/graphics/mac and
+          # related directories.
+          # platform/graphics/cg may need to stick around, though.
+          '../platform/graphics/cg',
+          '../platform/graphics/mac',
+        ],
+        'webcore_include_dirs': [
+          # FIXME: Eliminate dependency on platform/mac and related
+          # directories.
+          '../loader/archive/cf',
+          '../platform/mac',
+          '../platform/text/mac',
+        ],
+      }],
+      ['OS=="win"', {
+        'webcore_include_dirs': [
+          '../page/win',
+          '../platform/graphics/win',
+          '../platform/text/win',
+          '../platform/win',
+        ],
+      }],
+    ],
+  },
+  'targets': [
+    {
+      'target_name': 'webcore',
+      'type': '<(library)',
+      'msvs_guid': '1C16337B-ACF3-4D03-AA90-851C5B5EADA6',
+      'dependencies': [
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:pcre',
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
+        '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
+        '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+        '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
+      ],
+      'defines': [
+        'WEBCORE_NAVIGATOR_VENDOR="Google Inc."', 
+      ],
+      'actions': [
+        # Actions to build derived sources.
+        {
+          'action_name': 'CSSPropertyNames',
+          'inputs': [
+            '../css/makeprop.pl',
+            '../css/CSSPropertyNames.in',
+            '../css/SVGCSSPropertyNames.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/CSSPropertyNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSPropertyNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_csspropertynames.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+        {
+          'action_name': 'CSSValueKeywords',
+          'inputs': [
+            '../css/makevalues.pl',
+            '../css/CSSValueKeywords.in',
+            '../css/SVGCSSValueKeywords.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/CSSValueKeywords.c',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/CSSValueKeywords.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_cssvaluekeywords.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+        {
+          'action_name': 'HTMLNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../html/HTMLTagNames.in',
+            '../html/HTMLAttributeNames.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/HTMLNames.cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/HTMLNames.h',
+            '<(INTERMEDIATE_DIR)/HTMLElementFactory.cpp',
+            # Pass --wrapperFactory to make_names to get these (JSC build?)
+            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.cpp',
+            #'<(INTERMEDIATE_DIR)/JSHTMLElementWrapperFactory.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'SVGNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../svg/svgtags.in',
+            '../svg/svgattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/SVGNames.cpp',
+            '<(INTERMEDIATE_DIR)/SVGNames.h',
+            '<(INTERMEDIATE_DIR)/SVGElementFactory.cpp',
+            '<(INTERMEDIATE_DIR)/SVGElementFactory.h',
+            # Pass --wrapperFactory to make_names to get these (JSC build?)
+            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.cpp',
+            #'<(INTERMEDIATE_DIR)/JSSVGElementWrapperFactory.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--factory', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'UserAgentStyleSheets',
+          'inputs': [
+            '../css/make-css-file-arrays.pl',
+            '../css/html.css',
+            '../css/quirks.css',
+            '../css/view-source.css',
+            '../css/themeChromiumLinux.css',
+            '../css/themeWin.css',
+            '../css/themeWinQuirks.css',
+            '../css/svg.css',
+            '../css/mediaControls.css',
+            '../css/mediaControlsChromium.css',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/UserAgentStyleSheets.h',
+            '<(INTERMEDIATE_DIR)/UserAgentStyleSheetsData.cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_useragentstylesheets.py', '<@(_outputs)', '--', '<@(_inputs)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'XLinkNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../svg/xlinkattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/XLinkNames.cpp',
+            '<(INTERMEDIATE_DIR)/XLinkNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'XMLNames',
+          'inputs': [
+            '../dom/make_names.pl',
+            '../xml/xmlattrs.in',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/XMLNames.cpp',
+            '<(INTERMEDIATE_DIR)/XMLNames.h',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_makenames.py', '<@(_outputs)', '--', '<@(_inputs)', '--', '--extraDefines', '<(feature_defines)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'action_name': 'tokenizer',
+          'inputs': [
+            '../css/maketokenizer',
+            '../css/tokenizer.flex',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/tokenizer.cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/action_maketokenizer.py', '<@(_outputs)', '--', '<@(_inputs)'],
+        },
+      ],
+      'rules': [
+        # Rules to build derived sources.
+        {
+          'rule_name': 'bison',
+          'extension': 'y',
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).cpp',
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).h'
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_bison.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)'],
+          'process_outputs_as_sources': 1,
+        },
+        {
+          'rule_name': 'gperf',
+          'extension': 'gperf',
+          # gperf output is only ever #included by other source files.  As
+          # such, process_outputs_as_sources is off.  Some gperf output is
+          # #included as *.c and some as *.cpp.  Since there's no way to tell
+          # which one will be needed in a rule definition, declare both as
+          # outputs.  The harness script will generate one file and copy it to
+          # the other.
+          #
+          # This rule places outputs in SHARED_INTERMEDIATE_DIR because glue
+          # needs access to HTMLEntityNames.c.
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).c',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/<(RULE_INPUT_ROOT).cpp',
+          ],
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_gperf.py', '<(RULE_INPUT_PATH)', '<(SHARED_INTERMEDIATE_DIR)/webkit'],
+          'process_outputs_as_sources': 0,
+        },
+        # Rule to build generated JavaScript (V8) bindings from .idl source.
+        {
+          'rule_name': 'binding',
+          'extension': 'idl',
+          'msvs_external_rule': 1,
+          'inputs': [
+            '../bindings/scripts/generate-bindings.pl',
+            '../bindings/scripts/CodeGenerator.pm',
+            '../bindings/scripts/CodeGeneratorV8.pm',
+            '../bindings/scripts/IDLParser.pm',
+            '../bindings/scripts/IDLStructure.pm',
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/bindings/V8<(RULE_INPUT_ROOT).cpp',
+            '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings/V8<(RULE_INPUT_ROOT).h',
+          ],
+          'variables': {
+            'generator_include_dirs': [
+              '--include', '../css',
+              '--include', '../dom',
+              '--include', '../html',
+              '--include', '../notifications',
+              '--include', '../page',
+              '--include', '../plugins',
+              '--include', '../svg',
+              '--include', '../websockets',
+              '--include', '../workers',
+              '--include', '../xml',
+            ],
+          },
+          'action': ['python', '<(chromium_src_dir)/webkit/build/rule_binding.py', '<(RULE_INPUT_PATH)', '<(INTERMEDIATE_DIR)/bindings', '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings', '--', '<@(_inputs)', '--', '--defines', '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING', '--generator', 'V8', '<@(generator_include_dirs)'],
+          # They are included by DerivedSourcesAllInOne.cpp instead.
+          'process_outputs_as_sources': 0,
+          'message': 'Generating binding from <(RULE_INPUT_PATH)',
+        },
+      ],
+      'include_dirs': [
+        '<(INTERMEDIATE_DIR)',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit',
+        '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+        '<@(webcore_include_dirs)',
+      ],
+      'sources': [
+        # bison rule
+        '../css/CSSGrammar.y',
+        '../xml/XPathGrammar.y',
+
+        # gperf rule
+        '../html/DocTypeStrings.gperf',
+        '../html/HTMLEntityNames.gperf',
+        '../platform/ColorData.gperf',
+
+        # This file includes all the .cpp files generated from the .idl files
+        # in webcore_files.
+        '../bindings/v8/DerivedSourcesAllInOne.cpp',
+
+        '<@(webcore_files)',
+
+        # For WebCoreSystemInterface, Mac-only.
+        '../../WebKit/mac/WebCoreSupport/WebSystemInterface.m',
+      ],
+      'sources/': [
+        # Exclude JSC custom bindings.
+        ['exclude', 'bindings/js'],
+
+        # SVG_FILTERS only.
+        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.idl$'],
+
+        # Fortunately, many things can be excluded by using broad patterns.
+
+        # Exclude things that don't apply to the Chromium platform on the basis
+        # of their enclosing directories and tags at the ends of their
+        # filenames.
+        ['exclude', '(android|cairo|cf|cg|curl|gtk|haiku|linux|mac|opentype|posix|qt|soup|symbian|win|wx)/'],
+        ['exclude', '(?<!Chromium)(SVGAllInOne|Android|Cairo|CF|CG|Curl|Gtk|Linux|Mac|OpenType|POSIX|Posix|Qt|Safari|Soup|Symbian|Win|Wx)\\.(cpp|mm?)$'],
+
+        # JSC-only.
+        ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
+
+        # ENABLE_OFFLINE_WEB_APPLICATIONS, exclude most of webcore's impl
+        ['exclude', 'loader/appcache/'],
+        ['include', 'loader/appcache/ApplicationCacheHost\.h$'],
+        ['include', 'loader/appcache/DOMApplicationCache\.(h|cpp|idl)$'],
+
+        # SVG_FILTERS only.
+        ['exclude', '(platform|svg)/graphics/filters/'],
+        ['exclude', 'svg/Filter[^/]*\\.cpp$'],
+        ['exclude', 'svg/SVG(FE|Filter)[^/]*\\.cpp$'],
+
+        # Exclude some DB-related files.
+        ['exclude', 'platform/sql/SQLiteFileSystem.cpp'],
+      ],
+      'sources!': [
+        # Custom bindings in bindings/v8/custom exist for these.
+        '../dom/EventListener.idl',
+        '../dom/EventTarget.idl',
+        '../html/VoidCallback.idl',
+
+        # JSC-only.
+        '../inspector/JavaScriptCallFrame.idl',
+
+        # ENABLE_GEOLOCATION only.
+        '../page/Geolocation.idl',
+        '../page/Geoposition.idl',
+        '../page/PositionCallback.idl',
+        '../page/PositionError.idl',
+        '../page/PositionErrorCallback.idl',
+
+        # Bindings with custom Objective-C implementations.
+        '../page/AbstractView.idl',
+
+        # FIXME: I don't know why all of these are excluded.
+        # Extra SVG bindings to exclude.
+        '../svg/ElementTimeControl.idl',
+        '../svg/SVGAnimatedPathData.idl',
+        '../svg/SVGComponentTransferFunctionElement.idl',
+        '../svg/SVGExternalResourcesRequired.idl',
+        '../svg/SVGFitToViewBox.idl',
+        '../svg/SVGHKernElement.idl',
+        '../svg/SVGLangSpace.idl',
+        '../svg/SVGLocatable.idl',
+        '../svg/SVGStylable.idl',
+        '../svg/SVGTests.idl',
+        '../svg/SVGTransformable.idl',
+        '../svg/SVGViewSpec.idl',
+        '../svg/SVGZoomAndPan.idl',
+
+        # FIXME: I don't know why these are excluded, either.
+        # Someone (me?) should figure it out and add appropriate comments.
+        '../css/CSSUnknownRule.idl',
+
+        # A few things can't be excluded by patterns.  List them individually.
+
+        # Don't build StorageNamespace.  We have our own implementation.
+        '../storage/StorageNamespace.cpp',
+
+        # Don't build StorageEventDispatcher.  We have our own implementation.
+        '../storage/StorageEventDispatcher.cpp',
+
+        # Use history/BackForwardListChromium.cpp instead.
+        '../history/BackForwardList.cpp',
+
+        # Use loader/icon/IconDatabaseNone.cpp instead.
+        '../loader/icon/IconDatabase.cpp',
+
+        # Use platform/KURLGoogle.cpp instead.
+        '../platform/KURL.cpp',
+
+        # Use platform/MIMETypeRegistryChromium.cpp instead.
+        '../platform/MIMETypeRegistry.cpp',
+
+        # Theme.cpp is used only if we're using USE_NEW_THEME. We are not for
+        # Windows and Linux. We manually include Theme.cpp for the Mac below.
+        '../platform/Theme.cpp',
+
+        # Exclude some, but not all, of plugins.
+        '../plugins/PluginDatabase.cpp',
+        '../plugins/PluginInfoStore.cpp',
+        '../plugins/PluginMainThreadScheduler.cpp',
+        '../plugins/PluginPackage.cpp',
+        '../plugins/PluginStream.cpp',
+        '../plugins/PluginView.cpp',
+        '../plugins/npapi.cpp',
+
+        # Use LinkHashChromium.cpp instead
+        '../platform/LinkHash.cpp',
+
+        # Don't build these.
+        # FIXME: I don't know exactly why these are excluded.  It would
+        # be nice to provide more explicit comments.  Some of these do actually
+        # compile.
+        '../dom/StaticStringList.cpp',
+        '../loader/icon/IconFetcher.cpp',
+        '../loader/UserStyleSheetLoader.cpp',
+        '../platform/graphics/GraphicsLayer.cpp',
+        '../platform/graphics/RenderLayerBacking.cpp',
+        '../platform/graphics/RenderLayerCompositor.cpp',
+
+        # We use a multi-process version from the WebKit API.
+        '../dom/default/PlatformMessagePortChannel.cpp',
+        '../dom/default/PlatformMessagePortChannel.h',
+
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          '<(SHARED_INTERMEDIATE_DIR)/webkit',
+          '<(SHARED_INTERMEDIATE_DIR)/webkit/bindings',
+          '<@(webcore_include_dirs)',
+        ],
+        'mac_framework_dirs': [
+          '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
+        ],
+      },
+      'export_dependent_settings': [
+        '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+        '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+        '<(chromium_src_dir)/skia/skia.gyp:skia',
+        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+      ],
+      'link_settings': {
+        'mac_bundle_resources': [
+          '../Resources/aliasCursor.png',
+          '../Resources/cellCursor.png',
+          '../Resources/contextMenuCursor.png',
+          '../Resources/copyCursor.png',
+          '../Resources/crossHairCursor.png',
+          '../Resources/eastResizeCursor.png',
+          '../Resources/eastWestResizeCursor.png',
+          '../Resources/helpCursor.png',
+          '../Resources/linkCursor.png',
+          '../Resources/missingImage.png',
+          '../Resources/moveCursor.png',
+          '../Resources/noDropCursor.png',
+          '../Resources/noneCursor.png',
+          '../Resources/northEastResizeCursor.png',
+          '../Resources/northEastSouthWestResizeCursor.png',
+          '../Resources/northResizeCursor.png',
+          '../Resources/northSouthResizeCursor.png',
+          '../Resources/northWestResizeCursor.png',
+          '../Resources/northWestSouthEastResizeCursor.png',
+          '../Resources/notAllowedCursor.png',
+          '../Resources/progressCursor.png',
+          '../Resources/southEastResizeCursor.png',
+          '../Resources/southResizeCursor.png',
+          '../Resources/southWestResizeCursor.png',
+          '../Resources/verticalTextCursor.png',
+          '../Resources/waitCursor.png',
+          '../Resources/westResizeCursor.png',
+          '../Resources/zoomInCursor.png',
+          '../Resources/zoomOutCursor.png',
+        ],
+      },
+      'hard_dependency': 1,
+      'mac_framework_dirs': [
+        '$(SDKROOT)/System/Library/Frameworks/ApplicationServices.framework/Frameworks',
+      ],
+      'msvs_disabled_warnings': [
+        4138, 4244, 4291, 4305, 4344, 4355, 4521, 4099,
+      ],
+      'scons_line_length' : 1,
+      'xcode_settings': {
+        # Some Mac-specific parts of WebKit won't compile without having this
+        # prefix header injected.
+        # FIXME: make this a first-class setting.
+        'GCC_PREFIX_HEADER': '../WebCorePrefix.h',
+      },
+      'conditions': [
+        ['javascript_engine=="v8"', {
+          'dependencies': [
+            '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+          ],
+          'export_dependent_settings': [
+            '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+          ],
+        }],
+        ['OS=="linux" or OS=="freebsd"', {
+          'dependencies': [
+            '<(chromium_src_dir)/build/linux/system.gyp:fontconfig',
+            '<(chromium_src_dir)/build/linux/system.gyp:gtk',
+          ],
+          'sources': [
+            '../platform/graphics/chromium/VDMXParser.cpp',
+            '../platform/graphics/chromium/HarfbuzzSkia.cpp',
+          ],
+          'sources/': [
+            # Cherry-pick files excluded by the broader regular expressions above.
+            ['include', 'platform/chromium/KeyCodeConversionGtk\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontCacheLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/FontPlatformDataLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/GlyphPageTreeNodeLinux\\.cpp$'],
+            ['include', 'platform/graphics/chromium/SimpleFontDataLinux\\.cpp$'],
+          ],
+          'cflags': [
+            # WebCore does not work with strict aliasing enabled.
+            # https://bugs.webkit.org/show_bug.cgi?id=25864
+            '-fno-strict-aliasing',
+          ],
+        }],
+        ['OS=="linux"', {
+          'defines': [
+            # Mozilla on Linux effectively uses uname -sm, but when running
+            # 32-bit x86 code on an x86_64 processor, it uses
+            # "Linux i686 (x86_64)".  Matching that would require making a
+            # run-time determination.
+            'WEBCORE_NAVIGATOR_PLATFORM="Linux i686"',
+          ],
+        }],
+        ['OS=="mac"', {
+          'defines': [
+            # Match Safari and Mozilla on Mac x86.
+            'WEBCORE_NAVIGATOR_PLATFORM="MacIntel"',
+
+            # Chromium's version of WebCore includes the following Objective-C
+            # classes. The system-provided WebCore framework may also provide
+            # these classes. Because of the nature of Objective-C binding
+            # (dynamically at runtime), it's possible for the Chromium-provided
+            # versions to interfere with the system-provided versions.  This may
+            # happen when a system framework attempts to use WebCore.framework,
+            # such as when converting an HTML-flavored string to an
+            # NSAttributedString.  The solution is to force Objective-C class
+            # names that would conflict to use alternate names.
+
+            # FIXME: This list will hopefully shrink but may also grow.
+            # Periodically run:
+            # nm libwebcore.a | grep -E '[atsATS] ([+-]\[|\.objc_class_name)'
+            # and make sure that everything listed there has the alternate
+            # ChromiumWebCoreObjC name, and that nothing extraneous is listed
+            # here. If all Objective-C can be eliminated from Chromium's WebCore
+            # library, these defines should be removed entirely.
+            'ScrollbarPrefsObserver=ChromiumWebCoreObjCScrollbarPrefsObserver',
+            'WebCoreRenderThemeNotificationObserver=ChromiumWebCoreObjCWebCoreRenderThemeNotificationObserver',
+            'WebFontCache=ChromiumWebCoreObjCWebFontCache',
+          ],
+          'actions': [
+            {
+              # Allow framework-style #include of
+              # <WebCore/WebCoreSystemInterface.h>.
+              'action_name': 'WebCoreSystemInterface.h',
+              'inputs': [
+                '../platform/mac/WebCoreSystemInterface.h',
+              ],
+              'outputs': [
+                '<(INTERMEDIATE_DIR)/WebCore/WebCoreSystemInterface.h',
+              ],
+              'action': ['cp', '<@(_inputs)', '<@(_outputs)'],
+            },
+          ],
+          'include_dirs': [
+            '../../WebKitLibraries',
+          ],
+          'sources/': [
+            # Additional files from the WebCore Mac build that are presently
+            # used in the WebCore Chromium Mac build too.
+
+            # The Mac build is PLATFORM_CF but does not use CFNetwork.
+            ['include', 'CF\\.cpp$'],
+            ['exclude', 'network/cf/'],
+
+            # The Mac build is PLATFORM_CG too.  platform/graphics/cg is the
+            # only place that CG files we want to build are located, and not
+            # all of them even have a CG suffix, so just add them by a
+            # regexp matching their directory.
+            ['include', 'platform/graphics/cg/[^/]*(?<!Win)?\\.(cpp|mm?)$'],
+
+            # Use native Mac font code from WebCore.
+            ['include', 'platform/(graphics/)?mac/[^/]*Font[^/]*\\.(cpp|mm?)$'],
+
+            # Cherry-pick some files that can't be included by broader regexps.
+            # Some of these are used instead of Chromium platform files, see
+            # the specific exclusions in the "sources!" list below.
+            ['include', 'loader/archive/cf/LegacyWebArchive\\.cpp$'],
+            ['include', 'platform/graphics/mac/ColorMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatPointMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatRectMac\\.mm$'],
+            ['include', 'platform/graphics/mac/FloatSizeMac\\.mm$'],
+            ['include', 'platform/graphics/mac/GlyphPageTreeNodeMac\\.cpp$'],
+            ['include', 'platform/graphics/mac/GraphicsContextMac\\.mm$'],
+            ['include', 'platform/graphics/mac/IntRectMac\\.mm$'],
+            ['include', 'platform/mac/BlockExceptions\\.mm$'],
+            ['include', 'platform/mac/LocalCurrentGraphicsContext\\.mm$'],
+            ['include', 'platform/mac/PurgeableBufferMac\\.cpp$'],
+            ['include', 'platform/mac/ScrollbarThemeMac\\.mm$'],
+            ['include', 'platform/mac/WebCoreSystemInterface\\.mm$'],
+            ['include', 'platform/mac/WebCoreTextRenderer\\.mm$'],
+            ['include', 'platform/text/mac/ShapeArabic\\.c$'],
+            ['include', 'platform/text/mac/String(Impl)?Mac\\.mm$'],
+            # Use USE_NEW_THEME on Mac.
+            ['include', 'platform/Theme\\.cpp$'],
+
+            ['include', 'WebKit/mac/WebCoreSupport/WebSystemInterface\\.m$'],
+          ],
+          'sources!': [
+            # The Mac currently uses FontCustomPlatformData.cpp from
+            # platform/graphics/mac, included by regex above, instead.
+            '../platform/graphics/chromium/FontCustomPlatformData.cpp',
+
+            # The Mac currently uses ScrollbarThemeMac.mm, included by regex
+            # above, instead of ScrollbarThemeChromium.cpp.
+            '../platform/chromium/ScrollbarThemeChromium.cpp',
+
+            # The Mac uses ImageSourceCG.cpp from platform/graphics/cg, included
+            # by regex above, instead.
+            '../platform/graphics/ImageSource.cpp',
+
+            # These Skia files aren't currently built on the Mac, which uses
+            # CoreGraphics directly for this portion of graphics handling.
+            '../platform/graphics/skia/FloatPointSkia.cpp',
+            '../platform/graphics/skia/FloatRectSkia.cpp',
+            '../platform/graphics/skia/GradientSkia.cpp',
+            '../platform/graphics/skia/GraphicsContextSkia.cpp',
+            '../platform/graphics/skia/ImageBufferSkia.cpp',
+            '../platform/graphics/skia/ImageSkia.cpp',
+            '../platform/graphics/skia/ImageSourceSkia.cpp',
+            '../platform/graphics/skia/IntPointSkia.cpp',
+            '../platform/graphics/skia/IntRectSkia.cpp',
+            '../platform/graphics/skia/PathSkia.cpp',
+            '../platform/graphics/skia/PatternSkia.cpp',
+            '../platform/graphics/skia/TransformationMatrixSkia.cpp',
+
+            # RenderThemeChromiumSkia is not used on mac since RenderThemeChromiumMac
+            # does not reference the Skia code that is used by Windows and Linux.
+            '../rendering/RenderThemeChromiumSkia.cpp',
+
+            # Skia image-decoders are also not used on mac.  CoreGraphics
+            # is used directly instead.
+            '../platform/image-decoders/ImageDecoder.h',
+            '../platform/image-decoders/bmp/BMPImageDecoder.cpp',
+            '../platform/image-decoders/bmp/BMPImageDecoder.h',
+            '../platform/image-decoders/bmp/BMPImageReader.cpp',
+            '../platform/image-decoders/bmp/BMPImageReader.h',
+            '../platform/image-decoders/gif/GIFImageDecoder.cpp',
+            '../platform/image-decoders/gif/GIFImageDecoder.h',
+            '../platform/image-decoders/gif/GIFImageReader.cpp',
+            '../platform/image-decoders/gif/GIFImageReader.h',
+            '../platform/image-decoders/ico/ICOImageDecoder.cpp',
+            '../platform/image-decoders/ico/ICOImageDecoder.h',
+            '../platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
+            '../platform/image-decoders/jpeg/JPEGImageDecoder.h',
+            '../platform/image-decoders/png/PNGImageDecoder.cpp',
+            '../platform/image-decoders/png/PNGImageDecoder.h',
+            '../platform/image-decoders/skia/ImageDecoderSkia.cpp',
+            '../platform/image-decoders/xbm/XBMImageDecoder.cpp',
+            '../platform/image-decoders/xbm/XBMImageDecoder.h',
+          ],
+          'link_settings': {
+            'libraries': [
+              '../../WebKitLibraries/libWebKitSystemInterfaceLeopard.a',
+            ],
+          },
+          'direct_dependent_settings': {
+            'include_dirs': [
+              '../../WebKitLibraries',
+              '../../WebKit/mac/WebCoreSupport',
+            ],
+          },
+        }],
+        ['OS=="win"', {
+          'dependencies': ['<(chromium_src_dir)/build/win/system.gyp:cygwin'],
+          'sources/': [
+            ['exclude', 'Posix\\.cpp$'],
+            ['include', '/opentype/'],
+            ['include', '/TransparencyWin\\.cpp$'],
+            ['include', '/SkiaFontWin\\.cpp$'],
+          ],
+          'defines': [
+            # Match Safari and Mozilla on Windows.
+            'WEBCORE_NAVIGATOR_PLATFORM="Win32"',
+            '__PRETTY_FUNCTION__=__FUNCTION__',
+          ],
+          # This is needed because Event.h in this directory is blocked
+          # by a system header on windows.
+          'include_dirs++': ['../dom'],
+          'direct_dependent_settings': {
+            'include_dirs+++': ['../dom'],
+          },
+        }],
+        ['OS!="linux" and OS!="freebsd"', {'sources/': [['exclude', '(Gtk|Linux)\\.cpp$']]}],
+        ['OS!="mac"', {'sources/': [['exclude', 'Mac\\.(cpp|mm?)$']]}],
+        ['OS!="win"', {
+          'sources/': [
+            ['exclude', 'Win\\.cpp$'],
+            ['exclude', '/(Windows|Uniscribe)[^/]*\\.cpp$']
+          ],
+        }],
+        ['OS!="win" and remove_webcore_debug_symbols==1', {
+          'configurations': {
+            'Debug': {
+              'cflags!': ['-g'],
+            }
+          },
+        }],
+      ],
+    },
+  ], # targets
+}
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index 8738e15..a8cfeb9 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -31,6 +31,7 @@
             'css/WebKitCSSMatrix.idl',
             'css/WebKitCSSTransformValue.idl',
             'dom/Attr.idl',
+            'dom/BeforeLoadEvent.idl',
             'dom/CDATASection.idl',
             'dom/CharacterData.idl',
             'dom/ClientRect.idl',
@@ -64,6 +65,7 @@
             'dom/NodeList.idl',
             'dom/Notation.idl',
             'dom/OverflowEvent.idl',
+            'dom/PageTransitionEvent.idl',
             'dom/ProcessingInstruction.idl',
             'dom/ProgressEvent.idl',
             'dom/Range.idl',
@@ -75,10 +77,27 @@
             'dom/WebKitAnimationEvent.idl',
             'dom/WebKitTransitionEvent.idl',
             'dom/WheelEvent.idl',
+            'html/canvas/CanvasArray.idl',
+            'html/canvas/CanvasArrayBuffer.idl',
+            'html/canvas/CanvasBuffer.idl',
+            'html/canvas/CanvasByteArray.idl',
+            'html/canvas/CanvasFloatArray.idl',
+            'html/canvas/CanvasFramebuffer.idl',
             'html/canvas/CanvasGradient.idl',
+            'html/canvas/CanvasIntArray.idl',
             'html/canvas/CanvasPattern.idl',
             'html/canvas/CanvasPixelArray.idl',
+            'html/canvas/CanvasProgram.idl',
+            'html/canvas/CanvasRenderbuffer.idl',
+            'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
+            'html/canvas/CanvasRenderingContext3D.idl',
+            'html/canvas/CanvasShader.idl',
+            'html/canvas/CanvasShortArray.idl',
+            'html/canvas/CanvasUnsignedByteArray.idl',
+            'html/canvas/CanvasUnsignedIntArray.idl',
+            'html/canvas/CanvasUnsignedShortArray.idl',
+            'html/canvas/CanvasTexture.idl',
             'html/DataGridColumn.idl',
             'html/DataGridColumnList.idl',
             'html/File.idl',
@@ -100,6 +119,7 @@
             'html/HTMLDataGridColElement.idl',
             'html/HTMLDataGridElement.idl',
             'html/HTMLDataGridRowElement.idl',
+            'html/HTMLDataListElement.idl',
             'html/HTMLDirectoryElement.idl',
             'html/HTMLDivElement.idl',
             'html/HTMLDocument.idl',
@@ -160,6 +180,8 @@
             'inspector/InspectorBackend.idl',
             'inspector/JavaScriptCallFrame.idl',
             'loader/appcache/DOMApplicationCache.idl',
+            'notifications/Notification.idl',
+            'notifications/NotificationCenter.idl',
             'page/AbstractView.idl',
             'page/BarInfo.idl',
             'page/Console.idl',
@@ -212,7 +234,6 @@
             'svg/SVGColor.idl',
             'svg/SVGComponentTransferFunctionElement.idl',
             'svg/SVGCursorElement.idl',
-            'svg/SVGDefinitionSrcElement.idl',
             'svg/SVGDefsElement.idl',
             'svg/SVGDescElement.idl',
             'svg/SVGDocument.idl',
@@ -332,6 +353,7 @@
             'svg/SVGViewSpec.idl',
             'svg/SVGZoomAndPan.idl',
             'svg/SVGZoomEvent.idl',
+            'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
@@ -369,6 +391,8 @@
             'accessibility/AccessibilityListBox.h',
             'accessibility/AccessibilityListBoxOption.cpp',
             'accessibility/AccessibilityListBoxOption.h',
+            'accessibility/AccessibilityMediaControls.cpp',
+            'accessibility/AccessibilityMediaControls.h',
             'accessibility/AccessibilityObject.cpp',
             'accessibility/AccessibilityObject.h',
             'accessibility/AccessibilityRenderObject.cpp',
@@ -405,15 +429,19 @@
             'bindings/js/DOMObjectWithSVGContext.h',
             'bindings/js/GCController.cpp',
             'bindings/js/GCController.h',
+            'bindings/js/JSCallbackData.cpp',
+            'bindings/js/JSCallbackData.h',
             'bindings/js/JSAttrCustom.cpp',
             'bindings/js/JSAudioConstructor.cpp',
             'bindings/js/JSAudioConstructor.h',
+            'bindings/js/JSCanvasRenderingContextCustom.cpp',
             'bindings/js/JSCanvasRenderingContext2DCustom.cpp',
             'bindings/js/JSCDATASectionCustom.cpp',
             'bindings/js/JSClipboardCustom.cpp',
             'bindings/js/JSConsoleCustom.cpp',
             'bindings/js/JSCoordinatesCustom.cpp',
             'bindings/js/JSCSSRuleCustom.cpp',
+            'bindings/js/JSCSSRuleListCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.cpp',
             'bindings/js/JSCSSStyleDeclarationCustom.h',
             'bindings/js/JSCSSValueCustom.cpp',
@@ -464,6 +492,7 @@
             'bindings/js/JSHTMLAllCollection.h',
             'bindings/js/JSHTMLAppletElementCustom.cpp',
             'bindings/js/JSHTMLAppletElementCustom.h',
+            'bindings/js/JSHTMLCanvasElementCustom.cpp',
             'bindings/js/JSHTMLCollectionCustom.cpp',
             'bindings/js/JSHTMLDataGridElementCustom.cpp',
             'bindings/js/JSHTMLDocumentCustom.cpp',
@@ -497,7 +526,9 @@
             'bindings/js/JSMessageChannelConstructor.cpp',
             'bindings/js/JSMessageChannelConstructor.h',
             'bindings/js/JSMessageChannelCustom.cpp',
+            'bindings/js/JSMessageEventCustom.cpp',
             'bindings/js/JSMessagePortCustom.cpp',
+            'bindings/js/JSMessagePortCustom.h',
             'bindings/js/JSMimeTypeArrayCustom.cpp',
             'bindings/js/JSNamedNodeMapCustom.cpp',
             'bindings/js/JSNamedNodesCollection.cpp',
@@ -521,7 +552,6 @@
             'bindings/js/JSRGBColor.h',
             'bindings/js/JSSharedWorkerConstructor.cpp',
             'bindings/js/JSSharedWorkerConstructor.h',
-            'bindings/js/JSSharedWorkerContextCustom.cpp',
             'bindings/js/JSSharedWorkerCustom.cpp',
             'bindings/js/JSSQLResultSetRowListCustom.cpp',
             'bindings/js/JSSQLTransactionCustom.cpp',
@@ -543,6 +573,9 @@
             'bindings/js/JSWebKitCSSMatrixConstructor.h',
             'bindings/js/JSWebKitPointConstructor.cpp',
             'bindings/js/JSWebKitPointConstructor.h',
+            'bindings/js/JSWebSocketConstructor.cpp',
+            'bindings/js/JSWebSocketConsuructor.h',
+            'bindings/js/JSWebSocketCustom.cpp',
             'bindings/js/JSWorkerConstructor.cpp',
             'bindings/js/JSWorkerConstructor.h',
             'bindings/js/JSWorkerContextBase.cpp',
@@ -597,7 +630,17 @@
             'bindings/v8/custom/V8AbstractWorkerCustom.cpp',
             'bindings/v8/custom/V8AttrCustom.cpp',
             'bindings/v8/custom/V8CanvasPixelArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasArrayCustom.h',
+            'bindings/v8/custom/V8CanvasArrayBufferCustom.cpp',
+            'bindings/v8/custom/V8CanvasByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasFloatArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasShortArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp',
+            'bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp',
             'bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp',
+            'bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp',
             'bindings/v8/custom/V8ClientRectListCustom.cpp',
             'bindings/v8/custom/V8ClipboardCustom.cpp',
             'bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp',
@@ -627,7 +670,9 @@
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
+            'bindings/v8/custom/V8FileListCustom.cpp',
             'bindings/v8/custom/V8HTMLAudioElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLAudioElementConstructor.h',
             'bindings/v8/custom/V8HTMLCanvasElementCustom.cpp',
             'bindings/v8/custom/V8HTMLCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLDataGridElementCustom.cpp',
@@ -637,8 +682,10 @@
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
             'bindings/v8/custom/V8HTMLIFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLImageElementConstructor.h',
             'bindings/v8/custom/V8HTMLInputElementCustom.cpp',
             'bindings/v8/custom/V8HTMLOptionElementConstructor.cpp',
+            'bindings/v8/custom/V8HTMLOptionElementConstructor.h',
             'bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp',
             'bindings/v8/custom/V8HTMLPlugInElementCustom.cpp',
             'bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp',
@@ -647,7 +694,9 @@
             'bindings/v8/custom/V8InspectorBackendCustom.cpp',
             'bindings/v8/custom/V8LocationCustom.cpp',
             'bindings/v8/custom/V8MessageChannelConstructor.cpp',
+            'bindings/v8/custom/V8MessageEventCustom.cpp',
             'bindings/v8/custom/V8MessagePortCustom.cpp',
+            'bindings/v8/custom/V8MessagePortCustom.h',
             'bindings/v8/custom/V8NamedNodeMapCustom.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.cpp',
             'bindings/v8/custom/V8NamedNodesCollection.h',
@@ -656,6 +705,7 @@
             'bindings/v8/custom/V8NodeFilterCustom.cpp',
             'bindings/v8/custom/V8NodeIteratorCustom.cpp',
             'bindings/v8/custom/V8NodeListCustom.cpp',
+            'bindings/v8/custom/V8NotificationCenterCustom.cpp',
             'bindings/v8/custom/V8StorageCustom.cpp',
             'bindings/v8/custom/V8SQLResultSetRowListCustom.cpp',
             'bindings/v8/custom/V8SQLTransactionCustom.cpp',
@@ -667,6 +717,7 @@
             'bindings/v8/custom/V8TreeWalkerCustom.cpp',
             'bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp',
             'bindings/v8/custom/V8WebKitPointConstructor.cpp',
+            'bindings/v8/custom/V8WebSocketCustom.cpp',
             'bindings/v8/custom/V8WorkerContextCustom.cpp',
             'bindings/v8/custom/V8WorkerCustom.cpp',
             'bindings/v8/custom/V8XMLHttpRequestConstructor.cpp',
@@ -675,6 +726,8 @@
             'bindings/v8/custom/V8XMLSerializerConstructor.cpp',
             'bindings/v8/custom/V8XPathEvaluatorConstructor.cpp',
             'bindings/v8/custom/V8XSLTProcessorCustom.cpp',
+            'bindings/v8/DateExtension.cpp',
+            'bindings/v8/DateExtension.h',
             'bindings/v8/DOMData.cpp',
             'bindings/v8/DOMData.h',
             'bindings/v8/DOMDataStore.cpp',
@@ -716,6 +769,7 @@
             'bindings/v8/ScriptString.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
+            'bindings/v8/SerializedScriptValue.h',
             'bindings/v8/StaticDOMDataStore.cpp',
             'bindings/v8/StaticDOMDataStore.h',
             'bindings/v8/V8AbstractEventListener.cpp',
@@ -752,8 +806,6 @@
             'bindings/v8/V8NPUtils.h',
             'bindings/v8/V8NodeFilterCondition.cpp',
             'bindings/v8/V8NodeFilterCondition.h',
-            'bindings/v8/V8ObjectEventListener.cpp',
-            'bindings/v8/V8ObjectEventListener.h',
             'bindings/v8/V8Proxy.cpp',
             'bindings/v8/V8Proxy.h',
             'bindings/v8/V8SVGPODTypeWrapper.h',
@@ -761,8 +813,6 @@
             'bindings/v8/V8Utilities.h',
             'bindings/v8/V8WorkerContextEventListener.cpp',
             'bindings/v8/V8WorkerContextEventListener.h',
-            'bindings/v8/V8WorkerContextObjectEventListener.cpp',
-            'bindings/v8/V8WorkerContextObjectEventListener.h',
             'bindings/v8/WorkerContextExecutionProxy.h',
             'bindings/v8/WorkerContextExecutionProxy.cpp',
             'bindings/v8/WorkerScriptController.h',
@@ -914,6 +964,7 @@
             'dom/Attribute.h',
             'dom/BeforeTextInsertedEvent.cpp',
             'dom/BeforeTextInsertedEvent.h',
+            'dom/BeforeLoadEvent.h',
             'dom/BeforeUnloadEvent.cpp',
             'dom/BeforeUnloadEvent.h',
             'dom/CDATASection.cpp',
@@ -947,7 +998,6 @@
             'dom/DOMCoreException.h',
             'dom/DOMImplementation.cpp',
             'dom/DOMImplementation.h',
-            'dom/DocPtr.h',
             'dom/Document.cpp',
             'dom/Document.h',
             'dom/DocumentFragment.cpp',
@@ -1028,6 +1078,8 @@
             'dom/OptionGroupElement.h',
             'dom/OverflowEvent.cpp',
             'dom/OverflowEvent.h',
+            'dom/PageTransitionEvent.cpp',
+            'dom/PageTransitionEvent.h',
             'dom/Position.cpp',
             'dom/Position.h',
             'dom/PositionIterator.cpp',
@@ -1067,6 +1119,8 @@
             'dom/TextEvent.cpp',
             'dom/TextEvent.h',
             'dom/Tokenizer.h',
+            'dom/TransformSourceLibxslt.cpp',
+            'dom/TransformSource.h',
             'dom/Traversal.cpp',
             'dom/Traversal.h',
             'dom/TreeWalker.cpp',
@@ -1204,16 +1258,52 @@
             'history/HistoryItem.h',
             'history/PageCache.cpp',
             'history/PageCache.h',
+            'html/canvas/CanvasArray.cpp',
+            'html/canvas/CanvasArray.h',
+            'html/canvas/CanvasArrayBuffer.cpp',
+            'html/canvas/CanvasArrayBuffer.h',
+            'html/canvas/CanvasBuffer.cpp',
+            'html/canvas/CanvasBuffer.h',
+            'html/canvas/CanvasByteArray.cpp',
+            'html/canvas/CanvasByteArray.h',
+            'html/canvas/CanvasFloatArray.cpp',
+            'html/canvas/CanvasFloatArray.h',
+            'html/canvas/CanvasFramebuffer.cpp',
+            'html/canvas/CanvasFramebuffer.h',
             'html/canvas/CanvasGradient.cpp',
             'html/canvas/CanvasGradient.h',
+            'html/canvas/CanvasIntArray.cpp',
+            'html/canvas/CanvasIntArray.h',
+            'html/canvas/CanvasObject.cpp',
+            'html/canvas/CanvasObject.h',
             'html/canvas/CanvasPattern.cpp',
             'html/canvas/CanvasPattern.h',
             'html/canvas/CanvasPixelArray.cpp',
             'html/canvas/CanvasPixelArray.h',
+            'html/canvas/CanvasProgram.cpp',
+            'html/canvas/CanvasProgram.h',
+            'html/canvas/CanvasRenderbuffer.cpp',
+            'html/canvas/CanvasRenderbuffer.h',
+            'html/canvas/CanvasRenderingContext.cpp',
+            'html/canvas/CanvasRenderingContext.h',
             'html/canvas/CanvasRenderingContext2D.cpp',
             'html/canvas/CanvasRenderingContext2D.h',
+            'html/canvas/CanvasRenderingContext3D.cpp',
+            'html/canvas/CanvasRenderingContext3D.h',
+            'html/canvas/CanvasShader.cpp',
+            'html/canvas/CanvasShader.h',
+            'html/canvas/CanvasShortArray.cpp',
+            'html/canvas/CanvasShortArray.h',
             'html/canvas/CanvasStyle.cpp',
             'html/canvas/CanvasStyle.h',
+            'html/canvas/CanvasTexture.cpp',
+            'html/canvas/CanvasTexture.h',
+            'html/canvas/CanvasUnsignedByteArray.cpp',
+            'html/canvas/CanvasUnsignedByteArray.h',
+            'html/canvas/CanvasUnsignedIntArray.cpp',
+            'html/canvas/CanvasUnsignedIntArray.h',
+            'html/canvas/CanvasUnsignedShortArray.cpp',
+            'html/canvas/CanvasUnsignedShortArray.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1263,6 +1353,8 @@
             'html/HTMLDataGridElement.h',
             'html/HTMLDataGridRowElement.cpp',
             'html/HTMLDataGridRowElement.h',
+            'html/HTMLDataListElement.cpp',
+            'html/HTMLDataListElement.h',
             'html/HTMLDirectoryElement.cpp',
             'html/HTMLDirectoryElement.h',
             'html/HTMLDivElement.cpp',
@@ -1409,6 +1501,8 @@
             'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
+            'inspector/DOMDispatchTimelineItem.cpp',
+            'inspector/DOMDispatchTimelineItem.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
             'inspector/InspectorController.cpp',
@@ -1423,6 +1517,8 @@
             'inspector/InspectorFrontend.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
+            'inspector/InspectorTimelineAgent.cpp',
+            'inspector/InspectorTimelineAgent.h',
             'inspector/JavaScriptCallFrame.cpp',
             'inspector/JavaScriptCallFrame.h',
             'inspector/JavaScriptDebugListener.h',
@@ -1432,6 +1528,8 @@
             'inspector/JavaScriptProfile.h',
             'inspector/JavaScriptProfileNode.cpp',
             'inspector/JavaScriptProfileNode.h',
+            'inspector/TimelineItem.cpp',
+            'inspector/TimelineItem.h',
             'loader/appcache/ApplicationCache.cpp',
             'loader/appcache/ApplicationCache.h',
             'loader/appcache/ApplicationCacheGroup.cpp',
@@ -1533,8 +1631,14 @@
             'loader/PlaceholderDocument.h',
             'loader/PluginDocument.cpp',
             'loader/PluginDocument.h',
+            'loader/PolicyCallback.cpp',
+            'loader/PolicyCallback.h',
+            'loader/PolicyChecker.cpp',
+            'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
             'loader/ProgressTracker.h',
+            'loader/RedirectScheduler.cpp',
+            'loader/RedirectScheduler.h',
             'loader/Request.cpp',
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
@@ -1552,12 +1656,16 @@
             'loader/ThreadableLoader.h',
             'loader/ThreadableLoaderClient.h',
             'loader/ThreadableLoaderClientWrapper.h',
-            'loader/UserStyleSheetLoader.cpp',
-            'loader/UserStyleSheetLoader.h',
             'loader/WorkerThreadableLoader.cpp',
             'loader/WorkerThreadableLoader.h',
             'loader/loader.cpp',
             'loader/loader.h',
+            'notifications/Notification.cpp',
+            'notifications/Notification.h',
+            'notifications/NotificationCenter.cpp',
+            'notifications/NotificationCenter.h',
+            'notifications/NotificationPresenter.h',
+            'notifications/NotificationContents.h',
             'page/animation/AnimationBase.cpp',
             'page/animation/AnimationBase.h',
             'page/animation/AnimationController.cpp',
@@ -1610,7 +1718,6 @@
             'page/ContextMenuClient.h',
             'page/ContextMenuController.cpp',
             'page/ContextMenuController.h',
-            'page/Coordinates.cpp',
             'page/DOMSelection.cpp',
             'page/DOMSelection.h',
             'page/DOMTimer.cpp',
@@ -1636,8 +1743,8 @@
             'page/FrameView.h',
             'page/Geolocation.cpp',
             'page/Geolocation.h',
-            'page/Geoposition.cpp',
             'page/Geoposition.h',
+            'page/HaltablePlugin.h',
             'page/History.cpp',
             'page/History.h',
             'page/Location.cpp',
@@ -1648,12 +1755,17 @@
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
             'page/NavigatorBase.h',
+            'page/OriginAccessEntry.cpp',
+            'page/OriginAccessEntry.h',
             'page/Page.cpp',
             'page/Page.h',
             'page/PageGroup.cpp',
             'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
+            'page/PluginHalter.cpp',
+            'page/PluginHalter.h',
+            'page/PluginHalterClient.h',
             'page/PositionCallback.h',
             'page/PositionError.h',
             'page/PositionErrorCallback.h',
@@ -1667,6 +1779,12 @@
             'page/SecurityOriginHash.h',
             'page/Settings.cpp',
             'page/Settings.h',
+            'page/UserContentURLPattern.cpp',
+            'page/UserContentURLPattern.h',
+            'page/UserScript.h',
+            'page/UserScriptTypes.h',
+            'page/UserStyleSheet.h',
+            'page/UserStyleSheetTypes.h',
             'page/WebKitPoint.h',
             'page/WindowFeatures.cpp',
             'page/WindowFeatures.h',
@@ -1737,6 +1855,8 @@
             'platform/chromium/SuddenTerminationChromium.cpp',
             'platform/chromium/SystemTimeChromium.cpp',
             'platform/chromium/TemporaryLinkStubs.cpp',
+            'platform/chromium/ThemeChromiumMac.h',
+            'platform/chromium/ThemeChromiumMac.mm',
             'platform/chromium/WidgetChromium.cpp',
             'platform/chromium/WindowsVersion.cpp',
             'platform/chromium/WindowsVersion.h',
@@ -1748,7 +1868,6 @@
             'platform/graphics/cairo/ImageBufferCairo.cpp',
             'platform/graphics/cairo/ImageBufferData.h',
             'platform/graphics/cairo/ImageCairo.cpp',
-            'platform/graphics/cairo/ImageSourceCairo.cpp',
             'platform/graphics/cairo/PathCairo.cpp',
             'platform/graphics/cairo/PatternCairo.cpp',
             'platform/graphics/cairo/TransformationMatrixCairo.cpp',
@@ -1912,8 +2031,6 @@
             'platform/graphics/skia/GraphicsContextSkia.cpp',
             'platform/graphics/skia/ImageBufferSkia.cpp',
             'platform/graphics/skia/ImageSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.cpp',
-            'platform/graphics/skia/ImageSourceSkia.h',
             'platform/graphics/skia/IntPointSkia.cpp',
             'platform/graphics/skia/IntRectSkia.cpp',
             'platform/graphics/skia/NativeImageSkia.cpp',
@@ -1996,7 +2113,6 @@
             'platform/graphics/wx/GraphicsContextWx.cpp',
             'platform/graphics/wx/ImageBufferData.h',
             'platform/graphics/wx/ImageBufferWx.cpp',
-            'platform/graphics/wx/ImageSourceWx.cpp',
             'platform/graphics/wx/ImageWx.cpp',
             'platform/graphics/wx/IntPointWx.cpp',
             'platform/graphics/wx/IntRectWx.cpp',
@@ -2034,6 +2150,7 @@
             'platform/graphics/FontFastPath.cpp',
             'platform/graphics/FontRenderingMode.h',
             'platform/graphics/FontSelector.h',
+            'platform/graphics/FontSmoothingMode.h',
             'platform/graphics/FontTraitsMask.h',
             'platform/graphics/GeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
@@ -2047,6 +2164,7 @@
             'platform/graphics/Gradient.h',
             'platform/graphics/GraphicsContext.cpp',
             'platform/graphics/GraphicsContext.h',
+            'platform/graphics/GraphicsContext3D.h',
             'platform/graphics/GraphicsContextPrivate.h',
             'platform/graphics/GraphicsLayer.cpp',
             'platform/graphics/GraphicsLayer.h',
@@ -2060,6 +2178,7 @@
             'platform/graphics/ImageBuffer.h',
             'platform/graphics/ImageObserver.h',
             'platform/graphics/ImageSource.h',
+            'platform/graphics/ImageSource.cpp',
             'platform/graphics/IntPoint.h',
             'platform/graphics/IntRect.cpp',
             'platform/graphics/IntRect.h',
@@ -2129,20 +2248,25 @@
             'platform/gtk/gtkdrawing.h',
             'platform/gtk/guriescape.h',
             'platform/image-decoders/ImageDecoder.h',
+            'platform/image-decoders/ImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.cpp',
             'platform/image-decoders/bmp/BMPImageDecoder.h',
             'platform/image-decoders/bmp/BMPImageReader.cpp',
             'platform/image-decoders/bmp/BMPImageReader.h',
+            'platform/image-decoders/cairo/ImageDecoderCairo.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.cpp',
             'platform/image-decoders/gif/GIFImageDecoder.h',
             'platform/image-decoders/gif/GIFImageReader.cpp',
             'platform/image-decoders/gif/GIFImageReader.h',
+            'platform/image-decoders/haiku/ImageDecoderHaiku.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.cpp',
             'platform/image-decoders/ico/ICOImageDecoder.h',
             'platform/image-decoders/jpeg/JPEGImageDecoder.cpp',
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
+            'platform/image-decoders/wx/ImageDecoderWx.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.cpp',
             'platform/image-decoders/xbm/XBMImageDecoder.h',
             'platform/image-decoders/zlib/crc32.h',
@@ -2156,7 +2280,6 @@
             'platform/image-decoders/zlib/zconf.h',
             'platform/image-decoders/zlib/zlib.h',
             'platform/image-decoders/zlib/zutil.h',
-            'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.cpp',
             'platform/image-encoders/skia/PNGImageEncoder.h',
             'platform/mac/AutodrainedPool.mm',
@@ -2231,6 +2354,9 @@
             'platform/network/cf/ResourceResponse.h',
             'platform/network/cf/ResourceResponseCFNet.cpp',
             'platform/network/cf/ResourceResponseCFNet.h',
+            'platform/network/cf/SocketStreamError.h',
+            'platform/network/cf/SocketStreamHandle.h',
+            'platform/network/cf/SocketStreamHandleCFNet.cpp',
             'platform/network/chromium/AuthenticationChallenge.h',
             'platform/network/chromium/AuthenticationChallengeChromium.cpp',
             'platform/network/chromium/CookieJarChromium.cpp',
@@ -2240,6 +2366,8 @@
             'platform/network/chromium/ResourceError.h',
             'platform/network/chromium/ResourceRequest.h',
             'platform/network/chromium/ResourceResponse.h',
+            'platform/network/chromium/SocketStreamError.h',
+            'platform/network/chromium/SocketStreamHandle.h',
             'platform/network/curl/AuthenticationChallenge.h',
             'platform/network/curl/CookieJarCurl.cpp',
             'platform/network/curl/DNSCurl.cpp',
@@ -2282,6 +2410,9 @@
             'platform/network/soup/ResourceHandleSoup.cpp',
             'platform/network/soup/ResourceRequest.h',
             'platform/network/soup/ResourceResponse.h',
+            'platform/network/soup/SocketStreamError.h',
+            'platform/network/soup/SocketStreamHandle.h',
+            'platform/network/soup/SocketStreamHandleSoup.cpp',
             'platform/network/soup/webkit-soup-auth-dialog.c',
             'platform/network/soup/webkit-soup-auth-dialog.h',
             'platform/network/win/CookieJarCFNetWin.cpp',
@@ -2316,6 +2447,11 @@
             'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
             'platform/network/ResourceResponseBase.h',
+            'platform/network/SocketStreamErrorBase.cpp',
+            'platform/network/SocketStreamErrorBase.h',
+            'platform/network/SocketStreamHandleBase.cpp',
+            'platform/network/SocketStreamHandleBase.h',
+            'platform/network/SocketStreamHandleClient.h',
             'platform/posix/FileSystemPOSIX.cpp',
             'platform/qt/ClipboardQt.cpp',
             'platform/qt/ClipboardQt.h',
@@ -2367,8 +2503,7 @@
             'platform/sql/SQLiteTransaction.cpp',
             'platform/sql/SQLiteTransaction.h',
             'platform/sql/chromium/SQLiteFileSystemChromium.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp',
-            'platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp',
+            'platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp',
             'platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp',
             'platform/symbian/FloatPointSymbian.cpp',
             'platform/symbian/FloatRectSymbian.cpp',
@@ -2541,6 +2676,7 @@
             'platform/ContextMenu.cpp',
             'platform/ContextMenu.h',
             'platform/ContextMenuItem.h',
+            'platform/Cookie.h',
             'platform/CookieJar.h',
             'platform/CrossThreadCopier.h',
             'platform/CrossThreadCopier.cpp',
@@ -2578,6 +2714,8 @@
             'platform/Logging.h',
             'platform/MIMETypeRegistry.cpp',
             'platform/MIMETypeRegistry.h',
+            'platform/mock/GeolocationServiceMock.cpp',
+            'platform/mock/GeolocationServiceMock.h',
             'platform/NotImplemented.h',
             'platform/Pasteboard.h',
             'platform/PlatformKeyboardEvent.h',
@@ -2807,6 +2945,8 @@
             'rendering/RenderMarquee.h',
             'rendering/RenderMedia.cpp',
             'rendering/RenderMedia.h',
+            'rendering/RenderMediaControlsChromium.cpp',
+            'rendering/RenderMediaControlsChromium.h',
             'rendering/RenderMenuList.cpp',
             'rendering/RenderMenuList.h',
             'rendering/RenderObject.cpp',
@@ -2963,6 +3103,10 @@
             'storage/SQLTransaction.cpp',
             'storage/SQLTransaction.h',
             'storage/SQLTransactionCallback.h',
+            'storage/SQLTransactionClient.h',
+            'storage/SQLTransactionClient.cpp',
+            'storage/SQLTransactionCoordinator.h',
+            'storage/SQLTransactionCoordinator.cpp',
             'storage/SQLTransactionErrorCallback.h',
             'storage/Storage.cpp',
             'storage/Storage.h',
@@ -2973,6 +3117,8 @@
             'storage/StorageAreaSync.h',
             'storage/StorageEvent.cpp',
             'storage/StorageEvent.h',
+            'storage/StorageEventDispatcher.cpp',
+            'storage/StorageEventDispatcher.h',
             'storage/StorageMap.cpp',
             'storage/StorageMap.h',
             'storage/StorageNamespace.cpp',
@@ -3089,8 +3235,6 @@
             'svg/SVGComponentTransferFunctionElement.h',
             'svg/SVGCursorElement.cpp',
             'svg/SVGCursorElement.h',
-            'svg/SVGDefinitionSrcElement.cpp',
-            'svg/SVGDefinitionSrcElement.h',
             'svg/SVGDefsElement.cpp',
             'svg/SVGDefsElement.h',
             'svg/SVGDescElement.cpp',
@@ -3326,6 +3470,13 @@
             'svg/SVGZoomEvent.cpp',
             'svg/SVGZoomEvent.h',
             'svg/SynchronizableTypeWrapper.h',
+            'websockets/WebSocket.cpp',
+            'websockets/WebSocket.h',
+            'websockets/WebSocketChannel.cpp',
+            'websockets/WebSocketChannel.h',
+            'websockets/WebSocketChannelClient.h',
+            'websockets/WebSocketHandshake.cpp',
+            'websockets/WebSocketHandshake.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -3353,6 +3504,7 @@
             'workers/WorkerMessagingProxy.cpp',
             'workers/WorkerMessagingProxy.h',
             'workers/WorkerObjectProxy.h',
+            'workers/WorkerReportingProxy.h',
             'workers/WorkerRunLoop.cpp',
             'workers/WorkerRunLoop.h',
             'workers/WorkerScriptLoader.cpp',
@@ -3405,11 +3557,12 @@
             'xml/XPathVariableReference.h',
             'xml/XSLImportRule.cpp',
             'xml/XSLImportRule.h',
-            'xml/XSLStyleSheet.cpp',
+            'xml/XSLStyleSheetLibxslt.cpp',
             'xml/XSLStyleSheet.h',
             'xml/XSLTExtensions.cpp',
             'xml/XSLTExtensions.h',
             'xml/XSLTProcessor.cpp',
+            'xml/XSLTProcessorLibxslt.cpp',
             'xml/XSLTProcessor.h',
             'xml/XSLTUnicodeSort.cpp',
             'xml/XSLTUnicodeSort.h',
@@ -3425,9 +3578,9 @@
             'inspector/front-end/ChangesView.js',
             'inspector/front-end/Color.js',
             'inspector/front-end/ConsoleView.js',
+            'inspector/front-end/CookieItemsView.js',
             'inspector/front-end/Database.js',
             'inspector/front-end/DatabaseQueryView.js',
-            'inspector/front-end/DatabasesPanel.js',
             'inspector/front-end/DatabaseTableView.js',
             'inspector/front-end/DataGrid.js',
             'inspector/front-end/DOMAgent.js',
@@ -3437,9 +3590,11 @@
             'inspector/front-end/Drawer.js',
             'inspector/front-end/ElementsPanel.js',
             'inspector/front-end/ElementsTreeOutline.js',
+            'inspector/front-end/EventListenersSidebarPane.js',
             'inspector/front-end/FontView.js',
             'inspector/front-end/ImageView.js',
             'inspector/front-end/InjectedScript.js',
+            'inspector/front-end/InjectedScriptAccess.js',
             'inspector/front-end/inspector.js',
             'inspector/front-end/KeyboardShortcut.js',
             'inspector/front-end/MetricsSidebarPane.js',
@@ -3449,6 +3604,7 @@
             'inspector/front-end/Panel.js',
             'inspector/front-end/PanelEnablerView.js',
             'inspector/front-end/Placard.js',
+            'inspector/front-end/Popup.js',
             'inspector/front-end/ProfileDataGridTree.js',
             'inspector/front-end/ProfilesPanel.js',
             'inspector/front-end/ProfileView.js',
@@ -3466,13 +3622,19 @@
             'inspector/front-end/SidebarTreeElement.js',
             'inspector/front-end/SourceFrame.js',
             'inspector/front-end/SourceView.js',
+            'inspector/front-end/StatusBarButton.js',
+            'inspector/front-end/StoragePanel.js',
             'inspector/front-end/StylesSidebarPane.js',
+            'inspector/front-end/SummaryBar.js',
             'inspector/front-end/TextPrompt.js',
+            'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TopDownProfileDataGridTree.js',
             'inspector/front-end/treeoutline.js',
             'inspector/front-end/utilities.js',
             'inspector/front-end/View.js',
+            'inspector/front-end/WatchExpressionsSidebarPane.js',
             'inspector/front-end/inspector.css',
+            'inspector/front-end/inspectorSyntaxHighlight.css',
         ],
         'webinspector_image_files': [
 
@@ -3481,8 +3643,8 @@
             'inspector/front-end/Images/clearConsoleButtonGlyph.png',
             'inspector/front-end/Images/closeButtons.png',
             'inspector/front-end/Images/consoleButtonGlyph.png',
+            'inspector/front-end/Images/cookie.png',
             'inspector/front-end/Images/database.png',
-            'inspector/front-end/Images/databasesIcon.png',
             'inspector/front-end/Images/databaseTable.png',
             'inspector/front-end/Images/debuggerContinue.png',
             'inspector/front-end/Images/debuggerPause.png',
@@ -3499,7 +3661,6 @@
             'inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png',
             'inspector/front-end/Images/disclosureTriangleSmallRightWhite.png',
             'inspector/front-end/Images/dockButtonGlyph.png',
-            'inspector/front-end/Images/domStorage.png',
             'inspector/front-end/Images/elementsIcon.png',
             'inspector/front-end/Images/enableOutlineButtonGlyph.png',
             'inspector/front-end/Images/enableSolidButtonGlyph.png',
@@ -3515,7 +3676,9 @@
             'inspector/front-end/Images/goArrow.png',
             'inspector/front-end/Images/graphLabelCalloutLeft.png',
             'inspector/front-end/Images/graphLabelCalloutRight.png',
+            'inspector/front-end/Images/grayConnectorPoint.png',
             'inspector/front-end/Images/largerResourcesButtonGlyph.png',
+            'inspector/front-end/Images/localStorage.png',
             'inspector/front-end/Images/nodeSearchButtonGlyph.png',
             'inspector/front-end/Images/paneBottomGrow.png',
             'inspector/front-end/Images/paneBottomGrowActive.png',
@@ -3553,6 +3716,7 @@
             'inspector/front-end/Images/segmentHoverEnd.png',
             'inspector/front-end/Images/segmentSelected.png',
             'inspector/front-end/Images/segmentSelectedEnd.png',
+            'inspector/front-end/Images/sessionStorage.png',
             'inspector/front-end/Images/splitviewDimple.png',
             'inspector/front-end/Images/splitviewDividerBackground.png',
             'inspector/front-end/Images/statusbarBackground.png',
@@ -3562,6 +3726,7 @@
             'inspector/front-end/Images/statusbarMenuButtonSelected.png',
             'inspector/front-end/Images/statusbarResizerHorizontal.png',
             'inspector/front-end/Images/statusbarResizerVertical.png',
+            'inspector/front-end/Images/storageIcon.png',
             'inspector/front-end/Images/timelineHollowPillBlue.png',
             'inspector/front-end/Images/timelineHollowPillGray.png',
             'inspector/front-end/Images/timelineHollowPillGreen.png',
@@ -3594,6 +3759,7 @@
             'inspector/front-end/Images/warningIcon.png',
             'inspector/front-end/Images/warningMediumIcon.png',
             'inspector/front-end/Images/warningsErrors.png',
+            'inspector/front-end/Images/whiteConnectorPoint.png'
         ],
     }
 }
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index 31b178c..c1040e2 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -334,8 +334,6 @@ __ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
 __ZN7WebCore6Widget21releasePlatformWidgetEv
 __ZN7WebCore6Widget20retainPlatformWidgetEv
-__ZN7WebCore9FrameView14initScrollbarsEv
-__ZN7WebCore9FrameView27updateDefaultScrollbarStateEv
 __ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
 __ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
 __ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
@@ -1267,7 +1265,7 @@ __ZNK7WebCore4KURL11createCFURLEv
 __ZNK7WebCore4KURL12copyToBufferERN3WTF6VectorIcLm512EEE
 __ZNK7WebCore19ResourceRequestBase11cachePolicyEv
 __ZNK7WebCore19ResourceRequestBase15timeoutIntervalEv
-__ZNK7WebCore19ResourceRequestBase16allowHTTPCookiesEv
+__ZNK7WebCore19ResourceRequestBase16allowCookiesEv
 __ZNK7WebCore19ResourceRequestBase16httpHeaderFieldsEv
 __ZNK7WebCore19ResourceRequestBase8httpBodyEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
@@ -2290,7 +2288,6 @@ __ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
 __ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
 __ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
 __ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
-__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
 __ZN7WebCore6StringC1ERKN3JSC7UStringE
 __ZN7WebCore6StringC2ERKN3JSC7UStringE
 __ZNK7WebCore20StringSourceProvider4dataEv
@@ -5760,7 +5757,6 @@ __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashI
 __ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
 __ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
 __ZN7WebCore16RenderPartObject11viewClearedEv
-__ZN7WebCore9FrameView20setCanHaveScrollbarsEb
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
 __ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
@@ -7855,6 +7851,7 @@ __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
 __ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKNS_6StringE
 __ZN7WebCore19InspectorController5closeEv
 __ZN7WebCore15BackForwardList5closeEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
@@ -20833,7 +20830,7 @@ __ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
 __ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
 __ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
-__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore19ResourceRequestBase19setAllowCookiesEb
 __ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
 __ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
 __ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 6a19309..24ce0c9 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -10,7 +10,12 @@ symbian: {
     webkitlibs.sources = QtWebKit.dll
     webkitlibs.path = /sys/bin
     DEPLOYMENT += webkitlibs
+
+    TARGET.UID3 = 0x200267C2
 }
+# RO-section in qtwebkit.dll exceeds allocated space in SBSv2. Move RW-section
+# base address to start from 0x800000 instead of the toolchain default 0x400000.
+symbian-sbsv2: MMP_RULES += "LINKEROPTION  armcc --rw-base 0x800000"
 
 include($$PWD/../WebKit.pri)
 
@@ -98,7 +103,7 @@ CONFIG(QTDIR_build) {
 # Optional components (look for defs in config.h and included files!)
 
 contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
-    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0 ENABLE_SHARED_WORKERS=0
 }
 
 # turn off SQLITE support if we do not have sqlite3 available
@@ -106,10 +111,12 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 
 !contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
 !contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
+!contains(DEFINES, ENABLE_EVENTSOURCE=.): DEFINES += ENABLE_EVENTSOURCE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 !contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
+!contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
 
 # turn on SQLITE support if any of the dependent features are turned on
 !contains(DEFINES, ENABLE_SQLITE=.) {
@@ -123,10 +130,10 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
 !contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
-!contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
+!contains(DEFINES, ENABLE_WCSS=.): DEFINES += ENABLE_WCSS=0
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=0
+!contains(DEFINES, ENABLE_SHARED_WORKERS=.): DEFINES += ENABLE_SHARED_WORKERS=1
 !contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
 !contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
 !contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=1
@@ -152,6 +159,9 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     else:DEFINES += ENABLE_VIDEO=0
 }
 
+# HTML5 datalist support
+!contains(DEFINES, ENABLE_DATALIST=.): DEFINES += ENABLE_DATALIST=1
+
 # Nescape plugins support (NPAPI)
 !contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
     unix|win32-*:!embedded:!wince*:!symbian {
@@ -161,6 +171,15 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
     }
 }
 
+# Web Socket support.
+!contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
+
+# XSLT support with QtXmlPatterns
+!contains(DEFINES, ENABLE_XSLT=.) {
+    contains(QT_CONFIG, xmlpatterns):!lessThan(QT_MINOR_VERSION, 5):DEFINES += ENABLE_XSLT=1
+    else:DEFINES += ENABLE_XSLT=0
+}
+
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
 # Used to compute defaults for the build-webkit script
@@ -170,9 +189,12 @@ CONFIG(compute_defaults) {
 }
 
 RESOURCES += \
-    $$PWD/../WebCore/inspector/front-end/WebKit.qrc \
     $$PWD/../WebCore/WebCore.qrc
 
+!symbian {
+    RESOURCES += $$PWD/../WebCore/inspector/front-end/WebKit.qrc
+}
+
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
 INCLUDEPATH = \
@@ -193,6 +215,7 @@ INCLUDEPATH = \
     $$PWD/loader/appcache \
     $$PWD/loader/archive \
     $$PWD/loader/icon \
+    $$PWD/notifications \
     $$PWD/page \
     $$PWD/page/animation \
     $$PWD/platform \
@@ -201,6 +224,7 @@ INCLUDEPATH = \
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/image-decoders \
+    $$PWD/platform/mock \
     $$PWD/platform/network \
     $$PWD/platform/sql \
     $$PWD/platform/text \
@@ -212,6 +236,7 @@ INCLUDEPATH = \
     $$PWD/svg/animation \
     $$PWD/svg/graphics \
     $$PWD/svg/graphics/filters \
+    $$PWD/websockets \
     $$PWD/wml \
     $$PWD/workers \
     $$PWD/xml \
@@ -254,9 +279,16 @@ WALDOCSSVALUES = $$PWD/css/CSSValueKeywords.in
 
 DASHBOARDSUPPORTCSSPROPERTIES = $$PWD/css/DashboardSupportCSSPropertyNames.in
 
-SVGCSSPROPERTIES = $$PWD/css/SVGCSSPropertyNames.in
 
-SVGCSSVALUES = $$PWD/css/SVGCSSValueKeywords.in
+contains(DEFINES, ENABLE_SVG=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/SVGCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/SVGCSSValueKeywords.in
+}
+
+contains(DEFINES, ENABLE_WCSS=1) {
+    EXTRACSSPROPERTIES += $$PWD/css/WCSSPropertyNames.in
+    EXTRACSSVALUES += $$PWD/css/WCSSValueKeywords.in
+}
 
 STYLESHEETS_EMBED = \
     $$PWD/css/html.css \
@@ -264,7 +296,8 @@ STYLESHEETS_EMBED = \
     $$PWD/css/svg.css \
     $$PWD/css/view-source.css \
     $$PWD/css/wml.css \
-    $$PWD/css/mediaControls.css
+    $$PWD/css/mediaControls.css \
+    $$PWD/css/mediaControlsQt.css
 
 DOMLUT_FILES += \
     bindings/js/JSDOMWindowBase.cpp \
@@ -298,6 +331,7 @@ IDL_BINDINGS += \
     css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
+    dom/BeforeLoadEvent.idl \
     dom/CharacterData.idl \
     dom/ClientRect.idl \
     dom/ClientRectList.idl \
@@ -330,6 +364,7 @@ IDL_BINDINGS += \
     dom/NodeList.idl \
     dom/Notation.idl \
     dom/OverflowEvent.idl \
+    dom/PageTransitionEvent.idl \
     dom/ProcessingInstruction.idl \
     dom/ProgressEvent.idl \
     dom/RangeException.idl \
@@ -341,9 +376,20 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
+    html/canvas/CanvasArray.idl \
+    html/canvas/CanvasArrayBuffer.idl \
+    html/canvas/CanvasByteArray.idl \
+    html/canvas/CanvasFloatArray.idl \
     html/canvas/CanvasGradient.idl \
+    html/canvas/CanvasIntArray.idl \
     html/canvas/CanvasPattern.idl \
+    html/canvas/CanvasRenderingContext.idl \
     html/canvas/CanvasRenderingContext2D.idl \
+    html/canvas/CanvasRenderingContext3D.idl \
+    html/canvas/CanvasShortArray.idl \
+    html/canvas/CanvasUnsignedByteArray.idl \
+    html/canvas/CanvasUnsignedIntArray.idl \
+    html/canvas/CanvasUnsignedShortArray.idl \
     html/DataGridColumn.idl \
     html/DataGridColumnList.idl \
     html/File.idl \
@@ -364,6 +410,7 @@ IDL_BINDINGS += \
     html/HTMLDataGridCellElement.idl \
     html/HTMLDataGridColElement.idl \
     html/HTMLDataGridRowElement.idl \
+    html/HTMLDataListElement.idl \
     html/HTMLDirectoryElement.idl \
     html/HTMLDivElement.idl \
     html/HTMLDListElement.idl \
@@ -430,6 +477,7 @@ IDL_BINDINGS += \
     page/Coordinates.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
+    page/EventSource.idl \
     page/Geolocation.idl \
     page/Geoposition.idl \
     page/History.idl \
@@ -475,7 +523,6 @@ IDL_BINDINGS += \
     svg/SVGColor.idl \
     svg/SVGComponentTransferFunctionElement.idl \
     svg/SVGCursorElement.idl \
-    svg/SVGDefinitionSrcElement.idl \
     svg/SVGDefsElement.idl \
     svg/SVGDescElement.idl \
     svg/SVGDocument.idl \
@@ -583,6 +630,7 @@ IDL_BINDINGS += \
     svg/SVGUnitTypes.idl \
     svg/SVGUseElement.idl \
     svg/SVGViewElement.idl \
+    websockets/WebSocket.idl \
     workers/AbstractWorker.idl \
     workers/DedicatedWorkerContext.idl \
     workers/SharedWorker.idl \
@@ -606,6 +654,7 @@ IDL_BINDINGS += \
 
 SOURCES += \
     accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityMediaControls.cpp \    
     accessibility/AccessibilityObject.cpp \    
     accessibility/AccessibilityList.cpp \    
     accessibility/AccessibilityListBox.cpp \    
@@ -622,12 +671,15 @@ SOURCES += \
     accessibility/AccessibilityTableRow.cpp \    
     accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
+    bindings/js/JSCallbackData.cpp \
     bindings/js/JSAttrCustom.cpp \
     bindings/js/JSCDATASectionCustom.cpp \
+    bindings/js/JSCanvasRenderingContextCustom.cpp \
     bindings/js/JSCanvasRenderingContext2DCustom.cpp \
     bindings/js/JSClipboardCustom.cpp \
     bindings/js/JSConsoleCustom.cpp \
     bindings/js/JSCSSRuleCustom.cpp \
+    bindings/js/JSCSSRuleListCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
     bindings/js/JSCoordinatesCustom.cpp \
@@ -645,11 +697,14 @@ SOURCES += \
     bindings/js/JSDOMWindowShell.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
+    bindings/js/JSEventSourceConstructor.cpp \
+    bindings/js/JSEventSourceCustom.cpp \
     bindings/js/JSEventTarget.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
+    bindings/js/JSHTMLCanvasElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
     bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
@@ -670,7 +725,6 @@ SOURCES += \
     bindings/js/JSInspectorCallbackWrapper.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
-    bindings/js/JSNamedNodesCollection.cpp  \
     bindings/js/JSNavigatorCustom.cpp  \
     bindings/js/JSNodeCustom.cpp \
     bindings/js/JSNodeFilterCondition.cpp \
@@ -692,7 +746,9 @@ SOURCES += \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
     bindings/js/JSMessageChannelCustom.cpp \
+    bindings/js/JSMessageEventCustom.cpp \
     bindings/js/JSMessagePortCustom.cpp \
+    bindings/js/JSMessagePortCustom.h \
     bindings/js/JSMimeTypeArrayCustom.cpp \
     bindings/js/JSDOMBinding.cpp \
     bindings/js/JSEventListener.cpp \
@@ -710,6 +766,7 @@ SOURCES += \
     bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bindings/js/SerializedScriptValue.cpp \
     bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
@@ -836,6 +893,7 @@ SOURCES += \
     dom/OptionGroupElement.cpp \
     dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
+    dom/PageTransitionEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
     dom/ProcessingInstruction.cpp \
@@ -862,7 +920,6 @@ SOURCES += \
     dom/WheelEvent.cpp \
     dom/XMLTokenizer.cpp \
     dom/XMLTokenizerQt.cpp \
-    dom/XMLTokenizerScope.cpp \
     dom/default/PlatformMessagePortChannel.cpp \
     editing/AppendNodeCommand.cpp \
     editing/ApplyStyleCommand.cpp \
@@ -920,6 +977,7 @@ SOURCES += \
     html/canvas/CanvasGradient.cpp \
     html/canvas/CanvasPattern.cpp \
     html/canvas/CanvasPixelArray.cpp \
+    html/canvas/CanvasRenderingContext.cpp \
     html/canvas/CanvasRenderingContext2D.cpp \
     html/canvas/CanvasStyle.cpp \
     html/CollectionCache.cpp \
@@ -944,6 +1002,7 @@ SOURCES += \
     html/HTMLDataGridCellElement.cpp \
     html/HTMLDataGridColElement.cpp \
     html/HTMLDataGridRowElement.cpp \
+    html/HTMLDataListElement.cpp \
     html/HTMLDirectoryElement.cpp \
     html/HTMLDivElement.cpp \
     html/HTMLDListElement.cpp \
@@ -1013,17 +1072,19 @@ SOURCES += \
     html/PreloadScanner.cpp \
     html/ValidityState.cpp \
     inspector/ConsoleMessage.cpp \
+    inspector/DOMDispatchTimelineItem.cpp \
     inspector/InspectorBackend.cpp \
+    inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDOMAgent.cpp \
     inspector/InspectorDOMStorageResource.cpp \
-    inspector/InspectorController.cpp \
     inspector/InspectorFrontend.cpp \
     inspector/InspectorResource.cpp \
+    inspector/InspectorTimelineAgent.cpp \
+    inspector/TimelineItem.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
-    loader/UserStyleSheetLoader.cpp \
     loader/Cache.cpp \
     loader/CachedCSSStyleSheet.cpp \
     loader/CachedFont.cpp \
@@ -1052,7 +1113,10 @@ SOURCES += \
     loader/NetscapePlugInStreamLoader.cpp \
     loader/PlaceholderDocument.cpp \
     loader/PluginDocument.cpp \
+    loader/PolicyCallback.cpp \
+    loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
+    loader/RedirectScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
     loader/SubresourceLoader.cpp \
@@ -1068,7 +1132,6 @@ SOURCES += \
     page/Chrome.cpp \
     page/Console.cpp \
     page/ContextMenuController.cpp \
-    page/Coordinates.cpp \
     page/DOMSelection.cpp \
     page/DOMTimer.cpp \
     page/DOMWindow.cpp \
@@ -1076,22 +1139,25 @@ SOURCES += \
     page/NavigatorBase.cpp \
     page/DragController.cpp \
     page/EventHandler.cpp \
+    page/EventSource.cpp \
     page/FocusController.cpp \
     page/Frame.cpp \
     page/FrameTree.cpp \
     page/FrameView.cpp \
     page/Geolocation.cpp \
-    page/Geoposition.cpp \
     page/History.cpp \
     page/Location.cpp \
     page/MouseEventWithHitTestResults.cpp \
+    page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/PluginHalter.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
+    page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
     plugins/PluginData.cpp \
@@ -1115,6 +1181,7 @@ SOURCES += \
     platform/DragImage.cpp \
     platform/FileChooser.cpp \
     platform/GeolocationService.cpp \
+    platform/image-decoders/qt/RGBA32BufferQt.cpp \
     platform/graphics/FontDescription.cpp \
     platform/graphics/FontFamily.cpp \
     platform/graphics/BitmapImage.cpp \
@@ -1132,6 +1199,7 @@ SOURCES += \
     platform/graphics/GraphicsTypes.cpp \
     platform/graphics/Image.cpp \
     platform/graphics/ImageBuffer.cpp \
+    platform/graphics/ImageSource.cpp \
     platform/graphics/IntRect.cpp \
     platform/graphics/Path.cpp \
     platform/graphics/PathTraversalState.cpp \
@@ -1153,6 +1221,7 @@ SOURCES += \
     platform/LinkHash.cpp \
     platform/Logging.cpp \
     platform/MIMETypeRegistry.cpp \
+    platform/mock/GeolocationServiceMock.cpp \
     platform/network/AuthenticationChallengeBase.cpp \
     platform/network/Credential.cpp \
     platform/network/FormData.cpp \
@@ -1293,6 +1362,7 @@ HEADERS += \
     accessibility/AccessibilityListBox.h \
     accessibility/AccessibilityListBoxOption.h \
     accessibility/AccessibilityList.h \
+    accessibility/AccessibilityMediaControls.h \
     accessibility/AccessibilityObject.h \
     accessibility/AccessibilityRenderObject.h \
     accessibility/AccessibilitySlider.h \
@@ -1305,6 +1375,7 @@ HEADERS += \
     bindings/js/CachedScriptSourceProvider.h \
     bindings/js/DOMObjectWithSVGContext.h \
     bindings/js/GCController.h \
+    bindings/js/JSCallbackData.h \
     bindings/js/JSAudioConstructor.h \
     bindings/js/JSCSSStyleDeclarationCustom.h \
     bindings/js/JSCustomPositionCallback.h \
@@ -1323,6 +1394,7 @@ HEADERS += \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
     bindings/js/JSEventListener.h \
+    bindings/js/JSEventSourceConstructor.h \
     bindings/js/JSEventTarget.h \
     bindings/js/JSHistoryCustom.h \
     bindings/js/JSHTMLAllCollection.h \
@@ -1337,7 +1409,6 @@ HEADERS += \
     bindings/js/JSLazyEventListener.h \
     bindings/js/JSLocationCustom.h \
     bindings/js/JSMessageChannelConstructor.h \
-    bindings/js/JSNamedNodesCollection.h \
     bindings/js/JSNodeFilterCondition.h \
     bindings/js/JSOptionConstructor.h \
     bindings/js/JSPluginElementFunctions.h \
@@ -1365,6 +1436,7 @@ HEADERS += \
     bindings/js/ScriptSourceProvider.h \
     bindings/js/ScriptState.h \
     bindings/js/ScriptValue.h \
+    bindings/js/SerializedScriptValue.h \
     bindings/js/StringSourceProvider.h \
     bindings/js/WorkerScriptController.h \
     bridge/c/c_class.h \
@@ -1496,6 +1568,7 @@ HEADERS += \
     dom/OptionElement.h \
     dom/OptionGroupElement.h \
     dom/OverflowEvent.h \
+    dom/PageTransitionEvent.h \
     dom/Position.h \
     dom/PositionIterator.h \
     dom/ProcessingInstruction.h \
@@ -1513,6 +1586,7 @@ HEADERS += \
     dom/TagNodeList.h \
     dom/TextEvent.h \
     dom/Text.h \
+    dom/TransformSource.h \
     dom/Traversal.h \
     dom/TreeWalker.h \
     dom/UIEvent.h \
@@ -1521,7 +1595,6 @@ HEADERS += \
     dom/WebKitTransitionEvent.h \
     dom/WheelEvent.h \
     dom/XMLTokenizer.h \
-    dom/XMLTokenizerScope.h \
     editing/AppendNodeCommand.h \
     editing/ApplyStyleCommand.h \
     editing/BreakBlockquoteCommand.h \
@@ -1575,6 +1648,7 @@ HEADERS += \
     html/canvas/CanvasGradient.h \
     html/canvas/CanvasPattern.h \
     html/canvas/CanvasPixelArray.h \
+    html/canvas/CanvasRenderingContext.h \
     html/canvas/CanvasRenderingContext2D.h \
     html/canvas/CanvasStyle.h \
     html/CollectionCache.h \
@@ -1673,16 +1747,19 @@ HEADERS += \
     html/TimeRanges.h \
     html/ValidityState.h \
     inspector/ConsoleMessage.h \
+    inspector/DOMDispatchTimelineItem.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontend.h \
     inspector/InspectorResource.h \
+    inspector/InspectorTimelineAgent.h \
     inspector/JavaScriptCallFrame.h \
     inspector/JavaScriptDebugServer.h \
     inspector/JavaScriptProfile.h \
     inspector/JavaScriptProfileNode.h \
+    inspector/TimelineItem.h \
     loader/appcache/ApplicationCacheGroup.h \
     loader/appcache/ApplicationCacheHost.h \
     loader/appcache/ApplicationCache.h \
@@ -1731,7 +1808,6 @@ HEADERS += \
     loader/TextDocument.h \
     loader/TextResourceDecoder.h \
     loader/ThreadableLoader.h \
-    loader/UserStyleSheetLoader.h \
     loader/WorkerThreadableLoader.h \
     page/animation/AnimationBase.h \
     page/animation/AnimationController.h \
@@ -1748,12 +1824,14 @@ HEADERS += \
     page/DOMWindow.h \
     page/DragController.h \
     page/EventHandler.h \
+    page/EventSource.h \
     page/FocusController.h \
     page/Frame.h \
     page/FrameTree.h \
     page/FrameView.h \
     page/Geolocation.h \
     page/Geoposition.h \
+    page/HaltablePlugin.h \
     page/History.h \
     page/Location.h \
     page/MouseEventWithHitTestResults.h \
@@ -1762,6 +1840,8 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
+    page/PluginHalter.h \
+    page/PluginHalterClient.h \
     page/PrintContext.h \
     page/Screen.h \
     page/SecurityOrigin.h \
@@ -1780,6 +1860,8 @@ HEADERS += \
     platform/DragImage.h \
     platform/FileChooser.h \
     platform/GeolocationService.h \
+    platform/image-decoders/ImageDecoder.h \
+    platform/mock/GeolocationServiceMock.h \
     platform/graphics/BitmapImage.h \
     platform/graphics/Color.h \
     platform/graphics/filters/FEBlend.h \
@@ -1803,6 +1885,7 @@ HEADERS += \
     platform/graphics/GraphicsContext.h \
     platform/graphics/GraphicsTypes.h \
     platform/graphics/Image.h \
+    platform/graphics/ImageSource.h \
     platform/graphics/IntRect.h \
     platform/graphics/MediaPlayer.h \
     platform/graphics/Path.h \
@@ -1842,6 +1925,7 @@ HEADERS += \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
     platform/qt/ClipboardQt.h \
+    platform/qt/QWebPageClient.h \
     platform/qt/QWebPopup.h \
     platform/qt/RenderThemeQt.h \
     platform/qt/ScrollbarThemeQt.h \
@@ -2050,7 +2134,6 @@ HEADERS += \
     svg/SVGColor.h \
     svg/SVGComponentTransferFunctionElement.h \
     svg/SVGCursorElement.h \
-    svg/SVGDefinitionSrcElement.h \
     svg/SVGDefsElement.h \
     svg/SVGDescElement.h \
     svg/SVGDocumentExtensions.h \
@@ -2237,6 +2320,7 @@ HEADERS += \
     xml/XSLTProcessor.h \
     xml/XSLTUnicodeSort.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
+    $$PWD/platform/network/qt/DnsPrefetchHelper.h
 
 SOURCES += \
     accessibility/qt/AccessibilityObjectQt.cpp \
@@ -2260,7 +2344,6 @@ SOURCES += \
     platform/graphics/qt/ImageBufferQt.cpp \
     platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
-    platform/graphics/qt/ImageSourceQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
     platform/graphics/qt/IntSizeQt.cpp \
@@ -2269,6 +2352,7 @@ SOURCES += \
     platform/graphics/qt/StillImageQt.cpp \
     platform/network/qt/ResourceHandleQt.cpp \
     platform/network/qt/ResourceRequestQt.cpp \
+    platform/network/qt/DnsPrefetchHelper.cpp \
     platform/network/qt/QNetworkReplyHandler.cpp \
     editing/qt/EditorQt.cpp \
     platform/qt/ClipboardQt.cpp \
@@ -2320,6 +2404,7 @@ SOURCES += \
     ../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp \
     ../WebKit/qt/WebCoreSupport/InspectorClientQt.cpp \
     ../WebKit/qt/Api/qwebframe.cpp \
+    ../WebKit/qt/Api/qgraphicswebview.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
     ../WebKit/qt/Api/qwebelement.cpp \
@@ -2330,6 +2415,7 @@ SOURCES += \
     ../WebKit/qt/Api/qwebpluginfactory.cpp \
     ../WebKit/qt/Api/qwebsecurityorigin.cpp \
     ../WebKit/qt/Api/qwebdatabase.cpp \
+    ../WebKit/qt/Api/qwebinspector.cpp \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
 
@@ -2339,6 +2425,7 @@ SOURCES += \
         SOURCES += \
             platform/text/cf/StringCF.cpp \
             platform/text/cf/StringImplCF.cpp
+        LIBS_PRIVATE += -framework Carbon -framework AppKit
     }
 
     win32-* {
@@ -2418,6 +2505,10 @@ contains(DEFINES, ENABLE_CHANNEL_MESSAGING=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_CHANNEL_MESSAGING=1
 }
 
+contains(DEFINES, ENABLE_ORIENTATION_EVENTS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_ORIENTATION_EVENTS=1
+}
+
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
@@ -2426,6 +2517,10 @@ contains(DEFINES, ENABLE_DATAGRID=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATAGRID=1
 }
 
+contains(DEFINES, ENABLE_EVENTSOURCE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_EVENTSOURCE=1
+}
+
 contains(DEFINES, ENABLE_SQLITE=1) {
     !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
             # Build sqlite3 into WebCore from source
@@ -2473,6 +2568,8 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
         storage/SQLTransaction.cpp \
+        storage/SQLTransactionClient.cpp \
+        storage/SQLTransactionCoordinator.cpp \
         bindings/js/JSCustomSQLStatementCallback.cpp \
         bindings/js/JSCustomSQLStatementErrorCallback.cpp \
         bindings/js/JSCustomSQLTransactionCallback.cpp \
@@ -2500,10 +2597,13 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/SQLResultSetRowList.h \
         storage/SQLStatement.h \
         storage/SQLTransaction.h \
+        storage/SQLTransactionClient.h \
+        storage/SQLTransactionCoordinator.h \
         storage/StorageArea.h \
         storage/StorageAreaImpl.h \
         storage/StorageAreaSync.h \
         storage/StorageEvent.h \
+        storage/StorageEventDispatcher.h \
         storage/Storage.h \
         storage/StorageMap.h \
         storage/StorageNamespace.h \
@@ -2518,6 +2618,7 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
         storage/StorageAreaImpl.cpp \
         storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
+        storage/StorageEventDispatcher.cpp \
         storage/StorageMap.cpp \
         storage/StorageNamespace.cpp \
         storage/StorageNamespaceImpl.cpp \
@@ -2559,12 +2660,11 @@ contains(DEFINES, ENABLE_WORKERS=1) {
         workers/WorkerScriptLoader.cpp
 }
 
-contains(DEFINES, SHARED_WORKERS=1) {
+contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SHARED_WORKERS=1
 
     SOURCES += \
         bindings/js/JSSharedWorkerConstructor.cpp \
-        bindings/js/JSSharedWorkerContextCustom.cpp \
         bindings/js/JSSharedWorkerCustom.cpp \
         workers/DefaultSharedWorkerRepository.cpp \
         workers/SharedWorker.cpp \
@@ -2634,25 +2734,16 @@ unix:!mac:CONFIG += link_pkgconfig
 
 contains(DEFINES, ENABLE_XSLT=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_XSLT=1
-    PKGCONFIG += libxml-2.0 libxslt
 
-    macx {
-        INCLUDEPATH += /usr/include/libxml2
-        LIBS += -lxml2 -lxslt
-    }
-
-    win32-msvc* {
-        LIBS += -llibxml2 -llibxslt
-    }
+    QT += xmlpatterns
 
     SOURCES += \
         bindings/js/JSXSLTProcessorConstructor.cpp \
         bindings/js/JSXSLTProcessorCustom.cpp \
-        xml/XSLImportRule.cpp \
-        xml/XSLStyleSheet.cpp \
-        xml/XSLTExtensions.cpp \
+        dom/TransformSourceQt.cpp \
+        xml/XSLStyleSheetQt.cpp \
         xml/XSLTProcessor.cpp \
-        xml/XSLTUnicodeSort.cpp
+        xml/XSLTProcessorQt.cpp
 }
 
 contains(DEFINES, ENABLE_XBL=1) {
@@ -2672,6 +2763,14 @@ contains(DEFINES, ENABLE_FILTERS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
 }
 
+contains(DEFINES, ENABLE_WCSS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WCSS=1
+    contains(DEFINES, ENABLE_XHTMLMP=0) {
+        DEFINES -= ENABLE_XHTMLMP=0
+        DEFINES += ENABLE_XHTMLMP=1
+    }
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -2776,7 +2875,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGColor.cpp \
         svg/SVGComponentTransferFunctionElement.cpp \
         svg/SVGCursorElement.cpp \
-        svg/SVGDefinitionSrcElement.cpp \
         svg/SVGDefsElement.cpp \
         svg/SVGDescElement.cpp \
         svg/SVGDocument.cpp \
@@ -2980,42 +3078,25 @@ contains(DEFINES, ENABLE_SVG=1) {
         xlinknames.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(xlinknames)
 
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
-    addExtraCompilerWithHeader(cssvalues)
-} else {
-    # GENERATOR 6-A:
-    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-    cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
-    cssprops.CONFIG = target_predeps no_link
-    cssprops.variable_out =
-    cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
-    addExtraCompilerWithHeader(cssprops)
-
-    # GENERATOR 6-B:
-    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
-    cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
-    cssvalues.CONFIG = target_predeps no_link
-    cssvalues.variable_out =
-    cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
-    addExtraCompiler(cssvalues)
-}
+} 
+# GENERATOR 6-A:
+cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssprops.input = WALDOCSSPROPS
+cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$EXTRACSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+cssprops.CONFIG = target_predeps no_link
+cssprops.variable_out =
+cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES EXTRACSSPROPERTIES
+addExtraCompilerWithHeader(cssprops)
+
+# GENERATOR 6-B:
+cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
+cssvalues.input = WALDOCSSVALUES
+cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$EXTRACSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+cssvalues.CONFIG = target_predeps no_link
+cssvalues.variable_out =
+cssvalues.depend = ${QMAKE_FILE_NAME} EXTRACSSVALUES
+cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
+addExtraCompiler(cssvalues)
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
@@ -3042,6 +3123,20 @@ SOURCES += \
     bindings/js/JSDOMApplicationCacheCustom.cpp
 }
 
+contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+
+SOURCES += \
+    websockets/WebSocket.cpp \
+    websockets/WebSocketChannel.cpp \
+    websockets/WebSocketHandshake.cpp \
+    platform/network/SocketStreamErrorBase.cpp \
+    platform/network/SocketStreamHandleBase.cpp \
+    platform/network/qt/SocketStreamHandleSoup.cpp \
+    bindings/js/JSWebSocketCustom.cpp \
+    bindings/js/JSWebSocketConstructor.cpp
+}
+
 # GENERATOR 1: IDL compiler
 idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
@@ -3217,10 +3312,10 @@ HEADERS += $$WEBKIT_API_HEADERS
             !build_pass {
                 message("Building QtWebKit as a framework, as that's how Qt was built. You can")
                 message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+
+                CONFIG += build_all
             } else {
-                debug_and_release:CONFIG(debug, debug|release) {
-                    TARGET = $$qtLibraryTarget($$TARGET)
-                }
+                debug_and_release:TARGET = $$qtLibraryTarget($$TARGET)
             }
 
             CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
@@ -3231,6 +3326,7 @@ HEADERS += $$WEBKIT_API_HEADERS
         }
 
         QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+        LIBS += -framework Carbon -framework AppKit
     }
 }
 
@@ -3241,3 +3337,20 @@ CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4
     CONFIG += no_debug_info
 }
 
+!win32-g++:win32:contains(QMAKE_HOST.arch, x86_64):{
+    asm_compiler.commands = ml64 /c
+    asm_compiler.commands +=  /Fo ${QMAKE_FILE_OUT} ${QMAKE_FILE_IN}
+    asm_compiler.output = ${QMAKE_VAR_OBJECTS_DIR}${QMAKE_FILE_BASE}$${first(QMAKE_EXT_OBJ)}
+    asm_compiler.input = ASM_SOURCES
+    asm_compiler.variable_out = OBJECTS
+    asm_compiler.name = compiling[asm] ${QMAKE_FILE_IN}
+    silent:asm_compiler.commands = @echo compiling[asm] ${QMAKE_FILE_IN} && $$asm_compiler.commands
+    QMAKE_EXTRA_COMPILERS += asm_compiler
+
+    ASM_SOURCES += \
+        plugins/win/PaintHooks.asm
+   if(win32-msvc2005|win32-msvc2008):equals(TEMPLATE_PREFIX, "vc") {
+        SOURCES += \
+            plugins/win/PaintHooks.asm
+    }
+}
diff --git a/WebCore/WebCore.qrc b/WebCore/WebCore.qrc
index b3fe43a..69f860a 100644
--- a/WebCore/WebCore.qrc
+++ b/WebCore/WebCore.qrc
@@ -1,7 +1,4 @@
 <!DOCTYPE RCC><RCC version="1.0">
-<qresource prefix="/webcore/css">
-    <file alias="mediaControls-extras.css">css/qt/mediaControls-extras.css</file>
-</qresource>
 <qresource prefix="/webkit/resources">
     <file alias="missingImage.png">Resources/missingImage.png</file>
     <file alias="nullPlugin.png">Resources/nullPlugin.png</file>
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.rc b/WebCore/WebCore.vcproj/QTMovieWin.rc
index 2889f4b..1ed0428 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.rc
+++ b/WebCore/WebCore.vcproj/QTMovieWin.rc
@@ -14,8 +14,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION __VERSION_MAJOR__,__BUILD_NUMBER_MAJOR__,__BUILD_NUMBER_MINOR__,__BUILD_NUMBER_VARIANT__
- PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,0
+ FILEVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
+ PRODUCTVERSION __VERSION_MAJOR__,__VERSION_MINOR__,__VERSION_TINY__,__VERSION_BUILD__
  FILEFLAGSMASK 0x17L
 #ifdef _DEBUG
  FILEFLAGS 0x1L
@@ -37,7 +37,7 @@ BEGIN
             VALUE "LegalCopyright", "Copyright Apple Inc. 2007-2009"
             VALUE "OriginalFilename", "QTMovieWin.dll"
             VALUE "ProductName", "WebKit"
-            VALUE "ProductVersion", __BUILD_NUMBER_SHORT__
+            VALUE "ProductVersion", __VERSION_TEXT__
         END
     END
     BLOCK "VarFileInfo"
diff --git a/WebCore/WebCore.vcproj/QTMovieWin.vcproj b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
index 593855b..5e54c67 100644
--- a/WebCore/WebCore.vcproj/QTMovieWin.vcproj
+++ b/WebCore/WebCore.vcproj/QTMovieWin.vcproj
@@ -1,280 +1,280 @@
-<?xml version="1.0" encoding="windows-1251"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="QTMovieWin"
-	ProjectGUID="{E498CA9D-3BD2-4D52-8E37-C8DC76526325}"
-	RootNamespace="QuickTimeWin"
-	Keyword="Win32Proj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Debug|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Release|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"
-			CharacterSet="1"
-			WholeProgramOptimization="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-		<Configuration
-			Name="Debug_Internal|Win32"
-			ConfigurationType="2"
-			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"
-			CharacterSet="1"
-			>
-			<Tool
-				Name="VCPreBuildEventTool"
-				CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"
-			/>
-			<Tool
-				Name="VCCustomBuildTool"
-			/>
-			<Tool
-				Name="VCXMLDataGeneratorTool"
-			/>
-			<Tool
-				Name="VCWebServiceProxyGeneratorTool"
-			/>
-			<Tool
-				Name="VCMIDLTool"
-			/>
-			<Tool
-				Name="VCCLCompilerTool"
-				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"
-				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"
-				DisableSpecificWarnings="4819"
-			/>
-			<Tool
-				Name="VCManagedResourceCompilerTool"
-			/>
-			<Tool
-				Name="VCResourceCompilerTool"
-				AdditionalIncludeDirectories=""
-			/>
-			<Tool
-				Name="VCPreLinkEventTool"
-			/>
-			<Tool
-				Name="VCLinkerTool"
-				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"
-				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"
-				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"
-				IgnoreDefaultLibraryNames="LIBCMT"
-				DelayLoadDLLs=""
-			/>
-			<Tool
-				Name="VCALinkTool"
-			/>
-			<Tool
-				Name="VCManifestTool"
-			/>
-			<Tool
-				Name="VCXDCMakeTool"
-			/>
-			<Tool
-				Name="VCBscMakeTool"
-			/>
-			<Tool
-				Name="VCFxCopTool"
-			/>
-			<Tool
-				Name="VCAppVerifierTool"
-			/>
-			<Tool
-				Name="VCWebDeploymentTool"
-			/>
-			<Tool
-				Name="VCPostBuildEventTool"
-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<Filter
-			Name="Source Files"
-			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
-			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
-			>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWin.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWinTimer.cpp"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Header Files"
-			Filter="h;hpp;hxx;hm;inl;inc;xsd"
-			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
-			>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWin.h"
-				>
-			</File>
-			<File
-				RelativePath="..\platform\graphics\win\QTMovieWinTimer.h"
-				>
-			</File>
-		</Filter>
-		<Filter
-			Name="Resource Files"
-			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
-			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
-			>
-			<File
-				RelativePath=".\QTMovieWin.rc"
-				>
-			</File>
-		</Filter>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="windows-1251"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="QTMovieWin"

+	ProjectGUID="{E498CA9D-3BD2-4D52-8E37-C8DC76526325}"

+	RootNamespace="QuickTimeWin"

+	Keyword="Win32Proj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Internal|Win32"

+			ConfigurationType="2"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash &quot;$(WebKitLibrariesDir)\tools\scripts\auto-version.sh&quot; &quot;$(IntDir)&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\Include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitLibrariesDir)\QuickTime SDK\CIncludes&quot;;&quot;$(ProgramFiles)/QuickTime SDK/cincludes&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;"

+				PreprocessorDefinitions="_USRDLL;QTMOVIEWIN_EXPORTS"

+				DisableSpecificWarnings="4819"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+				AdditionalIncludeDirectories=""

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalDependencies="QTMLClient.lib WTF$(WebKitConfigSuffix).lib winmm.lib pthreadVC2$(LibraryConfigSuffix).lib Msimg32.lib user32.lib advapi32.lib"

+				OutputFile="$(OutDir)\$(ProjectName)$(WebKitConfigSuffix).dll"

+				AdditionalLibraryDirectories="&quot;$(WebKitLibrariesDir)\QuickTime SDK\Libraries&quot;;&quot;$(ProgramFiles)\QuickTime SDK\Libraries&quot;"

+				IgnoreDefaultLibraryNames="LIBCMT"

+				DelayLoadDLLs=""

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\QTMovieWin.h&quot; &quot;$(WebKitOutputDir)\include\QTMovieWin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<Filter

+			Name="Source Files"

+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"

+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"

+			>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWin.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWinTimer.cpp"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Header Files"

+			Filter="h;hpp;hxx;hm;inl;inc;xsd"

+			UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"

+			>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWin.h"

+				>

+			</File>

+			<File

+				RelativePath="..\platform\graphics\win\QTMovieWinTimer.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Resource Files"

+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"

+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"

+			>

+			<File

+				RelativePath=".\QTMovieWin.rc"

+				>

+			</File>

+		</Filter>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index 7aef730..9a9e3ec 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -67,7 +67,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -123,7 +123,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -178,7 +178,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -233,7 +233,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -289,7 +289,7 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\config.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\accessibility\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\inspector\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\appcache\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\archive\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\loader\icon\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\history\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\html\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\notifications\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\css\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\transforms\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\graphics\opentype\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\text\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\curl\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\network\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\sql\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\platform\cairo\cairo\src\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bindings\js\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\animation\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\page\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\bridge\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\plugins\win\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\rendering\style\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\editing\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\dom\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\xml\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\svg\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\storage\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\websockets\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\workers\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\bindings\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\bindings&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\parser&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\runtime&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\masm\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\masm&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\pcre\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\pcre&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\profiler&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wrec\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wrec&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders\wtf\unicode\icu&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\inspector\front-end\*&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\inspector&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;xcopy /y /d /s /exclude:xcopy.excludes &quot;$(ProjectDir)\..\English.lproj\localizedStrings.js&quot; &quot;$(WebKitOutputDir)\bin\WebKit.resources\en.lproj&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -566,6 +566,54 @@
 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBarInfo.h"

 				>

 			</File>

+                        <File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeLoadEvent.h"

+				>

+			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasGradient.cpp"

 				>

@@ -663,6 +711,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSCanvasRenderingContext2D.cpp"

 				>

 				<FileConfiguration

@@ -2779,6 +2875,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventSource.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEventSource.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFile.cpp"

 				>

 				<FileConfiguration

@@ -3787,6 +3931,54 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataListElement.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDataListElement.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSHTMLDirectoryElement.cpp"

 				>

 				<FileConfiguration

@@ -7387,7 +7579,7 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotification.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7431,11 +7623,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotification.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotificationCenter.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7479,11 +7671,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNotificationCenter.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7527,11 +7719,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSOverflowEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPageTransitionEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7575,11 +7767,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPageTransitionEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7623,11 +7815,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7671,11 +7863,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPluginArray.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7719,11 +7911,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPositionError.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7767,11 +7959,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProcessingInstruction.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7815,11 +8007,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSProgressEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7863,11 +8055,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRange.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7911,11 +8103,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRangeException.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -7959,11 +8151,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRect.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8007,11 +8199,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSRGBColor.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8055,11 +8247,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSScreen.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8103,11 +8295,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorker.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8151,11 +8343,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSharedWorkerContext.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8199,11 +8391,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLError.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8247,11 +8439,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSet.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8295,11 +8487,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSQLResultSetRowList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8343,11 +8535,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSSQLTransaction.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8391,11 +8583,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorage.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8439,11 +8631,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStorageEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8487,11 +8679,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheet.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8535,11 +8727,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSStyleSheetList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8583,11 +8775,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8631,11 +8823,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAltGlyphElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8679,11 +8871,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAngle.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8727,11 +8919,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateColorElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8775,11 +8967,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedAngle.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8823,11 +9015,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedBoolean.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8871,11 +9063,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedEnumeration.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8919,11 +9111,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedInteger.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -8967,11 +9159,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLength.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9015,11 +9207,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedLengthList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9063,11 +9255,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumber.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9111,11 +9303,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedNumberList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9159,11 +9351,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedPreserveAspectRatio.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9207,11 +9399,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedRect.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9255,11 +9447,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedString.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9303,11 +9495,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimatedTransformList.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9351,11 +9543,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9399,11 +9591,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimateTransformElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9447,11 +9639,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGAnimationElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9495,11 +9687,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCircleElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9543,11 +9735,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGClipPathElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefinitionSrcElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9591,11 +9783,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefinitionSrcElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGColor.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9639,11 +9831,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGComponentTransferFunctionElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9687,11 +9879,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGCursorElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9735,11 +9927,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDefsElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9783,11 +9975,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDescElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9831,11 +10023,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGDocument.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9879,11 +10071,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElement.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpcpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9927,11 +10119,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstance.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -9975,6 +10167,14 @@
 				</FileConfiguration>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementInstanceList.h"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.cpp"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGElementWrapperFactory.h"

 				>

 			</File>

@@ -15163,7 +15363,7 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSVoidCallback.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15207,11 +15407,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSVoidCallback.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15255,11 +15455,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitAnimationEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15303,11 +15503,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframeRule.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15351,11 +15551,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSKeyframesRule.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15399,11 +15599,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSMatrix.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15447,11 +15647,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitCSSTransformValue.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15495,11 +15695,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitPoint.h"

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.h"

 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.cpp"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWebSocket.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -15543,7 +15743,7 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSWebKitTransitionEvent.h"

+				RelativePath="$(WebKitOutputDir)\obj\WebCore\DerivedSources\JSWebSocket.h"

 				>

 			</File>

 			<File

@@ -16489,6 +16689,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\accessibility\AccessibilityMediaControls.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\accessibility\AccessibilityMediaControls.h"

+				>

+			</File>

+			<File

 				RelativePath="..\accessibility\AccessibilityObject.cpp"

 				>

 			</File>

@@ -16649,10 +16857,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\page\Coordinates.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\page\Coordinates.h"

 				>

 			</File>

@@ -16717,6 +16921,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\EventSource.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\EventSource.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\FocusController.cpp"

 				>

 			</File>

@@ -16765,11 +16977,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\page\Geoposition.cpp"

+				RelativePath="..\page\Geoposition.h"

 				>

 			</File>

 			<File

-				RelativePath="..\page\Geoposition.h"

+				RelativePath="..\page\HaltablePlugin.h"

 				>

 			</File>

 			<File

@@ -16829,6 +17041,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\OriginAccessEntry.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\OriginAccessEntry.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Page.cpp"

 				>

 			</File>

@@ -16853,6 +17073,18 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\PluginHalter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\PluginHalter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\PluginHalterClient.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\PositionCallback.h"

 				>

 			</File>

@@ -16892,6 +17124,30 @@
 				RelativePath="..\page\Settings.h"

 				>

 			</File>

+                        <File

+				RelativePath="..\page\UserContentURLPattern.cpp"

+				>

+			</File>

+                        <File

+				RelativePath="..\page\UserContentURLPattern.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserScript.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserScriptTypes.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserStyleSheet.h"

+				>

+			</File>

+			<File

+				RelativePath="..\page\UserStyleSheetTypes.h"

+				>

+			</File>

 			<File

 				RelativePath="..\page\WebKitPoint.h"

 				>

@@ -17233,6 +17489,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\PolicyCallback.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyCallback.h"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyChecker.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\PolicyChecker.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\ProgressTracker.cpp"

 				>

 			</File>

@@ -17241,6 +17513,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\RedirectScheduler.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\RedirectScheduler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\Request.cpp"

 				>

 			</File>

@@ -18305,6 +18585,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\FontSmoothingMode.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\FontTraitsMask.h"

 					>

 				</File>

@@ -18389,6 +18673,34 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ImageSource.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\ImageSource.h"

 					>

 				</File>

@@ -19564,34 +19876,6 @@
 						</FileConfiguration>

 					</File>

 					<File

-						RelativePath="..\platform\graphics\cairo\ImageSourceCairo.cpp"

-						>

-						<FileConfiguration

-							Name="Debug|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Release|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-						<FileConfiguration

-							Name="Debug_Internal|Win32"

-							ExcludedFromBuild="true"

-							>

-							<Tool

-								Name="VCCLCompilerTool"

-							/>

-						</FileConfiguration>

-					</File>

-					<File

 						RelativePath="..\platform\graphics\cairo\PathCairo.cpp"

 						>

 						<FileConfiguration

@@ -19781,6 +20065,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\CredentialStorage.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\CredentialStorage.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\FormData.cpp"

 					>

 				</File>

@@ -19829,6 +20121,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\ProtectionSpaceHash.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\ResourceErrorBase.cpp"

 					>

 				</File>

@@ -19868,6 +20164,26 @@
 					RelativePath="..\platform\network\ResourceResponseBase.h"

 					>

 				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamErrorBase.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamErrorBase.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleBase.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleBase.h"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\SocketStreamHandleClient.h"

+					>

+				</File>

 				<Filter

 					Name="cf"

 					>

@@ -20151,6 +20467,66 @@
 							/>

 						</FileConfiguration>

 					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamError.h"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamHandle.h"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

+						RelativePath="..\platform\network\cf\SocketStreamHandleCFNet.cpp"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

 				</Filter>

 				<Filter

 					Name="win"

@@ -20531,6 +20907,34 @@
 							/>

 						</FileConfiguration>

 					</File>

+					<File

+						RelativePath="..\platform\network\curl\SocketStreamHandleCurl.cpp"

+						>

+						<FileConfiguration

+							Name="Debug|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_Internal|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

 				</Filter>

 			</Filter>

 			<Filter

@@ -20869,6 +21273,34 @@
 				Name="image-decoders"

 				>

 				<File

+					RelativePath="..\platform\image-decoders\ImageDecoder.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\platform\image-decoders\ImageDecoder.h"

 					>

 					<FileConfiguration

@@ -21547,6 +21979,18 @@
 					>

 				</File>

 			</Filter>

+			<Filter

+				Name="mock"

+				>

+				<File

+					RelativePath="..\platform\mock\GeolocationServiceMock.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\mock\GeolocationServiceMock.h"

+					>

+				</File>

+			</Filter>

 		</Filter>

 		<Filter

 			Name="css"

@@ -23444,7 +23888,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\xml\XSLStyleSheet.cpp"

+				RelativePath="..\xml\XSLStyleSheetLibxslt.cpp"

 				>

 			</File>

 			<File

@@ -23464,6 +23908,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\xml\XSLTProcessorLibxslt.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\xml\XSLTProcessor.h"

 				>

 			</File>

@@ -23507,6 +23955,10 @@
 				RelativePath="..\dom\Attribute.h"

 				>

 			</File>

+                        <File

+				RelativePath="..\dom\BeforeLoadEvent.h"

+				>

+			</File>

 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.cpp"

 				>

@@ -23632,10 +24084,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\dom\DocPtr.h"

-				>

-			</File>

-			<File

 				RelativePath="..\dom\Document.cpp"

 				>

 			</File>

@@ -23948,6 +24396,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\PageTransitionEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\PageTransitionEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\default\PlatformMessagePortChannel.cpp"

 				>

 			</File>

@@ -24104,6 +24560,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\TransformSourceLibxslt.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\TransformSource.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Traversal.cpp"

 				>

 			</File>

@@ -24292,6 +24756,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\workers\WorkerReportingProxy.h"

+				>

+			</File>

+			<File

 				RelativePath="..\workers\WorkerRunLoop.cpp"

 				>

 			</File>

@@ -24321,6 +24789,34 @@
 			</File>

 		</Filter>

 		<Filter

+			Name="notifications"

+			>

+			<File

+				RelativePath="..\notifications\Notification.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\Notification.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationCenter.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationCenter.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationContents.h"

+				>

+			</File>

+			<File

+				RelativePath="..\notifications\NotificationPresenter.h"

+				>

+			</File>

+		</Filter>

+		<Filter

 			Name="editing"

 			>

 			<File

@@ -24736,6 +25232,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\canvas\CanvasRenderingContext.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\canvas\CanvasRenderingContext.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\canvas\CanvasRenderingContext2D.cpp"

 				>

 			</File>

@@ -25552,6 +26056,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLDataListElement.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLDataListElement.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLDirectoryElement.cpp"

 				>

 				<FileConfiguration

@@ -28451,6 +28963,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCallbackData.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSCallbackData.h"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSAbstractWorkerCustom.cpp"

 					>

 				</File>

@@ -28471,6 +28991,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCanvasRenderingContextCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCDATASectionCustom.cpp"

 					>

 				</File>

@@ -28491,6 +29015,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSCSSRuleListCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSCSSStyleDeclarationCustom.cpp"

 					>

 				</File>

@@ -28575,6 +29103,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSDesktopNotificationsCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSDocumentCustom.cpp"

 					>

 				</File>

@@ -28643,6 +29175,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSEventSourceConstructor.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSEventSourceConstructor.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSEventTarget.cpp"

 					>

 				</File>

@@ -28671,6 +29215,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

 					>

 				</File>

@@ -28791,23 +29339,23 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

+					RelativePath="..\bindings\js\JSMessageEventCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

+					RelativePath="..\bindings\js\JSMessagePortCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

+					RelativePath="..\bindings\js\JSMessagePortCustom.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodesCollection.cpp"

+					RelativePath="..\bindings\js\JSMimeTypeArrayCustom.cpp"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSNamedNodesCollection.h"

+					RelativePath="..\bindings\js\JSNamedNodeMapCustom.cpp"

 					>

 				</File>

 				<File

@@ -28879,10 +29427,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSSharedWorkerContextCustom.cpp"

-					>

-				</File>

-				<File

 					RelativePath="..\bindings\js\JSSharedWorkerCustom.cpp"

 					>

 				</File>

@@ -28963,6 +29507,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSWebSocketConstructor.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSWebSocketConstructor.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSWebSocketCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSWorkerConstructor.cpp"

 					>

 				</File>

@@ -29131,6 +29687,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\SerializedScriptValue.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\SerializedScriptValue.h"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\StringSourceProvider.h"

 					>

 				</File>

@@ -29364,10 +29928,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGDefinitionSrcElement.h"

-				>

-			</File>

-			<File

 				RelativePath="..\svg\SVGDefsElement.h"

 				>

 			</File>

@@ -30596,6 +31156,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\storage\SQLTransactionClient.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionClient.h"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionCoordinator.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\SQLTransactionCoordinator.h"

+				>

+			</File>

+			<File

 				RelativePath="..\storage\SQLTransactionErrorCallback.h"

 				>

 			</File>

@@ -30636,6 +31212,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\storage\StorageEventDispatcher.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\storage\StorageEventDispatcher.h"

+				>

+			</File>

+			<File

 				RelativePath="..\storage\StorageMap.cpp"

 				>

 			</File>

@@ -30800,6 +31384,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\DOMDispatchTimelineItem.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\DOMDispatchTimelineItem.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorBackend.cpp"

 				>

 			</File>

@@ -30860,6 +31452,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorTimelineAgent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorTimelineAgent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\JavaScriptCallFrame.cpp"

 				>

 			</File>

@@ -30895,6 +31495,14 @@
 				RelativePath="..\inspector\JavaScriptProfileNode.h"

 				>

 			</File>

+			<File

+				RelativePath="..\inspector\TimelineItem.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\TimelineItem.h"

+				>

+			</File>

 			<Filter

 				Name="front-end"

 				>

@@ -30939,10 +31547,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\DatabasesPanel.js"

-					>

-				</File>

-				<File

 					RelativePath="..\inspector\front-end\DatabaseTableView.js"

 					>

 				</File>

@@ -30975,6 +31579,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ElementsTreeOutline.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\EventListenersSidebarPane.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\FontView.js"

 					>

 				</File>

@@ -30987,10 +31599,18 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\InjectedScriptAccess.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\inspector.css"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\inspectorSyntaxHighlight.css"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\inspector.html"

 					>

 				</File>

@@ -31027,6 +31647,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\Popup.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ProfileDataGridTree.js"

 					>

 				</File>

@@ -31083,14 +31707,30 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\StatusBarButton.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\StoragePanel.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\StylesSidebarPane.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\SummaryBar.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TextPrompt.js"

 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\TimelineAgent.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\TopDownProfileDataGridTree.js"

 					>

 				</File>

@@ -31106,6 +31746,10 @@
 					RelativePath="..\inspector\front-end\View.js"

 					>

 				</File>

+				<File

+					RelativePath="..\inspector\front-end\WatchExpressionsSidebarPane.js"

+					>

+				</File>

 			</Filter>

 		</Filter>

 		<Filter

@@ -31440,11 +32084,47 @@
 				>

 			</File>

 		</Filter>

+		<Filter

+			Name="websockets"

+			>

+			<File

+				RelativePath="..\websockets\WebSocket.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocket.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannel.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannel.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketChannelClient.h"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketHandshake.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\websockets\WebSocketHandshake.h"

+				>

+			</File>

+		</Filter>

 		<File

 			RelativePath="..\config.h"

 			>

 		</File>

 		<File

+			RelativePath="..\platform\graphics\TextRenderingMode.h"

+			>

+		</File>

+		<File

 			RelativePath="..\WebCorePrefix.cpp"

 			>

 			<FileConfiguration

diff --git a/WebCore/WebCore.vcproj/WebCoreCURL.vsprops b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
index aaadb97..4320e05 100644
--- a/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCURL.vsprops
@@ -7,5 +7,6 @@
 	<Tool

 		Name="VCCLCompilerTool"

 		AdditionalIncludeDirectories="$(ProjectDir)..\platform\network\curl"

+		PreprocessorDefinitions="USE_WINDOWS_SSPI;USE_SSLEAY;HAVE_ZLIB"

 	/>

 </VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCairo.vsprops b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
index b1493d4..3531128 100644
--- a/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCairo.vsprops
@@ -6,6 +6,6 @@
 	>

 	<Tool

 		Name="VCCLCompilerTool"

-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\platform\graphics\cairo&quot;;&quot;$(ProjectDir)..\svg\graphics\cairo&quot;;&quot;$(ProjectDir)..\platform\image-decoders&quot;;&quot;$(ProjectDir)..\platform\image-decoders\bmp&quot;;&quot;$(ProjectDir)..\platform\image-decoders\gif&quot;;&quot;$(ProjectDir)..\platform\image-decoders\ico&quot;;&quot;$(ProjectDir)..\platform\image-decoders\jpeg&quot;;&quot;$(ProjectDir)..\platform\image-decoders\png&quot;;&quot;$(ProjectDir)..\platform\image-decoders\xbm&quot;;&quot;$(ProjectDir)..\platform\image-decoders\zlib&quot;;&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 </VisualStudioPropertySheet>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 3dd37fc..6923c15 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,8 +7,8 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
-		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DOM_STORAGE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..\&quot;;&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\icu&quot;;&quot;$(WebKitLibrariesDir)\include\iconv&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include\CoreFoundation\OSXCompatibilityHeaders\GNUCompatibility&quot;;&quot;$(ProjectDir)..\svg\animation&quot;"
+		PreprocessorDefinitions="__WIN32__;WEBCORE_CONTEXT_MENUS;ENABLE_CHANNEL_MESSAGING;ENABLE_DATABASE;ENABLE_DATAGRID;ENABLE_DATALIST;ENABLE_DOM_STORAGE;ENABLE_EVENTSOURCE;ENABLE_ICONDATABASE;ENABLE_OFFLINE_WEB_APPLICATIONS;ENABLE_RUBY;ENABLE_SHARED_WORKERS;ENABLE_SVG;ENABLE_SVG_ANIMATION;ENABLE_SVG_AS_IMAGE;ENABLE_SVG_FONTS;ENABLE_SVG_FOREIGN_OBJECT;ENABLE_SVG_USE;ENABLE_WEB_SOCKETS;ENABLE_WORKERS;ENABLE_XPATH;ENABLE_XSLT"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
 		ForcedIncludeFiles="WebCorePrefix.h"
@@ -19,6 +19,6 @@
 	/>
 	<Tool
 		Name="VCPreBuildEventTool"
-		CommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"
+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;touch &quot;$(WebKitOutputDir)\tmp.cpp&quot;&#x0D;&#x0A;cl /analyze /nologo /c &quot;$(WebKitOutputDir)\tmp.cpp&quot; /Fo&quot;$(IntDir)\tmp.obj&quot; 2&gt;&amp;1 | findstr D9040&#x0D;&#x0A;if ERRORLEVEL 1 (set EnablePREfast=&quot;true&quot;) else (set EnablePREfast=&quot;false&quot;)&#x0D;&#x0A;if ERRORLEVEL 1 (set AnalyzeWithLargeStack=&quot;/analyze:65536&quot;) else (set AnalyzeWithLargeStack=&quot;&quot;)&#x0D;&#x0A;exit /b&#x0D;&#x0A;"
 	/>
 </VisualStudioPropertySheet>
diff --git a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index a7e8f6f..73bde6c 100644
--- a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -1,48 +1,48 @@
-<?xml version="1.0" encoding="Windows-1252"?>
-<VisualStudioProject
-	ProjectType="Visual C++"
-	Version="8.00"
-	Name="WebCoreGenerated"
-	ProjectGUID="{0A324352-B3B6-496C-9E5B-4C7E923E628B}"
-	Keyword="MakeFileProj"
-	>
-	<Platforms>
-		<Platform
-			Name="Win32"
-		/>
-	</Platforms>
-	<ToolFiles>
-	</ToolFiles>
-	<Configurations>
-		<Configuration
-			Name="Release|Win32"
-			OutputDirectory="$(WebKitOutputDir)\lib"
-			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"
-			ConfigurationType="0"
-			>
-			<Tool
-				Name="VCNMakeTool"
-				BuildCommandLine="set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"
-				Output=""
-				PreprocessorDefinitions=""
-				IncludeSearchPath=""
-				ForcedIncludes=""
-				AssemblySearchPath=""
-				ForcedUsingAssemblies=""
-				CompileAsManaged=""
-			/>
-		</Configuration>
-	</Configurations>
-	<References>
-	</References>
-	<Files>
-		<File
-			RelativePath=".\build-generated-files.sh"
-			>
-		</File>
-	</Files>
-	<Globals>
-	</Globals>
-</VisualStudioProject>
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="WebCoreGenerated"

+	ProjectGUID="{0A324352-B3B6-496C-9E5B-4C7E923E628B}"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Release|Win32"

+			OutputDirectory="$(WebKitOutputDir)\lib"

+			IntermediateDirectory="$(WebKitOutputDir)\obj\$(ProjectName)\$(ConfigurationName)"

+			ConfigurationType="0"

+			>

+			<Tool

+				Name="VCNMakeTool"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot;&#x0D;&#x0A;bash migrate-idls.sh &quot;$(WebKitOutputDir)/obj/WebKit/DOMInterfaces&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebKit\DOMInterfaces&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				Output=""

+				PreprocessorDefinitions=""

+				IncludeSearchPath=""

+				ForcedIncludes=""

+				AssemblySearchPath=""

+				ForcedUsingAssemblies=""

+				CompileAsManaged=""

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\build-generated-files.sh"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebCore/WebCore.vcproj/build-generated-files.sh b/WebCore/WebCore.vcproj/build-generated-files.sh
index e4cbd45..06b3c6d 100644
--- a/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/WebCore/WebCore.vcproj/build-generated-files.sh
@@ -55,21 +55,9 @@ export SDKROOT
 
 export BUILT_PRODUCTS_DIR="$XDSTROOT/obj/WebCore"
 
-if [ -e "$XDSTROOT/include/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$XDSTROOT/include/JavaScriptCore/create_hash_table"
-elif [ -e "$XDSTROOT/include/private/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$XDSTROOT/include/private/JavaScriptCore/create_hash_table"
-elif [ -e "$SDKROOT/include/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$SDKROOT/include/JavaScriptCore/create_hash_table"
-elif [ -e "$SDKROOT/include/private/JavaScriptCore/create_hash_table" ]; then
-    export CREATE_HASH_TABLE="$SDKROOT/include/private/JavaScriptCore/create_hash_table"
-fi
-
-echo ${CREATE_HASH_TABLE}
-
 mkdir -p "${BUILT_PRODUCTS_DIR}/DerivedSources"
 cd "${BUILT_PRODUCTS_DIR}/DerivedSources"
 
 export WebCore="${XSRCROOT}"
-export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DOM_STORAGE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
+export FEATURE_DEFINES="ENABLE_CHANNEL_MESSAGING ENABLE_DATABASE ENABLE_DATAGRID ENABLE_DATALIST ENABLE_DOM_STORAGE ENABLE_EVENTSOURCE ENABLE_ICONDATABASE ENABLE_JAVASCRIPT_DEBUGGER ENABLE_OFFLINE_WEB_APPLICATIONS ENABLE_RUBY ENABLE_SHARED_WORKERS ENABLE_SVG ENABLE_SVG_ANIMATION ENABLE_SVG_AS_IMAGE ENABLE_SVG_FONTS ENABLE_SVG_FOREIGN_OBJECT ENABLE_SVG_USE ENABLE_VIDEO ENABLE_WEB_SOCKETS ENABLE_WORKERS ENABLE_XPATH ENABLE_XSLT"
 make -f "$WebCore/DerivedSources.make" -j ${NUMCPUS} || exit 1
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 50e6a2a..01db8ea 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -21,6 +21,8 @@
 /* End PBXAggregateTarget section */
 
 /* Begin PBXBuildFile section */
+		0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */; };
+		0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 00146289103CD1DE000B20DB /* OriginAccessEntry.h */; };
 		06027CAD0B1CBFC000884B2D /* ContextMenuItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */; };
 		062287840B4DB322000C34DF /* FocusDirection.h in Headers */ = {isa = PBXBuildFile; fileRef = 062287830B4DB322000C34DF /* FocusDirection.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -38,6 +40,8 @@
 		0709FC4C1025DED80059CDBA /* AccessibilitySlider.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0709FC4B1025DED80059CDBA /* AccessibilitySlider.cpp */; };
 		0709FC4E1025DEE30059CDBA /* AccessibilitySlider.h in Headers */ = {isa = PBXBuildFile; fileRef = 0709FC4D1025DEE30059CDBA /* AccessibilitySlider.h */; };
 		0735EE6A0F40C5E4004A2604 /* MediaPlayerProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */; };
+		07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */ = {isa = PBXBuildFile; fileRef = 07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */; };
 		080081960ED3B2DD00C53BC0 /* WMLAnchorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */; };
 		080081970ED3B2DD00C53BC0 /* WMLAnchorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */; };
 		0804BF6E0EE09C3B0006C000 /* WMLDoElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0804BF6C0EE09C3B0006C000 /* WMLDoElement.cpp */; };
@@ -193,6 +197,8 @@
 		142011B70A003133008303F9 /* JSCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = 142011B50A003133008303F9 /* JSCSSStyleDeclaration.h */; };
 		1432E8470C51493800B1500F /* GCController.h in Headers */ = {isa = PBXBuildFile; fileRef = 1432E8460C51493800B1500F /* GCController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1432E8490C51493F00B1500F /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1432E8480C51493F00B1500F /* GCController.cpp */; };
+		1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */ = {isa = PBXBuildFile; fileRef = 1449E24A107D4A8400B5793F /* JSCallbackData.h */; };
+		1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1449E286107D4DB400B5793F /* JSCallbackData.cpp */; };
 		1477E7760BF4134A00152872 /* PageCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1477E7740BF4134A00152872 /* PageCache.cpp */; };
 		1477E7770BF4134A00152872 /* PageCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1477E7750BF4134A00152872 /* PageCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		148AFDA50AF58360008CC700 /* ExceptionHandlers.h in Headers */ = {isa = PBXBuildFile; fileRef = 148AFDA30AF58360008CC700 /* ExceptionHandlers.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -200,6 +206,7 @@
 		14993BE50B2F2B1C0050497F /* FocusController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14993BE30B2F2B1C0050497F /* FocusController.cpp */; };
 		14993BE60B2F2B1C0050497F /* FocusController.h in Headers */ = {isa = PBXBuildFile; fileRef = 14993BE40B2F2B1C0050497F /* FocusController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14C9A5E90B3D105F005A0232 /* Settings.cpp */; };
+		14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */; };
 		14CF78A409F58CBF00EB3665 /* JSCSSValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CF78A309F58CBF00EB3665 /* JSCSSValue.cpp */; };
 		14CF78A609F58CD800EB3665 /* JSCSSValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 14CF78A509F58CD800EB3665 /* JSCSSValue.h */; };
 		14CF7B3309F6ECD700EB3665 /* JSCSSRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 14CF7B3109F6ECD700EB3665 /* JSCSSRule.cpp */; };
@@ -364,7 +371,6 @@
 		1A8F6BC50DB55CDC001DB794 /* ManifestParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A8F6BBA0DB55CDC001DB794 /* ManifestParser.cpp */; };
 		1A8F6BC60DB55CDC001DB794 /* ManifestParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A8F6BBB0DB55CDC001DB794 /* ManifestParser.h */; };
 		1A98956B0AA78F80005EF5EF /* KURLCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */; };
-		1A9EF4570A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */; };
 		1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE780C051FDE00139F4F /* zoomInCursor.png */; };
 		1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */; };
 		1AB7FC680A8B92EC00D9D37B /* XPathEvaluator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */; };
@@ -463,7 +469,6 @@
 		1AE82F900CAAFA9D002237AE /* JSDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82F8E0CAAFA9D002237AE /* JSDatabase.h */; };
 		1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */; };
 		1AE82FED0CAB07EE002237AE /* JSSQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */; };
-		1AE830440CAB0ED1002237AE /* JSDatabaseCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */; };
 		1AF326790D78B9440068F0C4 /* EditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF326770D78B9440068F0C4 /* EditorClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
 		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; };
@@ -548,7 +553,6 @@
 		29A812310FBB9C1D00510293 /* AccessibilityTableRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812130FBB9C1D00510293 /* AccessibilityTableRow.h */; };
 		29A812320FBB9C1D00510293 /* AccessibilityTableCell.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812140FBB9C1D00510293 /* AccessibilityTableCell.h */; };
 		29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812150FBB9C1D00510293 /* AccessibilityARIAGridRow.h */; };
-		29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812160FBB9C1D00510293 /* AccessibilityARIAGrid.h */; };
 		29A812350FBB9C1D00510293 /* AccessibilityTableColumn.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812170FBB9C1D00510293 /* AccessibilityTableColumn.cpp */; };
 		29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 29A812180FBB9C1D00510293 /* AccessibilityObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		29A812370FBB9C1D00510293 /* AXObjectCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 29A812190FBB9C1D00510293 /* AXObjectCache.cpp */; };
@@ -582,9 +586,9 @@
 		2E4346500F546A8200B0F1BA /* WorkerMessagingProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E43463E0F546A8200B0F1BA /* WorkerMessagingProxy.h */; };
 		2E4346510F546A8200B0F1BA /* WorkerObjectProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E43463F0F546A8200B0F1BA /* WorkerObjectProxy.h */; };
 		2E4346520F546A8200B0F1BA /* WorkerRunLoop.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346400F546A8200B0F1BA /* WorkerRunLoop.cpp */; };
-		2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */; };
+		2E4346530F546A8200B0F1BA /* WorkerRunLoop.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2E4346540F546A8200B0F1BA /* WorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346420F546A8200B0F1BA /* WorkerThread.cpp */; };
-		2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346430F546A8200B0F1BA /* WorkerThread.h */; };
+		2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346430F546A8200B0F1BA /* WorkerThread.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2E4346580F546A9900B0F1BA /* CrossThreadCopier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E4346560F546A9900B0F1BA /* CrossThreadCopier.cpp */; };
 		2E4346590F546A9900B0F1BA /* CrossThreadCopier.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */; };
 		2EA768040FE7126400AB9C8A /* WorkerScriptLoaderClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EA768030FE7126400AB9C8A /* WorkerScriptLoaderClient.h */; };
@@ -635,6 +639,16 @@
 		31C0FF4C0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */; };
 		31C0FF4D0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */; };
 		31C0FF4E0E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */; };
+		33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationPresenter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503C9F10179AD7003B47E1 /* JSNotification.cpp */; };
+		33503CA410179AD7003B47E1 /* JSNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA010179AD7003B47E1 /* JSNotification.h */; };
+		33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */; };
+		33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA210179AD7003B47E1 /* JSNotificationCenter.h */; };
+		33503CC010179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */; };
+		33503CC71017A1B1003B47E1 /* Notification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CC61017A1B1003B47E1 /* Notification.cpp */; };
+		3390CA550FFC157B00921962 /* NotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3390CA510FFC157B00921962 /* NotificationCenter.cpp */; };
+		3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 3390CA520FFC157B00921962 /* NotificationCenter.h */; };
+		3390CA580FFC157B00921962 /* NotificationContents.h in Headers */ = {isa = PBXBuildFile; fileRef = 3390CA540FFC157B00921962 /* NotificationContents.h */; };
 		371F4F400D25B9AF00ECE0D5 /* FontData.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F4F3E0D25B9AF00ECE0D5 /* FontData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		371F4F410D25B9AF00ECE0D5 /* FontData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F4F3F0D25B9AF00ECE0D5 /* FontData.cpp */; };
 		371F4FFC0D25E7F300ECE0D5 /* SegmentedFontData.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F4FFA0D25E7F300ECE0D5 /* SegmentedFontData.h */; };
@@ -643,6 +657,7 @@
 		371F51A20D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F51A00D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp */; };
 		371F53E90D2704F900ECE0D5 /* CSSUnicodeRangeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */; };
 		371F53EA0D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */; };
+		37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 37202198106213C600F25C4B /* FontSmoothingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3724CA570E68A7E400DB4384 /* CoreTextController.h in Headers */ = {isa = PBXBuildFile; fileRef = 3724CA540E68A7E400DB4384 /* CoreTextController.h */; };
 		3724CA580E68A7E400DB4384 /* CoreTextController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA550E68A7E400DB4384 /* CoreTextController.cpp */; };
 		3724CA590E68A7E400DB4384 /* FontMacATSUI.mm in Sources */ = {isa = PBXBuildFile; fileRef = 3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */; };
@@ -660,13 +675,13 @@
 		37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */ = {isa = PBXBuildFile; fileRef = 37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */; };
 		41002CCD0F66EDEF009E660D /* ScriptFunctionCall.h in Headers */ = {isa = PBXBuildFile; fileRef = 41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */; };
 		41002CCE0F66EDEF009E660D /* ScriptFunctionCall.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */; };
+		410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */; };
 		411046410FA222A600BA436A /* ScriptEventListener.h in Headers */ = {isa = PBXBuildFile; fileRef = 4110463F0FA222A600BA436A /* ScriptEventListener.h */; };
 		411046420FA222A600BA436A /* ScriptEventListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 411046400FA222A600BA436A /* ScriptEventListener.cpp */; };
 		4127D5370F8AAB1D00E424F5 /* ScriptState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */; };
 		412A68470F6B03DD000EA66E /* ScriptObjectQuarantine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */; };
 		415B7C570FF598E6006770F7 /* JSAbstractWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */; };
 		415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */; };
-		415B7C590FF598E6006770F7 /* JSSharedWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */; };
 		415B7C630FF5A767006770F7 /* JSSharedWorkerConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */; };
 		4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */; };
 		4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */; };
@@ -675,6 +690,7 @@
 		4162A4581011464700DFF3ED /* JSDedicatedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 4162A4561011464700DFF3ED /* JSDedicatedWorkerContext.h */; };
 		4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4167EBF3102962BA003D252A /* DefaultSharedWorkerRepository.cpp */; };
 		4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */ = {isa = PBXBuildFile; fileRef = 4167EBF4102962BA003D252A /* DefaultSharedWorkerRepository.h */; };
+		416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E29A5102FA962007FC14E /* WorkerReportingProxy.h */; };
 		416E75BE0EDF8FD700360E1D /* ScriptCallStack.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */; };
 		416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */; };
 		416E75CB0EDF90C700360E1D /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75C90EDF90C700360E1D /* ScriptCallFrame.h */; };
@@ -686,7 +702,7 @@
 		41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41A3D58C101C152D00316D07 /* DedicatedWorkerThread.cpp */; };
 		41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41A3D58D101C152D00316D07 /* DedicatedWorkerThread.h */; };
 		41BF700B0FE86F49005E8DEC /* MessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF70090FE86F49005E8DEC /* MessagePortChannel.cpp */; };
-		41BF700C0FE86F49005E8DEC /* MessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700A0FE86F49005E8DEC /* MessagePortChannel.h */; };
+		41BF700C0FE86F49005E8DEC /* MessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700A0FE86F49005E8DEC /* MessagePortChannel.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */; };
 		41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */; };
 		41C760B10EDE03D300C1655F /* ScriptState.h in Headers */ = {isa = PBXBuildFile; fileRef = 41C760B00EDE03D300C1655F /* ScriptState.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -699,7 +715,6 @@
 		41D168EA10226E89009BC827 /* SharedWorkerRepository.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D168E210226E89009BC827 /* SharedWorkerRepository.h */; };
 		41D168ED10226E89009BC827 /* SharedWorkerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D168E510226E89009BC827 /* SharedWorkerThread.cpp */; };
 		41D168EE10226E89009BC827 /* SharedWorkerThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D168E610226E89009BC827 /* SharedWorkerThread.h */; };
-		41D168F010226EC4009BC827 /* JSSharedWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */; };
 		41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41D1690310238B66009BC827 /* JSSharedWorkerContext.cpp */; };
 		41D1690610238B66009BC827 /* JSSharedWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 41D1690410238B66009BC827 /* JSSharedWorkerContext.h */; };
 		41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41E1B1CA0FF5986900576B3B /* AbstractWorker.cpp */; };
@@ -720,6 +735,7 @@
 		41F066E50F64BCF600A07EAC /* ScriptObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F066E30F64BCF600A07EAC /* ScriptObject.cpp */; };
 		41F1D21F0EF35C2A00DA8753 /* ScriptCachedFrameData.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F1D21D0EF35C2A00DA8753 /* ScriptCachedFrameData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41F1D2200EF35C2A00DA8753 /* ScriptCachedFrameData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */; };
+		41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */; };
 		4415292E0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */; };
 		4415292F0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */; };
 		441B055C0CD77A2D007C1F18 /* DOMHTMLEmbedElementPrivate.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */; };
@@ -744,16 +760,12 @@
 		46F9D5DF0B0D60170028EE36 /* progressCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 46F9D5DC0B0D60170028EE36 /* progressCursor.png */; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
-		49484FC3102CF23C00187DD3 /* CanvasGradient.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FB5102CF23C00187DD3 /* CanvasGradient.idl */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
 		49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB7102CF23C00187DD3 /* CanvasPattern.h */; };
-		49484FC6102CF23C00187DD3 /* CanvasPattern.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FB8102CF23C00187DD3 /* CanvasPattern.idl */; };
 		49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */; };
 		49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */; };
-		49484FC9102CF23C00187DD3 /* CanvasPixelArray.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */; };
 		49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */; };
 		49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */; };
-		49484FCC102CF23C00187DD3 /* CanvasRenderingContext2D.idl in Resources */ = {isa = PBXBuildFile; fileRef = 49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */; };
 		49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */; };
 		49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FC0102CF23C00187DD3 /* CanvasStyle.h */; };
 		494BD7950F55C8EE00747828 /* WebKitPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 494BD7930F55C8EE00747828 /* WebKitPoint.h */; };
@@ -770,6 +782,46 @@
 		498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391560F1E776900C23782 /* WebKitCSSMatrix.h */; };
 		498391630F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */; };
 		498391640F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */; };
+		49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */; };
+		49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */; };
+		49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */; };
+		49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */; };
+		49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */; };
+		49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */; };
+		49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */; };
+		49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9891042D2D30009D447 /* JSCanvasProgram.h */; };
+		49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */; };
+		49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */; };
+		49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */; };
+		49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9901042D2D30009D447 /* JSCanvasShader.h */; };
+		49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */; };
+		49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9921042D2D30009D447 /* JSCanvasTexture.h */; };
+		49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */; };
+		49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9A91042D32E0009D447 /* CanvasBuffer.h */; };
+		49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */; };
+		49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */; };
+		49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */; };
+		49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */; };
+		49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B41042D32F0009D447 /* CanvasObject.cpp */; };
+		49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B51042D32F0009D447 /* CanvasObject.h */; };
+		49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */; };
+		49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9B71042D32F0009D447 /* CanvasProgram.h */; };
+		49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */; };
+		49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */; };
+		49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */; };
+		49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */; };
+		49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */; };
+		49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */; };
+		49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C21042D32F0009D447 /* CanvasShader.cpp */; };
+		49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C31042D32F0009D447 /* CanvasShader.h */; };
+		49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */; };
+		49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9C61042D32F0009D447 /* CanvasTexture.h */; };
+		49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */; };
+		49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */; };
+		49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */; };
+		49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 49C7BA781042EFAE0009D447 /* OpenGL.framework */; };
+		49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */; };
 		49D5DC2B0F423A73008F20FD /* Matrix3DTransformOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49D5DC270F423A73008F20FD /* Matrix3DTransformOperation.cpp */; };
 		49D5DC2C0F423A73008F20FD /* Matrix3DTransformOperation.h in Headers */ = {isa = PBXBuildFile; fileRef = 49D5DC280F423A73008F20FD /* Matrix3DTransformOperation.h */; };
 		49D5DC2D0F423A73008F20FD /* PerspectiveTransformOperation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49D5DC290F423A73008F20FD /* PerspectiveTransformOperation.cpp */; };
@@ -795,6 +847,70 @@
 		49E912AC0EFAC906009D0CAF /* AnimationList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49E912A70EFAC906009D0CAF /* AnimationList.cpp */; };
 		49E912AD0EFAC906009D0CAF /* AnimationList.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A80EFAC906009D0CAF /* AnimationList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 49E912A90EFAC906009D0CAF /* TimingFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDC710503C2300099FAB /* CanvasArray.cpp */; };
+		49EECDE010503C2400099FAB /* CanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDC810503C2300099FAB /* CanvasArray.h */; };
+		49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */; };
+		49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */; };
+		49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */; };
+		49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDCE10503C2300099FAB /* CanvasFloatArray.h */; };
+		49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD010503C2300099FAB /* CanvasIntArray.cpp */; };
+		49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD110503C2300099FAB /* CanvasIntArray.h */; };
+		49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD310503C2300099FAB /* CanvasShortArray.cpp */; };
+		49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD410503C2300099FAB /* CanvasShortArray.h */; };
+		49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */; };
+		49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */; };
+		49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */; };
+		49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */; };
+		49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */; };
+		49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */; };
+		49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */; };
+		49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */; };
+		49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */; };
+		49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */; };
+		49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */; };
+		49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF7105070C400099FAB /* JSCanvasIntArray.h */; };
+		49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */; };
+		49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEF9105070C400099FAB /* JSCanvasShortArray.h */; };
+		49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */; };
+		49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */; };
+		49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */; };
+		49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */; };
+		49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */; };
+		49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */; };
+		49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF19105072F300099FAB /* JSCanvasArray.cpp */; };
+		49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF1A105072F300099FAB /* JSCanvasArray.h */; };
+		49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */; };
+		49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */; };
+		49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */; };
+		49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */; };
+		49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */; };
+		49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */; };
+		49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */; };
+		49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */; };
+		49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */; };
+		49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */; };
+		49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */; };
+		49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */; };
+		49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */; };
+		49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */; };
+		49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */; };
+		49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */; };
+		49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */; };
+		49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */; };
+		49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */; };
+		49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */; };
+		49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */; };
+		49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */; };
+		49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */; };
+		49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */; };
+		49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */; };
+		49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */; };
+		49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */; };
+		49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */; };
+		49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */; };
+		49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */; };
+		49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */; };
+		49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */; };
 		4A8C96EB0BE69032004EEFF0 /* SelectionControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
 		4B2709830AF2E5E00065127F /* PasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4B2709810AF2E5E00065127F /* PasteboardMac.mm */; };
@@ -819,6 +935,14 @@
 		4E19592E0A39DACC00220FE5 /* MediaQueryExp.h in Headers */ = {isa = PBXBuildFile; fileRef = 4E1959280A39DACC00220FE5 /* MediaQueryExp.h */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5101846A0B08602A004A825F /* CachedPage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510184680B08602A004A825F /* CachedPage.cpp */; };
+		510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */; };
+		510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */; };
+		510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */; };
+		510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */; };
+		510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */; };
+		510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A47103177A20049EA54 /* WebSocketChannel.cpp */; };
+		510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A48103177A20049EA54 /* WebSocketChannel.h */; };
+		510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A49103177A20049EA54 /* WebSocketChannelClient.h */; };
 		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511F23170DC160DA004F0032 /* LocalStorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* LocalStorageTask.cpp */; };
 		511F23180DC160DA004F0032 /* LocalStorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* LocalStorageTask.h */; };
@@ -895,6 +1019,9 @@
 		519611780CAC56A80010A80C /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611620CAC56570010A80C /* DatabaseThread.h */; };
 		519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611E80CAC749C0010A80C /* DatabaseTask.h */; };
 		519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611E90CAC749C0010A80C /* DatabaseTask.cpp */; };
+		51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052311058774F00CC9E95 /* CredentialStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A052321058774F00CC9E95 /* CredentialStorage.cpp */; };
+		51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052551058874000CC9E95 /* ProtectionSpaceHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */; };
 		51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */; };
 		51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */; };
@@ -902,6 +1029,11 @@
 		51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */; };
 		51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */; };
 		51AA3F6F0BD5AA9E00892971 /* ResourceLoaderMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */; };
+		51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1A103C18FF008C5260 /* SocketStreamError.h */; };
+		51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */; };
+		51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */; };
+		51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */; };
+		51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */; };
 		51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */; };
 		51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 51BE37DE0DAEE00E001085FC /* StorageArea.h */; };
 		51C0AA390F2AA10A001648C2 /* CachedFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C0AA380F2AA10A001648C2 /* CachedFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -952,6 +1084,8 @@
 		5D925B680F64D4DD00B847F0 /* ScrollBehavior.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5DA5E0FC102B953800088CF9 /* JSWebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5DA5E0FA102B953800088CF9 /* JSWebSocket.cpp */; };
 		5DA5E0FD102B953800088CF9 /* JSWebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DA5E0FB102B953800088CF9 /* JSWebSocket.h */; };
+		5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DB1BC6810715A6400EFAA49 /* TransformSource.h */; };
+		5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */; };
 		5DCF836D0D59159800953BC6 /* PluginInfoStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 5DCF836C0D59159800953BC6 /* PluginInfoStore.h */; };
 		5DD0A3810D9AC6070056C122 /* DOMElementTimeControl.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = E415F1680D9A165D0033CE97 /* DOMElementTimeControl.h */; };
 		5DF7F5C20F01F92A00526B4B /* CSSPropertyNames.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 656580EF09D12B20000E61D7 /* CSSPropertyNames.h */; };
@@ -967,7 +1101,7 @@
 		6515EC910D9723FF0063D49A /* JSSVGAltGlyphElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6515EC8F0D9723FF0063D49A /* JSSVGAltGlyphElement.cpp */; };
 		6515EC920D9723FF0063D49A /* JSSVGAltGlyphElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 6515EC900D9723FF0063D49A /* JSSVGAltGlyphElement.h */; };
 		652FBBBC0DE27CB60001D386 /* JSDOMWindowCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */; };
-		65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */; };
+		65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = 65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6550B693099DF0270090D781 /* CDATASection.cpp */; };
 		6550B69E099DF0270090D781 /* CDATASection.h in Headers */ = {isa = PBXBuildFile; fileRef = 6550B694099DF0270090D781 /* CDATASection.h */; };
 		6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6550B695099DF0270090D781 /* CharacterData.cpp */; };
@@ -1047,13 +1181,13 @@
 		65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323409D1DE65000BE325 /* JSCanvasGradient.h */; };
 		65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */; };
 		65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323609D1DE65000BE325 /* JSCanvasPattern.h */; };
-		65DF323D09D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */; };
-		65DF323E09D1DE65000BE325 /* JSCanvasRenderingContext2D.h in Headers */ = {isa = PBXBuildFile; fileRef = 65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */; };
 		65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AF09D14EE6000E61D7 /* UserAgentStyleSheetsData.cpp */; };
 		65FEA86909833ADE00BED4AB /* Page.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FEA86809833ADE00BED4AB /* Page.cpp */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
-		7284ADDD0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */; };
-		7284ADDE0E6FEB31002EEFBD /* UserStyleSheetLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */; };
+		75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */; };
+		75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */; };
+		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
+		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
 		75793E830D0CE0B3007FC0AC /* MessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */; };
 		75793E840D0CE0B3007FC0AC /* MessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793E810D0CE0B3007FC0AC /* MessageEvent.h */; };
 		75793EC80D0CE72D007FC0AC /* JSMessageEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75793EC60D0CE72D007FC0AC /* JSMessageEvent.cpp */; };
@@ -1061,8 +1195,14 @@
 		75793ED30D0CE85B007FC0AC /* DOMMessageEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */; };
 		75793ED40D0CE85B007FC0AC /* DOMMessageEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */; };
 		75793ED50D0CE85B007FC0AC /* DOMMessageEventInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */; };
+		75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 75A94A01104B74FB0006673C /* TimelineItem.cpp */; };
+		75A94A04104B74FB0006673C /* TimelineItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 75A94A02104B74FB0006673C /* TimelineItem.h */; };
+		7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BACE106C2DCA007B0823 /* HaltablePlugin.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7693BACF106C2DCA007B0823 /* PluginHalter.cpp */; };
+		7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD0106C2DCA007B0823 /* PluginHalter.h */; };
+		7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A1E88F5101CC384000C4DF5 /* ScriptArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */; };
-		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; };
+		7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A1E88F4101CC384000C4DF5 /* ScriptArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
@@ -1944,7 +2084,6 @@
 		85F74E0A0AA8DF8C000DC284 /* DOMCSSUnknownRule.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85032DD50AA8C9BE007D3B7D /* DOMCSSUnknownRule.h */; };
 		85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */; };
 		85FF315B0AAFBFCB00374F38 /* DOMKeyboardEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */; };
-		929264770B61FC7200B41D34 /* JSDocumentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */; };
 		9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */; };
 		9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 9302B0BE0D79F82C00C7EE83 /* PageGroup.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9305B24D098F1B6B00C28855 /* Timer.h in Headers */ = {isa = PBXBuildFile; fileRef = 9305B24C098F1B6B00C28855 /* Timer.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1956,6 +2095,7 @@
 		9307F1D70AF2D59000DBA31A /* HitTestResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9307F1D50AF2D59000DBA31A /* HitTestResult.cpp */; };
 		9307F1D80AF2D59000DBA31A /* HitTestResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 9307F1D60AF2D59000DBA31A /* HitTestResult.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		930908910AF7EDE40081DF01 /* HitTestRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 930908900AF7EDE40081DF01 /* HitTestRequest.h */; };
+		930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */ = {isa = PBXBuildFile; fileRef = 930FC6891072B9280045293E /* TextRenderingMode.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9326DC0C09DAD5D600AFC847 /* CharsetData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 656581AC09D14EE6000E61D7 /* CharsetData.cpp */; };
 		9327A94209968D1A0068A546 /* HTMLOptionsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9327A94109968D1A0068A546 /* HTMLOptionsCollection.cpp */; };
 		932871C00B20DEB70049035A /* PlatformMenuDescription.h in Headers */ = {isa = PBXBuildFile; fileRef = 932871BF0B20DEB70049035A /* PlatformMenuDescription.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2089,6 +2229,8 @@
 		938E65F709F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E65F609F0985D008A48EC /* JSHTMLElementWrapperFactory.cpp */; };
 		938E666009F09B81008A48EC /* JSHTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 938E665F09F09B81008A48EC /* JSHTMLCanvasElement.cpp */; };
 		938E666209F09B87008A48EC /* JSHTMLCanvasElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 938E666109F09B87008A48EC /* JSHTMLCanvasElement.h */; };
+		9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */; };
+		9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */; };
 		9392F1420AD185F400691BD4 /* RenderCounter.h in Headers */ = {isa = PBXBuildFile; fileRef = 9392F1410AD185F400691BD4 /* RenderCounter.h */; };
 		9392F1440AD185FE00691BD4 /* RenderCounter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9392F1430AD185FE00691BD4 /* RenderCounter.cpp */; };
 		9392F14C0AD1861B00691BD4 /* CounterNode.h in Headers */ = {isa = PBXBuildFile; fileRef = 9392F14B0AD1861B00691BD4 /* CounterNode.h */; };
@@ -2138,7 +2280,6 @@
 		93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93EB169409F880B00091F8FF /* WebCoreSystemInterface.mm */; };
 		93EB169709F880C00091F8FF /* WebCoreSystemInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93EB355F09E37FD600F43799 /* MouseEventWithHitTestResults.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93EB355E09E37FD600F43799 /* MouseEventWithHitTestResults.cpp */; };
-		93EEC1FA09C2877700C515D1 /* DocPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EEC1E709C2877700C515D1 /* DocPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198E508245E59001E9ABC /* HTMLDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D23C02DE4396018635CA /* HTMLDocument.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198E608245E59001E9ABC /* HTMLElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D23F02DE4396018635CA /* HTMLElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93F198EF08245E59001E9ABC /* HTMLParser.h in Headers */ = {isa = PBXBuildFile; fileRef = F523D25102DE4396018635CA /* HTMLParser.h */; };
@@ -2183,8 +2324,9 @@
 		93F19AF808245E59001E9ABC /* Position.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BE91FC8C06133666005E3790 /* Position.cpp */; };
 		93F19AFD08245E59001E9ABC /* HTMLCanvasElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */; };
 		93F19AFF08245E59001E9ABC /* ClipboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 2D90660C0665D937006B6F1A /* ClipboardMac.mm */; };
-		93F19B0308245E59001E9ABC /* XSLStyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */; };
+		93F19B0308245E59001E9ABC /* XSLStyleSheetLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */; };
 		93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */; };
+		93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */; };
 		93F19B0708245E59001E9ABC /* WebCoreView.m in Sources */ = {isa = PBXBuildFile; fileRef = BE8560510701F91100239769 /* WebCoreView.m */; };
 		93F19B0808245E59001E9ABC /* WebDashboardRegion.m in Sources */ = {isa = PBXBuildFile; fileRef = 5150C2A50702629800AF642C /* WebDashboardRegion.m */; settings = {COMPILER_FLAGS = "-Wno-cast-qual"; }; };
 		93F19B1308245E59001E9ABC /* ApplicationServices.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5C2869302846DCD018635CA /* ApplicationServices.framework */; };
@@ -2203,6 +2345,12 @@
 		93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93F9B79E0BA6032600854064 /* JSCDATASection.cpp */; };
 		93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */ = {isa = PBXBuildFile; fileRef = 93F9B79F0BA6032600854064 /* JSCDATASection.h */; };
 		93FDAFCA0B11307400E2746F /* EditorInsertAction.h in Headers */ = {isa = PBXBuildFile; fileRef = 93FDAFC90B11307400E2746F /* EditorInsertAction.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059973107D975200A50A7C /* PolicyCallback.cpp */; };
+		97059978107D975200A50A7C /* PolicyCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059974107D975200A50A7C /* PolicyCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97059975107D975200A50A7C /* PolicyChecker.cpp */; };
+		9705997A107D975200A50A7C /* PolicyChecker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97059976107D975200A50A7C /* PolicyChecker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* RedirectScheduler.cpp */; };
+		979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* RedirectScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */; };
 		97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */; };
 		A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */; };
@@ -2211,6 +2359,8 @@
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
 		A7352C190B1BB89D00A986D0 /* RenderSVGBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7352C170B1BB89D00A986D0 /* RenderSVGBlock.cpp */; };
 		A7352C1A0B1BB89D00A986D0 /* RenderSVGBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = A7352C180B1BB89D00A986D0 /* RenderSVGBlock.h */; };
+		A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */ = {isa = PBXBuildFile; fileRef = A75E497410752ACB00C9B896 /* SerializedScriptValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */; };
 		A75E8B880E1DE2D6007F2481 /* FEBlend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */; };
 		A75E8B890E1DE2D6007F2481 /* FEBlend.h in Headers */ = {isa = PBXBuildFile; fileRef = A75E8B810E1DE2D6007F2481 /* FEBlend.h */; };
 		A75E8B8A0E1DE2D6007F2481 /* FEColorMatrix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */; };
@@ -2319,12 +2469,6 @@
 		A80E7E9E0A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E7E940A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp */; };
 		A80E7E9F0A1A83E3007FB8C5 /* JSHTMLButtonElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E7E950A1A83E3007FB8C5 /* JSHTMLButtonElement.h */; };
 		A80E7EA00A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80E7E960A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp */; };
-		A80F393D0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */; };
-		A80F393E0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */; };
-		A80F39580CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */; };
-		A80F39590CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */; };
-		A80F395A0CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */; };
-		A80F3A2E0CCD9D5A002DD990 /* DOMSVGDefinitionSrcElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */; };
 		A80F3A500CCDA2A2002DD990 /* DOMSVGFETurbulenceElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 8502AB3E0AD438C000378540 /* DOMSVGFETurbulenceElement.h */; };
 		A80F3A5A0CCDA2ED002DD990 /* DOMSVGAnimatedPoints.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ACEF070ACDCCCF001214FF /* DOMSVGAnimatedPoints.h */; };
 		A80F3A640CCDA2FC002DD990 /* DOMSVGLineElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85C9A2FD0AD7E94200FBFF1E /* DOMSVGLineElement.h */; };
@@ -3147,8 +3291,6 @@
 		B22279A50D00BF220071B782 /* SVGComponentTransferFunctionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B222780F0D00BF1F0071B782 /* SVGComponentTransferFunctionElement.h */; };
 		B22279A70D00BF220071B782 /* SVGCursorElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */; };
 		B22279A80D00BF220071B782 /* SVGCursorElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278120D00BF1F0071B782 /* SVGCursorElement.h */; };
-		B22279AA0D00BF220071B782 /* SVGDefinitionSrcElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */; };
-		B22279AB0D00BF220071B782 /* SVGDefinitionSrcElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */; };
 		B22279AD0D00BF220071B782 /* SVGDefsElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */; };
 		B22279AE0D00BF220071B782 /* SVGDefsElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22278180D00BF1F0071B782 /* SVGDefsElement.h */; };
 		B22279B00D00BF220071B782 /* SVGDescElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B222781A0D00BF1F0071B782 /* SVGDescElement.cpp */; };
@@ -3849,8 +3991,12 @@
 		B2FA3E180AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */; };
 		B2FA3E190AB75A6F000E5AC4 /* JSSVGZoomEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */; };
 		B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
+		B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */; };
+		B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */; };
 		B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */; };
 		B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */; };
+		B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */; };
+		B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */; };
 		BC00F0040E0A185500FD04E3 /* DOMFile.h in Headers */ = {isa = PBXBuildFile; fileRef = BC00EFFE0E0A185500FD04E3 /* DOMFile.h */; };
 		BC00F0050E0A185500FD04E3 /* DOMFile.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC00EFFF0E0A185500FD04E3 /* DOMFile.mm */; };
 		BC00F0060E0A185500FD04E3 /* DOMFileInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BC00F0000E0A185500FD04E3 /* DOMFileInternal.h */; };
@@ -3906,7 +4052,6 @@
 		BC1A37BE097C715F0019F3D8 /* DOMTraversal.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1A37A8097C715F0019F3D8 /* DOMTraversal.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC1A37BF097C715F0019F3D8 /* DOMUtility.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC1A37A9097C715F0019F3D8 /* DOMUtility.mm */; };
 		BC1A37C0097C715F0019F3D8 /* DOMViews.h in Headers */ = {isa = PBXBuildFile; fileRef = BC1A37AA097C715F0019F3D8 /* DOMViews.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC1DEA4F0E268EB60083A73F /* JSDocumentFragmentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */; };
 		BC20FB7F0C0E8E6C00D1447F /* JSCSSValueCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */; };
 		BC212A1F0FE8333200EC3708 /* HTMLDataGridElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC212A1E0FE8333200EC3708 /* HTMLDataGridElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC212A410FE83A1800EC3708 /* JSHTMLDataGridElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC212A3F0FE83A1800EC3708 /* JSHTMLDataGridElement.cpp */; };
@@ -4135,18 +4280,22 @@
 		BC80C9880CD294EE00A0B7B3 /* CSSTimingFunctionValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */; };
 		BC8243290D0CE8A200460C8F /* JSSQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243250D0CE8A200460C8F /* JSSQLError.h */; };
 		BC82432A0D0CE8A200460C8F /* JSSQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */; };
-		BC82432B0D0CE8A200460C8F /* JSVoidCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */; };
-		BC82432C0D0CE8A200460C8F /* JSVoidCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243280D0CE8A200460C8F /* JSVoidCallback.h */; };
 		BC8243E80D0CFD7500460C8F /* WindowFeatures.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */; };
 		BC8243E90D0CFD7500460C8F /* WindowFeatures.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8243E70D0CFD7500460C8F /* WindowFeatures.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC8B853E0E7C7F1100AB6984 /* ScrollbarThemeMac.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8B853C0E7C7F1100AB6984 /* ScrollbarThemeMac.h */; };
 		BC8B854B0E7C7F5600AB6984 /* ScrollbarTheme.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8BF150105813BF00A40A07 /* UserStyleSheet.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */; };
 		BC8C8FAE0DDCD31B00B592F4 /* RenderStyle.h in Headers */ = {isa = PBXBuildFile; fileRef = BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC904B760D10998F00680D32 /* ClassNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC904B720D10998F00680D32 /* ClassNodeList.cpp */; };
 		BC904B770D10998F00680D32 /* ClassNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC904B730D10998F00680D32 /* ClassNodeList.h */; };
 		BC926F800C0552470082776B /* JSHTMLFrameSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */; };
 		BC926F810C0552470082776B /* JSHTMLFrameSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */; };
+		BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */ = {isa = PBXBuildFile; fileRef = BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */; };
+		BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */; };
+		BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */; };
+		BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = BC946347107A936600857193 /* JSBeforeLoadEvent.h */; };
 		BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */; };
 		BC94D14E0C275C68006BC617 /* JSHistory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC94D14C0C275C68006BC617 /* JSHistory.cpp */; };
 		BC94D14F0C275C68006BC617 /* JSHistory.h in Headers */ = {isa = PBXBuildFile; fileRef = BC94D14D0C275C68006BC617 /* JSHistory.h */; };
@@ -4163,6 +4312,8 @@
 		BC9BC64E0E7C4889008B9849 /* ScrollbarClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC9BC64D0E7C4889008B9849 /* ScrollbarClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCA169A20BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA169A00BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp */; };
 		BCA169A30BFD55B40019CA76 /* JSHTMLTableCaptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA169A10BFD55B40019CA76 /* JSHTMLTableCaptionElement.h */; };
+		BCA2B061105047600043BD1C /* UserScript.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA2B0601050475F0043BD1C /* UserScript.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCA83E4F0D7CE1E9003421A8 /* JSClipboard.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA83E4D0D7CE1E9003421A8 /* JSClipboard.cpp */; };
 		BCA83E500D7CE1E9003421A8 /* JSClipboard.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA83E4E0D7CE1E9003421A8 /* JSClipboard.h */; };
 		BCA83E520D7CE205003421A8 /* JSClipboardCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */; };
@@ -4170,6 +4321,8 @@
 		BCA846D70DC67A350026C309 /* RenderReplica.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA846D50DC67A350026C309 /* RenderReplica.h */; };
 		BCA85A100C3AEAF4006F8308 /* DOMSVGNumberInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = BCA85A0F0C3AEAF4006F8308 /* DOMSVGNumberInternal.h */; };
 		BCAA90C30A7EBA60008B1229 /* Scrollbar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */; };
+		BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */; };
+		BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */ = {isa = PBXBuildFile; fileRef = BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */; };
 		BCAEFCAE1016CE4A0040D34E /* DOMRGBColor.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCAEFCAD1016CE4A0040D34E /* DOMRGBColor.mm */; };
 		BCB16C170979C3BD00467741 /* Cache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCB16BFE0979C3BD00467741 /* Cache.cpp */; };
 		BCB16C180979C3BD00467741 /* Cache.h in Headers */ = {isa = PBXBuildFile; fileRef = BCB16BFF0979C3BD00467741 /* Cache.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4232,6 +4385,8 @@
 		BCCBE7B50E07166900EAFA8E /* CSSVariableDependentValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCBE7B40E07166900EAFA8E /* CSSVariableDependentValue.cpp */; };
 		BCCD74DC0A4C8D35005FDA6D /* HTMLViewSourceDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */; };
 		BCCD74E50A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */; };
+		BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */; };
+		BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */; };
 		BCCFBAE80B5152ED0001F1D7 /* Tokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCD0E0FA0E972C3500265DEA /* SecurityOrigin.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD0E0F70E972C3500265DEA /* SecurityOrigin.cpp */; };
 		BCD0E0FB0E972C3500265DEA /* SecurityOrigin.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD0E0F80E972C3500265DEA /* SecurityOrigin.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4244,8 +4399,6 @@
 		BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */; };
 		BCD9C2640C17AA67005C90A2 /* JSNodeCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2600C17AA67005C90A2 /* JSNodeCustom.cpp */; };
 		BCD9C2650C17AA67005C90A2 /* JSNodeListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */; };
-		BCD9C2720C17AA81005C90A2 /* JSNamedNodesCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */; };
-		BCD9C2730C17AA81005C90A2 /* JSNamedNodesCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */; };
 		BCD9C2C00C17B69E005C90A2 /* JSNamedNodeMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2BC0C17B69E005C90A2 /* JSNamedNodeMap.cpp */; };
 		BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BCD9C2BD0C17B69E005C90A2 /* JSNamedNodeMap.h */; };
 		BCD9C2C20C17B69E005C90A2 /* JSNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD9C2BE0C17B69E005C90A2 /* JSNodeList.cpp */; };
@@ -4344,6 +4497,7 @@
 		BCEFE1EA0DCA5F6400739219 /* JSXSLTProcessor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */; };
 		BCEFE1EB0DCA5F6400739219 /* JSXSLTProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */; };
 		BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF5245F0FEBEE5D0095BF26 /* HTMLDataGridElement.cpp */; };
+		BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFA930710333193007B25D1 /* RenderOverflow.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFB2E5E0979E46400BA703D /* CachedResourceClient.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCFB2F76097A2E1A00BA703D /* Arena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCFB2F74097A2E1A00BA703D /* Arena.cpp */; };
 		BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */ = {isa = PBXBuildFile; fileRef = BCFB2F75097A2E1A00BA703D /* Arena.h */; };
@@ -4370,9 +4524,11 @@
 		C5160EEB1004543A00A7CEE2 /* StorageAreaImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */; };
 		C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */; };
 		C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */; };
+		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
+		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
-		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; };
+		CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		D05CED290A40BB2C00C5AF38 /* FormatBlockCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D05CED270A40BB2C00C5AF38 /* FormatBlockCommand.cpp */; };
 		D05CED2A0A40BB2C00C5AF38 /* FormatBlockCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D05CED280A40BB2C00C5AF38 /* FormatBlockCommand.h */; };
 		D06C0D8F0CFD11460065F43F /* RemoveFormatCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = D06C0D8D0CFD11460065F43F /* RemoveFormatCommand.h */; };
@@ -4386,12 +4542,20 @@
 		D23CA55D0AB0EAAE005108A5 /* JSRangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */; };
 		D23CA55F0AB0EAB6005108A5 /* JSRangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */; };
 		D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA56B0AB0EB8D005108A5 /* RangeException.h */; };
+		D8B6152F1032495100C8554A /* Cookie.h in Headers */ = {isa = PBXBuildFile; fileRef = D8B6152E1032495100C8554A /* Cookie.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DB23C2CB0A508D29002489EB /* IndentOutdentCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DB23C2C90A508D29002489EB /* IndentOutdentCommand.cpp */; };
 		DB23C2CC0A508D29002489EB /* IndentOutdentCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = DB23C2CA0A508D29002489EB /* IndentOutdentCommand.h */; };
 		DD05FE0D0B8BA3C6009ACDFE /* WebCoreObjCExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		DD763BB20992C2C900740B8E /* libxml2.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = DD763BB10992C2C900740B8E /* libxml2.dylib */; };
 		DD7CDF250A23CF9800069928 /* CSSUnknownRule.h in Headers */ = {isa = PBXBuildFile; fileRef = A80E6CCE0A1989CA007FB8C5 /* CSSUnknownRule.h */; };
 		DDE63ED50B7D45A800226998 /* DOMTextEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A14750B7D1BAF00A53FFD /* DOMTextEvent.h */; };
+		E0FEF372B17C53EAC1C1FBEE /* EventSource.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B17C53EAC1C1FBEE /* EventSource.h */; };
+		E0FEF372B27C53EAC1C1FBEE /* EventSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */; };
+		E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */; };
+		E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */; };
+		E0FEF372B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */; };
+		E0FEF372B67C53EAC1C1FBEE /* JSEventSourceConstructor.h in Headers */ = {isa = PBXBuildFile; fileRef = E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */; };
+		E0FEF372B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */; };
 		E107400D0E77BDC00033AF24 /* JSMessageChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E107400B0E77BDC00033AF24 /* JSMessageChannel.cpp */; };
 		E107400E0E77BDC00033AF24 /* JSMessageChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = E107400C0E77BDC00033AF24 /* JSMessageChannel.h */; };
 		E10743240E7835830033AF24 /* JSMessageChannelConstructor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */; };
@@ -4410,6 +4574,12 @@
 		E1271A140EEEC80400F61213 /* WorkerNavigator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1271A130EEEC80400F61213 /* WorkerNavigator.cpp */; };
 		E1271A580EEECDE400F61213 /* JSWorkerNavigator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1271A560EEECDE400F61213 /* JSWorkerNavigator.h */; };
 		E1271A590EEECDE400F61213 /* JSWorkerNavigator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1271A570EEECDE400F61213 /* JSWorkerNavigator.cpp */; };
+		E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */; };
+		E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */; };
+		E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */; };
+		E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */; };
+		E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */; };
+		E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */; };
 		E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */ = {isa = PBXBuildFile; fileRef = E12EDB7A0B308A78002704B6 /* EventTarget.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E12EDBE90B308E0B002704B6 /* EventTarget.cpp */; };
 		E17A4A1B0D97991D00FC10C6 /* DOMSVGAltGlyphElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 65AA6BAC0D974A00000541AE /* DOMSVGAltGlyphElement.h */; };
@@ -4424,7 +4594,7 @@
 		E1A643FD0EC097A000779668 /* WorkerScriptController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */; };
 		E1ACAF4C0E791AAF0087D12B /* DOMMessagePort.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1ACAF4A0E791AAF0087D12B /* DOMMessagePort.mm */; };
 		E1ACAF4D0E791AAF0087D12B /* DOMMessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ACAF4B0E791AAF0087D12B /* DOMMessagePort.h */; };
-		E1ADECBF0E76ACF1004A1A5E /* MessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECBD0E76ACF1004A1A5E /* MessagePort.h */; };
+		E1ADECBF0E76ACF1004A1A5E /* MessagePort.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECBD0E76ACF1004A1A5E /* MessagePort.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1ADECC00E76ACF1004A1A5E /* MessagePort.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADECBE0E76ACF1004A1A5E /* MessagePort.cpp */; };
 		E1ADECCE0E76AD8B004A1A5E /* MessageChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = E1ADECCC0E76AD8B004A1A5E /* MessageChannel.h */; };
 		E1ADECCF0E76AD8B004A1A5E /* MessageChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1ADECCD0E76AD8B004A1A5E /* MessageChannel.cpp */; };
@@ -4521,10 +4691,29 @@
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDEC98030AED7E170059137F /* WebCorePrefix.h in Headers */ = {isa = PBXBuildFile; fileRef = EDEC98020AED7E170059137F /* WebCorePrefix.h */; };
+		F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */; };
+		F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */; };
+		F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */; };
+		F5C041E40FFCA96D00839D4A /* DOMHTMLDataListElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */; };
+		F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */; };
+		F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */; };
+		F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */; };
 		F916C48D0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F916C48B0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.cpp */; };
 		F916C48E0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */; };
 		F9F0ED7A0DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */; };
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE6FD4880F676E5700092873 /* Coordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD4850F676E5700092873 /* Coordinates.h */; };
+=======
+		FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */; };
+		FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72EE1059C1EB00D999DD /* MathMLElement.h */; };
+		FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */; };
+		FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */; };
+		FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */; };
+		FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */ = {isa = PBXBuildFile; fileRef = FABE72F21059C1EB00D999DD /* MathMLMathElement.h */; };
+		FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */; };
+		FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FABE72FC1059C21100D999DD /* MathMLNames.cpp */; };
+		FE6FD4880F676E5700092873 /* Coordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD4850F676E5700092873 /* Coordinates.h */; settings = {ATTRIBUTES = (Private, ); }; };
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE6FD48D0F676E9300092873 /* JSCoordinates.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE6FD48B0F676E9300092873 /* JSCoordinates.cpp */; };
 		FE6FD48E0F676E9300092873 /* JSCoordinates.h in Headers */ = {isa = PBXBuildFile; fileRef = FE6FD48C0F676E9300092873 /* JSCoordinates.h */; };
 		FE700DD10F92D81A008E2BFE /* JSCoordinatesCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */; };
@@ -4535,7 +4724,11 @@
 		FE80D7AB0E9C1ED2000D6F75 /* JSGeolocationCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */; };
 		FE80D7C50E9C1F25000D6F75 /* Geolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FE80D7B70E9C1F25000D6F75 /* Geolocation.cpp */; };
 		FE80D7C60E9C1F25000D6F75 /* Geolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7B80E9C1F25000D6F75 /* Geolocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; };
+=======
+		FE80D7C90E9C1F25000D6F75 /* Geoposition.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */; settings = {ATTRIBUTES = (Private, ); }; };
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 		FE80D7CB0E9C1F25000D6F75 /* PositionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80D7CD0E9C1F25000D6F75 /* PositionError.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7BF0E9C1F25000D6F75 /* PositionError.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = FE80D7C10E9C1F25000D6F75 /* PositionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -4745,7 +4938,6 @@
 				A80F3B870CCDCE24002DD990 /* DOMSVGComponentTransferFunctionElementInternal.h in Copy Generated Headers */,
 				A8F46AC40CB20A9D003A9670 /* DOMSVGCursorElement.h in Copy Generated Headers */,
 				A80F3B9C0CCDCE24002DD990 /* DOMSVGCursorElementInternal.h in Copy Generated Headers */,
-				A80F3A2E0CCD9D5A002DD990 /* DOMSVGDefinitionSrcElement.h in Copy Generated Headers */,
 				A8F46B2D0CB20A9D003A9670 /* DOMSVGDefsElement.h in Copy Generated Headers */,
 				A80F3B550CCDCE24002DD990 /* DOMSVGDefsElementInternal.h in Copy Generated Headers */,
 				A8F46ABB0CB20A9D003A9670 /* DOMSVGDescElement.h in Copy Generated Headers */,
@@ -4976,6 +5168,8 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
+		00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginAccessEntry.cpp; sourceTree = "<group>"; };
+		00146289103CD1DE000B20DB /* OriginAccessEntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginAccessEntry.h; sourceTree = "<group>"; };
 		06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = ContextMenuItem.h; sourceTree = "<group>"; };
 		06027CB20B1CC03D00884B2D /* ContextMenuItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = ContextMenuItemMac.mm; sourceTree = "<group>"; };
 		062287830B4DB322000C34DF /* FocusDirection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusDirection.h; sourceTree = "<group>"; };
@@ -4995,7 +5189,9 @@
 		070DD8F50F01868000727DEB /* mediaControls.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControls.css; sourceTree = "<group>"; };
 		0735EE690F40C5E4004A2604 /* MediaPlayerProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerProxy.h; sourceTree = "<group>"; };
 		079F5E4B0F3BEBEA005E0782 /* MediaPlayerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaPlayerPrivate.h; sourceTree = "<group>"; };
-		07AFE5900F1446BD00841617 /* mediaControlsQT.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mediaControlsQT.css; sourceTree = "<group>"; };
+		07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.css; path = mediaControlsQuickTime.css; sourceTree = "<group>"; };
+		07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityMediaControls.cpp; sourceTree = "<group>"; };
+		07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AccessibilityMediaControls.h; sourceTree = "<group>"; };
 		080081940ED3B2DD00C53BC0 /* WMLAnchorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLAnchorElement.cpp; sourceTree = "<group>"; };
 		080081950ED3B2DD00C53BC0 /* WMLAnchorElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLAnchorElement.h; sourceTree = "<group>"; };
 		0804BF6C0EE09C3B0006C000 /* WMLDoElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLDoElement.cpp; sourceTree = "<group>"; };
@@ -5111,6 +5307,7 @@
 		0F580CFC0F12DE9B0051D689 /* RenderLayerBacking.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderLayerBacking.cpp; sourceTree = "<group>"; };
 		0F6ECD430F252F3700BDE271 /* CSSPropertyLonghand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSPropertyLonghand.h; sourceTree = "<group>"; };
 		0F6ECD440F252F3700BDE271 /* CSSPropertyLonghand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSPropertyLonghand.cpp; sourceTree = "<group>"; };
+		0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.3DRendering.exp; sourceTree = "<group>"; };
 		0FC705200EB1815600B90AD8 /* AtomicStringHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AtomicStringHash.h; sourceTree = "<group>"; };
 		0FCF33230F2B9715004B6795 /* ColorCG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ColorCG.cpp; sourceTree = "<group>"; };
 		0FCF33280F2B9A25004B6795 /* WebTiledLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebTiledLayer.mm; sourceTree = "<group>"; };
@@ -5145,6 +5342,8 @@
 		142011B50A003133008303F9 /* JSCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSStyleDeclaration.h; sourceTree = "<group>"; };
 		1432E8460C51493800B1500F /* GCController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = GCController.h; sourceTree = "<group>"; };
 		1432E8480C51493F00B1500F /* GCController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GCController.cpp; sourceTree = "<group>"; };
+		1449E24A107D4A8400B5793F /* JSCallbackData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCallbackData.h; sourceTree = "<group>"; };
+		1449E286107D4DB400B5793F /* JSCallbackData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCallbackData.cpp; sourceTree = "<group>"; };
 		1477E7740BF4134A00152872 /* PageCache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PageCache.cpp; sourceTree = "<group>"; };
 		1477E7750BF4134A00152872 /* PageCache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PageCache.h; sourceTree = "<group>"; };
 		14813BF309EDF88E00F757E1 /* IDLParser.pm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text.script.perl; name = IDLParser.pm; path = scripts/IDLParser.pm; sourceTree = "<group>"; };
@@ -5153,6 +5352,7 @@
 		14993BE30B2F2B1C0050497F /* FocusController.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = FocusController.cpp; sourceTree = "<group>"; };
 		14993BE40B2F2B1C0050497F /* FocusController.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FocusController.h; sourceTree = "<group>"; };
 		14C9A5E90B3D105F005A0232 /* Settings.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Settings.cpp; sourceTree = "<group>"; };
+		14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		14CF787109F587CA00EB3665 /* CSSValue.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = CSSValue.idl; sourceTree = "<group>"; };
 		14CF78A309F58CBF00EB3665 /* JSCSSValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSValue.cpp; sourceTree = "<group>"; };
 		14CF78A509F58CD800EB3665 /* JSCSSValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCSSValue.h; sourceTree = "<group>"; };
@@ -5339,7 +5539,6 @@
 		1A8F6BBA0DB55CDC001DB794 /* ManifestParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ManifestParser.cpp; sourceTree = "<group>"; };
 		1A8F6BBB0DB55CDC001DB794 /* ManifestParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ManifestParser.h; sourceTree = "<group>"; };
 		1A98956A0AA78F80005EF5EF /* KURLCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = KURLCFNet.cpp; sourceTree = "<group>"; };
-		1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
 		1AB1AE780C051FDE00139F4F /* zoomInCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomInCursor.png; sourceTree = "<group>"; };
 		1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomOutCursor.png; sourceTree = "<group>"; };
 		1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XPathEvaluator.cpp; sourceTree = "<group>"; };
@@ -5466,7 +5665,6 @@
 		1AE82F8E0CAAFA9D002237AE /* JSDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabase.h; sourceTree = "<group>"; };
 		1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSet.cpp; sourceTree = "<group>"; };
 		1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSet.h; sourceTree = "<group>"; };
-		1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCustom.cpp; sourceTree = "<group>"; };
 		1AF326770D78B9440068F0C4 /* EditorClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditorClient.h; sourceTree = "<group>"; };
 		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
@@ -5632,6 +5830,19 @@
 		31C0FF460E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEvent.h; sourceTree = "<group>"; };
 		31C0FF470E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMWebKitTransitionEvent.mm; sourceTree = "<group>"; };
 		31C0FF480E4CEFDD007D6FE5 /* DOMWebKitTransitionEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitTransitionEventInternal.h; sourceTree = "<group>"; };
+		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
+		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
+		33503C9910179A74003B47E1 /* NotificationPresenter.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationPresenter.h; path = notifications/NotificationPresenter.h; sourceTree = "<group>"; };
+		33503C9F10179AD7003B47E1 /* JSNotification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotification.cpp; sourceTree = "<group>"; };
+		33503CA010179AD7003B47E1 /* JSNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotification.h; sourceTree = "<group>"; };
+		33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCenter.cpp; sourceTree = "<group>"; };
+		33503CA210179AD7003B47E1 /* JSNotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotificationCenter.h; sourceTree = "<group>"; };
+		33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDesktopNotificationsCustom.cpp; sourceTree = "<group>"; };
+		33503CC61017A1B1003B47E1 /* Notification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Notification.cpp; path = notifications/Notification.cpp; sourceTree = "<group>"; };
+		3390CA510FFC157B00921962 /* NotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NotificationCenter.cpp; path = notifications/NotificationCenter.cpp; sourceTree = "<group>"; };
+		3390CA520FFC157B00921962 /* NotificationCenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationCenter.h; path = notifications/NotificationCenter.h; sourceTree = "<group>"; };
+		3390CA530FFC157B00921962 /* NotificationCenter.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NotificationCenter.idl; path = notifications/NotificationCenter.idl; sourceTree = "<group>"; };
+		3390CA540FFC157B00921962 /* NotificationContents.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NotificationContents.h; path = notifications/NotificationContents.h; sourceTree = "<group>"; };
 		371F4F3E0D25B9AF00ECE0D5 /* FontData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontData.h; sourceTree = "<group>"; };
 		371F4F3F0D25B9AF00ECE0D5 /* FontData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontData.cpp; sourceTree = "<group>"; };
 		371F4FFA0D25E7F300ECE0D5 /* SegmentedFontData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SegmentedFontData.h; sourceTree = "<group>"; };
@@ -5640,6 +5851,7 @@
 		371F51A00D262FA000ECE0D5 /* CSSSegmentedFontFace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSegmentedFontFace.cpp; sourceTree = "<group>"; };
 		371F53E70D2704F900ECE0D5 /* CSSUnicodeRangeValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSUnicodeRangeValue.h; sourceTree = "<group>"; };
 		371F53E80D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSUnicodeRangeValue.cpp; sourceTree = "<group>"; };
+		37202198106213C600F25C4B /* FontSmoothingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontSmoothingMode.h; sourceTree = "<group>"; };
 		3724CA540E68A7E400DB4384 /* CoreTextController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CoreTextController.h; sourceTree = "<group>"; };
 		3724CA550E68A7E400DB4384 /* CoreTextController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CoreTextController.cpp; sourceTree = "<group>"; };
 		3724CA560E68A7E400DB4384 /* FontMacATSUI.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontMacATSUI.mm; sourceTree = "<group>"; };
@@ -5657,13 +5869,13 @@
 		37F818FC0D657606005E1F05 /* WebCoreURLResponse.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreURLResponse.mm; sourceTree = "<group>"; };
 		41002CCB0F66EDEF009E660D /* ScriptFunctionCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptFunctionCall.h; sourceTree = "<group>"; };
 		41002CCC0F66EDEF009E660D /* ScriptFunctionCall.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptFunctionCall.cpp; sourceTree = "<group>"; };
+		410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageEventCustom.cpp; sourceTree = "<group>"; };
 		4110463F0FA222A600BA436A /* ScriptEventListener.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptEventListener.h; sourceTree = "<group>"; };
 		411046400FA222A600BA436A /* ScriptEventListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptEventListener.cpp; sourceTree = "<group>"; };
 		4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptState.cpp; sourceTree = "<group>"; };
 		412A68460F6B03DD000EA66E /* ScriptObjectQuarantine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObjectQuarantine.cpp; sourceTree = "<group>"; };
 		415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerConstructor.cpp; sourceTree = "<group>"; };
-		415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerCustom.cpp; sourceTree = "<group>"; };
 		415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerConstructor.h; sourceTree = "<group>"; };
 		4162A44D101145AE00DFF3ED /* DedicatedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DedicatedWorkerContext.cpp; path = workers/DedicatedWorkerContext.cpp; sourceTree = "<group>"; };
 		4162A44E101145AE00DFF3ED /* DedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DedicatedWorkerContext.h; path = workers/DedicatedWorkerContext.h; sourceTree = "<group>"; };
@@ -5673,6 +5885,7 @@
 		4162A4561011464700DFF3ED /* JSDedicatedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDedicatedWorkerContext.h; sourceTree = "<group>"; };
 		4167EBF3102962BA003D252A /* DefaultSharedWorkerRepository.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DefaultSharedWorkerRepository.cpp; path = workers/DefaultSharedWorkerRepository.cpp; sourceTree = "<group>"; };
 		4167EBF4102962BA003D252A /* DefaultSharedWorkerRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DefaultSharedWorkerRepository.h; path = workers/DefaultSharedWorkerRepository.h; sourceTree = "<group>"; };
+		416E29A5102FA962007FC14E /* WorkerReportingProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerReportingProxy.h; path = workers/WorkerReportingProxy.h; sourceTree = "<group>"; };
 		416E75BC0EDF8FD700360E1D /* ScriptCallStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallStack.h; sourceTree = "<group>"; };
 		416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
 		416E75C90EDF90C700360E1D /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
@@ -5698,7 +5911,6 @@
 		41D168E210226E89009BC827 /* SharedWorkerRepository.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedWorkerRepository.h; path = workers/SharedWorkerRepository.h; sourceTree = "<group>"; };
 		41D168E510226E89009BC827 /* SharedWorkerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SharedWorkerThread.cpp; path = workers/SharedWorkerThread.cpp; sourceTree = "<group>"; };
 		41D168E610226E89009BC827 /* SharedWorkerThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedWorkerThread.h; path = workers/SharedWorkerThread.h; sourceTree = "<group>"; };
-		41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerContextCustom.cpp; sourceTree = "<group>"; };
 		41D1690310238B66009BC827 /* JSSharedWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSharedWorkerContext.cpp; sourceTree = "<group>"; };
 		41D1690410238B66009BC827 /* JSSharedWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSharedWorkerContext.h; sourceTree = "<group>"; };
 		41E1B1CA0FF5986900576B3B /* AbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AbstractWorker.cpp; path = workers/AbstractWorker.cpp; sourceTree = "<group>"; };
@@ -5721,6 +5933,7 @@
 		41F066E30F64BCF600A07EAC /* ScriptObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptObject.cpp; sourceTree = "<group>"; };
 		41F1D21D0EF35C2A00DA8753 /* ScriptCachedFrameData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCachedFrameData.h; sourceTree = "<group>"; };
 		41F1D21E0EF35C2A00DA8753 /* ScriptCachedFrameData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCachedFrameData.cpp; sourceTree = "<group>"; };
+		41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessagePortCustom.h; sourceTree = "<group>"; };
 		4415292C0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLPlugInImageElement.h; sourceTree = "<group>"; };
 		4415292D0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLPlugInImageElement.cpp; sourceTree = "<group>"; };
 		4429AAFB0CB84E88007647C5 /* DOMHTMLEmbedElementPrivate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMHTMLEmbedElementPrivate.h; sourceTree = "<group>"; };
@@ -5741,7 +5954,7 @@
 		449195980FBE17D700D9F824 /* WebCore.SVG.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.exp; sourceTree = "<group>"; };
 		449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.SVG.Animation.exp; sourceTree = "<group>"; };
 		4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.NPAPI.exp; sourceTree = "<group>"; };
-		4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.LP64.exp; sourceTree = "<group>"; };
+		4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.PluginHostProcess.exp; sourceTree = "<group>"; };
 		4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.JNI.exp; sourceTree = "<group>"; };
 		4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.DashboardSupport.exp; sourceTree = "<group>"; };
 		449B19F30FA72ECE0015CA4A /* HTMLParserQuirks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLParserQuirks.h; sourceTree = "<group>"; };
@@ -5785,6 +5998,55 @@
 		498391570F1E776900C23782 /* WebKitCSSMatrix.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitCSSMatrix.idl; sourceTree = "<group>"; };
 		498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSMatrixConstructor.cpp; sourceTree = "<group>"; };
 		498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSMatrixConstructor.h; sourceTree = "<group>"; };
+		49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasBuffer.h; sourceTree = "<group>"; };
+		49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArray.h; sourceTree = "<group>"; };
+		49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasProgram.cpp; sourceTree = "<group>"; };
+		49C7B9891042D2D30009D447 /* JSCanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasProgram.h; sourceTree = "<group>"; };
+		49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShader.cpp; sourceTree = "<group>"; };
+		49C7B9901042D2D30009D447 /* JSCanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShader.h; sourceTree = "<group>"; };
+		49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasTexture.cpp; sourceTree = "<group>"; };
+		49C7B9921042D2D30009D447 /* JSCanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasTexture.h; sourceTree = "<group>"; };
+		49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasBuffer.cpp; path = canvas/CanvasBuffer.cpp; sourceTree = "<group>"; };
+		49C7B9A91042D32E0009D447 /* CanvasBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasBuffer.h; path = canvas/CanvasBuffer.h; sourceTree = "<group>"; };
+		49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasBuffer.idl; path = canvas/CanvasBuffer.idl; sourceTree = "<group>"; };
+		49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasByteArray.cpp; path = canvas/CanvasByteArray.cpp; sourceTree = "<group>"; };
+		49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasByteArray.h; path = canvas/CanvasByteArray.h; sourceTree = "<group>"; };
+		49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasByteArray.idl; path = canvas/CanvasByteArray.idl; sourceTree = "<group>"; };
+		49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFramebuffer.cpp; path = canvas/CanvasFramebuffer.cpp; sourceTree = "<group>"; };
+		49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFramebuffer.h; path = canvas/CanvasFramebuffer.h; sourceTree = "<group>"; };
+		49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFramebuffer.idl; path = canvas/CanvasFramebuffer.idl; sourceTree = "<group>"; };
+		49C7B9B41042D32F0009D447 /* CanvasObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasObject.cpp; path = canvas/CanvasObject.cpp; sourceTree = "<group>"; };
+		49C7B9B51042D32F0009D447 /* CanvasObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasObject.h; path = canvas/CanvasObject.h; sourceTree = "<group>"; };
+		49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasProgram.cpp; path = canvas/CanvasProgram.cpp; sourceTree = "<group>"; };
+		49C7B9B71042D32F0009D447 /* CanvasProgram.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasProgram.h; path = canvas/CanvasProgram.h; sourceTree = "<group>"; };
+		49C7B9B81042D32F0009D447 /* CanvasProgram.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasProgram.idl; path = canvas/CanvasProgram.idl; sourceTree = "<group>"; };
+		49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderbuffer.cpp; path = canvas/CanvasRenderbuffer.cpp; sourceTree = "<group>"; };
+		49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderbuffer.h; path = canvas/CanvasRenderbuffer.h; sourceTree = "<group>"; };
+		49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderbuffer.idl; path = canvas/CanvasRenderbuffer.idl; sourceTree = "<group>"; };
+		49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext.cpp; path = canvas/CanvasRenderingContext.cpp; sourceTree = "<group>"; };
+		49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext.h; path = canvas/CanvasRenderingContext.h; sourceTree = "<group>"; };
+		49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext.idl; path = canvas/CanvasRenderingContext.idl; sourceTree = "<group>"; };
+		49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasRenderingContext3D.cpp; path = canvas/CanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
+		49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasRenderingContext3D.h; path = canvas/CanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasRenderingContext3D.idl; path = canvas/CanvasRenderingContext3D.idl; sourceTree = "<group>"; };
+		49C7B9C21042D32F0009D447 /* CanvasShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShader.cpp; path = canvas/CanvasShader.cpp; sourceTree = "<group>"; };
+		49C7B9C31042D32F0009D447 /* CanvasShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShader.h; path = canvas/CanvasShader.h; sourceTree = "<group>"; };
+		49C7B9C41042D32F0009D447 /* CanvasShader.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShader.idl; path = canvas/CanvasShader.idl; sourceTree = "<group>"; };
+		49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasTexture.cpp; path = canvas/CanvasTexture.cpp; sourceTree = "<group>"; };
+		49C7B9C61042D32F0009D447 /* CanvasTexture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasTexture.h; path = canvas/CanvasTexture.h; sourceTree = "<group>"; };
+		49C7B9C71042D32F0009D447 /* CanvasTexture.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasTexture.idl; path = canvas/CanvasTexture.idl; sourceTree = "<group>"; };
+		49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContext3D.h; sourceTree = "<group>"; };
+		49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Canvas3DLayer.h; sourceTree = "<group>"; };
+		49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = Canvas3DLayer.mm; sourceTree = "<group>"; };
+		49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContext3DMac.cpp; sourceTree = "<group>"; };
+		49C7BA781042EFAE0009D447 /* OpenGL.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = OpenGL.framework; path = /System/Library/Frameworks/OpenGL.framework; sourceTree = "<absolute>"; };
+		49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentCustom.cpp; sourceTree = "<group>"; };
 		49D5DC270F423A73008F20FD /* Matrix3DTransformOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Matrix3DTransformOperation.cpp; path = transforms/Matrix3DTransformOperation.cpp; sourceTree = "<group>"; };
 		49D5DC280F423A73008F20FD /* Matrix3DTransformOperation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Matrix3DTransformOperation.h; path = transforms/Matrix3DTransformOperation.h; sourceTree = "<group>"; };
 		49D5DC290F423A73008F20FD /* PerspectiveTransformOperation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PerspectiveTransformOperation.cpp; path = transforms/PerspectiveTransformOperation.cpp; sourceTree = "<group>"; };
@@ -5810,6 +6072,78 @@
 		49E912A70EFAC906009D0CAF /* AnimationList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AnimationList.cpp; path = animation/AnimationList.cpp; sourceTree = "<group>"; };
 		49E912A80EFAC906009D0CAF /* AnimationList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationList.h; path = animation/AnimationList.h; sourceTree = "<group>"; };
 		49E912A90EFAC906009D0CAF /* TimingFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TimingFunction.h; path = animation/TimingFunction.h; sourceTree = "<group>"; };
+		49EECDC710503C2300099FAB /* CanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArray.cpp; path = canvas/CanvasArray.cpp; sourceTree = "<group>"; };
+		49EECDC810503C2300099FAB /* CanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArray.h; path = canvas/CanvasArray.h; sourceTree = "<group>"; };
+		49EECDC910503C2300099FAB /* CanvasArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArray.idl; path = canvas/CanvasArray.idl; sourceTree = "<group>"; };
+		49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasArrayBuffer.cpp; path = canvas/CanvasArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasArrayBuffer.h; path = canvas/CanvasArrayBuffer.h; sourceTree = "<group>"; };
+		49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasArrayBuffer.idl; path = canvas/CanvasArrayBuffer.idl; sourceTree = "<group>"; };
+		49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasFloatArray.cpp; path = canvas/CanvasFloatArray.cpp; sourceTree = "<group>"; };
+		49EECDCE10503C2300099FAB /* CanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasFloatArray.h; path = canvas/CanvasFloatArray.h; sourceTree = "<group>"; };
+		49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasFloatArray.idl; path = canvas/CanvasFloatArray.idl; sourceTree = "<group>"; };
+		49EECDD010503C2300099FAB /* CanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasIntArray.cpp; path = canvas/CanvasIntArray.cpp; sourceTree = "<group>"; };
+		49EECDD110503C2300099FAB /* CanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasIntArray.h; path = canvas/CanvasIntArray.h; sourceTree = "<group>"; };
+		49EECDD210503C2300099FAB /* CanvasIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasIntArray.idl; path = canvas/CanvasIntArray.idl; sourceTree = "<group>"; };
+		49EECDD310503C2300099FAB /* CanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasShortArray.cpp; path = canvas/CanvasShortArray.cpp; sourceTree = "<group>"; };
+		49EECDD410503C2300099FAB /* CanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasShortArray.h; path = canvas/CanvasShortArray.h; sourceTree = "<group>"; };
+		49EECDD510503C2300099FAB /* CanvasShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasShortArray.idl; path = canvas/CanvasShortArray.idl; sourceTree = "<group>"; };
+		49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedByteArray.cpp; path = canvas/CanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedByteArray.h; path = canvas/CanvasUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedByteArray.idl; path = canvas/CanvasUnsignedByteArray.idl; sourceTree = "<group>"; };
+		49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedIntArray.cpp; path = canvas/CanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedIntArray.h; path = canvas/CanvasUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedIntArray.idl; path = canvas/CanvasUnsignedIntArray.idl; sourceTree = "<group>"; };
+		49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasUnsignedShortArray.cpp; path = canvas/CanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasUnsignedShortArray.h; path = canvas/CanvasUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasUnsignedShortArray.idl; path = canvas/CanvasUnsignedShortArray.idl; sourceTree = "<group>"; };
+		49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBuffer.cpp; sourceTree = "<group>"; };
+		49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBuffer.h; sourceTree = "<group>"; };
+		49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArray.cpp; sourceTree = "<group>"; };
+		49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArray.h; sourceTree = "<group>"; };
+		49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArray.cpp; sourceTree = "<group>"; };
+		49EECEF7105070C400099FAB /* JSCanvasIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArray.h; sourceTree = "<group>"; };
+		49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArray.cpp; sourceTree = "<group>"; };
+		49EECEF9105070C400099FAB /* JSCanvasShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArray.h; sourceTree = "<group>"; };
+		49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArray.cpp; sourceTree = "<group>"; };
+		49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArray.h; sourceTree = "<group>"; };
+		49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArray.cpp; sourceTree = "<group>"; };
+		49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArray.h; sourceTree = "<group>"; };
+		49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArray.cpp; sourceTree = "<group>"; };
+		49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArray.h; sourceTree = "<group>"; };
+		49EECF19105072F300099FAB /* JSCanvasArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArray.cpp; sourceTree = "<group>"; };
+		49EECF1A105072F300099FAB /* JSCanvasArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArray.h; sourceTree = "<group>"; };
+		49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayCustom.cpp; sourceTree = "<group>"; };
+		49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasArrayBufferConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasArrayBufferConstructor.h; sourceTree = "<group>"; };
+		49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasFloatArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasFloatArrayConstructor.h; sourceTree = "<group>"; };
+		49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedByteArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedByteArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedIntArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedIntArrayConstructor.h; sourceTree = "<group>"; };
+		49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasUnsignedShortArrayConstructor.cpp; sourceTree = "<group>"; };
+		49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasUnsignedShortArrayConstructor.h; sourceTree = "<group>"; };
+		49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext.cpp; sourceTree = "<group>"; };
+		49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext.h; sourceTree = "<group>"; };
+		49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
+		49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
+		49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3D.cpp; sourceTree = "<group>"; };
+		49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext3D.h; sourceTree = "<group>"; };
+		49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2DCustom.cpp; sourceTree = "<group>"; };
+		49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext3DCustom.cpp; sourceTree = "<group>"; };
+		49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContextCustom.cpp; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* SelectionControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = SelectionControllerMac.mm; path = mac/SelectionControllerMac.mm; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
 		4B2709810AF2E5E00065127F /* PasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PasteboardMac.mm; sourceTree = "<group>"; };
@@ -5849,6 +6183,14 @@
 		4E1959280A39DACC00220FE5 /* MediaQueryExp.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaQueryExp.h; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
 		510184680B08602A004A825F /* CachedPage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedPage.cpp; sourceTree = "<group>"; };
+		510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamErrorBase.cpp; sourceTree = "<group>"; };
+		510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamErrorBase.h; sourceTree = "<group>"; };
+		510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleBase.cpp; sourceTree = "<group>"; };
+		510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleBase.h; sourceTree = "<group>"; };
+		510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleClient.h; sourceTree = "<group>"; };
+		510D4A47103177A20049EA54 /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketChannel.cpp; sourceTree = "<group>"; };
+		510D4A48103177A20049EA54 /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannel.h; sourceTree = "<group>"; };
+		510D4A49103177A20049EA54 /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannelClient.h; sourceTree = "<group>"; };
 		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
 		511F23130DC160DA004F0032 /* LocalStorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalStorageTask.cpp; sourceTree = "<group>"; };
 		511F23140DC160DA004F0032 /* LocalStorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocalStorageTask.h; sourceTree = "<group>"; };
@@ -5932,6 +6274,9 @@
 		519611E90CAC749C0010A80C /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTask.cpp; sourceTree = "<group>"; };
 		519FE0A10DAD446E00A08F21 /* HTMLAttributeNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLAttributeNames.in; sourceTree = "<group>"; };
 		519FE0A20DAD446E00A08F21 /* HTMLTagNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTagNames.in; sourceTree = "<group>"; };
+		51A052311058774F00CC9E95 /* CredentialStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CredentialStorage.h; sourceTree = "<group>"; };
+		51A052321058774F00CC9E95 /* CredentialStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CredentialStorage.cpp; sourceTree = "<group>"; };
+		51A052551058874000CC9E95 /* ProtectionSpaceHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtectionSpaceHash.h; sourceTree = "<group>"; };
 		51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseAuthorizer.h; sourceTree = "<group>"; };
 		51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
 		51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginQuotaManager.cpp; sourceTree = "<group>"; };
@@ -5939,6 +6284,11 @@
 		51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginUsageRecord.cpp; sourceTree = "<group>"; };
 		51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginUsageRecord.h; sourceTree = "<group>"; };
 		51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ResourceLoaderMac.mm; sourceTree = "<group>"; };
+		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamError.h; path = cf/SocketStreamError.h; sourceTree = "<group>"; };
+		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamHandle.h; path = cf/SocketStreamHandle.h; sourceTree = "<group>"; };
+		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SocketStreamHandleCFNet.cpp; path = cf/SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
+		51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshake.cpp; sourceTree = "<group>"; };
+		51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshake.h; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
 		51BE37DE0DAEE00E001085FC /* StorageArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageArea.h; sourceTree = "<group>"; };
 		51C0AA380F2AA10A001648C2 /* CachedFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFrame.h; sourceTree = "<group>"; };
@@ -5995,10 +6345,13 @@
 		5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollBehavior.h; sourceTree = "<group>"; };
 		5DA5E0FA102B953800088CF9 /* JSWebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebSocket.cpp; sourceTree = "<group>"; };
 		5DA5E0FB102B953800088CF9 /* JSWebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebSocket.h; sourceTree = "<group>"; };
+		5DB1BC6810715A6400EFAA49 /* TransformSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformSource.h; sourceTree = "<group>"; };
+		5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformSourceLibxslt.cpp; sourceTree = "<group>"; };
 		5DCF836C0D59159800953BC6 /* PluginInfoStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginInfoStore.h; sourceTree = "<group>"; };
 		63189AE20E83A33300012E41 /* NodeRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeRareData.h; sourceTree = "<group>"; };
 		637B7ADE0E8767B800E32194 /* ElementRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ElementRareData.h; sourceTree = "<group>"; };
 		63D7B32C0E78CD3F00F7617C /* NodeRenderStyle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NodeRenderStyle.h; sourceTree = "<group>"; };
+		63F371CD100E790000BBA87A /* WebCore.Video.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.Video.exp; sourceTree = "<group>"; };
 		650F53DB09D15DDA00C9B0C8 /* CSSGrammar.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSGrammar.h; sourceTree = "<group>"; };
 		650FBF270D9AF046008FC292 /* SVGHKernElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGHKernElement.cpp; sourceTree = "<group>"; };
 		650FBF280D9AF047008FC292 /* SVGHKernElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGHKernElement.h; sourceTree = "<group>"; };
@@ -6101,13 +6454,13 @@
 		65DF323409D1DE65000BE325 /* JSCanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasGradient.h; sourceTree = "<group>"; };
 		65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasPattern.cpp; sourceTree = "<group>"; };
 		65DF323609D1DE65000BE325 /* JSCanvasPattern.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasPattern.h; sourceTree = "<group>"; };
-		65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCanvasRenderingContext2D.cpp; sourceTree = "<group>"; };
-		65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSCanvasRenderingContext2D.h; sourceTree = "<group>"; };
 		65F80697054D9F86008BF776 /* BlockExceptions.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = BlockExceptions.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65FEA86809833ADE00BED4AB /* Page.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Page.cpp; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
-		7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserStyleSheetLoader.cpp; sourceTree = "<group>"; };
-		7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheetLoader.h; sourceTree = "<group>"; };
+		75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMDispatchTimelineItem.cpp; sourceTree = "<group>"; };
+		75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDispatchTimelineItem.h; sourceTree = "<group>"; };
+		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
+		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
 		75793E800D0CE0B3007FC0AC /* MessageEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; name = MessageEvent.cpp; path = dom/MessageEvent.cpp; sourceTree = SOURCE_ROOT; };
 		75793E810D0CE0B3007FC0AC /* MessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; name = MessageEvent.h; path = dom/MessageEvent.h; sourceTree = SOURCE_ROOT; };
 		75793E820D0CE0B3007FC0AC /* MessageEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; name = MessageEvent.idl; path = dom/MessageEvent.idl; sourceTree = SOURCE_ROOT; };
@@ -6116,6 +6469,12 @@
 		75793ED00D0CE85B007FC0AC /* DOMMessageEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEvent.h; sourceTree = "<group>"; };
 		75793ED10D0CE85B007FC0AC /* DOMMessageEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMMessageEvent.mm; sourceTree = "<group>"; };
 		75793ED20D0CE85B007FC0AC /* DOMMessageEventInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMMessageEventInternal.h; sourceTree = "<group>"; };
+		75A94A01104B74FB0006673C /* TimelineItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TimelineItem.cpp; sourceTree = "<group>"; };
+		75A94A02104B74FB0006673C /* TimelineItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TimelineItem.h; sourceTree = "<group>"; };
+		7693BACE106C2DCA007B0823 /* HaltablePlugin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HaltablePlugin.h; sourceTree = "<group>"; };
+		7693BACF106C2DCA007B0823 /* PluginHalter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginHalter.cpp; sourceTree = "<group>"; };
+		7693BAD0106C2DCA007B0823 /* PluginHalter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalter.h; sourceTree = "<group>"; };
+		7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginHalterClient.h; sourceTree = "<group>"; };
 		7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptArray.cpp; sourceTree = "<group>"; };
 		7A1E88F4101CC384000C4DF5 /* ScriptArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptArray.h; sourceTree = "<group>"; };
 		7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMAgent.cpp; sourceTree = "<group>"; };
@@ -6948,7 +7307,6 @@
 		85F56A790A98CE3700ADB60A /* DOMProcessingInstruction.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMProcessingInstruction.mm; sourceTree = "<group>"; };
 		85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMKeyboardEvent.h; sourceTree = "<group>"; };
 		85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMKeyboardEvent.mm; sourceTree = "<group>"; };
-		929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentCustom.cpp; sourceTree = "<group>"; };
 		9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroup.cpp; sourceTree = "<group>"; };
 		9302B0BE0D79F82C00C7EE83 /* PageGroup.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageGroup.h; sourceTree = "<group>"; };
 		9305B24C098F1B6B00C28855 /* Timer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Timer.h; sourceTree = "<group>"; };
@@ -6962,6 +7320,7 @@
 		9307F1D50AF2D59000DBA31A /* HitTestResult.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HitTestResult.cpp; sourceTree = "<group>"; };
 		9307F1D60AF2D59000DBA31A /* HitTestResult.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HitTestResult.h; sourceTree = "<group>"; };
 		930908900AF7EDE40081DF01 /* HitTestRequest.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HitTestRequest.h; sourceTree = "<group>"; };
+		930FC6891072B9280045293E /* TextRenderingMode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextRenderingMode.h; sourceTree = "<group>"; };
 		9327A94109968D1A0068A546 /* HTMLOptionsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLOptionsCollection.cpp; sourceTree = "<group>"; };
 		932871BF0B20DEB70049035A /* PlatformMenuDescription.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PlatformMenuDescription.h; sourceTree = "<group>"; };
 		932E16080AF578340025F408 /* FrameLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameLoader.cpp; sourceTree = "<group>"; };
@@ -7097,6 +7456,8 @@
 		938E662509F09956008A48EC /* HTMLCanvasElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLCanvasElement.idl; sourceTree = "<group>"; };
 		938E665F09F09B81008A48EC /* JSHTMLCanvasElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCanvasElement.cpp; sourceTree = "<group>"; };
 		938E666109F09B87008A48EC /* JSHTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLCanvasElement.h; sourceTree = "<group>"; };
+		9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLCanvasElementCustom.cpp; sourceTree = "<group>"; };
+		9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSRuleListCustom.cpp; sourceTree = "<group>"; };
 		9392F1410AD185F400691BD4 /* RenderCounter.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderCounter.h; sourceTree = "<group>"; };
 		9392F1430AD185FE00691BD4 /* RenderCounter.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderCounter.cpp; sourceTree = "<group>"; };
 		9392F14B0AD1861B00691BD4 /* CounterNode.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CounterNode.h; sourceTree = "<group>"; };
@@ -7158,7 +7519,6 @@
 		93EB355E09E37FD600F43799 /* MouseEventWithHitTestResults.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MouseEventWithHitTestResults.cpp; sourceTree = "<group>"; };
 		93EEC1E509C2877700C515D1 /* Attr.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Attr.idl; sourceTree = "<group>"; };
 		93EEC1E609C2877700C515D1 /* CharacterData.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CharacterData.idl; sourceTree = "<group>"; };
-		93EEC1E709C2877700C515D1 /* DocPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocPtr.h; sourceTree = "<group>"; };
 		93EEC1E809C2877700C515D1 /* DocumentType.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DocumentType.idl; sourceTree = "<group>"; };
 		93EEC1E909C2877700C515D1 /* DOMImplementation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMImplementation.idl; sourceTree = "<group>"; };
 		93EEC1EA09C2877700C515D1 /* Element.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Element.idl; sourceTree = "<group>"; };
@@ -7186,6 +7546,12 @@
 		93F9B79E0BA6032600854064 /* JSCDATASection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCDATASection.cpp; sourceTree = "<group>"; };
 		93F9B79F0BA6032600854064 /* JSCDATASection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCDATASection.h; sourceTree = "<group>"; };
 		93FDAFC90B11307400E2746F /* EditorInsertAction.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = EditorInsertAction.h; sourceTree = "<group>"; };
+		97059973107D975200A50A7C /* PolicyCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyCallback.cpp; sourceTree = "<group>"; };
+		97059974107D975200A50A7C /* PolicyCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyCallback.h; sourceTree = "<group>"; };
+		97059975107D975200A50A7C /* PolicyChecker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PolicyChecker.cpp; sourceTree = "<group>"; };
+		97059976107D975200A50A7C /* PolicyChecker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PolicyChecker.h; sourceTree = "<group>"; };
+		979F43D11075E44A0000F83B /* RedirectScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RedirectScheduler.cpp; sourceTree = "<group>"; };
+		979F43D21075E44A0000F83B /* RedirectScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RedirectScheduler.h; sourceTree = "<group>"; };
 		97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
 		97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
 		A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementFactory.cpp; sourceTree = "<group>"; };
@@ -7194,6 +7560,8 @@
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A7352C170B1BB89D00A986D0 /* RenderSVGBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGBlock.cpp; sourceTree = "<group>"; };
 		A7352C180B1BB89D00A986D0 /* RenderSVGBlock.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGBlock.h; sourceTree = "<group>"; };
+		A75E497410752ACB00C9B896 /* SerializedScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SerializedScriptValue.h; sourceTree = "<group>"; };
+		A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SerializedScriptValue.cpp; sourceTree = "<group>"; };
 		A75E8B800E1DE2D6007F2481 /* FEBlend.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FEBlend.cpp; path = filters/FEBlend.cpp; sourceTree = "<group>"; };
 		A75E8B810E1DE2D6007F2481 /* FEBlend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FEBlend.h; path = filters/FEBlend.h; sourceTree = "<group>"; };
 		A75E8B820E1DE2D6007F2481 /* FEColorMatrix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FEColorMatrix.cpp; path = filters/FEColorMatrix.cpp; sourceTree = "<group>"; };
@@ -7316,11 +7684,6 @@
 		A80E7E940A1A83E3007FB8C5 /* JSHTMLTextAreaElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTextAreaElement.cpp; sourceTree = "<group>"; };
 		A80E7E950A1A83E3007FB8C5 /* JSHTMLButtonElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLButtonElement.h; sourceTree = "<group>"; };
 		A80E7E960A1A83E3007FB8C5 /* JSHTMLButtonElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLButtonElement.cpp; sourceTree = "<group>"; };
-		A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGDefinitionSrcElement.h; sourceTree = "<group>"; };
-		A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGDefinitionSrcElement.cpp; sourceTree = "<group>"; };
-		A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGDefinitionSrcElementInternal.h; sourceTree = "<group>"; };
-		A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGDefinitionSrcElement.mm; sourceTree = "<group>"; };
-		A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGDefinitionSrcElement.h; sourceTree = "<group>"; };
 		A81369AE097374F500D74463 /* HTMLIsIndexElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLIsIndexElement.h; sourceTree = "<group>"; };
 		A81369AF097374F500D74463 /* HTMLIsIndexElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLIsIndexElement.cpp; sourceTree = "<group>"; };
 		A81369B0097374F500D74463 /* HTMLInputElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLInputElement.h; sourceTree = "<group>"; };
@@ -7900,9 +8263,6 @@
 		B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGCursorElement.cpp; sourceTree = "<group>"; };
 		B22278120D00BF1F0071B782 /* SVGCursorElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGCursorElement.h; sourceTree = "<group>"; };
 		B22278130D00BF1F0071B782 /* SVGCursorElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGCursorElement.idl; sourceTree = "<group>"; };
-		B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGDefinitionSrcElement.cpp; sourceTree = "<group>"; };
-		B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGDefinitionSrcElement.h; sourceTree = "<group>"; };
-		B22278160D00BF1F0071B782 /* SVGDefinitionSrcElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGDefinitionSrcElement.idl; sourceTree = "<group>"; };
 		B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGDefsElement.cpp; sourceTree = "<group>"; };
 		B22278180D00BF1F0071B782 /* SVGDefsElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGDefsElement.h; sourceTree = "<group>"; };
 		B22278190D00BF1F0071B782 /* SVGDefsElement.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGDefsElement.idl; sourceTree = "<group>"; };
@@ -8725,8 +9085,12 @@
 		B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGZoomEvent.cpp; sourceTree = "<group>"; };
 		B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGZoomEvent.h; sourceTree = "<group>"; };
 		B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreObjCExtras.mm; sourceTree = "<group>"; };
+		B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionClient.cpp; sourceTree = "<group>"; };
+		B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionClient.h; sourceTree = "<group>"; };
 		B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLiteFileSystem.h; path = sql/SQLiteFileSystem.h; sourceTree = "<group>"; };
 		B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLiteFileSystem.cpp; path = sql/SQLiteFileSystem.cpp; sourceTree = "<group>"; };
+		B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCoordinator.h; sourceTree = "<group>"; };
 		BC00EFFE0E0A185500FD04E3 /* DOMFile.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMFile.h; sourceTree = "<group>"; };
 		BC00EFFF0E0A185500FD04E3 /* DOMFile.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMFile.mm; sourceTree = "<group>"; };
 		BC00F0000E0A185500FD04E3 /* DOMFileInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMFileInternal.h; sourceTree = "<group>"; };
@@ -8751,10 +9115,11 @@
 		BC06EDE20BFD6D0D00856E9D /* JSHTMLTableCellElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableCellElement.h; sourceTree = "<group>"; };
 		BC06EE020BFD71AA00856E9D /* JSHTMLTableElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableElement.cpp; sourceTree = "<group>"; };
 		BC06EE030BFD71AA00856E9D /* JSHTMLTableElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableElement.h; sourceTree = "<group>"; };
-		BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLStyleSheet.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLStyleSheetLibxslt.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24A06D18A7E004A6FA3 /* XSLStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = XSLStyleSheet.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTProcessor.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC06F24C06D18A7E004A6FA3 /* XSLTProcessor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = XSLTProcessor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSLTProcessorLibxslt.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		BC073BA90C399B1F000F5979 /* FloatConversion.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = FloatConversion.h; sourceTree = "<group>"; };
 		BC0B36A10CD3C67C00AC7EB5 /* Console.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Console.cpp; sourceTree = "<group>"; };
 		BC0B36A20CD3C67C00AC7EB5 /* Console.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Console.h; sourceTree = "<group>"; };
@@ -8786,7 +9151,6 @@
 		BC1A37A8097C715F0019F3D8 /* DOMTraversal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMTraversal.h; sourceTree = "<group>"; };
 		BC1A37A9097C715F0019F3D8 /* DOMUtility.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMUtility.mm; sourceTree = "<group>"; };
 		BC1A37AA097C715F0019F3D8 /* DOMViews.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMViews.h; sourceTree = "<group>"; };
-		BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentFragmentCustom.cpp; sourceTree = "<group>"; };
 		BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSCSSValueCustom.cpp; sourceTree = "<group>"; };
 		BC212A1E0FE8333200EC3708 /* HTMLDataGridElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataGridElement.h; sourceTree = "<group>"; };
 		BC212A230FE8345D00EC3708 /* HTMLDataGridElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataGridElement.idl; sourceTree = "<group>"; };
@@ -9028,18 +9392,22 @@
 		BC80C9860CD294EE00A0B7B3 /* CSSTimingFunctionValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSTimingFunctionValue.h; sourceTree = "<group>"; };
 		BC8243250D0CE8A200460C8F /* JSSQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLError.h; sourceTree = "<group>"; };
 		BC8243260D0CE8A200460C8F /* JSSQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransaction.h; sourceTree = "<group>"; };
-		BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSVoidCallback.cpp; sourceTree = "<group>"; };
-		BC8243280D0CE8A200460C8F /* JSVoidCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSVoidCallback.h; sourceTree = "<group>"; };
 		BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WindowFeatures.cpp; sourceTree = "<group>"; };
 		BC8243E70D0CFD7500460C8F /* WindowFeatures.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WindowFeatures.h; sourceTree = "<group>"; };
 		BC8B853C0E7C7F1100AB6984 /* ScrollbarThemeMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarThemeMac.h; sourceTree = "<group>"; };
 		BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarTheme.h; sourceTree = "<group>"; };
+		BC8BF150105813BF00A40A07 /* UserStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheet.h; sourceTree = "<group>"; };
+		BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserStyleSheetTypes.h; sourceTree = "<group>"; };
 		BC8C8FAB0DDCD31B00B592F4 /* RenderStyle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderStyle.cpp; path = style/RenderStyle.cpp; sourceTree = "<group>"; };
 		BC8C8FAC0DDCD31B00B592F4 /* RenderStyle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderStyle.h; path = style/RenderStyle.h; sourceTree = "<group>"; };
 		BC904B720D10998F00680D32 /* ClassNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ClassNodeList.cpp; sourceTree = "<group>"; };
 		BC904B730D10998F00680D32 /* ClassNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassNodeList.h; sourceTree = "<group>"; };
 		BC926F7E0C0552470082776B /* JSHTMLFrameSetElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLFrameSetElement.cpp; sourceTree = "<group>"; };
 		BC926F7F0C0552470082776B /* JSHTMLFrameSetElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLFrameSetElement.h; sourceTree = "<group>"; };
+		BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BeforeLoadEvent.idl; sourceTree = "<group>"; };
+		BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeLoadEvent.h; sourceTree = "<group>"; };
+		BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBeforeLoadEvent.cpp; sourceTree = "<group>"; };
+		BC946347107A936600857193 /* JSBeforeLoadEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBeforeLoadEvent.h; sourceTree = "<group>"; };
 		BC94D1070C274F88006BC617 /* PlatformScreenMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformScreenMac.mm; sourceTree = "<group>"; };
 		BC94D14C0C275C68006BC617 /* JSHistory.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHistory.cpp; sourceTree = "<group>"; };
 		BC94D14D0C275C68006BC617 /* JSHistory.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHistory.h; sourceTree = "<group>"; };
@@ -9057,6 +9425,8 @@
 		BC9BC64D0E7C4889008B9849 /* ScrollbarClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarClient.h; sourceTree = "<group>"; };
 		BCA169A00BFD55B40019CA76 /* JSHTMLTableCaptionElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLTableCaptionElement.cpp; sourceTree = "<group>"; };
 		BCA169A10BFD55B40019CA76 /* JSHTMLTableCaptionElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSHTMLTableCaptionElement.h; sourceTree = "<group>"; };
+		BCA2B0601050475F0043BD1C /* UserScript.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserScript.h; sourceTree = "<group>"; };
+		BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserScriptTypes.h; sourceTree = "<group>"; };
 		BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScheduledAction.cpp; sourceTree = "<group>"; };
 		BCA378BB0D15F64200B793D6 /* ScheduledAction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScheduledAction.h; sourceTree = "<group>"; };
 		BCA83E360D7CDC4E003421A8 /* Clipboard.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Clipboard.idl; sourceTree = "<group>"; };
@@ -9067,6 +9437,8 @@
 		BCA846D50DC67A350026C309 /* RenderReplica.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderReplica.h; sourceTree = "<group>"; };
 		BCA85A0F0C3AEAF4006F8308 /* DOMSVGNumberInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGNumberInternal.h; sourceTree = "<group>"; };
 		BCAA90C20A7EBA60008B1229 /* Scrollbar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; name = Scrollbar.cpp; path = platform/Scrollbar.cpp; sourceTree = SOURCE_ROOT; };
+		BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = UserContentURLPattern.cpp; sourceTree = "<group>"; };
+		BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UserContentURLPattern.h; sourceTree = "<group>"; };
 		BCAEFCAD1016CE4A0040D34E /* DOMRGBColor.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMRGBColor.mm; sourceTree = "<group>"; };
 		BCB16BFE0979C3BD00467741 /* Cache.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Cache.cpp; sourceTree = "<group>"; };
 		BCB16BFF0979C3BD00467741 /* Cache.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Cache.h; sourceTree = "<group>"; };
@@ -9131,6 +9503,8 @@
 		BCCBE7B40E07166900EAFA8E /* CSSVariableDependentValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSVariableDependentValue.cpp; sourceTree = "<group>"; };
 		BCCD74DB0A4C8D35005FDA6D /* HTMLViewSourceDocument.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HTMLViewSourceDocument.h; sourceTree = "<group>"; };
 		BCCD74E40A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLViewSourceDocument.cpp; sourceTree = "<group>"; };
+		BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCustom.cpp; sourceTree = "<group>"; };
+		BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDocumentFragmentCustom.cpp; sourceTree = "<group>"; };
 		BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Tokenizer.h; sourceTree = "<group>"; };
 		BCD0E0F70E972C3500265DEA /* SecurityOrigin.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SecurityOrigin.cpp; sourceTree = "<group>"; };
 		BCD0E0F80E972C3500265DEA /* SecurityOrigin.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SecurityOrigin.h; sourceTree = "<group>"; };
@@ -9143,8 +9517,6 @@
 		BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodeMapCustom.cpp; sourceTree = "<group>"; };
 		BCD9C2600C17AA67005C90A2 /* JSNodeCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeCustom.cpp; sourceTree = "<group>"; };
 		BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeListCustom.cpp; sourceTree = "<group>"; };
-		BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodesCollection.cpp; sourceTree = "<group>"; };
-		BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSNamedNodesCollection.h; sourceTree = "<group>"; };
 		BCD9C2BC0C17B69E005C90A2 /* JSNamedNodeMap.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNamedNodeMap.cpp; sourceTree = "<group>"; };
 		BCD9C2BD0C17B69E005C90A2 /* JSNamedNodeMap.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSNamedNodeMap.h; sourceTree = "<group>"; };
 		BCD9C2BE0C17B69E005C90A2 /* JSNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSNodeList.cpp; sourceTree = "<group>"; };
@@ -9251,6 +9623,7 @@
 		BCEFE1E80DCA5F6400739219 /* JSXSLTProcessor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSXSLTProcessor.cpp; sourceTree = "<group>"; };
 		BCEFE1E90DCA5F6400739219 /* JSXSLTProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSXSLTProcessor.h; sourceTree = "<group>"; };
 		BCF5245F0FEBEE5D0095BF26 /* HTMLDataGridElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataGridElement.cpp; sourceTree = "<group>"; };
+		BCFA930710333193007B25D1 /* RenderOverflow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderOverflow.h; sourceTree = "<group>"; };
 		BCFB2E5D0979E46400BA703D /* CachedResourceClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CachedResourceClient.h; sourceTree = "<group>"; };
 		BCFB2F74097A2E1A00BA703D /* Arena.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Arena.cpp; sourceTree = "<group>"; };
 		BCFB2F75097A2E1A00BA703D /* Arena.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Arena.h; sourceTree = "<group>"; };
@@ -9282,6 +9655,8 @@
 		C5160EE91004543A00A7CEE2 /* StorageAreaImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageAreaImpl.h; sourceTree = "<group>"; };
 		C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageNamespaceImpl.h; sourceTree = "<group>"; };
 		C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageNamespaceImpl.cpp; sourceTree = "<group>"; };
+		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
+		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceProvider.h; sourceTree = "<group>"; };
@@ -9299,10 +9674,19 @@
 		D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSRangeException.h; sourceTree = "<group>"; };
 		D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSRangeException.cpp; sourceTree = "<group>"; };
 		D23CA56B0AB0EB8D005108A5 /* RangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RangeException.h; sourceTree = "<group>"; };
+		D8B6152E1032495100C8554A /* Cookie.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Cookie.h; sourceTree = "<group>"; };
 		DB23C2C90A508D29002489EB /* IndentOutdentCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IndentOutdentCommand.cpp; sourceTree = "<group>"; };
 		DB23C2CA0A508D29002489EB /* IndentOutdentCommand.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IndentOutdentCommand.h; sourceTree = "<group>"; };
 		DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebCoreObjCExtras.h; sourceTree = "<group>"; };
 		DD763BB10992C2C900740B8E /* libxml2.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libxml2.dylib; path = /usr/lib/libxml2.dylib; sourceTree = "<absolute>"; };
+		E0FEF371B07C53EAC1C1FBEE /* EventSource.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = EventSource.idl; sourceTree = "<group>"; };
+		E0FEF371B17C53EAC1C1FBEE /* EventSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventSource.h; sourceTree = "<group>"; };
+		E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventSource.cpp; sourceTree = "<group>"; };
+		E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEventSource.h; sourceTree = "<group>"; };
+		E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSource.cpp; sourceTree = "<group>"; };
+		E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSourceCustom.cpp; sourceTree = "<group>"; };
+		E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEventSourceConstructor.h; sourceTree = "<group>"; };
+		E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEventSourceConstructor.cpp; sourceTree = "<group>"; };
 		E107400B0E77BDC00033AF24 /* JSMessageChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannel.cpp; sourceTree = "<group>"; };
 		E107400C0E77BDC00033AF24 /* JSMessageChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMessageChannel.h; sourceTree = "<group>"; };
 		E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelConstructor.cpp; sourceTree = "<group>"; };
@@ -9322,6 +9706,13 @@
 		E1271A510EEECD1C00F61213 /* WorkerNavigator.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WorkerNavigator.idl; sourceTree = "<group>"; };
 		E1271A560EEECDE400F61213 /* JSWorkerNavigator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerNavigator.h; sourceTree = "<group>"; };
 		E1271A570EEECDE400F61213 /* JSWorkerNavigator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerNavigator.cpp; sourceTree = "<group>"; };
+		E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = PageTransitionEvent.idl; sourceTree = "<group>"; };
+		E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageTransitionEvent.h; sourceTree = "<group>"; };
+		E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageTransitionEvent.cpp; sourceTree = "<group>"; };
+		E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPageTransitionEvent.h; sourceTree = "<group>"; };
+		E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPageTransitionEvent.cpp; sourceTree = "<group>"; };
+		E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMPageTransitionEvent.mm; sourceTree = "<group>"; };
+		E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPageTransitionEvent.h; sourceTree = "<group>"; };
 		E12EDB7A0B308A78002704B6 /* EventTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTarget.h; sourceTree = "<group>"; };
 		E12EDBE90B308E0B002704B6 /* EventTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTarget.cpp; sourceTree = "<group>"; };
 		E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContext.cpp; sourceTree = "<group>"; };
@@ -9469,6 +9860,14 @@
 		F587868402DE3B8601EA4122 /* Cursor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Cursor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587869902DE3B8601EA4122 /* DeprecatedPtrList.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedPtrList.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F58EF58E02DFDFB7018635CA /* WebCore.base.exp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.exports; path = WebCore.base.exp; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
+		F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataListElement.cpp; sourceTree = "<group>"; };
+		F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataListElement.h; sourceTree = "<group>"; };
+		F5C041D90FFCA7CE00839D4A /* HTMLDataListElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataListElement.idl; sourceTree = "<group>"; };
+		F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLDataListElement.h; sourceTree = "<group>"; };
+		F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMHTMLDataListElement.mm; sourceTree = "<group>"; };
+		F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMHTMLDataListElementInternal.h; sourceTree = "<group>"; };
+		F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLDataListElement.cpp; sourceTree = "<group>"; };
+		F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLDataListElement.h; sourceTree = "<group>"; };
 		F5C2869302846DCD018635CA /* ApplicationServices.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = ApplicationServices.framework; path = /System/Library/Frameworks/ApplicationServices.framework; sourceTree = "<absolute>"; };
 		F5C2869402846DCD018635CA /* Carbon.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Carbon.framework; path = /System/Library/Frameworks/Carbon.framework; sourceTree = "<absolute>"; };
 		F5C2869502846DCD018635CA /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = /System/Library/Frameworks/Cocoa.framework; sourceTree = "<absolute>"; };
@@ -9477,6 +9876,17 @@
 		F916C48C0DB510F80076CD83 /* JSXMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
 		F9F0ED770DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLHttpRequestProgressEvent.h; sourceTree = "<group>"; };
 		F9F0ED780DB50CA200D16DB9 /* XMLHttpRequestProgressEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = XMLHttpRequestProgressEvent.idl; sourceTree = "<group>"; };
+		FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLElement.cpp; sourceTree = "<group>"; };
+		FABE72EE1059C1EB00D999DD /* MathMLElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLElement.h; sourceTree = "<group>"; };
+		FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLInlineContainerElement.cpp; sourceTree = "<group>"; };
+		FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLInlineContainerElement.h; sourceTree = "<group>"; };
+		FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLMathElement.cpp; sourceTree = "<group>"; };
+		FABE72F21059C1EB00D999DD /* MathMLMathElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathMLMathElement.h; sourceTree = "<group>"; };
+		FABE72F31059C1EB00D999DD /* mathtags.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = mathtags.in; sourceTree = "<group>"; };
+		FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLElementFactory.cpp; sourceTree = "<group>"; };
+		FABE72FC1059C21100D999DD /* MathMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MathMLNames.cpp; sourceTree = "<group>"; };
+		FE136AE710643BE50078CF6D /* WebCore.OrientationEvents.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.OrientationEvents.exp; sourceTree = "<group>"; };
+		FE49BD301061719100D0E1AE /* WebCore.Inspector.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.Inspector.exp; sourceTree = "<group>"; };
 		FE49EF970DC51462004266E1 /* DashboardSupportCSSPropertyNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DashboardSupportCSSPropertyNames.in; sourceTree = "<group>"; };
 		FE6FD4850F676E5700092873 /* Coordinates.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Coordinates.h; sourceTree = "<group>"; };
 		FE6FD4860F676E5700092873 /* Coordinates.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Coordinates.idl; sourceTree = "<group>"; };
@@ -9504,8 +9914,10 @@
 		FE80DA620E9C4703000D6F75 /* JSGeoposition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSGeoposition.h; sourceTree = "<group>"; };
 		FE80DA6D0E9C472F000D6F75 /* JSPositionError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPositionError.cpp; sourceTree = "<group>"; };
 		FE80DA6E0E9C472F000D6F75 /* JSPositionError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPositionError.h; sourceTree = "<group>"; };
+		FEA4133F105D67AE0007236F /* WebCore.DragSupport.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.DragSupport.exp; sourceTree = "<group>"; };
 		FEAB90100EA51B9C006348C3 /* GeolocationService.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GeolocationService.cpp; sourceTree = "<group>"; };
 		FEAB90110EA51B9C006348C3 /* GeolocationService.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeolocationService.h; sourceTree = "<group>"; };
+		FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.ContextMenus.exp; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFrameworksBuildPhase section */
@@ -9522,6 +9934,7 @@
 				DD763BB20992C2C900740B8E /* libxml2.dylib in Frameworks */,
 				A88AD52F09524B92001DD196 /* QuartzCore.framework in Frameworks */,
 				1A7FA7CC0DDA4B770028F8A5 /* SystemConfiguration.framework in Frameworks */,
+				49C7BA791042EFAE0009D447 /* OpenGL.framework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -9555,6 +9968,8 @@
 				93EEC1EC09C2877700C515D1 /* html */,
 				1C81B94D0E9732D900266E07 /* inspector */,
 				BCB16BFB0979C38700467741 /* loader */,
+				FABE72EC1059C1EB00D999DD /* mathml */,
+				333F703D0FB49C16008E12A6 /* notifications */,
 				65BF02180974806300C43196 /* page */,
 				BCF1A5BA097832090061A123 /* platform */,
 				5DCF83690D59157800953BC6 /* plugins */,
@@ -9578,6 +9993,7 @@
 		0867D69AFE84028FC02AAC07 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
+				49C7BA781042EFAE0009D447 /* OpenGL.framework */,
 				F5C2869302846DCD018635CA /* ApplicationServices.framework */,
 				F5C2869402846DCD018635CA /* Carbon.framework */,
 				F5C2869502846DCD018635CA /* Cocoa.framework */,
@@ -9642,6 +10058,7 @@
 				A83B79120CCB003F000B0825 /* Events */,
 				A83B79080CCAFF2B000B0825 /* HTML */,
 				1C5FAECA0DCFD8C900D58F78 /* Inspector */,
+				33503C9C10179A9A003B47E1 /* Notifications */,
 				1AC226020DB69EA70089B669 /* Offline */,
 				A9D247F90D757E4100FDF959 /* Plugins */,
 				BC9854460CD3DA5F00069BC1 /* Ranges */,
@@ -9808,6 +10225,10 @@
 		1AE82EC90CAAE177002237AE /* storage */ = {
 			isa = PBXGroup;
 			children = (
+				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
+				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
+				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
+				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
 				514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */,
 				514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */,
 				5196115E0CAC56570010A80C /* Database.cpp */,
@@ -9859,6 +10280,8 @@
 				51E0BABA0DA5547100A9E417 /* StorageEvent.cpp */,
 				51E0BAB90DA5547100A9E417 /* StorageEvent.h */,
 				51E0BABD0DA5548400A9E417 /* StorageEvent.idl */,
+				C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */,
+				C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */,
 				51E0BB370DA5ACB600A9E417 /* StorageMap.cpp */,
 				51E0BB360DA5ACB600A9E417 /* StorageMap.h */,
 				C50D0E800FF4272900AC2644 /* StorageNamespace.cpp */,
@@ -9888,6 +10311,12 @@
 		1C81B94D0E9732D900266E07 /* inspector */ = {
 			isa = PBXGroup;
 			children = (
+				75092BFC104B80F9003DD168 /* DOMDispatchTimelineItem.cpp */,
+				75092BFD104B80F9003DD168 /* DOMDispatchTimelineItem.h */,
+				75A94A01104B74FB0006673C /* TimelineItem.cpp */,
+				75A94A02104B74FB0006673C /* TimelineItem.h */,
+				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
+				754133A7102E00E800075D00 /* InspectorTimelineAgent.h */,
 				1C81B9590E97330800266E07 /* front-end */,
 				41F0618D0F5F069800A07EAC /* ConsoleMessage.cpp */,
 				41F0618C0F5F069800A07EAC /* ConsoleMessage.h */,
@@ -9956,6 +10385,8 @@
 				29A812250FBB9C1D00510293 /* AccessibilityListBox.h */,
 				29A8121F0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp */,
 				29A812240FBB9C1D00510293 /* AccessibilityListBoxOption.h */,
+				07B0113C1032241900FBDC33 /* AccessibilityMediaControls.cpp */,
+				07B0113E1032242200FBDC33 /* AccessibilityMediaControls.h */,
 				29A8121E0FBB9C1D00510293 /* AccessibilityObject.cpp */,
 				29A812180FBB9C1D00510293 /* AccessibilityObject.h */,
 				29A812080FBB9C1D00510293 /* AccessibilityRenderObject.cpp */,
@@ -10026,6 +10457,7 @@
 				2E43463D0F546A8200B0F1BA /* WorkerMessagingProxy.cpp */,
 				2E43463E0F546A8200B0F1BA /* WorkerMessagingProxy.h */,
 				2E43463F0F546A8200B0F1BA /* WorkerObjectProxy.h */,
+				416E29A5102FA962007FC14E /* WorkerReportingProxy.h */,
 				2E4346400F546A8200B0F1BA /* WorkerRunLoop.cpp */,
 				2E4346410F546A8200B0F1BA /* WorkerRunLoop.h */,
 				A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */,
@@ -10055,19 +10487,51 @@
 			name = animation;
 			sourceTree = "<group>";
 		};
+		333F703D0FB49C16008E12A6 /* notifications */ = {
+			isa = PBXGroup;
+			children = (
+				33503CC61017A1B1003B47E1 /* Notification.cpp */,
+				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
+				3390CA510FFC157B00921962 /* NotificationCenter.cpp */,
+				3390CA520FFC157B00921962 /* NotificationCenter.h */,
+				3390CA530FFC157B00921962 /* NotificationCenter.idl */,
+				3390CA540FFC157B00921962 /* NotificationContents.h */,
+				333F704E0FB49CA2008E12A6 /* Notification.idl */,
+				333F704F0FB49CA2008E12A6 /* Notification.h */,
+			);
+			name = notifications;
+			sourceTree = "<group>";
+		};
+		33503C9C10179A9A003B47E1 /* Notifications */ = {
+			isa = PBXGroup;
+			children = (
+				33503C9F10179AD7003B47E1 /* JSNotification.cpp */,
+				33503CA010179AD7003B47E1 /* JSNotification.h */,
+				33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */,
+				33503CA210179AD7003B47E1 /* JSNotificationCenter.h */,
+			);
+			name = Notifications;
+			sourceTree = "<group>";
+		};
 		449195900FBE175B00D9F824 /* Exports */ = {
 			isa = PBXGroup;
 			children = (
 				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
+				0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */,
+				FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */,
 				4491959D0FBE17D700D9F824 /* WebCore.DashboardSupport.exp */,
+				FEA4133F105D67AE0007236F /* WebCore.DragSupport.exp */,
+				FE49BD301061719100D0E1AE /* WebCore.Inspector.exp */,
 				4491959C0FBE17D700D9F824 /* WebCore.JNI.exp */,
-				4491959B0FBE17D700D9F824 /* WebCore.LP64.exp */,
+				4491959B0FBE17D700D9F824 /* WebCore.PluginHostProcess.exp */,
 				4491959A0FBE17D700D9F824 /* WebCore.NPAPI.exp */,
+				FE136AE710643BE50078CF6D /* WebCore.OrientationEvents.exp */,
 				449195990FBE17D700D9F824 /* WebCore.SVG.Animation.exp */,
 				449195980FBE17D700D9F824 /* WebCore.SVG.exp */,
 				449195970FBE17D700D9F824 /* WebCore.SVG.Filters.exp */,
 				449195960FBE17D700D9F824 /* WebCore.SVG.ForeignObject.exp */,
 				449195950FBE17D700D9F824 /* WebCore.Tiger.exp */,
+				63F371CD100E790000BBA87A /* WebCore.Video.exp */,
 				449195940FBE17D700D9F824 /* WebCore.VideoProxy.exp */,
 			);
 			name = Exports;
@@ -10076,20 +10540,73 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
+				49EECDC710503C2300099FAB /* CanvasArray.cpp */,
+				49EECDC810503C2300099FAB /* CanvasArray.h */,
+				49EECDC910503C2300099FAB /* CanvasArray.idl */,
+				49EECDCA10503C2300099FAB /* CanvasArrayBuffer.cpp */,
+				49EECDCB10503C2300099FAB /* CanvasArrayBuffer.h */,
+				49EECDCC10503C2300099FAB /* CanvasArrayBuffer.idl */,
+				49C7B9A81042D32E0009D447 /* CanvasBuffer.cpp */,
+				49C7B9A91042D32E0009D447 /* CanvasBuffer.h */,
+				49C7B9AA1042D32E0009D447 /* CanvasBuffer.idl */,
+				49C7B9AB1042D32E0009D447 /* CanvasByteArray.cpp */,
+				49C7B9AC1042D32E0009D447 /* CanvasByteArray.h */,
+				49C7B9AD1042D32E0009D447 /* CanvasByteArray.idl */,
+				49EECDCD10503C2300099FAB /* CanvasFloatArray.cpp */,
+				49EECDCE10503C2300099FAB /* CanvasFloatArray.h */,
+				49EECDCF10503C2300099FAB /* CanvasFloatArray.idl */,
+				49C7B9AE1042D32E0009D447 /* CanvasFramebuffer.cpp */,
+				49C7B9AF1042D32E0009D447 /* CanvasFramebuffer.h */,
+				49C7B9B01042D32E0009D447 /* CanvasFramebuffer.idl */,
 				49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */,
 				49484FB4102CF23C00187DD3 /* CanvasGradient.h */,
 				49484FB5102CF23C00187DD3 /* CanvasGradient.idl */,
+				49EECDD010503C2300099FAB /* CanvasIntArray.cpp */,
+				49EECDD110503C2300099FAB /* CanvasIntArray.h */,
+				49EECDD210503C2300099FAB /* CanvasIntArray.idl */,
+				49C7B9B41042D32F0009D447 /* CanvasObject.cpp */,
+				49C7B9B51042D32F0009D447 /* CanvasObject.h */,
 				49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */,
 				49484FB7102CF23C00187DD3 /* CanvasPattern.h */,
 				49484FB8102CF23C00187DD3 /* CanvasPattern.idl */,
 				49484FB9102CF23C00187DD3 /* CanvasPixelArray.cpp */,
 				49484FBA102CF23C00187DD3 /* CanvasPixelArray.h */,
 				49484FBB102CF23C00187DD3 /* CanvasPixelArray.idl */,
+				49C7B9B61042D32F0009D447 /* CanvasProgram.cpp */,
+				49C7B9B71042D32F0009D447 /* CanvasProgram.h */,
+				49C7B9B81042D32F0009D447 /* CanvasProgram.idl */,
+				49C7B9B91042D32F0009D447 /* CanvasRenderbuffer.cpp */,
+				49C7B9BA1042D32F0009D447 /* CanvasRenderbuffer.h */,
+				49C7B9BB1042D32F0009D447 /* CanvasRenderbuffer.idl */,
+				49C7B9BC1042D32F0009D447 /* CanvasRenderingContext.cpp */,
+				49C7B9BD1042D32F0009D447 /* CanvasRenderingContext.h */,
+				49C7B9BE1042D32F0009D447 /* CanvasRenderingContext.idl */,
 				49484FBC102CF23C00187DD3 /* CanvasRenderingContext2D.cpp */,
 				49484FBD102CF23C00187DD3 /* CanvasRenderingContext2D.h */,
 				49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */,
+				49C7B9BF1042D32F0009D447 /* CanvasRenderingContext3D.cpp */,
+				49C7B9C01042D32F0009D447 /* CanvasRenderingContext3D.h */,
+				49C7B9C11042D32F0009D447 /* CanvasRenderingContext3D.idl */,
+				49C7B9C21042D32F0009D447 /* CanvasShader.cpp */,
+				49C7B9C31042D32F0009D447 /* CanvasShader.h */,
+				49C7B9C41042D32F0009D447 /* CanvasShader.idl */,
+				49EECDD310503C2300099FAB /* CanvasShortArray.cpp */,
+				49EECDD410503C2300099FAB /* CanvasShortArray.h */,
+				49EECDD510503C2300099FAB /* CanvasShortArray.idl */,
 				49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */,
 				49484FC0102CF23C00187DD3 /* CanvasStyle.h */,
+				49C7B9C51042D32F0009D447 /* CanvasTexture.cpp */,
+				49C7B9C61042D32F0009D447 /* CanvasTexture.h */,
+				49C7B9C71042D32F0009D447 /* CanvasTexture.idl */,
+				49EECDD610503C2300099FAB /* CanvasUnsignedByteArray.cpp */,
+				49EECDD710503C2300099FAB /* CanvasUnsignedByteArray.h */,
+				49EECDD810503C2300099FAB /* CanvasUnsignedByteArray.idl */,
+				49EECDD910503C2300099FAB /* CanvasUnsignedIntArray.cpp */,
+				49EECDDA10503C2300099FAB /* CanvasUnsignedIntArray.h */,
+				49EECDDB10503C2300099FAB /* CanvasUnsignedIntArray.idl */,
+				49EECDDC10503C2300099FAB /* CanvasUnsignedShortArray.cpp */,
+				49EECDDD10503C2400099FAB /* CanvasUnsignedShortArray.h */,
+				49EECDDE10503C2400099FAB /* CanvasUnsignedShortArray.idl */,
 			);
 			name = canvas;
 			sourceTree = "<group>";
@@ -10300,6 +10817,11 @@
 		518A34BD1026C831001B6896 /* websockets */ = {
 			isa = PBXGroup;
 			children = (
+				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
+				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
+				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
+				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
+				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
 				518A34BE1026C831001B6896 /* WebSocket.cpp */,
 				518A34BF1026C831001B6896 /* WebSocket.h */,
 				518A34C01026C831001B6896 /* WebSocket.idl */,
@@ -10374,6 +10896,8 @@
 				938E65F009F09840008A48EC /* JSHTMLElementWrapperFactory.h */,
 				8574D1F10ADE6122004CBA11 /* JSSVGElementWrapperFactory.cpp */,
 				8574D1F20ADE6122004CBA11 /* JSSVGElementWrapperFactory.h */,
+				FABE72FB1059C21100D999DD /* MathMLElementFactory.cpp */,
+				FABE72FC1059C21100D999DD /* MathMLNames.cpp */,
 				656581E609D1508D000E61D7 /* SVGElementFactory.cpp */,
 				656581E709D1508D000E61D7 /* SVGElementFactory.h */,
 				656581E809D1508D000E61D7 /* SVGNames.cpp */,
@@ -10407,6 +10931,8 @@
 				934F71390D5A6F1000018D69 /* AuthenticationChallengeBase.h */,
 				514C76580CE923A1007EF3CD /* Credential.cpp */,
 				514C76590CE923A1007EF3CD /* Credential.h */,
+				51A052321058774F00CC9E95 /* CredentialStorage.cpp */,
+				51A052311058774F00CC9E95 /* CredentialStorage.h */,
 				B2F34FE50E82F81400F627CD /* DNS.h */,
 				514C765A0CE923A1007EF3CD /* FormData.cpp */,
 				514C765B0CE923A1007EF3CD /* FormData.h */,
@@ -10420,6 +10946,7 @@
 				1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */,
 				514C765F0CE923A1007EF3CD /* ProtectionSpace.cpp */,
 				514C76600CE923A1007EF3CD /* ProtectionSpace.h */,
+				51A052551058874000CC9E95 /* ProtectionSpaceHash.h */,
 				934F713D0D5A6F2800018D69 /* ResourceErrorBase.cpp */,
 				934F713B0D5A6F1900018D69 /* ResourceErrorBase.h */,
 				514C76630CE923A1007EF3CD /* ResourceHandle.cpp */,
@@ -10430,6 +10957,11 @@
 				514C76680CE923A1007EF3CD /* ResourceRequestBase.h */,
 				514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */,
 				514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */,
+				510D4A2D103165EE0049EA54 /* SocketStreamErrorBase.cpp */,
+				510D4A2E103165EE0049EA54 /* SocketStreamErrorBase.h */,
+				510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */,
+				510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */,
+				510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */,
 			);
 			path = network;
 			sourceTree = "<group>";
@@ -10561,6 +11093,9 @@
 				1AF326770D78B9440068F0C4 /* EditorClient.h */,
 				93C09A800B064F00005ABD4D /* EventHandler.cpp */,
 				93C09A520B064DB3005ABD4D /* EventHandler.h */,
+				E0FEF371B27C53EAC1C1FBEE /* EventSource.cpp */,
+				E0FEF371B17C53EAC1C1FBEE /* EventSource.h */,
+				E0FEF371B07C53EAC1C1FBEE /* EventSource.idl */,
 				14993BE30B2F2B1C0050497F /* FocusController.cpp */,
 				14993BE40B2F2B1C0050497F /* FocusController.h */,
 				062287830B4DB322000C34DF /* FocusDirection.h */,
@@ -10576,6 +11111,7 @@
 				FE80D7B90E9C1F25000D6F75 /* Geolocation.idl */,
 				FE80D7BB0E9C1F25000D6F75 /* Geoposition.h */,
 				FE80D7BC0E9C1F25000D6F75 /* Geoposition.idl */,
+				7693BACE106C2DCA007B0823 /* HaltablePlugin.h */,
 				BC94D1500C275C8B006BC617 /* History.cpp */,
 				BC94D1510C275C8B006BC617 /* History.h */,
 				BC94D1520C275C8B006BC617 /* History.idl */,
@@ -10589,12 +11125,17 @@
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
 				E12719C90EEEC21300F61213 /* NavigatorBase.cpp */,
 				E12719C60EEEC16800F61213 /* NavigatorBase.h */,
+				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
+				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
 				65A21467097A329100B9050A /* Page.h */,
 				9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */,
 				9302B0BE0D79F82C00C7EE83 /* PageGroup.h */,
 				7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */,
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
+				7693BACF106C2DCA007B0823 /* PluginHalter.cpp */,
+				7693BAD0106C2DCA007B0823 /* PluginHalter.h */,
+				7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */,
 				FE80D7BD0E9C1F25000D6F75 /* PositionCallback.h */,
 				FE80D7BF0E9C1F25000D6F75 /* PositionError.h */,
 				FE80D7C00E9C1F25000D6F75 /* PositionError.idl */,
@@ -10608,6 +11149,12 @@
 				BCD0E0F90E972C3500265DEA /* SecurityOriginHash.h */,
 				14C9A5E90B3D105F005A0232 /* Settings.cpp */,
 				F587863A02DE3A1401EA4122 /* Settings.h */,
+				BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */,
+				BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */,
+				BCA2B0601050475F0043BD1C /* UserScript.h */,
+				BCA2B08A10505BCD0043BD1C /* UserScriptTypes.h */,
+				BC8BF150105813BF00A40A07 /* UserStyleSheet.h */,
+				BC8BF1591058141800A40A07 /* UserStyleSheetTypes.h */,
 				494BD7930F55C8EE00747828 /* WebKitPoint.h */,
 				494BD7940F55C8EE00747828 /* WebKitPoint.idl */,
 				BC8243E60D0CFD7500460C8F /* WindowFeatures.cpp */,
@@ -10878,9 +11425,6 @@
 				850361300ACE007C001F3D9E /* DOMSVGCursorElement.h */,
 				850361310ACE007C001F3D9E /* DOMSVGCursorElement.mm */,
 				A8E544970CA9D1C20097D09B /* DOMSVGCursorElementInternal.h */,
-				A80F39570CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h */,
-				A80F39560CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm */,
-				A80F39550CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h */,
 				85004D880ACEEAEF00C438F6 /* DOMSVGDefsElement.h */,
 				85004D890ACEEAEF00C438F6 /* DOMSVGDefsElement.mm */,
 				A8E544950CA9D1C20097D09B /* DOMSVGDefsElementInternal.h */,
@@ -11264,6 +11808,8 @@
 				85C7F5BD0AAFB7CC004014DD /* DOMMutationEvent.mm */,
 				85C7F5CE0AAFB8D9004014DD /* DOMOverflowEvent.h */,
 				85C7F5CF0AAFB8D9004014DD /* DOMOverflowEvent.mm */,
+				E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */,
+				E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */,
 				BCC573330D695BBE006EF517 /* DOMProgressEvent.h */,
 				BCC573340D695BBE006EF517 /* DOMProgressEvent.mm */,
 				933A14750B7D1BAF00A53FFD /* DOMTextEvent.h */,
@@ -11328,6 +11874,8 @@
 				93F9B6540BA0F35E00854064 /* DOMHTMLCanvasElement.mm */,
 				85DF2F8C0AA3C88100AD64C5 /* DOMHTMLCollection.h */,
 				85DF2F8D0AA3C88100AD64C5 /* DOMHTMLCollection.mm */,
+				F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */,
+				F5C041DF0FFCA96D00839D4A /* DOMHTMLDataListElement.mm */,
 				85BA4CFD0AA688680088052D /* DOMHTMLDirectoryElement.h */,
 				85BA4CFE0AA688680088052D /* DOMHTMLDirectoryElement.mm */,
 				85BA4CFF0AA688680088052D /* DOMHTMLDivElement.h */,
@@ -11482,6 +12030,7 @@
 				85E711520AC5D5340053270F /* DOMHTMLButtonElementInternal.h */,
 				93F9B6550BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h */,
 				85E711530AC5D5340053270F /* DOMHTMLCollectionInternal.h */,
+				F5C041E00FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h */,
 				85E711540AC5D5340053270F /* DOMHTMLDirectoryElementInternal.h */,
 				85E711550AC5D5340053270F /* DOMHTMLDivElementInternal.h */,
 				85E711560AC5D5340053270F /* DOMHTMLDListElementInternal.h */,
@@ -11909,6 +12458,9 @@
 				BC77CD410FEFE0C40070887B /* HTMLDataGridRowElement.cpp */,
 				BC77CCED0FEFDE6C0070887B /* HTMLDataGridRowElement.h */,
 				BC77CC6B0FEC3D5F0070887B /* HTMLDataGridRowElement.idl */,
+				F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */,
+				F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */,
+				F5C041D90FFCA7CE00839D4A /* HTMLDataListElement.idl */,
 				A8EA79ED0A1916DF00A8EF5F /* HTMLDirectoryElement.cpp */,
 				A8EA79EE0A1916DF00A8EF5F /* HTMLDirectoryElement.h */,
 				1A85B1D90A1B23A400D8C87C /* HTMLDirectoryElement.idl */,
@@ -12145,12 +12697,46 @@
 		A83B79080CCAFF2B000B0825 /* HTML */ = {
 			isa = PBXGroup;
 			children = (
+				49EECF19105072F300099FAB /* JSCanvasArray.cpp */,
+				49EECF1A105072F300099FAB /* JSCanvasArray.h */,
+				49EECEF2105070C400099FAB /* JSCanvasArrayBuffer.cpp */,
+				49EECEF3105070C400099FAB /* JSCanvasArrayBuffer.h */,
+				49C7B9801042D2D30009D447 /* JSCanvasBuffer.cpp */,
+				49C7B9811042D2D30009D447 /* JSCanvasBuffer.h */,
+				49C7B9821042D2D30009D447 /* JSCanvasByteArray.cpp */,
+				49C7B9831042D2D30009D447 /* JSCanvasByteArray.h */,
+				49EECEF4105070C400099FAB /* JSCanvasFloatArray.cpp */,
+				49EECEF5105070C400099FAB /* JSCanvasFloatArray.h */,
+				49C7B9841042D2D30009D447 /* JSCanvasFramebuffer.cpp */,
+				49C7B9851042D2D30009D447 /* JSCanvasFramebuffer.h */,
 				65DF323309D1DE65000BE325 /* JSCanvasGradient.cpp */,
 				65DF323409D1DE65000BE325 /* JSCanvasGradient.h */,
+				49EECEF6105070C400099FAB /* JSCanvasIntArray.cpp */,
+				49EECEF7105070C400099FAB /* JSCanvasIntArray.h */,
 				65DF323509D1DE65000BE325 /* JSCanvasPattern.cpp */,
 				65DF323609D1DE65000BE325 /* JSCanvasPattern.h */,
-				65DF323709D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp */,
-				65DF323809D1DE65000BE325 /* JSCanvasRenderingContext2D.h */,
+				49C7B9881042D2D30009D447 /* JSCanvasProgram.cpp */,
+				49C7B9891042D2D30009D447 /* JSCanvasProgram.h */,
+				49C7B98A1042D2D30009D447 /* JSCanvasRenderbuffer.cpp */,
+				49C7B98B1042D2D30009D447 /* JSCanvasRenderbuffer.h */,
+				49EED13C1051969400099FAB /* JSCanvasRenderingContext.cpp */,
+				49EED13D1051969400099FAB /* JSCanvasRenderingContext.h */,
+				49EED13E1051969400099FAB /* JSCanvasRenderingContext2D.cpp */,
+				49EED13F1051969400099FAB /* JSCanvasRenderingContext2D.h */,
+				49EED1401051969400099FAB /* JSCanvasRenderingContext3D.cpp */,
+				49EED1411051969400099FAB /* JSCanvasRenderingContext3D.h */,
+				49C7B98F1042D2D30009D447 /* JSCanvasShader.cpp */,
+				49C7B9901042D2D30009D447 /* JSCanvasShader.h */,
+				49EECEF8105070C400099FAB /* JSCanvasShortArray.cpp */,
+				49EECEF9105070C400099FAB /* JSCanvasShortArray.h */,
+				49C7B9911042D2D30009D447 /* JSCanvasTexture.cpp */,
+				49C7B9921042D2D30009D447 /* JSCanvasTexture.h */,
+				49EECEFA105070C400099FAB /* JSCanvasUnsignedByteArray.cpp */,
+				49EECEFB105070C400099FAB /* JSCanvasUnsignedByteArray.h */,
+				49EECEFC105070C400099FAB /* JSCanvasUnsignedIntArray.cpp */,
+				49EECEFD105070C400099FAB /* JSCanvasUnsignedIntArray.h */,
+				49EECEFE105070C400099FAB /* JSCanvasUnsignedShortArray.cpp */,
+				49EECEFF105070C400099FAB /* JSCanvasUnsignedShortArray.h */,
 				BC77D1650FF19F550070887B /* JSDataGridColumn.cpp */,
 				BC77D1660FF19F550070887B /* JSDataGridColumn.h */,
 				BC77D1670FF19F550070887B /* JSDataGridColumnList.cpp */,
@@ -12191,6 +12777,8 @@
 				BC212A400FE83A1800EC3708 /* JSHTMLDataGridElement.h */,
 				BC77CD4C0FEFE1610070887B /* JSHTMLDataGridRowElement.cpp */,
 				BC77CD4D0FEFE1610070887B /* JSHTMLDataGridRowElement.h */,
+				F5C041E10FFCA96D00839D4A /* JSHTMLDataListElement.cpp */,
+				F5C041E20FFCA96D00839D4A /* JSHTMLDataListElement.h */,
 				1A85B1E00A1B240500D8C87C /* JSHTMLDirectoryElement.cpp */,
 				1A85B1E10A1B240500D8C87C /* JSHTMLDirectoryElement.h */,
 				1A85B2B40A1B2AC700D8C87C /* JSHTMLDivElement.cpp */,
@@ -12305,8 +12893,6 @@
 				E44614130CD6826900FADA75 /* JSTimeRanges.h */,
 				15C77092100D3CA8005BA267 /* JSValidityState.cpp */,
 				15C77091100D3CA8005BA267 /* JSValidityState.h */,
-				BC8243270D0CE8A200460C8F /* JSVoidCallback.cpp */,
-				BC8243280D0CE8A200460C8F /* JSVoidCallback.h */,
 			);
 			name = HTML;
 			sourceTree = "<group>";
@@ -12362,8 +12948,6 @@
 				B2FA3C770AB75A6E000E5AC4 /* JSSVGComponentTransferFunctionElement.h */,
 				B2FA3C780AB75A6E000E5AC4 /* JSSVGCursorElement.cpp */,
 				B2FA3C790AB75A6E000E5AC4 /* JSSVGCursorElement.h */,
-				A80F393C0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp */,
-				A80F393B0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h */,
 				B2FA3C7A0AB75A6E000E5AC4 /* JSSVGDefsElement.cpp */,
 				B2FA3C7B0AB75A6E000E5AC4 /* JSSVGDefsElement.h */,
 				B2FA3C7C0AB75A6E000E5AC4 /* JSSVGDescElement.cpp */,
@@ -12720,6 +13304,8 @@
 		A83B79120CCB003F000B0825 /* Events */ = {
 			isa = PBXGroup;
 			children = (
+				BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */,
+				BC946347107A936600857193 /* JSBeforeLoadEvent.h */,
 				2ECF7ADA10162B3800427DE7 /* JSErrorEvent.cpp */,
 				2ECF7ADB10162B3800427DE7 /* JSErrorEvent.h */,
 				14E8378309F85D1C00B85AE4 /* JSEvent.cpp */,
@@ -12740,6 +13326,8 @@
 				65DF31E809D1CC60000BE325 /* JSMutationEvent.h */,
 				1A0D573E0A5C7867007EDD4C /* JSOverflowEvent.cpp */,
 				1A0D573F0A5C7867007EDD4C /* JSOverflowEvent.h */,
+				E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */,
+				E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,
 				933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,
 				933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,
 				A86629CA09DA2B47009633A5 /* JSUIEvent.cpp */,
@@ -12882,9 +13470,6 @@
 				B22278110D00BF1F0071B782 /* SVGCursorElement.cpp */,
 				B22278120D00BF1F0071B782 /* SVGCursorElement.h */,
 				B22278130D00BF1F0071B782 /* SVGCursorElement.idl */,
-				B22278140D00BF1F0071B782 /* SVGDefinitionSrcElement.cpp */,
-				B22278150D00BF1F0071B782 /* SVGDefinitionSrcElement.h */,
-				B22278160D00BF1F0071B782 /* SVGDefinitionSrcElement.idl */,
 				B22278170D00BF1F0071B782 /* SVGDefsElement.cpp */,
 				B22278180D00BF1F0071B782 /* SVGDefsElement.h */,
 				B22278190D00BF1F0071B782 /* SVGDefsElement.idl */,
@@ -13347,6 +13932,8 @@
 		B27535490B053814002CE64F /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				49C7B9FD1042D38C0009D447 /* Canvas3DLayer.h */,
+				49C7B9FE1042D38C0009D447 /* Canvas3DLayer.mm */,
 				EDE3A4FF0C7A430600956A37 /* ColorMac.h */,
 				B275354A0B053814002CE64F /* ColorMac.mm */,
 				3724CA550E68A7E400DB4384 /* CoreTextController.cpp */,
@@ -13364,6 +13951,7 @@
 				B2AFFC7A0D00A5C10030074D /* FontPlatformDataMac.mm */,
 				B2AFFC7B0D00A5C10030074D /* GlyphPageTreeNodeMac.cpp */,
 				B277B4030B22F37C0004BEC6 /* GraphicsContextMac.mm */,
+				49C7B9FF1042D38C0009D447 /* GraphicsContext3DMac.cpp */,
 				0F580B040F12A2550051D689 /* GraphicsLayerCA.h */,
 				0F580B030F12A2540051D689 /* GraphicsLayerCA.mm */,
 				B275358D0B053A66002CE64F /* IconMac.mm */,
@@ -13420,6 +14008,7 @@
 				72626E010EF022FE00A07E20 /* FontFastPath.cpp */,
 				37ACCE410DA2980F0089E602 /* FontRenderingMode.h */,
 				B2C3DA5A0D006CD600EF6F26 /* FontSelector.h */,
+				37202198106213C600F25C4B /* FontSmoothingMode.h */,
 				3784C34A0E11AA34007D8D48 /* FontTraitsMask.h */,
 				BCE04C930DAFF902007A0F41 /* GeneratedImage.cpp */,
 				BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */,
@@ -13434,6 +14023,7 @@
 				B2A015920AF6CD53006BCE0E /* GraphicsContext.cpp */,
 				B2A015930AF6CD53006BCE0E /* GraphicsContext.h */,
 				A88FE3330E5EEE87008D8C0F /* GraphicsContextPrivate.h */,
+				49C7B9FB1042D3650009D447 /* GraphicsContext3D.h */,
 				0F580B090F12A2690051D689 /* GraphicsLayer.cpp */,
 				0F580B0A0F12A2690051D689 /* GraphicsLayer.h */,
 				0F580B0B0F12A2690051D689 /* GraphicsLayerClient.h */,
@@ -13467,6 +14057,7 @@
 				B2C3DA540D006CD600EF6F26 /* SimpleFontData.h */,
 				B23540F00D00782E002382FA /* StringTruncator.cpp */,
 				B23540F10D00782E002382FA /* StringTruncator.h */,
+				930FC6891072B9280045293E /* TextRenderingMode.h */,
 				A824B4640E2EF2EA0081A7B7 /* TextRun.h */,
 				E4AFCFA40DAF29A300F5F55C /* UnitBezier.h */,
 				939B02EC0EA2DBC400C54570 /* WidthIterator.cpp */,
@@ -13565,6 +14156,9 @@
 		B2F34FE70E82F81700F627CD /* cf */ = {
 			isa = PBXGroup;
 			children = (
+				51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */,
+				51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */,
+				51ABAE1A103C18FF008C5260 /* SocketStreamError.h */,
 				B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */,
 			);
 			name = cf;
@@ -13588,6 +14182,8 @@
 		BC1A3793097C6FB10019F3D8 /* js */ = {
 			isa = PBXGroup;
 			children = (
+				BCCE58A71061E82F008FB35A /* Callback Objects */,
+				BCCE58B41061E925008FB35A /* Constructors */,
 				BC4EDEF70C08F414007EDD49 /* Custom */,
 				14DFB33F0A7DF7630018F769 /* Derived Sources */,
 				BCD533630ED6848900887468 /* CachedScriptSourceProvider.h */,
@@ -13595,12 +14191,6 @@
 				A8EDB03C1016849400FE8113 /* DOMObjectWithSVGContext.h */,
 				1432E8480C51493F00B1500F /* GCController.cpp */,
 				1432E8460C51493800B1500F /* GCController.h */,
-				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
-				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
-				E10B93C20B73C291003ED890 /* JSCustomXPathNSResolver.cpp */,
-				E10B937B0B73C00A003ED890 /* JSCustomXPathNSResolver.h */,
-				BCBCAE3A0FF19399000762AE /* JSDataGridDataSource.cpp */,
-				BCBCAE3B0FF19399000762AE /* JSDataGridDataSource.h */,
 				93B70D4709EB0C7C009D8468 /* JSDOMBinding.cpp */,
 				93B70D4809EB0C7C009D8468 /* JSDOMBinding.h */,
 				E1C36CBC0EB08062007410BC /* JSDOMGlobalObject.cpp */,
@@ -13609,50 +14199,22 @@
 				BC6932720D7E293900AE44D1 /* JSDOMWindowBase.h */,
 				BCBFB53A0DCD29CF0019B3E5 /* JSDOMWindowShell.cpp */,
 				BCBFB53B0DCD29CF0019B3E5 /* JSDOMWindowShell.h */,
-				93B70D4D09EB0C7C009D8468 /* JSEventListener.cpp */,
-				93B70D4E09EB0C7C009D8468 /* JSEventListener.h */,
 				BC60901E0E91B8EC000C68B5 /* JSEventTarget.cpp */,
 				BC60901D0E91B8EC000C68B5 /* JSEventTarget.h */,
-				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
-				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
-				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
-				BC6C49F20D7DBA0500FFA558 /* JSImageConstructor.h */,
 				C09158840DB4209200E55AF4 /* JSInspectedObjectWrapper.cpp */,
 				C09158850DB4209200E55AF4 /* JSInspectedObjectWrapper.h */,
 				C09158860DB4209200E55AF4 /* JSInspectorCallbackWrapper.cpp */,
 				C09158870DB4209200E55AF4 /* JSInspectorCallbackWrapper.h */,
-				935F45400F7C3B5F00D7C1FB /* JSLazyEventListener.cpp */,
-				935F45410F7C3B5F00D7C1FB /* JSLazyEventListener.h */,
-				E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */,
-				E10743260E7835A50033AF24 /* JSMessageChannelConstructor.h */,
-				BCD9C26C0C17AA81005C90A2 /* JSNamedNodesCollection.cpp */,
-				BCD9C26D0C17AA81005C90A2 /* JSNamedNodesCollection.h */,
-				BCB7735E0C17853D00132BA4 /* JSNodeFilterCondition.cpp */,
-				BCB7735F0C17853D00132BA4 /* JSNodeFilterCondition.h */,
-				A826E8AD0A1A8F2300CD1BB6 /* JSOptionConstructor.cpp */,
-				A826E8AC0A1A8F2300CD1BB6 /* JSOptionConstructor.h */,
 				93B70D4F09EB0C7C009D8468 /* JSPluginElementFunctions.cpp */,
 				93B70D5009EB0C7C009D8468 /* JSPluginElementFunctions.h */,
 				C09158880DB4209200E55AF4 /* JSQuarantinedObjectWrapper.cpp */,
 				C09158890DB4209200E55AF4 /* JSQuarantinedObjectWrapper.h */,
 				415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */,
 				415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */,
-				415B7C560FF598E6006770F7 /* JSSharedWorkerCustom.cpp */,
+				14CD8D81106B529000A46D23 /* JSSharedWorkerCustom.cpp */,
 				B21127A50B3186770009BE53 /* JSSVGPODTypeWrapper.h */,
-				498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */,
-				498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */,
-				494BD7970F55C90E00747828 /* JSWebKitPointConstructor.cpp */,
-				494BD7980F55C90E00747828 /* JSWebKitPointConstructor.h */,
-				518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */,
-				518A34C51026C8C9001B6896 /* JSWebSocketConstructor.h */,
-				E1CA5CD50E8CDEE900E8EF90 /* JSWorkerConstructor.cpp */,
-				E1CA5CD20E8CDE8000E8EF90 /* JSWorkerConstructor.h */,
 				E1C36D320EB0A094007410BC /* JSWorkerContextBase.cpp */,
 				E1C36D330EB0A094007410BC /* JSWorkerContextBase.h */,
-				BC348BE70DB80354004ABAB9 /* JSXMLHttpRequestConstructor.cpp */,
-				BC348BE80DB80354004ABAB9 /* JSXMLHttpRequestConstructor.h */,
-				BCE99EC10DCA624100182683 /* JSXSLTProcessorConstructor.cpp */,
-				BCE99EC20DCA624100182683 /* JSXSLTProcessorConstructor.h */,
 				BCA378BA0D15F64200B793D6 /* ScheduledAction.cpp */,
 				BCA378BB0D15F64200B793D6 /* ScheduledAction.h */,
 				7A1E88F3101CC384000C4DF5 /* ScriptArray.cpp */,
@@ -13685,6 +14247,8 @@
 				65488D6A0DD5A83D009D83B2 /* StringSourceProvider.h */,
 				E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */,
 				E1A643F10EC0972500779668 /* WorkerScriptController.h */,
+				A75E497410752ACB00C9B896 /* SerializedScriptValue.h */,
+				A75E497510752ACB00C9B896 /* SerializedScriptValue.cpp */,
 			);
 			path = js;
 			sourceTree = "<group>";
@@ -13740,12 +14304,22 @@
 			children = (
 				415B7C540FF598E6006770F7 /* JSAbstractWorkerCustom.cpp */,
 				BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */,
-				1A9EF4560A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp */,
+				49EECF7110508D9C00099FAB /* JSCanvasByteArrayCustom.cpp */,
+				49EECF7210508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp */,
+				49EECF7310508D9C00099FAB /* JSCanvasIntArrayCustom.cpp */,
+				49EED14B1051971900099FAB /* JSCanvasRenderingContext2DCustom.cpp */,
+				49EED14C1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp */,
+				49EED14D1051971A00099FAB /* JSCanvasRenderingContextCustom.cpp */,
+				49EECF7410508D9C00099FAB /* JSCanvasShortArrayCustom.cpp */,
+				49EECF7510508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp */,
+				49EECF7610508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp */,
+				49EECF7710508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp */,
 				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
 				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
 				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
 				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
 				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
 				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
 				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
 				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
@@ -13762,22 +14336,30 @@
 				51EC92620CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h */,
 				1A3417C80CECFF250049CBDE /* JSCustomVoidCallback.cpp */,
 				1A3417C70CECFF250049CBDE /* JSCustomVoidCallback.h */,
-				1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */,
-				1AE830420CAB0ED1002237AE /* JSDatabaseCustom.cpp */,
+				93BA59B10F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp */,
+				BCA83E510D7CE205003421A8 /* JSClipboardCustom.cpp */,
+				C0DFC86F0DB6841A003EAE7C /* JSConsoleCustom.cpp */,
+				FE700DD00F92D81A008E2BFE /* JSCoordinatesCustom.cpp */,
+				BC46C1ED0C0DDBDF0020CFC3 /* JSCSSRuleCustom.cpp */,
+				9392262E10321084006E7D5D /* JSCSSRuleListCustom.cpp */,
+				BC5825F20C0B89380053F1B5 /* JSCSSStyleDeclarationCustom.cpp */,
+				BC20FB7E0C0E8E6C00D1447F /* JSCSSValueCustom.cpp */,
+				BCCE58AB1061E8CF008FB35A /* JSDatabaseCustom.cpp */,
 				BC77D1510FF19C730070887B /* JSDataGridColumnListCustom.cpp */,
 				4162A453101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp */,
-				929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */,
-				929264760B61FC7200B41D34 /* JSDocumentCustom.cpp */,
-				BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */,
-				BC1DEA4E0E268EB60083A73F /* JSDocumentFragmentCustom.cpp */,
+				33503CBF10179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp */,
+				49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */,
+				BCCE58AE1061E90C008FB35A /* JSDocumentFragmentCustom.cpp */,
 				1AC226160DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp */,
 				BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */,
 				652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */,
 				BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */,
 				BCEFAF4D0C317E6900FA81F6 /* JSEventCustom.cpp */,
+				E0FEF371B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp */,
 				FE80D7A60E9C1ED2000D6F75 /* JSGeolocationCustom.cpp */,
 				BCE7B1920D4E86960075A539 /* JSHistoryCustom.cpp */,
 				BC4EDEF30C08F3FB007EDD49 /* JSHTMLAppletElementCustom.cpp */,
+				9392262C1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp */,
 				BCCBAD3A0C18BFF800CE890F /* JSHTMLCollectionCustom.cpp */,
 				BCBCAE530FF1A29E000762AE /* JSHTMLDataGridElementCustom.cpp */,
 				BC51580A0C03D404008BB0EE /* JSHTMLDocumentCustom.cpp */,
@@ -13797,7 +14379,9 @@
 				1C5FAEE60DCFDA6800D58F78 /* JSJavaScriptCallFrameCustom.cpp */,
 				BCE1C43F0D9830F4003B02F2 /* JSLocationCustom.cpp */,
 				E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */,
+				410B7E711045FAB000D8224F /* JSMessageEventCustom.cpp */,
 				E1ADED460E76B8DD004A1A5E /* JSMessagePortCustom.cpp */,
+				41F584C6104652CB009CAA64 /* JSMessagePortCustom.h */,
 				A9C6E6460D7465CA006442E9 /* JSMimeTypeArrayCustom.cpp */,
 				BCD9C25F0C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp */,
 				A9C6E6480D7465D8006442E9 /* JSNavigatorCustom.cpp */,
@@ -13807,7 +14391,6 @@
 				BCD9C2610C17AA67005C90A2 /* JSNodeListCustom.cpp */,
 				A9C6E64A0D7465E7006442E9 /* JSPluginArrayCustom.cpp */,
 				A9C6E64B0D7465E7006442E9 /* JSPluginCustom.cpp */,
-				41D168EF10226EC4009BC827 /* JSSharedWorkerContextCustom.cpp */,
 				51DCE8010CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp */,
 				1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */,
 				51D0C5150DAA90B7003B3831 /* JSStorageCustom.cpp */,
@@ -13908,6 +14491,8 @@
 				BC5A86B40C3367E800EEA649 /* JSDOMSelection.h */,
 				1403BA0B09EB18C700797C7F /* JSDOMWindow.cpp */,
 				1403BA0E09EB18F800797C7F /* JSDOMWindow.h */,
+				E0FEF371B37C53EAC1C1FBEE /* JSEventSource.h */,
+				E0FEF371B47C53EAC1C1FBEE /* JSEventSource.cpp */,
 				BC94D14C0C275C68006BC617 /* JSHistory.cpp */,
 				BC94D14D0C275C68006BC617 /* JSHistory.h */,
 				BCE1C4390D9830D3003B02F2 /* JSLocation.cpp */,
@@ -14015,8 +14600,14 @@
 				377C4CDD1014E9F600B9AE42 /* PlaceholderDocument.h */,
 				1AC694C50A3B1676003F5049 /* PluginDocument.cpp */,
 				1AC694C60A3B1676003F5049 /* PluginDocument.h */,
+				97059973107D975200A50A7C /* PolicyCallback.cpp */,
+				97059974107D975200A50A7C /* PolicyCallback.h */,
+				97059975107D975200A50A7C /* PolicyChecker.cpp */,
+				97059976107D975200A50A7C /* PolicyChecker.h */,
 				1A2A68210B5BEDE70002A480 /* ProgressTracker.cpp */,
 				1A2A68220B5BEDE70002A480 /* ProgressTracker.h */,
+				979F43D11075E44A0000F83B /* RedirectScheduler.cpp */,
+				979F43D21075E44A0000F83B /* RedirectScheduler.h */,
 				BCB16C150979C3BD00467741 /* Request.cpp */,
 				BCB16C160979C3BD00467741 /* Request.h */,
 				93E227DE0AF589AD00D48324 /* ResourceLoader.cpp */,
@@ -14033,8 +14624,6 @@
 				0B90561D0F257E930095FF6A /* ThreadableLoader.cpp */,
 				0B9056170F2578BE0095FF6A /* ThreadableLoader.h */,
 				0B9056180F2578BE0095FF6A /* ThreadableLoaderClient.h */,
-				7284ADDB0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp */,
-				7284ADDC0E6FEB31002EEFBD /* UserStyleSheetLoader.h */,
 				0B9056F60F2685F30095FF6A /* WorkerThreadableLoader.cpp */,
 				0B9056F70F2685F30095FF6A /* WorkerThreadableLoader.h */,
 			);
@@ -14043,6 +14632,88 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		BCCE58A71061E82F008FB35A /* Callback Objects */ = {
+			isa = PBXGroup;
+			children = (
+				1449E286107D4DB400B5793F /* JSCallbackData.cpp */,
+				1449E24A107D4A8400B5793F /* JSCallbackData.h */,
+				FE80D7A20E9C1ED2000D6F75 /* JSCustomPositionCallback.cpp */,
+				FE80D7A30E9C1ED2000D6F75 /* JSCustomPositionCallback.h */,
+				FE80D7A40E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.cpp */,
+				FE80D7A50E9C1ED2000D6F75 /* JSCustomPositionErrorCallback.h */,
+				51EC925B0CE90DD400F90308 /* JSCustomSQLStatementCallback.cpp */,
+				51EC925C0CE90DD400F90308 /* JSCustomSQLStatementCallback.h */,
+				51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */,
+				51EC925E0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.h */,
+				51EC925F0CE90DD400F90308 /* JSCustomSQLTransactionCallback.cpp */,
+				51EC92600CE90DD400F90308 /* JSCustomSQLTransactionCallback.h */,
+				51EC92610CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.cpp */,
+				51EC92620CE90DD400F90308 /* JSCustomSQLTransactionErrorCallback.h */,
+				1A3417C80CECFF250049CBDE /* JSCustomVoidCallback.cpp */,
+				1A3417C70CECFF250049CBDE /* JSCustomVoidCallback.h */,
+				E10B93C20B73C291003ED890 /* JSCustomXPathNSResolver.cpp */,
+				E10B937B0B73C00A003ED890 /* JSCustomXPathNSResolver.h */,
+				BCBCAE3A0FF19399000762AE /* JSDataGridDataSource.cpp */,
+				BCBCAE3B0FF19399000762AE /* JSDataGridDataSource.h */,
+				93B70D4D09EB0C7C009D8468 /* JSEventListener.cpp */,
+				93B70D4E09EB0C7C009D8468 /* JSEventListener.h */,
+				935F45400F7C3B5F00D7C1FB /* JSLazyEventListener.cpp */,
+				935F45410F7C3B5F00D7C1FB /* JSLazyEventListener.h */,
+				BCB7735E0C17853D00132BA4 /* JSNodeFilterCondition.cpp */,
+				BCB7735F0C17853D00132BA4 /* JSNodeFilterCondition.h */,
+			);
+			name = "Callback Objects";
+			sourceTree = "<group>";
+		};
+		BCCE58B41061E925008FB35A /* Constructors */ = {
+			isa = PBXGroup;
+			children = (
+				E4EEFFC60D34550C00469A58 /* JSAudioConstructor.cpp */,
+				E4EEFFC70D34550C00469A58 /* JSAudioConstructor.h */,
+				49EECF991050938200099FAB /* JSCanvasArrayBufferConstructor.cpp */,
+				49EECF9A1050938200099FAB /* JSCanvasArrayBufferConstructor.h */,
+				49EECF9B1050938200099FAB /* JSCanvasByteArrayConstructor.cpp */,
+				49EECF9C1050938200099FAB /* JSCanvasByteArrayConstructor.h */,
+				49EECF9D1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp */,
+				49EECF9E1050938200099FAB /* JSCanvasFloatArrayConstructor.h */,
+				49EECF9F1050938200099FAB /* JSCanvasIntArrayConstructor.cpp */,
+				49EECFA01050938200099FAB /* JSCanvasIntArrayConstructor.h */,
+				49EECFA31050938200099FAB /* JSCanvasShortArrayConstructor.cpp */,
+				49EECFA41050938200099FAB /* JSCanvasShortArrayConstructor.h */,
+				49EECFA51050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp */,
+				49EECFA61050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h */,
+				49EECFA71050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp */,
+				49EECFA81050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h */,
+				49EECFA91050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp */,
+				49EECFAA1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h */,
+				E0FEF371B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp */,
+				E0FEF371B67C53EAC1C1FBEE /* JSEventSourceConstructor.h */,
+				9350E70C0E87500B00189FFF /* JSHTMLAllCollection.cpp */,
+				BC6DC7A00C1A4BFA004E2017 /* JSHTMLAllCollection.h */,
+				BC6C49F10D7DBA0500FFA558 /* JSImageConstructor.cpp */,
+				BC6C49F20D7DBA0500FFA558 /* JSImageConstructor.h */,
+				E10743230E7835830033AF24 /* JSMessageChannelConstructor.cpp */,
+				E10743260E7835A50033AF24 /* JSMessageChannelConstructor.h */,
+				A826E8AD0A1A8F2300CD1BB6 /* JSOptionConstructor.cpp */,
+				A826E8AC0A1A8F2300CD1BB6 /* JSOptionConstructor.h */,
+				415B7C550FF598E6006770F7 /* JSSharedWorkerConstructor.cpp */,
+				415B7C620FF5A767006770F7 /* JSSharedWorkerConstructor.h */,
+				498391610F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.cpp */,
+				498391620F1E8EE100C23782 /* JSWebKitCSSMatrixConstructor.h */,
+				494BD7970F55C90E00747828 /* JSWebKitPointConstructor.cpp */,
+				494BD7980F55C90E00747828 /* JSWebKitPointConstructor.h */,
+				518A34C41026C8C9001B6896 /* JSWebSocketConstructor.cpp */,
+				518A34C51026C8C9001B6896 /* JSWebSocketConstructor.h */,
+				E1CA5CD50E8CDEE900E8EF90 /* JSWorkerConstructor.cpp */,
+				E1CA5CD20E8CDE8000E8EF90 /* JSWorkerConstructor.h */,
+				BC348BE70DB80354004ABAB9 /* JSXMLHttpRequestConstructor.cpp */,
+				BC348BE80DB80354004ABAB9 /* JSXMLHttpRequestConstructor.h */,
+				BCE99EC10DCA624100182683 /* JSXSLTProcessorConstructor.cpp */,
+				BCE99EC20DCA624100182683 /* JSXSLTProcessorConstructor.h */,
+			);
+			name = Constructors;
+			sourceTree = "<group>";
+		};
 		BCD0FBCE0DBD624100B2F630 /* Views */ = {
 			isa = PBXGroup;
 			children = (
@@ -14073,6 +14744,7 @@
 				93B6A0E70B0BCA6700F5027A /* ContextMenu.cpp */,
 				93B6A0E50B0BCA5C00F5027A /* ContextMenu.h */,
 				06027CAC0B1CBFC000884B2D /* ContextMenuItem.h */,
+				D8B6152E1032495100C8554A /* Cookie.h */,
 				9352088109BD45E900F2038D /* CookieJar.h */,
 				2E4346560F546A9900B0F1BA /* CrossThreadCopier.cpp */,
 				2E4346570F546A9900B0F1BA /* CrossThreadCopier.h */,
@@ -14238,12 +14910,13 @@
 				1AB7FC670A8B92EC00D9D37B /* XPathVariableReference.h */,
 				85217E000A5ECD4700DB8D00 /* XSLImportRule.cpp */,
 				85217E010A5ECD4700DB8D00 /* XSLImportRule.h */,
-				BC06F24906D18A7E004A6FA3 /* XSLStyleSheet.cpp */,
+				BC06F24906D18A7E004A6FA3 /* XSLStyleSheetLibxslt.cpp */,
 				BC06F24A06D18A7E004A6FA3 /* XSLStyleSheet.h */,
 				E1F1E82D0C3C2BB9006DB391 /* XSLTExtensions.cpp */,
 				E1F1E82E0C3C2BB9006DB391 /* XSLTExtensions.h */,
 				BC06F24B06D18A7E004A6FA3 /* XSLTProcessor.cpp */,
 				BC06F24C06D18A7E004A6FA3 /* XSLTProcessor.h */,
+				BC06F24D06D18A7E004A6FA3 /* XSLTProcessorLibxslt.cpp */,
 				BCEFE1DC0DCA5CFD00739219 /* XSLTProcessor.idl */,
 				E1BE512B0CF6C512002EA959 /* XSLTUnicodeSort.cpp */,
 				E1BE512C0CF6C512002EA959 /* XSLTUnicodeSort.h */,
@@ -14399,7 +15072,7 @@
 				93CA4C9B09DF93FA00DF8677 /* makeprop.pl */,
 				93CA4C9D09DF93FA00DF8677 /* makevalues.pl */,
 				070DD8F50F01868000727DEB /* mediaControls.css */,
-				07AFE5900F1446BD00841617 /* mediaControlsQT.css */,
+				07AFE5900F1446BD00841617 /* mediaControlsQuickTime.css */,
 				4E19591F0A39DABA00220FE5 /* MediaFeatureNames.cpp */,
 				4E1959200A39DABA00220FE5 /* MediaFeatureNames.h */,
 				0FF5026E102BA9660066F39A /* Media.cpp */,
@@ -14555,6 +15228,7 @@
 				BCEA4841097D93020094C9E4 /* RenderObject.h */,
 				BC60EFB60F33A0E700812A93 /* RenderObjectChildList.cpp */,
 				BC2CC8DE0F32881000A9DF26 /* RenderObjectChildList.h */,
+				BCFA930710333193007B25D1 /* RenderOverflow.h */,
 				A871DEC80A1530C700B12A68 /* RenderPart.cpp */,
 				A871DECF0A1530C700B12A68 /* RenderPart.h */,
 				A871DECE0A1530C700B12A68 /* RenderPartObject.cpp */,
@@ -14675,8 +15349,10 @@
 				A8C4A7F909D563270003AC8D /* Attribute.h */,
 				AB23A32509BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp */,
 				AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */,
+				BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */,
 				85031B260A44EFC700F992E0 /* BeforeUnloadEvent.cpp */,
 				85031B270A44EFC700F992E0 /* BeforeUnloadEvent.h */,
+				BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */,
 				6550B693099DF0270090D781 /* CDATASection.cpp */,
 				6550B694099DF0270090D781 /* CDATASection.h */,
 				85089CC90A98C2AB00A275AA /* CDATASection.idl */,
@@ -14710,7 +15386,6 @@
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				A8C4A7F809D563270003AC8D /* CSSMappedAttributeDeclaration.cpp */,
 				A8C4A7F709D563270003AC8D /* CSSMappedAttributeDeclaration.h */,
-				93EEC1E709C2877700C515D1 /* DocPtr.h */,
 				A8185F3409765765005826D9 /* Document.cpp */,
 				A8185F3809765765005826D9 /* Document.h */,
 				6548E24809E1E04D00AF8020 /* Document.idl */,
@@ -14820,6 +15495,9 @@
 				1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */,
 				1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */,
 				1A0D57380A5C7812007EDD4C /* OverflowEvent.idl */,
+				E1284AE910447DEE00EAEB52 /* PageTransitionEvent.cpp */,
+				E1284AE010447D4500EAEB52 /* PageTransitionEvent.h */,
+				E1284AD910447AEB00EAEB52 /* PageTransitionEvent.idl */,
 				41BF700D0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp */,
 				41BF700E0FE86F61005E8DEC /* PlatformMessagePortChannel.h */,
 				BE91FC8C06133666005E3790 /* Position.cpp */,
@@ -14865,6 +15543,8 @@
 				933A142D0B7D188600A53FFD /* TextEvent.h */,
 				933A142C0B7D188600A53FFD /* TextEvent.idl */,
 				BCCFBAE70B5152ED0001F1D7 /* Tokenizer.h */,
+				5DB1BC6810715A6400EFAA49 /* TransformSource.h */,
+				5DB1BC6910715A6400EFAA49 /* TransformSourceLibxslt.cpp */,
 				854FE72C0A2297BE0058D7AD /* Traversal.cpp */,
 				854FE72D0A2297BE0058D7AD /* Traversal.h */,
 				854FE72E0A2297BE0058D7AD /* TreeWalker.cpp */,
@@ -14895,6 +15575,20 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		FABE72EC1059C1EB00D999DD /* mathml */ = {
+			isa = PBXGroup;
+			children = (
+				FABE72ED1059C1EB00D999DD /* MathMLElement.cpp */,
+				FABE72EE1059C1EB00D999DD /* MathMLElement.h */,
+				FABE72EF1059C1EB00D999DD /* MathMLInlineContainerElement.cpp */,
+				FABE72F01059C1EB00D999DD /* MathMLInlineContainerElement.h */,
+				FABE72F11059C1EB00D999DD /* MathMLMathElement.cpp */,
+				FABE72F21059C1EB00D999DD /* MathMLMathElement.h */,
+				FABE72F31059C1EB00D999DD /* mathtags.in */,
+			);
+			path = mathml;
+			sourceTree = "<group>";
+		};
 /* End PBXGroup section */
 
 /* Begin PBXHeadersBuildPhase section */
@@ -14903,13 +15597,13 @@
 			buildActionMask = 2147483647;
 			files = (
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
-				29A812340FBB9C1D00510293 /* AccessibilityARIAGrid.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
 				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
 				29A8123B0FBB9C1D00510293 /* AccessibilityImageMapLink.h in Headers */,
 				29A8122C0FBB9C1D00510293 /* AccessibilityList.h in Headers */,
 				29A812430FBB9C1D00510293 /* AccessibilityListBox.h in Headers */,
 				29A812420FBB9C1D00510293 /* AccessibilityListBoxOption.h in Headers */,
+				07B0113F1032242200FBDC33 /* AccessibilityMediaControls.h in Headers */,
 				29A812360FBB9C1D00510293 /* AccessibilityObject.h in Headers */,
 				29A812490FBB9CA900510293 /* AccessibilityObjectWrapper.h in Headers */,
 				29A812390FBB9C1D00510293 /* AccessibilityRenderObject.h in Headers */,
@@ -15111,7 +15805,6 @@
 				93F1996D08245E59001E9ABC /* DeprecatedPtrListImpl.h in Headers */,
 				B2F34FE60E82F81400F627CD /* DNS.h in Headers */,
 				BCB16C2A0979C3BD00467741 /* DocLoader.h in Headers */,
-				93EEC1FA09C2877700C515D1 /* DocPtr.h in Headers */,
 				A8185F4009765766005826D9 /* Document.h in Headers */,
 				A8185F3D09765766005826D9 /* DocumentFragment.h in Headers */,
 				656D37360ADBA5DE00A4554D /* DocumentLoader.h in Headers */,
@@ -15217,6 +15910,8 @@
 				93F9B6580BA0F35E00854064 /* DOMHTMLCanvasElementInternal.h in Headers */,
 				85DF2F8E0AA3C88100AD64C5 /* DOMHTMLCollection.h in Headers */,
 				85E711A20AC5D5350053270F /* DOMHTMLCollectionInternal.h in Headers */,
+				F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */,
+				F5C041E50FFCA96D00839D4A /* DOMHTMLDataListElementInternal.h in Headers */,
 				85BA4D0B0AA688680088052D /* DOMHTMLDirectoryElement.h in Headers */,
 				85E711A30AC5D5350053270F /* DOMHTMLDirectoryElementInternal.h in Headers */,
 				85BA4D0D0AA688680088052D /* DOMHTMLDivElement.h in Headers */,
@@ -15447,8 +16142,6 @@
 				8503613A0ACE007C001F3D9E /* DOMSVGCursorElement.h in Headers */,
 				850361450ACE00BB001F3D9E /* DOMSVGCursorElementInternal.h in Headers */,
 				A8E545950CA9D1C20097D09B /* DOMSVGCursorElementInternal.h in Headers */,
-				A80F395A0CCD9796002DD990 /* DOMSVGDefinitionSrcElement.h in Headers */,
-				A80F39580CCD9796002DD990 /* DOMSVGDefinitionSrcElementInternal.h in Headers */,
 				85004D940ACEEAEF00C438F6 /* DOMSVGDefsElement.h in Headers */,
 				85004DA40ACEEB5A00C438F6 /* DOMSVGDefsElementInternal.h in Headers */,
 				A8E545930CA9D1C20097D09B /* DOMSVGDefsElementInternal.h in Headers */,
@@ -15874,6 +16567,7 @@
 				935FBC4509BA00B900E230B1 /* EventListener.h in Headers */,
 				1CA19E160DC255CA0065A994 /* EventLoop.h in Headers */,
 				939885C408B7E3D100E707C4 /* EventNames.h in Headers */,
+				E0FEF372B17C53EAC1C1FBEE /* EventSource.h in Headers */,
 				E12EDB7B0B308A78002704B6 /* EventTarget.h in Headers */,
 				BC60D8F30D2A11E000B9918F /* ExceptionBase.h in Headers */,
 				935FBCF209BA143B00E230B1 /* ExceptionCode.h in Headers */,
@@ -15944,6 +16638,7 @@
 				B2A015A90AF6CD53006BCE0E /* GraphicsContext.h in Headers */,
 				A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */,
 				A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */,
+				49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */,
 				0F580B0D0F12A2690051D689 /* GraphicsLayer.h in Headers */,
 				0F580B060F12A2550051D689 /* GraphicsLayerCA.h in Headers */,
 				0F580B0E0F12A2690051D689 /* GraphicsLayerClient.h in Headers */,
@@ -15970,6 +16665,7 @@
 				BC77CB870FEBF5AF0070887B /* HTMLDataGridColElement.h in Headers */,
 				BC212A1F0FE8333200EC3708 /* HTMLDataGridElement.h in Headers */,
 				BC77CCEE0FEFDE6C0070887B /* HTMLDataGridRowElement.h in Headers */,
+				F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */,
 				A8EA79FA0A1916DF00A8EF5F /* HTMLDirectoryElement.h in Headers */,
 				A8EA7CB70A192B9C00A8EF5F /* HTMLDivElement.h in Headers */,
 				A8EA79F70A1916DF00A8EF5F /* HTMLDListElement.h in Headers */,
@@ -16101,7 +16797,6 @@
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
 				65DF323A09D1DE65000BE325 /* JSCanvasGradient.h in Headers */,
 				65DF323C09D1DE65000BE325 /* JSCanvasPattern.h in Headers */,
-				65DF323E09D1DE65000BE325 /* JSCanvasRenderingContext2D.h in Headers */,
 				93F9B7A10BA6032600854064 /* JSCDATASection.h in Headers */,
 				65DF31F409D1CC60000BE325 /* JSCharacterData.h in Headers */,
 				BCC065880F3CE2A700CD2D87 /* JSClientRect.h in Headers */,
@@ -16159,6 +16854,8 @@
 				14E8378E09F85D4F00B85AE4 /* JSEvent.h in Headers */,
 				BC60D9C00D2A269A00B9918F /* JSEventException.h in Headers */,
 				93B70D6A09EB0C7C009D8468 /* JSEventListener.h in Headers */,
+				E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */,
+				E0FEF372B67C53EAC1C1FBEE /* JSEventSourceConstructor.h in Headers */,
 				BC60901F0E91B8EC000C68B5 /* JSEventTarget.h in Headers */,
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				BC00F0170E0A189500FD04E3 /* JSFileList.h in Headers */,
@@ -16182,6 +16879,7 @@
 				BC77CBD40FEBF8310070887B /* JSHTMLDataGridColElement.h in Headers */,
 				BC212A420FE83A1800EC3708 /* JSHTMLDataGridElement.h in Headers */,
 				BC77CD4F0FEFE1610070887B /* JSHTMLDataGridRowElement.h in Headers */,
+				F5C041E70FFCA96D00839D4A /* JSHTMLDataListElement.h in Headers */,
 				1A85B1E70A1B240500D8C87C /* JSHTMLDirectoryElement.h in Headers */,
 				1A85B2B70A1B2AC700D8C87C /* JSHTMLDivElement.h in Headers */,
 				1A85B1E90A1B240500D8C87C /* JSHTMLDListElement.h in Headers */,
@@ -16256,13 +16954,14 @@
 				A86629D109DA2B48009633A5 /* JSMouseEvent.h in Headers */,
 				65DF31FC09D1CC60000BE325 /* JSMutationEvent.h in Headers */,
 				BCD9C2C10C17B69E005C90A2 /* JSNamedNodeMap.h in Headers */,
-				BCD9C2730C17AA81005C90A2 /* JSNamedNodesCollection.h in Headers */,
 				A9D247F80D757E3400FDF959 /* JSNavigator.h in Headers */,
 				14115B7309F84CD600CA4FC1 /* JSNodeFilter.h in Headers */,
 				BCB773620C17853D00132BA4 /* JSNodeFilterCondition.h in Headers */,
 				1A750D8E0A90E521000FF215 /* JSNodeIterator.h in Headers */,
 				BCD9C2C30C17B69E005C90A2 /* JSNodeList.h in Headers */,
 				65DF31FE09D1CC60000BE325 /* JSNotation.h in Headers */,
+				33503CA410179AD7003B47E1 /* JSNotification.h in Headers */,
+				33503CA610179AD7003B47E1 /* JSNotificationCenter.h in Headers */,
 				A826E8AE0A1A8F2300CD1BB6 /* JSOptionConstructor.h in Headers */,
 				1A0D57410A5C7867007EDD4C /* JSOverflowEvent.h in Headers */,
 				A9D247FF0D757E6900FDF959 /* JSPlugin.h in Headers */,
@@ -16311,7 +17010,6 @@
 				B2FA3D5D0AB75A6F000E5AC4 /* JSSVGColor.h in Headers */,
 				B2FA3D5F0AB75A6F000E5AC4 /* JSSVGComponentTransferFunctionElement.h in Headers */,
 				B2FA3D610AB75A6F000E5AC4 /* JSSVGCursorElement.h in Headers */,
-				A80F393D0CCD971A002DD990 /* JSSVGDefinitionSrcElement.h in Headers */,
 				B2FA3D630AB75A6F000E5AC4 /* JSSVGDefsElement.h in Headers */,
 				B2FA3D650AB75A6F000E5AC4 /* JSSVGDescElement.h in Headers */,
 				B2FA3D670AB75A6F000E5AC4 /* JSSVGDocument.h in Headers */,
@@ -16428,7 +17126,6 @@
 				1A750D5D0A90DEE1000FF215 /* JSTreeWalker.h in Headers */,
 				A86629CF09DA2B47009633A5 /* JSUIEvent.h in Headers */,
 				15C77093100D3CA8005BA267 /* JSValidityState.h in Headers */,
-				BC82432C0D0CE8A200460C8F /* JSVoidCallback.h in Headers */,
 				31C0FF3E0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.h in Headers */,
 				316FE0720E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.h in Headers */,
 				316FE0740E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.h in Headers */,
@@ -16535,6 +17232,9 @@
 				63D7B32D0E78CD3F00F7617C /* NodeRenderStyle.h in Headers */,
 				9382AAB40D8C386100F357A6 /* NodeWithIndex.h in Headers */,
 				A8EA7EBE0A1945D000A8EF5F /* Notation.h in Headers */,
+				3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */,
+				3390CA580FFC157B00921962 /* NotificationContents.h in Headers */,
+				33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */,
 				1A569D0B0D7E2B82007C3983 /* NP_jsobject.h in Headers */,
 				1A569D0C0D7E2B82007C3983 /* npapi.h in Headers */,
 				1A219B3B0DCA87AB0040E3A0 /* npfunctions.h in Headers */,
@@ -16847,7 +17547,6 @@
 				B22279A20D00BF220071B782 /* SVGColor.h in Headers */,
 				B22279A50D00BF220071B782 /* SVGComponentTransferFunctionElement.h in Headers */,
 				B22279A80D00BF220071B782 /* SVGCursorElement.h in Headers */,
-				B22279AB0D00BF220071B782 /* SVGDefinitionSrcElement.h in Headers */,
 				B22279AE0D00BF220071B782 /* SVGDefsElement.h in Headers */,
 				B22279B10D00BF220071B782 /* SVGDescElement.h in Headers */,
 				B25599710D00D8BA00BB825C /* SVGDistantLightSource.h in Headers */,
@@ -17063,7 +17762,6 @@
 				E4AFCFA50DAF29A300F5F55C /* UnitBezier.h in Headers */,
 				D086FE9809D53AAB005BC74D /* UnlinkCommand.h in Headers */,
 				656581B209D14EE6000E61D7 /* UserAgentStyleSheets.h in Headers */,
-				7284ADDE0E6FEB31002EEFBD /* UserStyleSheetLoader.h in Headers */,
 				15C7708D100D3C6B005BA267 /* ValidityState.h in Headers */,
 				93309E1E099E64920056E581 /* visible_units.h in Headers */,
 				93309E20099E64920056E581 /* VisiblePosition.h in Headers */,
@@ -17188,12 +17886,108 @@
 				0FF50263102BA92C0066F39A /* DOMMediaInternal.h in Headers */,
 				0FF5026A102BA9430066F39A /* JSMedia.h in Headers */,
 				0FF50272102BA96A0066F39A /* Media.h in Headers */,
+				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
 				49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */,
 				49484FC5102CF23C00187DD3 /* CanvasPattern.h in Headers */,
 				49484FC8102CF23C00187DD3 /* CanvasPixelArray.h in Headers */,
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				416E29A6102FA962007FC14E /* WorkerReportingProxy.h in Headers */,
+				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
+				D8B6152F1032495100C8554A /* Cookie.h in Headers */,
+				41F584C7104652CB009CAA64 /* JSMessagePortCustom.h in Headers */,
+				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
+				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
+				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
+				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
+				49C7B9941042D2D30009D447 /* JSCanvasBuffer.h in Headers */,
+				49C7B9961042D2D30009D447 /* JSCanvasByteArray.h in Headers */,
+				49C7B9981042D2D30009D447 /* JSCanvasFramebuffer.h in Headers */,
+				49C7B99C1042D2D30009D447 /* JSCanvasProgram.h in Headers */,
+				49C7B99E1042D2D30009D447 /* JSCanvasRenderbuffer.h in Headers */,
+				49C7B9A31042D2D30009D447 /* JSCanvasShader.h in Headers */,
+				49C7B9A51042D2D30009D447 /* JSCanvasTexture.h in Headers */,
+				49C7B9C91042D32F0009D447 /* CanvasBuffer.h in Headers */,
+				49C7B9CC1042D32F0009D447 /* CanvasByteArray.h in Headers */,
+				49C7B9CF1042D32F0009D447 /* CanvasFramebuffer.h in Headers */,
+				49C7B9D51042D32F0009D447 /* CanvasObject.h in Headers */,
+				49C7B9D71042D32F0009D447 /* CanvasProgram.h in Headers */,
+				49C7B9DA1042D32F0009D447 /* CanvasRenderbuffer.h in Headers */,
+				49C7B9DD1042D32F0009D447 /* CanvasRenderingContext.h in Headers */,
+				49C7B9E01042D32F0009D447 /* CanvasRenderingContext3D.h in Headers */,
+				49C7B9E31042D32F0009D447 /* CanvasShader.h in Headers */,
+				49C7B9E61042D32F0009D447 /* CanvasTexture.h in Headers */,
+				49C7BA001042D38C0009D447 /* Canvas3DLayer.h in Headers */,
+				BCA2B061105047600043BD1C /* UserScript.h in Headers */,
+				BCA2B08B10505BCD0043BD1C /* UserScriptTypes.h in Headers */,
+				E1284BB110449FFA00EAEB52 /* JSPageTransitionEvent.h in Headers */,
+				E1284BD61044A01E00EAEB52 /* DOMPageTransitionEvent.h in Headers */,
+				510D4A34103165EE0049EA54 /* SocketStreamErrorBase.h in Headers */,
+				510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */,
+				510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */,
+				51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */,
+				51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */,
+				75A94A04104B74FB0006673C /* TimelineItem.h in Headers */,
+				75092BFF104B80F9003DD168 /* DOMDispatchTimelineItem.h in Headers */,
+				49EECDE010503C2400099FAB /* CanvasArray.h in Headers */,
+				49EECDE310503C2400099FAB /* CanvasArrayBuffer.h in Headers */,
+				49EECDE610503C2400099FAB /* CanvasFloatArray.h in Headers */,
+				49EECDE910503C2400099FAB /* CanvasIntArray.h in Headers */,
+				49EECDEC10503C2400099FAB /* CanvasShortArray.h in Headers */,
+				49EECDEF10503C2400099FAB /* CanvasUnsignedByteArray.h in Headers */,
+				49EECDF210503C2400099FAB /* CanvasUnsignedIntArray.h in Headers */,
+				49EECDF510503C2400099FAB /* CanvasUnsignedShortArray.h in Headers */,
+				49EECF01105070C400099FAB /* JSCanvasArrayBuffer.h in Headers */,
+				49EECF03105070C400099FAB /* JSCanvasFloatArray.h in Headers */,
+				49EECF05105070C400099FAB /* JSCanvasIntArray.h in Headers */,
+				49EECF07105070C400099FAB /* JSCanvasShortArray.h in Headers */,
+				49EECF09105070C400099FAB /* JSCanvasUnsignedByteArray.h in Headers */,
+				49EECF0B105070C400099FAB /* JSCanvasUnsignedIntArray.h in Headers */,
+				49EECF0D105070C400099FAB /* JSCanvasUnsignedShortArray.h in Headers */,
+				49EECF1C105072F300099FAB /* JSCanvasArray.h in Headers */,
+				49EECFAC1050938200099FAB /* JSCanvasArrayBufferConstructor.h in Headers */,
+				49EECFAE1050938200099FAB /* JSCanvasByteArrayConstructor.h in Headers */,
+				49EECFB01050938200099FAB /* JSCanvasFloatArrayConstructor.h in Headers */,
+				49EECFB21050938200099FAB /* JSCanvasIntArrayConstructor.h in Headers */,
+				49EECFB61050938200099FAB /* JSCanvasShortArrayConstructor.h in Headers */,
+				49EECFB81050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.h in Headers */,
+				49EECFBA1050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.h in Headers */,
+				49EECFBC1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.h in Headers */,
+				49EED1431051969400099FAB /* JSCanvasRenderingContext.h in Headers */,
+				49EED1451051969400099FAB /* JSCanvasRenderingContext2D.h in Headers */,
+				49EED1471051969400099FAB /* JSCanvasRenderingContext3D.h in Headers */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 				59C77F2B10545B3B00506104 /* GeolocationServiceMock.h in Headers */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */,
+				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
+				BC8BF151105813BF00A40A07 /* UserStyleSheet.h in Headers */,
+				BC8BF15A1058141800A40A07 /* UserStyleSheetTypes.h in Headers */,
+				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
+				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
+				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
+				C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */,
+				FABE72F51059C1EB00D999DD /* MathMLElement.h in Headers */,
+				FABE72F71059C1EB00D999DD /* MathMLInlineContainerElement.h in Headers */,
+				FABE72F91059C1EB00D999DD /* MathMLMathElement.h in Headers */,
+				37202199106213C600F25C4B /* FontSmoothingMode.h in Headers */,
+				7693BAD2106C2DCA007B0823 /* HaltablePlugin.h in Headers */,
+				7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */,
+				7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */,
+				BCACF3BD1072921A00C0C8A3 /* UserContentURLPattern.h in Headers */,
+				5DB1BC6A10715A6400EFAA49 /* TransformSource.h in Headers */,
+				930FC68A1072B9280045293E /* TextRenderingMode.h in Headers */,
+				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
+				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
+				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
+				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
+				A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */,
+				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
+				9705997A107D975200A50A7C /* PolicyChecker.h in Headers */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -17212,7 +18006,6 @@
 				1C81BA330E97357C00266E07 /* Copy Inspector Resources */,
 				1C5F9D760E09A1B400E91D0A /* Streamline Inspector Source */,
 				93F19A0C08245E59001E9ABC /* Sources */,
-				1CB71D4A0B02658D0061EA45 /* Generate 64-bit Export File */,
 				93F19B1208245E59001E9ABC /* Frameworks */,
 				939D050109D9FF6B00984996 /* Check For Global Initializers */,
 				933457E60EBFDF6B00B80894 /* Check For Exit Time Destructors */,
@@ -17295,10 +18088,7 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
-				49484FC3102CF23C00187DD3 /* CanvasGradient.idl in Resources */,
-				49484FC6102CF23C00187DD3 /* CanvasPattern.idl in Resources */,
-				49484FC9102CF23C00187DD3 /* CanvasPixelArray.idl in Resources */,
-				49484FCC102CF23C00187DD3 /* CanvasRenderingContext2D.idl in Resources */,
+				BC9462CC107A7A3900857193 /* BeforeLoadEvent.idl in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -17339,23 +18129,6 @@
 			shellPath = /bin/sh;
 			shellScript = "# Copy all the Inspector front-end resources.\nditto \"${SRCROOT}/inspector/front-end\" \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector\"\n\n# Remove the WebKit.qrc file since it is not used on the Mac (this file is for Qt)\nrm -f \"${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector/WebKit.qrc\"\n";
 		};
-		1CB71D4A0B02658D0061EA45 /* Generate 64-bit Export File */ = {
-			isa = PBXShellScriptBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputPaths = (
-				"$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp",
-				"$(SRCROOT)/WebCore.LP64.exp",
-			);
-			name = "Generate 64-bit Export File";
-			outputPaths = (
-				"$(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "# Corrections for 64-bit\n# 1) Switch NSRect, NSSize and NSPoint with their CG counterparts\n# 2) Append any 64-bit only symbols from WebCore.LP64.exp\ncat \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.exp\" | sed -e s/7_NSRect/6CGRect/ -e s/7_NSSize/6CGSize/ -e s/8_NSPoint/7CGPoint/ > \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.LP64.exp\"\ncat \"${SRCROOT}/WebCore.LP64.exp\" >> \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore/WebCore.LP64.exp\"\n";
-		};
 		1CC93C640DAE929600E4BC3A /* Copy Forwarding and ICU Headers */ = {
 			isa = PBXShellScriptBuildPhase;
 			buildActionMask = 2147483647;
@@ -17460,6 +18233,7 @@
 				29A8122F0FBB9C1D00510293 /* AccessibilityList.cpp in Sources */,
 				29A8123E0FBB9C1D00510293 /* AccessibilityListBox.cpp in Sources */,
 				29A8123D0FBB9C1D00510293 /* AccessibilityListBoxOption.cpp in Sources */,
+				07B0113D1032241900FBDC33 /* AccessibilityMediaControls.cpp in Sources */,
 				29A8123C0FBB9C1D00510293 /* AccessibilityObject.cpp in Sources */,
 				29A812480FBB9CA900510293 /* AccessibilityObjectMac.mm in Sources */,
 				29A8124A0FBB9CA900510293 /* AccessibilityObjectWrapper.mm in Sources */,
@@ -17682,6 +18456,7 @@
 				85BA4CDE0AA6861B0088052D /* DOMHTMLButtonElement.mm in Sources */,
 				93F9B6570BA0F35E00854064 /* DOMHTMLCanvasElement.mm in Sources */,
 				85DF2F8F0AA3C88100AD64C5 /* DOMHTMLCollection.mm in Sources */,
+				F5C041E40FFCA96D00839D4A /* DOMHTMLDataListElement.mm in Sources */,
 				85BA4D0C0AA688680088052D /* DOMHTMLDirectoryElement.mm in Sources */,
 				85BA4D0E0AA688680088052D /* DOMHTMLDivElement.mm in Sources */,
 				85BA4D100AA688680088052D /* DOMHTMLDListElement.mm in Sources */,
@@ -17780,7 +18555,6 @@
 				850361390ACE007C001F3D9E /* DOMSVGColor.mm in Sources */,
 				8502AB770AD438E600378540 /* DOMSVGComponentTransferFunctionElement.mm in Sources */,
 				8503613B0ACE007C001F3D9E /* DOMSVGCursorElement.mm in Sources */,
-				A80F39590CCD9796002DD990 /* DOMSVGDefinitionSrcElement.mm in Sources */,
 				85004D950ACEEAEF00C438F6 /* DOMSVGDefsElement.mm in Sources */,
 				85004D970ACEEAEF00C438F6 /* DOMSVGDescElement.mm in Sources */,
 				85004D990ACEEAEF00C438F6 /* DOMSVGDocument.mm in Sources */,
@@ -17928,6 +18702,7 @@
 				93C09A7F0B064EEF005ABD4D /* EventHandlerMac.mm in Sources */,
 				1CA19E050DC255950065A994 /* EventLoopMac.mm in Sources */,
 				939885C308B7E3D100E707C4 /* EventNames.cpp in Sources */,
+				E0FEF372B27C53EAC1C1FBEE /* EventSource.cpp in Sources */,
 				E12EDBEA0B308E0B002704B6 /* EventTarget.cpp in Sources */,
 				BC60D8F20D2A11E000B9918F /* ExceptionBase.cpp in Sources */,
 				93831B570D087D6000E5C984 /* ExceptionCode.cpp in Sources */,
@@ -18023,6 +18798,7 @@
 				BC77CBAA0FEBF6C90070887B /* HTMLDataGridColElement.cpp in Sources */,
 				BCF524600FEBEE5D0095BF26 /* HTMLDataGridElement.cpp in Sources */,
 				BC77CD420FEFE0C40070887B /* HTMLDataGridRowElement.cpp in Sources */,
+				F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */,
 				A8EA79F90A1916DF00A8EF5F /* HTMLDirectoryElement.cpp in Sources */,
 				A8EA7CB10A192B9C00A8EF5F /* HTMLDivElement.cpp in Sources */,
 				A8EA79F50A1916DF00A8EF5F /* HTMLDListElement.cpp in Sources */,
@@ -18157,8 +18933,6 @@
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
 				65DF323909D1DE65000BE325 /* JSCanvasGradient.cpp in Sources */,
 				65DF323B09D1DE65000BE325 /* JSCanvasPattern.cpp in Sources */,
-				65DF323D09D1DE65000BE325 /* JSCanvasRenderingContext2D.cpp in Sources */,
-				1A9EF4570A1B957D00332B63 /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
 				93F9B7A00BA6032600854064 /* JSCDATASection.cpp in Sources */,
 				93BA59B20F2AA5FE008E8E99 /* JSCDATASectionCustom.cpp in Sources */,
 				65DF31F309D1CC60000BE325 /* JSCharacterData.cpp in Sources */,
@@ -18199,17 +18973,15 @@
 				1A3417CA0CECFF250049CBDE /* JSCustomVoidCallback.cpp in Sources */,
 				E10B93C30B73C291003ED890 /* JSCustomXPathNSResolver.cpp in Sources */,
 				1AE82F8F0CAAFA9D002237AE /* JSDatabase.cpp in Sources */,
-				1AE830440CAB0ED1002237AE /* JSDatabaseCustom.cpp in Sources */,
 				BC77D1690FF19F560070887B /* JSDataGridColumn.cpp in Sources */,
 				BC77D16B0FF19F560070887B /* JSDataGridColumnList.cpp in Sources */,
 				BC77D1520FF19C730070887B /* JSDataGridColumnListCustom.cpp in Sources */,
 				BCBCAE3C0FF19399000762AE /* JSDataGridDataSource.cpp in Sources */,
 				4162A4571011464700DFF3ED /* JSDedicatedWorkerContext.cpp in Sources */,
 				4162A454101145E300DFF3ED /* JSDedicatedWorkerContextCustom.cpp in Sources */,
+				33503CC010179C1A003B47E1 /* JSDesktopNotificationsCustom.cpp in Sources */,
 				659DDC8209E198BA001BF3C6 /* JSDocument.cpp in Sources */,
-				929264770B61FC7200B41D34 /* JSDocumentCustom.cpp in Sources */,
 				1A494EDE0A123F4C00FDAFC1 /* JSDocumentFragment.cpp in Sources */,
-				BC1DEA4F0E268EB60083A73F /* JSDocumentFragmentCustom.cpp in Sources */,
 				65DF31F509D1CC60000BE325 /* JSDocumentType.cpp in Sources */,
 				1AC2260C0DB69F190089B669 /* JSDOMApplicationCache.cpp in Sources */,
 				1AC226170DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp in Sources */,
@@ -18232,6 +19004,9 @@
 				BCEFAF4E0C317E6900FA81F6 /* JSEventCustom.cpp in Sources */,
 				BC60D9BF0D2A269A00B9918F /* JSEventException.cpp in Sources */,
 				93B70D6909EB0C7C009D8468 /* JSEventListener.cpp in Sources */,
+				E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */,
+				E0FEF372B77C53EAC1C1FBEE /* JSEventSourceConstructor.cpp in Sources */,
+				E0FEF372B57C53EAC1C1FBEE /* JSEventSourceCustom.cpp in Sources */,
 				BC6090200E91B8EC000C68B5 /* JSEventTarget.cpp in Sources */,
 				BC00F0140E0A189500FD04E3 /* JSFile.cpp in Sources */,
 				BC00F0160E0A189500FD04E3 /* JSFileList.cpp in Sources */,
@@ -18260,6 +19035,7 @@
 				BC212A410FE83A1800EC3708 /* JSHTMLDataGridElement.cpp in Sources */,
 				BCBCAE540FF1A29E000762AE /* JSHTMLDataGridElementCustom.cpp in Sources */,
 				BC77CD4E0FEFE1610070887B /* JSHTMLDataGridRowElement.cpp in Sources */,
+				F5C041E60FFCA96D00839D4A /* JSHTMLDataListElement.cpp in Sources */,
 				1A85B1E60A1B240500D8C87C /* JSHTMLDirectoryElement.cpp in Sources */,
 				1A85B2B60A1B2AC700D8C87C /* JSHTMLDivElement.cpp in Sources */,
 				1A85B1E80A1B240500D8C87C /* JSHTMLDListElement.cpp in Sources */,
@@ -18352,7 +19128,6 @@
 				65DF31FB09D1CC60000BE325 /* JSMutationEvent.cpp in Sources */,
 				BCD9C2C00C17B69E005C90A2 /* JSNamedNodeMap.cpp in Sources */,
 				BCD9C2630C17AA67005C90A2 /* JSNamedNodeMapCustom.cpp in Sources */,
-				BCD9C2720C17AA81005C90A2 /* JSNamedNodesCollection.cpp in Sources */,
 				A9D247F70D757E3400FDF959 /* JSNavigator.cpp in Sources */,
 				A9C6E6490D7465D8006442E9 /* JSNavigatorCustom.cpp in Sources */,
 				14DC0D3709FED073007B0235 /* JSNode.cpp in Sources */,
@@ -18365,6 +19140,8 @@
 				BCD9C2C20C17B69E005C90A2 /* JSNodeList.cpp in Sources */,
 				BCD9C2650C17AA67005C90A2 /* JSNodeListCustom.cpp in Sources */,
 				65DF31FD09D1CC60000BE325 /* JSNotation.cpp in Sources */,
+				33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */,
+				33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */,
 				A826EC480A1B0CBE00CD1BB6 /* JSOptionConstructor.cpp in Sources */,
 				1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */,
 				A9D247FE0D757E6900FDF959 /* JSPlugin.cpp in Sources */,
@@ -18384,8 +19161,6 @@
 				41D07A7E0FF935CA0095EDCE /* JSSharedWorker.cpp in Sources */,
 				415B7C580FF598E6006770F7 /* JSSharedWorkerConstructor.cpp in Sources */,
 				41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */,
-				41D168F010226EC4009BC827 /* JSSharedWorkerContextCustom.cpp in Sources */,
-				415B7C590FF598E6006770F7 /* JSSharedWorkerCustom.cpp in Sources */,
 				514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */,
 				1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */,
 				1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */,
@@ -18423,7 +19198,6 @@
 				B2FA3D5C0AB75A6F000E5AC4 /* JSSVGColor.cpp in Sources */,
 				B2FA3D5E0AB75A6F000E5AC4 /* JSSVGComponentTransferFunctionElement.cpp in Sources */,
 				B2FA3D600AB75A6F000E5AC4 /* JSSVGCursorElement.cpp in Sources */,
-				A80F393E0CCD971A002DD990 /* JSSVGDefinitionSrcElement.cpp in Sources */,
 				B2FA3D620AB75A6F000E5AC4 /* JSSVGDefsElement.cpp in Sources */,
 				B2FA3D640AB75A6F000E5AC4 /* JSSVGDescElement.cpp in Sources */,
 				B2FA3D660AB75A6F000E5AC4 /* JSSVGDocument.cpp in Sources */,
@@ -18548,7 +19322,6 @@
 				516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */,
 				A86629D009DA2B48009633A5 /* JSUIEvent.cpp in Sources */,
 				15C77094100D3CA8005BA267 /* JSValidityState.cpp in Sources */,
-				BC82432B0D0CE8A200460C8F /* JSVoidCallback.cpp in Sources */,
 				31C0FF3D0E4CEFAC007D6FE5 /* JSWebKitAnimationEvent.cpp in Sources */,
 				316FE0710E6CCBEE00BF6088 /* JSWebKitCSSKeyframeRule.cpp in Sources */,
 				316FE0730E6CCBEE00BF6088 /* JSWebKitCSSKeyframesRule.cpp in Sources */,
@@ -18654,6 +19427,8 @@
 				854FE7320A2297BE0058D7AD /* NodeFilterCondition.cpp in Sources */,
 				854FE7340A2297BE0058D7AD /* NodeIterator.cpp in Sources */,
 				A8EA7EBF0A1945D000A8EF5F /* Notation.cpp in Sources */,
+				33503CC71017A1B1003B47E1 /* Notification.cpp in Sources */,
+				3390CA550FFC157B00921962 /* NotificationCenter.cpp in Sources */,
 				1A569D0A0D7E2B82007C3983 /* NP_jsobject.cpp in Sources */,
 				1A569D0D0D7E2B82007C3983 /* npruntime.cpp in Sources */,
 				1A569D130D7E2B82007C3983 /* objc_class.mm in Sources */,
@@ -18932,7 +19707,6 @@
 				B2227B060D00BFF10071B782 /* SVGCSSParser.cpp in Sources */,
 				B2227B080D00BFF10071B782 /* SVGCSSStyleSelector.cpp in Sources */,
 				B22279A70D00BF220071B782 /* SVGCursorElement.cpp in Sources */,
-				B22279AA0D00BF220071B782 /* SVGDefinitionSrcElement.cpp in Sources */,
 				B22279AD0D00BF220071B782 /* SVGDefsElement.cpp in Sources */,
 				B22279B00D00BF220071B782 /* SVGDescElement.cpp in Sources */,
 				B22279B30D00BF220071B782 /* SVGDocument.cpp in Sources */,
@@ -19126,7 +19900,6 @@
 				B2C3DA4C0D006C1D00EF6F26 /* UnicodeRange.cpp in Sources */,
 				D086FE9909D53AAB005BC74D /* UnlinkCommand.cpp in Sources */,
 				65DF326109D1E199000BE325 /* UserAgentStyleSheetsData.cpp in Sources */,
-				7284ADDD0E6FEB31002EEFBD /* UserStyleSheetLoader.cpp in Sources */,
 				15C7708E100D3C6B005BA267 /* ValidityState.cpp in Sources */,
 				93309E1D099E64920056E581 /* visible_units.cpp in Sources */,
 				93309E1F099E64920056E581 /* VisiblePosition.cpp in Sources */,
@@ -19230,20 +20003,120 @@
 				1AB7FC850A8B92EC00D9D37B /* XPathValue.cpp in Sources */,
 				1AB7FC870A8B92EC00D9D37B /* XPathVariableReference.cpp in Sources */,
 				85217E020A5ECD4700DB8D00 /* XSLImportRule.cpp in Sources */,
-				93F19B0308245E59001E9ABC /* XSLStyleSheet.cpp in Sources */,
+				93F19B0308245E59001E9ABC /* XSLStyleSheetLibxslt.cpp in Sources */,
 				E1F1E82F0C3C2BB9006DB391 /* XSLTExtensions.cpp in Sources */,
 				93F19B0408245E59001E9ABC /* XSLTProcessor.cpp in Sources */,
+				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
 				0FF5025C102BA9010066F39A /* DOMMedia.mm in Sources */,
 				0FF50269102BA9430066F39A /* JSMedia.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* Media.cpp in Sources */,
+				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
 				49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */,
 				49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */,
 				49484FC7102CF23C00187DD3 /* CanvasPixelArray.cpp in Sources */,
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				9392262D1032107B006E7D5D /* JSHTMLCanvasElementCustom.cpp in Sources */,
+				9392262F10321084006E7D5D /* JSCSSRuleListCustom.cpp in Sources */,
+				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
+				410B7E721045FAB000D8224F /* JSMessageEventCustom.cpp in Sources */,
+				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
+				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
+				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
+				49C7B9931042D2D30009D447 /* JSCanvasBuffer.cpp in Sources */,
+				49C7B9951042D2D30009D447 /* JSCanvasByteArray.cpp in Sources */,
+				49C7B9971042D2D30009D447 /* JSCanvasFramebuffer.cpp in Sources */,
+				49C7B99B1042D2D30009D447 /* JSCanvasProgram.cpp in Sources */,
+				49C7B99D1042D2D30009D447 /* JSCanvasRenderbuffer.cpp in Sources */,
+				49C7B9A21042D2D30009D447 /* JSCanvasShader.cpp in Sources */,
+				49C7B9A41042D2D30009D447 /* JSCanvasTexture.cpp in Sources */,
+				49C7B9C81042D32F0009D447 /* CanvasBuffer.cpp in Sources */,
+				49C7B9CB1042D32F0009D447 /* CanvasByteArray.cpp in Sources */,
+				49C7B9CE1042D32F0009D447 /* CanvasFramebuffer.cpp in Sources */,
+				49C7B9D41042D32F0009D447 /* CanvasObject.cpp in Sources */,
+				49C7B9D61042D32F0009D447 /* CanvasProgram.cpp in Sources */,
+				49C7B9D91042D32F0009D447 /* CanvasRenderbuffer.cpp in Sources */,
+				49C7B9DC1042D32F0009D447 /* CanvasRenderingContext.cpp in Sources */,
+				49C7B9DF1042D32F0009D447 /* CanvasRenderingContext3D.cpp in Sources */,
+				49C7B9E21042D32F0009D447 /* CanvasShader.cpp in Sources */,
+				49C7B9E51042D32F0009D447 /* CanvasTexture.cpp in Sources */,
+				49C7BA011042D38C0009D447 /* Canvas3DLayer.mm in Sources */,
+				49C7BA021042D38C0009D447 /* GraphicsContext3DMac.cpp in Sources */,
+				49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */,
+				E1284BB210449FFA00EAEB52 /* JSPageTransitionEvent.cpp in Sources */,
+				E1284BD51044A01E00EAEB52 /* DOMPageTransitionEvent.mm in Sources */,
+				510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */,
+				510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */,
+				51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */,
+				75A94A03104B74FB0006673C /* TimelineItem.cpp in Sources */,
+				75092BFE104B80F9003DD168 /* DOMDispatchTimelineItem.cpp in Sources */,
+				49EECDDF10503C2400099FAB /* CanvasArray.cpp in Sources */,
+				49EECDE210503C2400099FAB /* CanvasArrayBuffer.cpp in Sources */,
+				49EECDE510503C2400099FAB /* CanvasFloatArray.cpp in Sources */,
+				49EECDE810503C2400099FAB /* CanvasIntArray.cpp in Sources */,
+				49EECDEB10503C2400099FAB /* CanvasShortArray.cpp in Sources */,
+				49EECDEE10503C2400099FAB /* CanvasUnsignedByteArray.cpp in Sources */,
+				49EECDF110503C2400099FAB /* CanvasUnsignedIntArray.cpp in Sources */,
+				49EECDF410503C2400099FAB /* CanvasUnsignedShortArray.cpp in Sources */,
+				49EECF00105070C400099FAB /* JSCanvasArrayBuffer.cpp in Sources */,
+				49EECF02105070C400099FAB /* JSCanvasFloatArray.cpp in Sources */,
+				49EECF04105070C400099FAB /* JSCanvasIntArray.cpp in Sources */,
+				49EECF06105070C400099FAB /* JSCanvasShortArray.cpp in Sources */,
+				49EECF08105070C400099FAB /* JSCanvasUnsignedByteArray.cpp in Sources */,
+				49EECF0A105070C400099FAB /* JSCanvasUnsignedIntArray.cpp in Sources */,
+				49EECF0C105070C400099FAB /* JSCanvasUnsignedShortArray.cpp in Sources */,
+				49EECF1B105072F300099FAB /* JSCanvasArray.cpp in Sources */,
+				49EECF7810508D9C00099FAB /* JSCanvasByteArrayCustom.cpp in Sources */,
+				49EECF7910508D9C00099FAB /* JSCanvasFloatArrayCustom.cpp in Sources */,
+				49EECF7A10508D9C00099FAB /* JSCanvasIntArrayCustom.cpp in Sources */,
+				49EECF7B10508D9C00099FAB /* JSCanvasShortArrayCustom.cpp in Sources */,
+				49EECF7C10508D9C00099FAB /* JSCanvasUnsignedByteArrayCustom.cpp in Sources */,
+				49EECF7D10508D9C00099FAB /* JSCanvasUnsignedIntArrayCustom.cpp in Sources */,
+				49EECF7E10508D9C00099FAB /* JSCanvasUnsignedShortArrayCustom.cpp in Sources */,
+				49EECFAB1050938200099FAB /* JSCanvasArrayBufferConstructor.cpp in Sources */,
+				49EECFAD1050938200099FAB /* JSCanvasByteArrayConstructor.cpp in Sources */,
+				49EECFAF1050938200099FAB /* JSCanvasFloatArrayConstructor.cpp in Sources */,
+				49EECFB11050938200099FAB /* JSCanvasIntArrayConstructor.cpp in Sources */,
+				49EECFB51050938200099FAB /* JSCanvasShortArrayConstructor.cpp in Sources */,
+				49EECFB71050938200099FAB /* JSCanvasUnsignedByteArrayConstructor.cpp in Sources */,
+				49EECFB91050938200099FAB /* JSCanvasUnsignedIntArrayConstructor.cpp in Sources */,
+				49EECFBB1050938200099FAB /* JSCanvasUnsignedShortArrayConstructor.cpp in Sources */,
+				49EED1421051969400099FAB /* JSCanvasRenderingContext.cpp in Sources */,
+				49EED1441051969400099FAB /* JSCanvasRenderingContext2D.cpp in Sources */,
+				49EED1461051969400099FAB /* JSCanvasRenderingContext3D.cpp in Sources */,
+				49EED14E1051971A00099FAB /* JSCanvasRenderingContext2DCustom.cpp in Sources */,
+				49EED14F1051971A00099FAB /* JSCanvasRenderingContext3DCustom.cpp in Sources */,
+				49EED1501051971A00099FAB /* JSCanvasRenderingContextCustom.cpp in Sources */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 				59C77F2A10545B3B00506104 /* GeolocationServiceMock.cpp in Sources */,
+<<<<<<< HEAD:WebCore/WebCore.xcodeproj/project.pbxproj
+=======
+				51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */,
+				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
+				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
+				FABE72F41059C1EB00D999DD /* MathMLElement.cpp in Sources */,
+				FABE72F61059C1EB00D999DD /* MathMLInlineContainerElement.cpp in Sources */,
+				FABE72F81059C1EB00D999DD /* MathMLMathElement.cpp in Sources */,
+				FABE72FD1059C21100D999DD /* MathMLElementFactory.cpp in Sources */,
+				FABE72FE1059C21100D999DD /* MathMLNames.cpp in Sources */,
+				BCCE58AC1061E8CF008FB35A /* JSDatabaseCustom.cpp in Sources */,
+				BCCE58AF1061E90C008FB35A /* JSDocumentFragmentCustom.cpp in Sources */,
+				C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */,
+				14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */,
+				7693BAD3106C2DCA007B0823 /* PluginHalter.cpp in Sources */,
+				BCACF3BC1072921A00C0C8A3 /* UserContentURLPattern.cpp in Sources */,
+				5DB1BC6B10715A6400EFAA49 /* TransformSourceLibxslt.cpp in Sources */,
+				979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */,
+				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
+				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
+				A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */,
+				97059977107D975200A50A7C /* PolicyCallback.cpp in Sources */,
+				97059979107D975200A50A7C /* PolicyChecker.cpp in Sources */,
+>>>>>>> webkit.org at 49305:WebCore/WebCore.xcodeproj/project.pbxproj
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/WebCorePrefix.h b/WebCore/WebCorePrefix.h
index c0d1e70..6c8e200 100644
--- a/WebCore/WebCorePrefix.h
+++ b/WebCore/WebCorePrefix.h
@@ -113,6 +113,13 @@
 #include <stdio.h>
 #else
 #include <CoreServices/CoreServices.h>
+
+#if defined(WIN32) || defined(_WIN32)
+/* Including CoreServices.h on Windows doesn't include CFNetwork.h, so we do
+   it explicitly here to make Windows more consistent with Mac. */
+#include <CFNetwork/CFNetwork.h>
+#endif
+
 #endif
 #endif
 
@@ -125,8 +132,11 @@
 #define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
 #endif
 
-/* Work around a bug with C++ library that screws up Objective-C++ when exception support is disabled. */
-#if defined(__APPLE__)
+/* When C++ exceptions are disabled, the C++ library defines |try| and |catch|
+ * to allow C++ code that expects exceptions to build. These definitions
+ * interfere with Objective-C++ uses of Objective-C exception handlers, which
+ * use |@try| and |@catch|. As a workaround, undefine these macros. */
+#ifdef __OBJC__
 #undef try
 #undef catch
 #endif
diff --git a/WebCore/WebCoreSources.bkl b/WebCore/WebCoreSources.bkl
index a9a1b42..013b4d6 100644
--- a/WebCore/WebCoreSources.bkl
+++ b/WebCore/WebCoreSources.bkl
@@ -1,5 +1,5 @@
 <?xml version="1.0" ?>
-<!-- 
+<!--
 
 Copyright (C) 2007 Kevin Ollivier.  All rights reserved.
 
@@ -8,13 +8,13 @@ modification, are permitted provided that the following conditions
 are met:
 
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
+    documentation and/or other materials provided with the distribution.
 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -37,6 +37,7 @@ This file contains the list of files needed to build WebCore.
         accessibility/AccessibilityARIAGridCell.cpp
         accessibility/AccessibilityARIAGridRow.cpp
         accessibility/AccessibilityImageMapLink.cpp
+        accessibility/AccessibilityMediaControls.cpp
         accessibility/AccessibilityObject.cpp
         accessibility/AccessibilityList.cpp
         accessibility/AccessibilityListBox.cpp
@@ -50,16 +51,18 @@ This file contains the list of files needed to build WebCore.
         accessibility/AccessibilityTableRow.cpp
         accessibility/AXObjectCache.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_JS">
         bindings/js/GCController.cpp
         bindings/js/JSAttrCustom.cpp
         bindings/js/JSAudioConstructor.cpp
         bindings/js/JSCDATASectionCustom.cpp
+        bindings/js/JSCanvasRenderingContextCustom.cpp
         bindings/js/JSCanvasRenderingContext2DCustom.cpp
         bindings/js/JSClipboardCustom.cpp
         bindings/js/JSConsoleCustom.cpp
         bindings/js/JSCSSRuleCustom.cpp
+        bindings/js/JSCSSRuleListCustom.cpp
         bindings/js/JSCSSStyleDeclarationCustom.cpp
         bindings/js/JSCSSValueCustom.cpp
         bindings/js/JSCoordinatesCustom.cpp
@@ -85,11 +88,14 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSDocumentFragmentCustom.cpp
         bindings/js/JSElementCustom.cpp
         bindings/js/JSEventCustom.cpp
+        bindings/js/JSEventSourceConstructor.cpp
+        bindings/js/JSEventSourceCustom.cpp
         bindings/js/JSEventTarget.cpp
         bindings/js/JSGeolocationCustom.cpp
         bindings/js/JSHTMLAllCollection.cpp
         bindings/js/JSHistoryCustom.cpp
         bindings/js/JSHTMLAppletElementCustom.cpp
+        bindings/js/JSHTMLCanvasElementCustom.cpp
         bindings/js/JSHTMLCollectionCustom.cpp
         bindings/js/JSHTMLDataGridElementCustom.cpp
         bindings/js/JSHTMLDocumentCustom.cpp
@@ -112,10 +118,10 @@ This file contains the list of files needed to build WebCore.
         bindings/js/JSLocationCustom.cpp
         bindings/js/JSMessageChannelConstructor.cpp
         bindings/js/JSMessageChannelCustom.cpp
+        bindings/js/JSMessageEventCustom.cpp
         bindings/js/JSMessagePortCustom.cpp
         bindings/js/JSMimeTypeArrayCustom.cpp
         bindings/js/JSNamedNodeMapCustom.cpp
-        bindings/js/JSNamedNodesCollection.cpp
         bindings/js/JSNavigatorCustom.cpp
         bindings/js/JSNodeCustom.cpp
         bindings/js/JSNodeFilterCondition.cpp
@@ -260,6 +266,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSCSSVariablesRule.cpp
         DerivedSources/WebCore/JSCanvasGradient.cpp
         DerivedSources/WebCore/JSCanvasPattern.cpp
+        DerivedSources/WebCore/JSCanvasRenderingContext.cpp
         DerivedSources/WebCore/JSCanvasRenderingContext2D.cpp
         DerivedSources/WebCore/JSCharacterData.cpp
         DerivedSources/WebCore/JSClientRect.cpp
@@ -283,6 +290,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSEntityReference.cpp
         DerivedSources/WebCore/JSErrorEvent.cpp
         DerivedSources/WebCore/JSEvent.cpp
+        DerivedSources/WebCore/JSEventSource.cpp
         DerivedSources/WebCore/JSEventException.cpp
         DerivedSources/WebCore/JSFile.cpp
         DerivedSources/WebCore/JSFileList.cpp
@@ -303,6 +311,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSHTMLDataGridCellElement.cpp
         DerivedSources/WebCore/JSHTMLDataGridColElement.cpp
         DerivedSources/WebCore/JSHTMLDataGridRowElement.cpp
+        DerivedSources/WebCore/JSHTMLDataListElement.cpp
         DerivedSources/WebCore/JSHTMLDListElement.cpp
         DerivedSources/WebCore/JSHTMLDirectoryElement.cpp
         DerivedSources/WebCore/JSHTMLDivElement.cpp
@@ -376,6 +385,7 @@ This file contains the list of files needed to build WebCore.
         DerivedSources/WebCore/JSNodeList.cpp
         DerivedSources/WebCore/JSNotation.cpp
         DerivedSources/WebCore/JSOverflowEvent.cpp
+        DerivedSources/WebCore/JSPageTransitionEvent.cpp
         DerivedSources/WebCore/JSPlugin.cpp
         DerivedSources/WebCore/JSPluginArray.cpp
         DerivedSources/WebCore/JSPositionError.cpp
@@ -479,6 +489,7 @@ This file contains the list of files needed to build WebCore.
         dom/OptionGroupElement.cpp
         dom/OptionElement.cpp
         dom/OverflowEvent.cpp
+        dom/PageTransitionEvent.cpp
         dom/Position.cpp
         dom/PositionIterator.cpp
         dom/ProcessingInstruction.cpp
@@ -488,7 +499,7 @@ This file contains the list of files needed to build WebCore.
         dom/RegisteredEventListener.cpp
         dom/ScriptElement.cpp
         dom/ScriptExecutionContext.cpp
-        dom/SelectElement.cpp 
+        dom/SelectElement.cpp
         dom/SelectorNodeList.cpp
         dom/StaticNodeList.cpp
         dom/StyleElement.cpp
@@ -496,6 +507,7 @@ This file contains the list of files needed to build WebCore.
         dom/TagNodeList.cpp
         dom/Text.cpp
         dom/TextEvent.cpp
+        dom/TransformSourceLibxslt.cpp
         dom/Traversal.cpp
         dom/TreeWalker.cpp
         dom/UIEvent.cpp
@@ -557,7 +569,7 @@ This file contains the list of files needed to build WebCore.
         editing/markup.cpp
         editing/visible_units.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_HISTORY">
         history/BackForwardList.cpp
         history/CachedFrame.cpp
@@ -565,11 +577,12 @@ This file contains the list of files needed to build WebCore.
         history/PageCache.cpp
         history/HistoryItem.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_HTML">
         html/canvas/CanvasGradient.cpp
         html/canvas/CanvasPattern.cpp
         html/canvas/CanvasPixelArray.cpp
+        html/canvas/CanvasRenderingContext.cpp
         html/canvas/CanvasRenderingContext2D.cpp
         html/canvas/CanvasStyle.cpp
         html/CollectionCache.cpp
@@ -592,6 +605,7 @@ This file contains the list of files needed to build WebCore.
         html/HTMLDataGridCellElement.cpp
         html/HTMLDataGridColElement.cpp
         html/HTMLDataGridRowElement.cpp
+        html/HTMLDataListElement.cpp
         html/HTMLDListElement.cpp
         html/HTMLDirectoryElement.cpp
         html/HTMLDivElement.cpp
@@ -714,6 +728,7 @@ This file contains the list of files needed to build WebCore.
         loader/PlaceholderDocument.cpp
         loader/PluginDocument.cpp
         loader/ProgressTracker.cpp
+        loader/RedirectScheduler.cpp
         loader/Request.cpp
         loader/ResourceLoader.cpp
         loader/SubresourceLoader.cpp
@@ -723,7 +738,7 @@ This file contains the list of files needed to build WebCore.
         loader/WorkerThreadableLoader.cpp
         loader/loader.cpp
     </set>
-    
+
     <set append="1" var="WEBCORE_SOURCES_ICON">
         loader/icon/IconDatabase.cpp
         loader/icon/IconLoader.cpp
@@ -741,23 +756,23 @@ This file contains the list of files needed to build WebCore.
         page/Chrome.cpp
         page/Console.cpp
         page/ContextMenuController.cpp
-        page/Coordinates.cpp
         page/DOMSelection.cpp
         page/DOMTimer.cpp
         page/DOMWindow.cpp
         page/DragController.cpp
         page/EventHandler.cpp
+        page/EventSource.cpp
         page/FocusController.cpp
         page/Frame.cpp
         page/FrameTree.cpp
         page/FrameView.cpp
         page/Geolocation.cpp
-        page/Geoposition.cpp
         page/History.cpp
         page/Location.cpp
         page/MouseEventWithHitTestResults.cpp
         page/Navigator.cpp
         page/NavigatorBase.cpp
+        page/OriginAccessEntry.cpp
         page/Page.cpp
         page/PageGroup.cpp
         page/PageGroupLoadDeferrer.cpp
@@ -801,6 +816,7 @@ This file contains the list of files needed to build WebCore.
         platform/LinkHash.cpp
         platform/Logging.cpp
         platform/MIMETypeRegistry.cpp
+        platform/mock/GeolocationServiceMock.cpp
         platform/text/RegularExpression.cpp
         platform/Scrollbar.cpp
         platform/ScrollbarThemeComposite.cpp
@@ -835,6 +851,7 @@ This file contains the list of files needed to build WebCore.
         platform/graphics/GraphicsContext.cpp
         platform/graphics/GraphicsTypes.cpp
         platform/graphics/Image.cpp
+        platform/graphics/ImageSource.cpp
         platform/graphics/IntRect.cpp
         platform/graphics/Path.cpp
         platform/graphics/PathTraversalState.cpp
@@ -884,6 +901,10 @@ This file contains the list of files needed to build WebCore.
         plugins/npapi.cpp
     </set>
 
+    <set append="1" var="WEBCORE_SOURCES_IMAGE_DECODERS">
+        platform/image-decoders/ImageDecoder.cpp
+    </set>
+
     <set append="1" var="WEBCORE_SOURCES_GIF">
         platform/image-decoders/gif/GIFImageDecoder.cpp
         platform/image-decoders/gif/GIFImageReader.cpp
@@ -913,8 +934,8 @@ This file contains the list of files needed to build WebCore.
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_BMP">
-      platform/image-decoders/bmp/BMPImageDecoder.cpp
-      platform/image-decoders/bmp/BMPImageReader.cpp
+        platform/image-decoders/bmp/BMPImageDecoder.cpp
+        platform/image-decoders/bmp/BMPImageReader.cpp
     </set>
 
     <set append="1" var="WEBCORE_SOURCES_ICO">
@@ -1030,10 +1051,13 @@ This file contains the list of files needed to build WebCore.
         storage/SQLResultSetRowList.cpp
         storage/SQLStatement.cpp
         storage/SQLTransaction.cpp
+        storage/SQLTransactionClient.cpp
+        storage/SQLTransactionCoordinator.cpp
         storage/Storage.cpp
         storage/StorageAreaImpl.cpp
         storage/StorageAreaSync.cpp
         storage/StorageEvent.cpp
+        storage/StorageEventDispatcher.cpp
         storage/StorageNamespace.cpp
         storage/StorageNamespaceImpl.cpp
         storage/StorageMap.cpp
@@ -1062,10 +1086,11 @@ This file contains the list of files needed to build WebCore.
         xml/XPathValue.cpp
         xml/XPathVariableReference.cpp
         xml/XSLImportRule.cpp
-        xml/XSLStyleSheet.cpp
+        xml/XSLStyleSheetLibxslt.cpp
         xml/XSLTExtensions.cpp
         xml/XSLTUnicodeSort.cpp
         xml/XSLTProcessor.cpp
+        xml/XSLTProcessorLibxslt.cpp
     </set>
 
 </makefile>
diff --git a/WebCore/accessibility/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
index 0b758e6..55199a3 100644
--- a/WebCore/accessibility/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,6 +36,7 @@
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
 #include "AccessibilityImageMapLink.h"
+#include "AccessibilityMediaControls.h"
 #include "AccessibilityRenderObject.h"
 #include "AccessibilitySlider.h"
 #include "AccessibilityTable.h"
@@ -43,8 +44,14 @@
 #include "AccessibilityTableColumn.h"
 #include "AccessibilityTableHeaderContainer.h"
 #include "AccessibilityTableRow.h"
-#include "InputElement.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "HTMLNames.h"
+#if ENABLE(VIDEO)
+#include "MediaControlElements.h"
+#endif
+#include "InputElement.h"
+#include "Page.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 
@@ -73,6 +80,32 @@ AXObjectCache::~AXObjectCache()
     }
 }
 
+AccessibilityObject* AXObjectCache::focusedUIElementForPage(const Page* page)
+{
+    // get the focused node in the page
+    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
+    Node* focusedNode = focusedDocument->focusedNode();
+    if (!focusedNode)
+        focusedNode = focusedDocument;
+
+    RenderObject* focusedNodeRenderer = focusedNode->renderer();
+    if (!focusedNodeRenderer)
+        return 0;
+
+    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
+
+    if (obj->shouldFocusActiveDescendant()) {
+        if (AccessibilityObject* descendant = obj->activeDescendant())
+            obj = descendant;
+    }
+
+    // the HTML element, for example, is focusable but has an AX object that is ignored
+    if (obj->accessibilityIsIgnored())
+        obj = obj->parentObjectUnignored();
+
+    return obj;
+}
+
 AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
 {
     if (!renderer)
@@ -108,7 +141,7 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
             newObj = AccessibilityListBox::create(renderer);
-        else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+        else if (node && (nodeIsAriaType(node, "list") || node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
             newObj = AccessibilityList::create(renderer);
         
         // aria tables
@@ -127,6 +160,12 @@ AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
         else if (renderer->isTableCell())
             newObj = AccessibilityTableCell::create(renderer);
 
+#if ENABLE(VIDEO)
+        // media controls
+        else if (renderer->node() && renderer->node()->isMediaControlElement())
+            newObj = AccessibilityMediaControl::create(renderer);
+#endif
+
         // input type=range
         else if (renderer->isSlider())
             newObj = AccessibilitySlider::create(renderer);
@@ -213,6 +252,23 @@ void AXObjectCache::remove(RenderObject* renderer)
     m_renderObjectMapping.remove(renderer);
 }
 
+#if !PLATFORM(WIN)
+AXID AXObjectCache::platformGenerateAXID() const
+{
+    static AXID lastUsedID = 0;
+
+    // Generate a new ID.
+    AXID objID = lastUsedID;
+    do {
+        ++objID;
+    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    lastUsedID = objID;
+
+    return objID;
+}
+#endif
+
 AXID AXObjectCache::getAXID(AccessibilityObject* obj)
 {
     // check for already-assigned ID
@@ -221,15 +277,10 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
         ASSERT(m_idsInUse.contains(objID));
         return objID;
     }
-    
-    // generate a new ID
-    static AXID lastUsedID = 0;
-    objID = lastUsedID;
-    do
-        ++objID;
-    while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    objID = platformGenerateAXID();
+
     m_idsInUse.add(objID);
-    lastUsedID = objID;
     obj->setAXObjectID(objID);
     
     return objID;
@@ -288,7 +339,7 @@ void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
 }
     
 #if HAVE(ACCESSIBILITY)
-void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+void AXObjectCache::postNotification(RenderObject* renderer, AXNotification notification, bool postToElement)
 {
     // Notifications for text input objects are sent to that object.
     // All others are sent to the top WebArea.
@@ -316,14 +367,14 @@ void AXObjectCache::postNotification(RenderObject* renderer, const String& messa
     if (!obj)
         return;
 
-    m_notificationsToPost.append(make_pair(obj, message));
+    m_notificationsToPost.append(make_pair(obj, notification));
     if (!m_notificationPostTimer.isActive())
         m_notificationPostTimer.startOneShot(0);
 }
 
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotification(renderer, "AXSelectedChildrenChanged", true);
+    postNotification(renderer, AXSelectedChildrenChanged, true);
 }
 #endif
 
diff --git a/WebCore/accessibility/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
index 7a808dd..5a75f84 100644
--- a/WebCore/accessibility/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,11 @@ class WebCoreTextMarker;
 
 namespace WebCore {
 
+    class Node;
+    class Page;
     class RenderObject;
     class String;
     class VisiblePosition;
-    class AccessibilityObject;
-    class Node;
-    
-    typedef unsigned AXID;
 
     struct TextMarkerData  {
         AXID axID;
@@ -61,7 +59,9 @@ namespace WebCore {
     public:
         AXObjectCache();
         ~AXObjectCache();
-        
+
+        static AccessibilityObject* focusedUIElementForPage(const Page*);
+
         // to be used with render objects
         AccessibilityObject* getOrCreate(RenderObject*);
         
@@ -76,16 +76,13 @@ namespace WebCore {
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&, bool postToElement);
-        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
-        void handleFocusedUIElementChanged();
-#if PLATFORM(GTK)
-        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
-#endif
+        void handleFocusedUIElementChanged(RenderObject* oldFocusedRenderer, RenderObject* newFocusedRenderer);
+        void handleScrolledToAnchor(const Node* anchorNode);
+
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -94,11 +91,29 @@ namespace WebCore {
 
         void removeAXID(AccessibilityObject*);
         bool isIDinUse(AXID id) const { return m_idsInUse.contains(id); }
+        AXID platformGenerateAXID() const;
+        AccessibilityObject* objectFromAXID(AXID id) const { return m_objects.get(id).get(); }
 
         // Text marker utilities.
         static void textMarkerDataForVisiblePosition(TextMarkerData&, const VisiblePosition&);
         static VisiblePosition visiblePositionForTextMarkerData(TextMarkerData&);
-                
+
+        enum AXNotification {
+            AXCheckedStateChanged,
+            AXFocusedUIElementChanged,
+            AXLayoutComplete,
+            AXLoadComplete,
+            AXSelectedChildrenChanged,
+            AXSelectedTextChanged,
+            AXValueChanged,
+            AXScrolledToAnchor,
+        };
+        
+        void postNotification(RenderObject*, AXNotification, bool postToElement);
+
+    protected:
+        void postPlatformNotification(AccessibilityObject*, AXNotification);
+
     private:
         HashMap<AXID, RefPtr<AccessibilityObject> > m_objects;
         HashMap<RenderObject*, AXID> m_renderObjectMapping;
@@ -108,7 +123,7 @@ namespace WebCore {
         HashSet<AXID> m_idsInUse;
         
         Timer<AXObjectCache> m_notificationPostTimer;
-        Vector<pair<RefPtr<AccessibilityObject>, const String> > m_notificationsToPost;
+        Vector<pair<RefPtr<AccessibilityObject>, AXNotification> > m_notificationsToPost;
         void notificationPostTimerFired(Timer<AXObjectCache>*);
         
         AXID getAXID(AccessibilityObject*);
@@ -118,15 +133,13 @@ namespace WebCore {
 #if !HAVE(ACCESSIBILITY)
     inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
     inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
-    inline void AXObjectCache::handleFocusedUIElementChanged() { }
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
-    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
-#if PLATFORM(GTK)
-    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
-#endif
+    inline void AXObjectCache::postNotification(RenderObject*, AXNotification, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification) { }
+    inline void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*) { }
+    inline void AXObjectCache::handleScrolledToAnchor(const Node*) { }
 #endif
 
 }
diff --git a/WebCore/accessibility/AccessibilityList.cpp b/WebCore/accessibility/AccessibilityList.cpp
index 3b7c7a4..95239b0 100644
--- a/WebCore/accessibility/AccessibilityList.cpp
+++ b/WebCore/accessibility/AccessibilityList.cpp
@@ -69,6 +69,13 @@ bool AccessibilityList::isUnorderedList() const
         return false;
     
     Node* node = m_renderer->node();
+
+    // The ARIA spec says the "list" role is supposed to mimic a UL or OL tag.
+    // Since it can't be both, it's probably OK to say that it's an un-ordered list.
+    // On the Mac, there's no distinction to the client.
+    if (ariaRoleAttribute() == ListRole)
+        return true;
+    
     return node && node->hasTagName(ulTag);
 }
 
diff --git a/WebCore/accessibility/AccessibilityMediaControls.cpp b/WebCore/accessibility/AccessibilityMediaControls.cpp
new file mode 100644
index 0000000..7200de9
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityMediaControls.cpp
@@ -0,0 +1,323 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilityMediaControls.h"
+
+#include "AXObjectCache.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "LocalizedStrings.h"
+#include "MediaControlElements.h"
+#include "RenderObject.h"
+#include "RenderSlider.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+
+AccessibilityMediaControl::AccessibilityMediaControl(RenderObject* renderer)
+    : AccessibilityRenderObject(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControl::create(RenderObject* renderer)
+{
+    ASSERT(renderer->node() && renderer->node()->isMediaControlElement());
+
+    Node* node = renderer->node();
+    MediaControlElementType controlType;
+
+    if (node->hasTagName(inputTag))
+        controlType = static_cast<MediaControlInputElement*>(node)->displayType();
+    else
+        controlType = static_cast<MediaControlElement*>(node)->displayType();
+
+    PassRefPtr<AccessibilityObject> obj;
+    switch (controlType) {
+    case MediaSlider:
+        obj = AccessibilityMediaTimeline::create(renderer);
+        break;
+
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+        obj = AccessibilityMediaTimeDisplay::create(renderer);
+        break;
+
+    case MediaControlsPanel:
+        obj = AccessibilityMediaControlsContainer::create(renderer);
+        break;
+
+    default:
+        obj = adoptRef(new AccessibilityMediaControl(renderer));
+        break;
+    }
+
+    return obj;
+}
+
+MediaControlElementType AccessibilityMediaControl::controlType() const
+{
+    if (!renderer() || !renderer()->node())
+        return MediaTimelineContainer;  // Timeline container is not accessible.
+
+    Node* node = renderer()->node();
+
+    if (node->hasTagName(inputTag))
+        return static_cast<MediaControlInputElement*>(node)->displayType();
+
+    return static_cast<MediaControlElement*>(node)->displayType();
+}
+
+String AccessibilityMediaControl::controlTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, mediaFullscreenButtonName, ("FullscreenButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaMuteButtonName, ("MuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPlayButtonName, ("PlayButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekBackButtonName, ("SeekBackButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaSeekForwardButtonName, ("SeekForwardButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaRewindButtonName, ("RewindButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaReturnToRealtimeButtonName, ("ReturnToRealtimeButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaUnMuteButtonName, ("UnMuteButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaPauseButtonName, ("PauseButton"));
+    DEFINE_STATIC_LOCAL(const String, mediaStatusDisplayName, ("StatusDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaCurrentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, mediaTimeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    switch (controlType()) {
+    case MediaFullscreenButton:
+        return mediaFullscreenButtonName;
+    case MediaMuteButton:
+        return mediaMuteButtonName;
+    case MediaPlayButton:
+        return mediaPlayButtonName;
+    case MediaSeekBackButton:
+        return mediaSeekBackButtonName;
+    case MediaSeekForwardButton:
+        return mediaSeekForwardButtonName;
+    case MediaRewindButton:
+        return mediaRewindButtonName;
+    case MediaReturnToRealtimeButton:
+        return mediaReturnToRealtimeButtonName;
+    case MediaUnMuteButton:
+        return mediaUnMuteButtonName;
+    case MediaPauseButton:
+        return mediaPauseButtonName;
+    case MediaStatusDisplay:
+        return mediaStatusDisplayName;
+    case MediaCurrentTimeDisplay:
+        return mediaCurrentTimeDisplay;
+    case MediaTimeRemainingDisplay:
+        return mediaTimeRemainingDisplay;
+
+    default:
+        break;
+    }
+
+    return String();
+}
+
+String AccessibilityMediaControl::title() const
+{
+    DEFINE_STATIC_LOCAL(const String, controlsPanel, ("ControlsPanel"));
+
+    if (controlType() == MediaControlsPanel)
+        return localizedMediaControlElementString(controlsPanel);
+
+    return AccessibilityRenderObject::title();
+}
+
+String AccessibilityMediaControl::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(controlTypeName());
+}
+
+String AccessibilityMediaControl::helpText() const
+{
+    return localizedMediaControlElementHelpText(controlTypeName());
+}
+
+bool AccessibilityMediaControl::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE || controlType() == MediaTimelineContainer)
+        return true;
+
+    return false;
+}
+
+AccessibilityRole AccessibilityMediaControl::roleValue() const
+{
+    switch (controlType()) {
+    case MediaFullscreenButton:
+    case MediaMuteButton:
+    case MediaPlayButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaRewindButton:
+    case MediaReturnToRealtimeButton:
+    case MediaUnMuteButton:
+    case MediaPauseButton:
+        return ButtonRole;
+
+    case MediaStatusDisplay:
+        return StaticTextRole;
+
+    case MediaTimelineContainer:
+        return GroupRole;
+
+    default:
+        break;
+    }
+
+    return UnknownRole;
+}
+
+
+
+//
+// AccessibilityMediaControlsContainer
+
+AccessibilityMediaControlsContainer::AccessibilityMediaControlsContainer(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaControlsContainer::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaControlsContainer(renderer));
+}
+
+String AccessibilityMediaControlsContainer::accessibilityDescription() const
+{
+    return localizedMediaControlElementString(elementTypeName());
+}
+
+String AccessibilityMediaControlsContainer::helpText() const
+{
+    return localizedMediaControlElementHelpText(elementTypeName());
+}
+
+bool AccessibilityMediaControlsContainer::controllingVideoElement() const
+{
+    if (!m_renderer->node())
+        return true;
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+
+    return element->mediaElement()->isVideo();
+}
+
+const String AccessibilityMediaControlsContainer::elementTypeName() const
+{
+    DEFINE_STATIC_LOCAL(const String, videoElement, ("VideoElement"));
+    DEFINE_STATIC_LOCAL(const String, audioElement, ("AudioElement"));
+
+    if (controllingVideoElement())
+        return videoElement;
+    return audioElement;
+}
+
+
+//
+// AccessibilityMediaTimeline
+
+AccessibilityMediaTimeline::AccessibilityMediaTimeline(RenderObject* renderer)
+    : AccessibilitySlider(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeline::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeline(renderer));
+}
+
+String AccessibilityMediaTimeline::valueDescription() const
+{
+    ASSERT(m_renderer->node()->hasTagName(inputTag));
+
+    float time = static_cast<HTMLInputElement*>(m_renderer->node())->value().toFloat();
+    return localizedMediaTimeDescription(time);
+}
+
+String AccessibilityMediaTimeline::helpText() const
+{
+    DEFINE_STATIC_LOCAL(const String, slider, ("Slider"));
+    return localizedMediaControlElementHelpText(slider);
+}
+
+
+//
+// AccessibilityMediaTimeDisplay
+
+AccessibilityMediaTimeDisplay::AccessibilityMediaTimeDisplay(RenderObject* renderer)
+    : AccessibilityMediaControl(renderer)
+{
+}
+
+PassRefPtr<AccessibilityObject> AccessibilityMediaTimeDisplay::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityMediaTimeDisplay(renderer));
+}
+
+bool AccessibilityMediaTimeDisplay::accessibilityIsIgnored() const
+{
+    if (!m_renderer || !m_renderer->style() || m_renderer->style()->visibility() != VISIBLE)
+        return true;
+
+    return !m_renderer->style()->width().value();
+}
+
+String AccessibilityMediaTimeDisplay::accessibilityDescription() const
+{
+    DEFINE_STATIC_LOCAL(const String, currentTimeDisplay, ("CurrentTimeDisplay"));
+    DEFINE_STATIC_LOCAL(const String, timeRemainingDisplay, ("TimeRemainingDisplay"));
+
+    if (controlType() == MediaCurrentTimeDisplay)
+        return localizedMediaControlElementString(currentTimeDisplay);
+
+    return localizedMediaControlElementString(timeRemainingDisplay);
+}
+
+String AccessibilityMediaTimeDisplay::stringValue() const
+{
+    if (!m_renderer || !m_renderer->node())
+        return String();
+
+    MediaControlTimeDisplayElement* element = static_cast<MediaControlTimeDisplayElement*>(m_renderer->node());
+    float time = element->currentValue();
+    return localizedMediaTimeDescription(fabsf(time));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/WebCore/accessibility/AccessibilityMediaControls.h b/WebCore/accessibility/AccessibilityMediaControls.h
new file mode 100644
index 0000000..9b306fd
--- /dev/null
+++ b/WebCore/accessibility/AccessibilityMediaControls.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef AccessibilityMediaControls_h
+#define AccessibilityMediaControls_h
+
+#if ENABLE(VIDEO)
+
+#include "AccessibilitySlider.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+    class AccessibilityMediaControl : public AccessibilityRenderObject {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControl() { }
+
+        virtual AccessibilityRole roleValue() const;
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String title() const;
+        virtual String accessibilityDescription() const;
+        virtual String helpText() const;
+
+    protected:
+        AccessibilityMediaControl(RenderObject*);
+        MediaControlElementType controlType() const;
+        String controlTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeline : public AccessibilitySlider {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeline() { }
+
+        virtual bool isMediaTimeline() const { return true; }
+
+        virtual String helpText() const;
+        virtual String valueDescription() const;
+        const AtomicString& getAttribute(const QualifiedName& attribute) const;
+
+    private:
+        AccessibilityMediaTimeline(RenderObject*);
+    };
+
+
+    class AccessibilityMediaControlsContainer : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaControlsContainer() { }
+
+        virtual AccessibilityRole roleValue() const { return ToolbarRole; }
+        virtual bool accessibilityIsIgnored() const { return false; }
+
+        virtual String helpText() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaControlsContainer(RenderObject*);
+        bool controllingVideoElement() const;
+        const String elementTypeName() const;
+    };
+
+
+    class AccessibilityMediaTimeDisplay : public AccessibilityMediaControl {
+
+    public:
+        static PassRefPtr<AccessibilityObject> create(RenderObject*);
+        virtual ~AccessibilityMediaTimeDisplay() { }
+
+        virtual AccessibilityRole roleValue() const { return StaticTextRole; }
+        virtual bool accessibilityIsIgnored() const;
+
+        virtual String stringValue() const;
+        virtual String accessibilityDescription() const;
+
+    private:
+        AccessibilityMediaTimeDisplay(RenderObject*);
+    };
+
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+
+#endif // AccessibilityMediaControls_h
diff --git a/WebCore/accessibility/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
index d6fd969..d7093e4 100644
--- a/WebCore/accessibility/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,6 +41,7 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "RenderImage.h"
+#include "RenderListItem.h"
 #include "RenderListMarker.h"
 #include "RenderMenuList.h"
 #include "RenderTextControl.h"
@@ -89,6 +90,35 @@ AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
     return parent;
 }
 
+AccessibilityObject* AccessibilityObject::firstAccessibleObjectFromNode(const Node* node)
+{
+    ASSERT(AXObjectCache::accessibilityEnabled());
+
+    if (!node)
+        return 0;
+
+    Document* document = node->document();
+    if (!document)
+        return 0;
+
+    AXObjectCache* cache = document->axObjectCache();
+
+    AccessibilityObject* accessibleObject = cache->getOrCreate(node->renderer());
+    while (accessibleObject && accessibleObject->accessibilityIsIgnored()) {
+        node = node->traverseNextNode();
+
+        while (node && !node->renderer())
+            node = node->traverseNextSibling();
+
+        if (!node)
+            return 0;
+
+        accessibleObject = cache->getOrCreate(node->renderer());
+    }
+
+    return accessibleObject;
+}
+
 bool AccessibilityObject::isARIAInput(AccessibilityRole ariaRole)
 {
     return ariaRole == RadioButtonRole || ariaRole == CheckBoxRole || ariaRole == TextFieldRole;
@@ -363,6 +393,49 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
     return true;
 }
 
+// Finds a RenderListItem parent give a node.
+RenderListItem* AccessibilityObject::renderListItemContainerForNode(Node* node) const
+{
+    for (Node* stringNode = node; stringNode; stringNode = stringNode->parent()) {
+        RenderObject* renderObject = stringNode->renderer();
+        if (!renderObject || !renderObject->isListItem())
+            continue;
+        
+        return toRenderListItem(renderObject);
+    }
+    
+    return 0;
+}
+    
+// Returns the text associated with a list marker if this node is contained within a list item.
+String AccessibilityObject::listMarkerTextForNodeAndPosition(Node* node, const VisiblePosition& visiblePositionStart) const
+{
+    // If the range does not contain the start of the line, the list marker text should not be included.
+    if (!isStartOfLine(visiblePositionStart))
+        return String();
+
+    RenderListItem* listItem = renderListItemContainerForNode(node);
+    if (!listItem)
+        return String();
+        
+    // If this is in a list item, we need to manually add the text for the list marker 
+    // because a RenderListMarker does not have a Node equivalent and thus does not appear
+    // when iterating text.
+    const String& markerText = listItem->markerText();
+    if (markerText.isEmpty())
+        return String();
+                
+    // Append text, plus the period that follows the text.
+    // FIXME: Not all list marker styles are followed by a period, but this
+    // sounds much better when there is a synthesized pause because of a period.
+    Vector<UChar> resultVector;
+    resultVector.append(markerText.characters(), markerText.length());
+    resultVector.append('.');
+    resultVector.append(' ');
+    
+    return String::adopt(resultVector);
+}
+    
 String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionRange& visiblePositionRange) const
 {
     if (visiblePositionRange.isNull())
@@ -373,6 +446,11 @@ String AccessibilityObject::stringForVisiblePositionRange(const VisiblePositionR
     for (TextIterator it(range.get()); !it.atEnd(); it.advance()) {
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
         if (it.length() != 0) {
+            // Add a textual representation for list marker text
+            String listMarkerText = listMarkerTextForNodeAndPosition(it.node(), visiblePositionRange.start);
+            if (!listMarkerText.isEmpty())
+                resultVector.append(listMarkerText.characters(), listMarkerText.length());
+                
             resultVector.append(it.characters(), it.length());
         } else {
             // locate the node and starting offset for this replaced range
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index 3f6c395..c5ba1ed 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -86,10 +86,13 @@ class IntPoint;
 class IntSize;
 class Node;
 class RenderObject;
+class RenderListItem;
 class VisibleSelection;
 class String;
 class Widget;
 
+typedef unsigned AXID;
+
 enum AccessibilityRole {
     UnknownRole = 1,
     ButtonRole,
@@ -156,7 +159,28 @@ enum AccessibilityRole {
     DefinitionListTermRole,
     DefinitionListDefinitionRole,
     AnnotationRole,
-    SliderThumbRole
+    SliderThumbRole,
+    
+    // ARIA Grouping roles
+    LandmarkApplicationRole,
+    LandmarkBannerRole,
+    LandmarkComplementaryRole,
+    LandmarkContentInfoRole,
+    LandmarkMainRole,
+    LandmarkNavigationRole,
+    LandmarkSearchRole,
+    
+    ApplicationLogRole,
+    ApplicationMarqueeRole,
+    ApplicationStatusRole,
+    ApplicationTimerRole,
+    
+    DocumentRole,
+    DocumentArticleRole,
+    DocumentNoteRole,
+    DocumentRegionRole,
+    
+    UserInterfaceTooltipRole
 };
 
 enum AccessibilityOrientation {
@@ -220,6 +244,7 @@ public:
     virtual bool isWebArea() const { return false; };
     virtual bool isCheckboxOrRadio() const { return false; };
     virtual bool isListBox() const { return roleValue() == ListBoxRole; };
+    virtual bool isMediaTimeline() const { return false; }
     virtual bool isMenuRelated() const { return false; }
     virtual bool isMenu() const { return false; }
     virtual bool isMenuBar() const { return false; }
@@ -285,11 +310,13 @@ public:
     virtual AccessibilityObject* parentObject() const = 0;
     virtual AccessibilityObject* parentObjectUnignored() const;
     virtual AccessibilityObject* parentObjectIfExists() const { return 0; }
+    static AccessibilityObject* firstAccessibleObjectFromNode(const Node*);
 
     virtual AccessibilityObject* observableObject() const { return 0; }
     virtual void linkedUIElements(AccessibilityChildrenVector&) const { }
     virtual AccessibilityObject* titleUIElement() const { return 0; }
     virtual bool exposesTitleUIElement() const { return true; }
+    virtual AccessibilityObject* correspondingControlForLabelElement() const { return 0; }
 
     virtual AccessibilityRole ariaRoleAttribute() const { return UnknownRole; }
     virtual bool isPresentationalChildOfAriaRole() const { return false; }
@@ -304,8 +331,8 @@ public:
     virtual PassRefPtr<Range> ariaSelectedTextDOMRange() const { return 0; }
 
     virtual AXObjectCache* axObjectCache() const { return 0; }
-    unsigned axObjectID() const { return m_id; }
-    void setAXObjectID(unsigned axObjectID) { m_id = axObjectID; }
+    AXID axObjectID() const { return m_id; }
+    void setAXObjectID(AXID axObjectID) { m_id = axObjectID; }
     
     static AccessibilityObject* anchorElementForNode(Node*);
     virtual Element* anchorElement() const { return 0; }
@@ -408,6 +435,7 @@ public:
 
     virtual String doAXStringForRange(const PlainTextRange&) const { return String(); }
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const { return IntRect(); }
+    String listMarkerTextForNodeAndPosition(Node*, const VisiblePosition&) const;
 
     unsigned doAXLineForIndex(unsigned);
 
@@ -436,14 +464,15 @@ public:
     virtual void updateBackingStore() { }
     
 protected:
-    unsigned m_id;
+    AXID m_id;
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
     AccessibilityRole m_role;
     
     virtual void clearChildren();
     virtual bool isDetached() const { return true; }
-
+    RenderListItem* renderListItemContainerForNode(Node* node) const;
+    
 #if PLATFORM(MAC)
     RetainPtr<AccessibilityObjectWrapper> m_wrapper;
 #elif PLATFORM(WIN) && !PLATFORM(WINCE)
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index e0f9a91..834e931 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -35,7 +35,6 @@
 #include "CharacterNames.h"
 #include "EventNames.h"
 #include "FloatRect.h"
-#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
@@ -54,7 +53,6 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "Page.h"
 #include "RenderButton.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
@@ -404,6 +402,11 @@ bool AccessibilityRenderObject::isReadOnly() const
         return !frame->isContentEditable();
     }
 
+    if (m_renderer->isTextField())
+        return static_cast<HTMLInputElement*>(m_renderer->node())->readOnly();
+    if (m_renderer->isTextArea())
+        return static_cast<HTMLTextAreaElement*>(m_renderer->node())->readOnly();
+    
     return !m_renderer->node() || !m_renderer->node()->isContentEditable();
 }
 
@@ -603,6 +606,22 @@ Element* AccessibilityRenderObject::mouseButtonListener() const
     return 0;
 }
 
+void AccessibilityRenderObject::increment()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(5);
+}
+
+void AccessibilityRenderObject::decrement()
+{
+    if (roleValue() != SliderRole)
+        return;
+    
+    changeValueByPercent(-5);
+}
+
 static Element* siblingWithAriaRole(String role, Node* node)
 {
     Node* sibling = node->parent()->firstChild();
@@ -1020,7 +1039,7 @@ String AccessibilityRenderObject::accessibilityDescription() const
                 const AtomicString& title = static_cast<HTMLFrameElementBase*>(owner)->getAttribute(titleAttr);
                 if (!title.isEmpty())
                     return title;
-                return static_cast<HTMLFrameElementBase*>(owner)->name();
+                return static_cast<HTMLFrameElementBase*>(owner)->getAttribute(nameAttr);
             }
             if (owner->isHTMLElement())
                 return static_cast<HTMLElement*>(owner)->getAttribute(nameAttr);
@@ -1135,22 +1154,10 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
     if (!linkedNode)
         return 0;
     
-    // the element we find may not be accessible, keep searching until we find a good one
-    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    while (linkedAXElement && linkedAXElement->accessibilityIsIgnored()) {
-        linkedNode = linkedNode->traverseNextNode();
-        
-        while (linkedNode && !linkedNode->renderer())
-            linkedNode = linkedNode->traverseNextSibling();
-        
-        if (!linkedNode)
-            return 0;
-        linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
-    }
-    
-    return linkedAXElement;
+    // The element we find may not be accessible, so find the first accessible object.
+    return firstAccessibleObjectFromNode(linkedNode);
 }
-    
+
 void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const
 {
     if (!m_renderer || roleValue() != RadioButtonRole)
@@ -1269,15 +1276,9 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
-    HTMLLabelElement* labelElement = labelElementContainer();
-    if (labelElement) {
-        HTMLElement* correspondingControl = labelElement->correspondingControl();
-        if (correspondingControl && correspondingControl->renderer()) {
-            AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
-            if (!controlObject->exposesTitleUIElement())
-                return true;
-        }
-    }
+    AccessibilityObject* controlObject = correspondingControlForLabelElement();
+    if (controlObject && !controlObject->exposesTitleUIElement())
+        return true;
         
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole == TextAreaRole || ariaRole == StaticTextRole) {
@@ -1590,8 +1591,22 @@ void AccessibilityRenderObject::setFocused(bool on)
     }
 }
 
+void AccessibilityRenderObject::changeValueByPercent(float percentChange)
+{
+    float range = maxValueForRange() - minValueForRange();
+    float value = valueForRange();
+    
+    value += range * (percentChange / 100);
+    setValue(String::number(value));
+    
+    axObjectCache()->postNotification(m_renderer, AXObjectCache::AXValueChanged, true);
+}
+    
 void AccessibilityRenderObject::setValue(const String& string)
 {
+    if (!m_renderer)
+        return;
+    
     // FIXME: Do we want to do anything here for ARIA textboxes?
     if (m_renderer->isTextField()) {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
@@ -1599,6 +1614,10 @@ void AccessibilityRenderObject::setValue(const String& string)
     } else if (m_renderer->isTextArea()) {
         HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
         textArea->setValue(string);
+    } else if (roleValue() == SliderRole) {
+        Node* element = m_renderer->node();
+        if (element && element->isElementNode())
+            static_cast<Element*>(element)->setAttribute(aria_valuenowAttr, string);
     }
 }
 
@@ -1658,7 +1677,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        String useMapName = static_cast<HTMLImageElement*>(curr)->getAttribute(usemapAttr).string().substring(1).lower();
         if (useMapName == mapName)
             return axObjectCache()->getOrCreate(obj);
     }
@@ -2094,40 +2113,25 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     if (obj->isListBox())
         return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
         
-    if (result->accessibilityIsIgnored())
+    if (result->accessibilityIsIgnored()) {
+        // If this element is the label of a control, a hit test should return the control.
+        AccessibilityObject* controlObject = result->correspondingControlForLabelElement();
+        if (controlObject && !controlObject->exposesTitleUIElement())
+            return controlObject;
+
         result = result->parentObjectUnignored();
+    }
 
     return result;
 }
 
 AccessibilityObject* AccessibilityRenderObject::focusedUIElement() const
 {
-    // get the focused node in the page
     Page* page = m_renderer->document()->page();
     if (!page)
         return 0;
-    
-    Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
-    Node* focusedNode = focusedDocument->focusedNode();
-    if (!focusedNode)
-        focusedNode = focusedDocument;
-    
-    RenderObject* focusedNodeRenderer = focusedNode->renderer();
-    if (!focusedNodeRenderer)
-        return 0;
-    
-    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
-    
-    if (obj->shouldFocusActiveDescendant()) {
-        if (AccessibilityObject* descendant = obj->activeDescendant())
-            obj = descendant;
-    }
-    
-    // the HTML element, for example, is focusable but has an AX object that is ignored
-    if (obj->accessibilityIsIgnored())
-        obj = obj->parentObjectUnignored();
-    
-    return obj;
+
+    return AXObjectCache::focusedUIElementForPage(page);
 }
 
 bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
@@ -2174,7 +2178,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
         return 0;
     
     AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
-    if (obj->isAccessibilityRenderObject())
+    if (obj && obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
     return 0;
@@ -2192,9 +2196,21 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), AXObjectCache::AXFocusedUIElementChanged, true);
 }
 
+AccessibilityObject* AccessibilityRenderObject::correspondingControlForLabelElement() const
+{
+    HTMLLabelElement* labelElement = labelElementContainer();
+    if (!labelElement)
+        return 0;
+    
+    HTMLElement* correspondingControl = labelElement->correspondingControl();
+    if (!correspondingControl)
+        return 0;
+    
+    return axObjectCache()->getOrCreate(correspondingControl->renderer());     
+}
 
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
@@ -2216,32 +2232,52 @@ static const ARIARoleMap& createARIARoleMap()
     };
 
     const RoleEntry roles[] = {
+        { "application", LandmarkApplicationRole },
+        { "article", DocumentArticleRole },
+        { "banner", LandmarkBannerRole },
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "complementary", LandmarkComplementaryRole },
+        { "contentinfo", LandmarkContentInfoRole },
         { "grid", TableRole },
         { "gridcell", CellRole },
         { "columnheader", ColumnHeaderRole },
+        { "definition", DefinitionListDefinitionRole },
+        { "document", DocumentRole },
         { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
         { "link", WebCoreLinkRole },
+        { "list", ListRole },        
+        { "listitem", GroupRole },        
         { "listbox", ListBoxRole },
+        { "log", ApplicationLogRole },
         // "option" isn't here because it may map to different roles depending on the parent element's role
+        { "main", LandmarkMainRole },
+        { "marquee", ApplicationMarqueeRole },
         { "menu", MenuRole },
         { "menubar", GroupRole },
         // "menuitem" isn't here because it may map to different roles depending on the parent element's role
         { "menuitemcheckbox", MenuItemRole },
         { "menuitemradio", MenuItemRole },
+        { "note", DocumentNoteRole },
+        { "navigation", LandmarkNavigationRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
         { "radiogroup", RadioGroupRole },
+        { "region", DocumentRegionRole },
         { "row", RowRole },
         { "range", SliderRole },
+        { "search", LandmarkSearchRole },
+        { "separator", SplitterRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
+        { "status", ApplicationStatusRole },
         { "textbox", TextAreaRole },
-        { "toolbar", ToolbarRole }
+        { "timer", ApplicationTimerRole },
+        { "toolbar", ToolbarRole },
+        { "tooltip", UserInterfaceTooltipRole }
     };
     ARIARoleMap& roleMap = *new ARIARoleMap;
         
@@ -2418,6 +2454,7 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
         case PopUpButtonRole:
         case CheckBoxRole:
         case RadioButtonRole:
+        case SliderRole:
             return true;
         default:
             return false;
@@ -2429,10 +2466,10 @@ bool AccessibilityRenderObject::canSetValueAttribute() const
     if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
         return false;
 
-    if (isWebArea()) 
+    if (isWebArea() || isTextControl()) 
         return !isReadOnly();
 
-    return isTextControl() || isProgressIndicator() || isSlider();
+    return isProgressIndicator() || isSlider();
 }
 
 bool AccessibilityRenderObject::canSetTextRangeAttributes() const
@@ -2639,7 +2676,9 @@ void AccessibilityRenderObject::updateBackingStore()
 {
     if (!m_renderer)
         return;
-    m_renderer->view()->layoutIfNeeded();
-}    
-    
+
+    // Updating layout may delete m_renderer and this object.
+    m_renderer->document()->updateLayoutIgnorePendingStylesheets();
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index 2b29f4a..d82ca71 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -133,6 +133,8 @@ public:
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual AccessibilityObject* correspondingControlForLabelElement() const;
+
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -188,6 +190,9 @@ public:
     virtual void setFocused(bool);
     virtual void setSelectedTextRange(const PlainTextRange&);
     virtual void setValue(const String&);
+    virtual void changeValueByPercent(float percentChange);
+    virtual void increment();
+    virtual void decrement();
     
     virtual void detach();
     virtual void childrenChanged();
diff --git a/WebCore/accessibility/AccessibilitySlider.cpp b/WebCore/accessibility/AccessibilitySlider.cpp
index e3a654b..5aca672 100644
--- a/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/WebCore/accessibility/AccessibilitySlider.cpp
@@ -75,6 +75,7 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
         
         case SliderThumbVerticalPart: 
         case SliderVerticalPart:
+        case MediaVolumeSliderPart:
             return AccessibilityOrientationVertical;
             
         default:
@@ -113,15 +114,6 @@ float AccessibilitySlider::minValueForRange() const
     return getAttribute(minAttr).toFloat();
 }
 
-void AccessibilitySlider::changeValue(float percentChange)
-{
-    float range = maxValueForRange() - minValueForRange();
-    float value = valueForRange();
-    
-    value += range * (percentChange / 100);
-    setValue(String::number(value));
-}
-
 void AccessibilitySlider::setValue(const String& value)
 {
     HTMLInputElement* input = element();
@@ -135,16 +127,6 @@ void AccessibilitySlider::setValue(const String& value)
     input->dispatchFormControlChangeEvent();
 }
 
-void AccessibilitySlider::increment()
-{
-    return changeValue(5);
-}
-
-void AccessibilitySlider::decrement()
-{
-    return changeValue(-5);
-}
-
 HTMLInputElement* AccessibilitySlider::element() const
 {
     return static_cast<HTMLInputElement*>(m_renderer->node());
diff --git a/WebCore/accessibility/AccessibilitySlider.h b/WebCore/accessibility/AccessibilitySlider.h
index eadab08..254ebdd 100644
--- a/WebCore/accessibility/AccessibilitySlider.h
+++ b/WebCore/accessibility/AccessibilitySlider.h
@@ -58,12 +58,10 @@ namespace WebCore {
         virtual float minValueForRange() const;
         virtual AccessibilityOrientation orientation() const;
 
-        virtual void increment();
-        virtual void decrement();
+    protected:
+        AccessibilitySlider(RenderObject*);
 
     private:
-        AccessibilitySlider(RenderObject*);
-        void changeValue(float /*percentChange*/);
         HTMLInputElement* element() const;
     };
 
diff --git a/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
index d0f1882..a97dfe2 100644
--- a/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
+++ b/WebCore/accessibility/chromium/AXObjectCacheChromium.cpp
@@ -43,11 +43,15 @@ void AXObjectCache::attachWrapper(AccessibilityObject*)
     // In Chromium, AccessibilityObjects are wrapped lazily.
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
+void AXObjectCache::postPlatformNotification(AccessibilityObject*, AXNotification)
 {
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*)
+{
+}
+
+void AXObjectCache::handleScrolledToAnchor(const Node*)
 {
 }
 
diff --git a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
index a04367f..cc515ad 100644
--- a/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
+++ b/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp
@@ -37,20 +37,16 @@ void AXObjectCache::attachWrapper(AccessibilityObject* obj)
     g_object_unref(atkObj);
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, const String& message)
+void AXObjectCache::postPlatformNotification(AccessibilityObject* coreObject, AXNotification notification)
 {
-    if (message == "AXCheckedStateChanged") {
+    if (notification == AXCheckedStateChanged) {
         if (!coreObject->isCheckboxOrRadio())
             return;
         g_signal_emit_by_name(coreObject->wrapper(), "state-change", "checked", coreObject->isChecked());
     }
 }
-    
-void AXObjectCache::handleFocusedUIElementChanged()
-{
-}
 
-void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject* oldFocusedRender, RenderObject* newFocusedRender)
 {
     RefPtr<AccessibilityObject> oldObject = getOrCreate(oldFocusedRender);
     if (oldObject) {
@@ -64,4 +60,8 @@ void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject* old
     }
 }
 
+void AXObjectCache::handleScrolledToAnchor(const Node*)
+{
+}
+
 } // namespace WebCore
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 6d3729b..811903d 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -60,7 +60,7 @@ using namespace WebCore;
 
 static AccessibilityObject* fallbackObject()
 {
-    static AXObjectCache* fallbackCache = new AXObjectCache();
+    static AXObjectCache* fallbackCache = new AXObjectCache;
     static AccessibilityObject* object = 0;
     if (!object) {
         // FIXME: using fallbackCache->getOrCreate(ListBoxOptionRole) is a hack
@@ -556,7 +556,7 @@ static PangoLayout* getPangoLayoutForAtk(AtkText* textObject)
     HostWindow* hostWindow = coreObject->document()->view()->hostWindow();
     if (!hostWindow)
         return 0;
-    PlatformWidget webView = hostWindow->platformWindow();
+    PlatformPageClient webView = hostWindow->platformPageClient();
     if (!webView)
         return 0;
 
diff --git a/WebCore/accessibility/mac/AXObjectCacheMac.mm b/WebCore/accessibility/mac/AXObjectCacheMac.mm
index be7968b..2f18cf3 100644
--- a/WebCore/accessibility/mac/AXObjectCacheMac.mm
+++ b/WebCore/accessibility/mac/AXObjectCacheMac.mm
@@ -51,19 +51,51 @@ void AXObjectCache::attachWrapper(AccessibilityObject* obj)
     obj->setWrapper([[AccessibilityObjectWrapper alloc] initWithAccessibilityObject:obj]);
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, const String& message)
+void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotification notification)
 {
     if (!obj)
         return;
     
-    NSAccessibilityPostNotification(obj->wrapper(), message);
+    // Some notifications are unique to Safari and do not have NSAccessibility equivalents.
+    String macNotification;
+    switch (notification) {
+        case AXCheckedStateChanged:
+            macNotification = "AXCheckedStateChanged";
+            break;
+        case AXFocusedUIElementChanged:
+            macNotification = NSAccessibilityFocusedUIElementChangedNotification;
+            break;
+        case AXLayoutComplete:
+            macNotification = "AXLayoutComplete";
+            break;
+        case AXLoadComplete:
+            macNotification = "AXLoadComplete";
+            break;
+        case AXSelectedChildrenChanged:
+            macNotification = NSAccessibilitySelectedChildrenChangedNotification;
+            break;
+        case AXSelectedTextChanged:
+            macNotification = NSAccessibilitySelectedTextChangedNotification;
+            break;
+        case AXValueChanged:
+            macNotification = NSAccessibilityValueChangedNotification;
+            break;
+        default:
+            return;
+    }
+    
+    NSAccessibilityPostNotification(obj->wrapper(), macNotification);
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject*)
 {
     [[WebCoreViewFactory sharedFactory] accessibilityHandleFocusChanged];
 }
 
+void AXObjectCache::handleScrolledToAnchor(const Node*)
+{
+}
+
 }
 
 #endif // HAVE(ACCESSIBILITY)
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index d1e0599..e56e77c 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -122,6 +122,7 @@ using namespace std;
 #ifdef BUILDING_ON_TIGER
 typedef unsigned NSUInteger;
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
+#define NSAccessibilityTimelineSubrole @"AXTimeline"
 #endif
 
 @interface NSObject (WebKitAccessibilityArrayCategory)
@@ -378,7 +379,7 @@ static void AXAttributeStringSetSpelling(NSMutableAttributedString* attrString,
         
         // add misspelling attribute for the intersection of the marker and the range
         int rStart = range.location + (marker.startOffset - offset);
-        int rLength = MIN(marker.endOffset, endOffset) - marker.startOffset;
+        int rLength = min(marker.endOffset, endOffset) - marker.startOffset;
         NSRange spellRange = NSMakeRange(rStart, rLength);
         AXAttributeStringSetNumber(attrString, NSAccessibilityMisspelledTextAttribute, [NSNumber numberWithBool:YES], spellRange);
         
@@ -478,6 +479,9 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
 
 - (NSAttributedString*)doAXAttributedStringForTextMarkerRange:(WebCoreTextMarkerRange*)textMarkerRange
 {
+    if (!m_object)
+        return nil;
+    
     // extract the start and end VisiblePosition
     VisiblePosition startVisiblePosition = visiblePositionForStartOfTextMarkerRange(textMarkerRange);
     if (startVisiblePosition.isNull())
@@ -487,6 +491,7 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
     if (endVisiblePosition.isNull())
         return nil;
 
+    VisiblePositionRange visiblePositionRange(startVisiblePosition, endVisiblePosition);
     // iterate over the range to build the AX attributed string
     NSMutableAttributedString* attrString = [[NSMutableAttributedString alloc] init];
     TextIterator it(makeRange(startVisiblePosition, endVisiblePosition).get());
@@ -499,6 +504,11 @@ static NSString* nsStringForReplacedNode(Node* replacedNode)
 
         // non-zero length means textual node, zero length means replaced node (AKA "attachments" in AX)
         if (it.length() != 0) {
+            // Add the text of the list marker item if necessary.
+            String listMarkerText = m_object->listMarkerTextForNodeAndPosition(node, VisiblePosition(it.range()->startPosition()));
+            if (!listMarkerText.isEmpty())
+                AXAttributedStringAppendText(attrString, node, offset, listMarkerText.characters(), listMarkerText.length());
+            
             AXAttributedStringAppendText(attrString, node, offset, it.characters(), it.length());
         } else {
             Node* replacedNode = node->childNode(offset);
@@ -536,6 +546,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     static NSArray* actionElementActions = [[NSArray alloc] initWithObjects: NSAccessibilityPressAction, NSAccessibilityShowMenuAction, nil];
     static NSArray* defaultElementActions = [[NSArray alloc] initWithObjects: NSAccessibilityShowMenuAction, nil];
@@ -563,6 +575,8 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         return nil;
     
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if (m_object->isAttachment())
         return [[self attachmentView] accessibilityAttributeNames];
@@ -669,6 +683,7 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         [tempArray addObject:NSAccessibilityMinValueAttribute];
         [tempArray addObject:NSAccessibilityMaxValueAttribute];
         [tempArray addObject:NSAccessibilityOrientationAttribute];
+        [tempArray addObject:NSAccessibilityValueDescriptionAttribute];
         rangeAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
@@ -969,8 +984,23 @@ static const AccessibilityRoleMap& createAccessibilityRoleMap()
         { TableHeaderContainerRole, NSAccessibilityGroupRole },
         { DefinitionListDefinitionRole, NSAccessibilityGroupRole },
         { DefinitionListTermRole, NSAccessibilityGroupRole },
-        
         { SliderThumbRole, NSAccessibilityValueIndicatorRole },
+        { LandmarkApplicationRole, NSAccessibilityGroupRole },
+        { LandmarkBannerRole, NSAccessibilityGroupRole },
+        { LandmarkComplementaryRole, NSAccessibilityGroupRole },
+        { LandmarkContentInfoRole, NSAccessibilityGroupRole },
+        { LandmarkMainRole, NSAccessibilityGroupRole },
+        { LandmarkNavigationRole, NSAccessibilityGroupRole },
+        { LandmarkSearchRole, NSAccessibilityGroupRole },
+        { ApplicationLogRole, NSAccessibilityGroupRole },
+        { ApplicationMarqueeRole, NSAccessibilityGroupRole },
+        { ApplicationStatusRole, NSAccessibilityGroupRole },
+        { ApplicationTimerRole, NSAccessibilityGroupRole },
+        { DocumentRole, NSAccessibilityGroupRole },
+        { DocumentArticleRole, NSAccessibilityGroupRole },
+        { DocumentNoteRole, NSAccessibilityGroupRole },
+        { DocumentRegionRole, NSAccessibilityGroupRole },
+        { UserInterfaceTooltipRole, NSAccessibilityGroupRole },
         
 
     };
@@ -1019,6 +1049,47 @@ static NSString* roleValueToNSString(AccessibilityRole value)
             return NSAccessibilityDefinitionListSubrole;
     }
     
+    // ARIA content subroles.
+    switch (m_object->roleValue()) {
+        case LandmarkApplicationRole:
+            return @"AXLandmarkApplication";
+        case LandmarkBannerRole:
+            return @"AXLandmarkBanner";
+        case LandmarkComplementaryRole:
+            return @"AXLandmarkComplementary";
+        case LandmarkContentInfoRole:
+            return @"AXLandmarkContentInfo";
+        case LandmarkMainRole:
+            return @"AXLandmarkMain";
+        case LandmarkNavigationRole:
+            return @"AXLandmarkNavigation";
+        case LandmarkSearchRole:
+            return @"AXLandmarkSearch";
+        case ApplicationLogRole:
+            return @"AXApplicationLog";
+        case ApplicationMarqueeRole:
+            return @"AXApplicationMarquee";
+        case ApplicationStatusRole:
+            return @"AXApplicationStatus";
+        case ApplicationTimerRole:
+            return @"AXApplicationTimer";
+        case DocumentRole:
+            return @"AXDocument";
+        case DocumentArticleRole:
+            return @"AXDocumentArticle";
+        case DocumentNoteRole:
+            return @"AXDocumentNote";
+        case DocumentRegionRole:
+            return @"AXDocumentRegion";
+        case UserInterfaceTooltipRole:
+            return @"AXUserInterfaceTooltip";
+        default:
+            return nil;
+    }
+    
+    if (m_object->isMediaTimeline())
+        return NSAccessibilityTimelineSubrole;
+
     return nil;
 }
 
@@ -1047,8 +1118,44 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:NSAccessibilityImageRole])
         return NSAccessibilityRoleDescription(NSAccessibilityImageRole, [self subrole]);
     
-    if ([axRole isEqualToString:NSAccessibilityGroupRole])
-        return NSAccessibilityRoleDescription(NSAccessibilityGroupRole, [self subrole]);
+    if ([axRole isEqualToString:NSAccessibilityGroupRole]) {
+        switch (m_object->roleValue()) {
+            default:
+                return NSAccessibilityRoleDescription(NSAccessibilityGroupRole, [self subrole]);
+            case LandmarkApplicationRole:
+                return AXARIAContentGroupText(@"ARIALandmarkApplication");
+            case LandmarkBannerRole:
+                return AXARIAContentGroupText(@"ARIALandmarkBanner");
+            case LandmarkComplementaryRole:
+                return AXARIAContentGroupText(@"ARIALandmarkComplementary");
+            case LandmarkContentInfoRole:
+                return AXARIAContentGroupText(@"ARIALandmarkContentInfo");
+            case LandmarkMainRole:
+                return AXARIAContentGroupText(@"ARIALandmarkMain");
+            case LandmarkNavigationRole:
+                return AXARIAContentGroupText(@"ARIALandmarkNavigation");
+            case LandmarkSearchRole:
+                return AXARIAContentGroupText(@"ARIALandmarkSearch");
+            case ApplicationLogRole:
+                return AXARIAContentGroupText(@"ARIAApplicationLog");
+            case ApplicationMarqueeRole:
+                return AXARIAContentGroupText(@"ARIAApplicationMarquee");
+            case ApplicationStatusRole:
+                return AXARIAContentGroupText(@"ARIAApplicationStatus");
+            case ApplicationTimerRole:
+                return AXARIAContentGroupText(@"ARIAApplicationTimer");
+            case DocumentRole:
+                return AXARIAContentGroupText(@"ARIADocument");
+            case DocumentArticleRole:
+                return AXARIAContentGroupText(@"ARIADocumentArticle");
+            case DocumentNoteRole:
+                return AXARIAContentGroupText(@"ARIADocumentNote");
+            case DocumentRegionRole:
+                return AXARIAContentGroupText(@"ARIADocumentRegion");
+            case UserInterfaceTooltipRole:
+                return AXARIAContentGroupText(@"ARIAUserInterfaceTooltip");
+        }
+    }        
     
     if ([axRole isEqualToString:NSAccessibilityCheckBoxRole])
         return NSAccessibilityRoleDescription(NSAccessibilityCheckBoxRole, [self subrole]);
@@ -1111,6 +1218,9 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([axRole isEqualToString:NSAccessibilityToolbarRole])
         return NSAccessibilityRoleDescription(NSAccessibilityToolbarRole, [self subrole]);
 
+    if ([axRole isEqualToString:NSAccessibilitySplitterRole])
+        return NSAccessibilityRoleDescription(NSAccessibilitySplitterRole, [self subrole]);
+    
     return NSAccessibilityRoleDescription(NSAccessibilityUnknownRole, nil);
 }
 
@@ -1123,6 +1233,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if ([attributeName isEqualToString: NSAccessibilityRoleAttribute])
         return [self role];
@@ -1244,7 +1356,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         }
         return m_object->accessibilityDescription();
     }
-    
+
     if ([attributeName isEqualToString: NSAccessibilityValueAttribute]) {
         if (m_object->isAttachment()) {
             if ([[[self attachmentView] accessibilityAttributeNames] containsObject:NSAccessibilityValueAttribute]) 
@@ -1465,6 +1577,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     RefPtr<AccessibilityObject> focusedObj = m_object->focusedUIElement();
 
@@ -1480,6 +1594,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     RefPtr<AccessibilityObject> axObject = m_object->doAccessibilityHitTest(IntPoint(point));
     if (axObject)
@@ -1493,6 +1609,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if ([attributeName isEqualToString: @"AXSelectedTextMarkerRange"])
         return YES;
@@ -1532,6 +1650,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if (m_object->isAttachment())
         return [[self attachmentView] accessibilityIsIgnored];
@@ -1544,6 +1664,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
 
     if (m_object->isAttachment()) 
         return nil;
@@ -1581,6 +1703,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
                       @"AXStyleTextMarkerRangeForTextMarker",
                       @"AXLengthForTextMarkerRange",
                       NSAccessibilityBoundsForRangeParameterizedAttribute,
+                      NSAccessibilityStringForRangeParameterizedAttribute,
                       nil];
     }
 
@@ -1629,6 +1752,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityPressAction];
@@ -1642,6 +1767,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityIncrementAction];
@@ -1655,6 +1782,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if (m_object->isAttachment())
         [[self attachmentView] accessibilityPerformAction:NSAccessibilityDecrementAction];
@@ -1704,6 +1833,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     if ([action isEqualToString:NSAccessibilityPressAction])
         [self accessibilityPerformPressAction];
@@ -1724,6 +1855,8 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return;
 
     WebCoreTextMarkerRange* textMarkerRange = nil;
     NSNumber*               number = nil;
@@ -1848,6 +1981,8 @@ static RenderObject* rendererForView(NSView* view)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     // common parameter type check/casting.  Nil checks in handlers catch wrong type case.
     // NOTE: This assumes nil is not a valid parameter, because it is indistinguishable from
@@ -1932,6 +2067,14 @@ static RenderObject* rendererForView(NSView* view)
         NSRect rect = m_object->boundsForVisiblePositionRange(VisiblePositionRange(start, end));
         return [NSValue valueWithRect:rect];
     }
+    
+    if ([attribute isEqualToString:NSAccessibilityStringForRangeParameterizedAttribute]) {
+        VisiblePosition start = m_object->visiblePositionForIndex(range.location);
+        VisiblePosition end = m_object->visiblePositionForIndex(range.location+range.length);
+        if (start.isNull() || end.isNull())
+            return nil;
+        return m_object->stringForVisiblePositionRange(VisiblePositionRange(start, end));
+    }
 
     if ([attribute isEqualToString: @"AXAttributedStringForTextMarkerRange"])
         return [self doAXAttributedStringForTextMarkerRange:textMarkerRange];
@@ -2098,7 +2241,9 @@ static RenderObject* rendererForView(NSView* view)
         return NSNotFound;
 
     m_object->updateBackingStore();
-    
+    if (!m_object)
+        return NSNotFound;
+
     const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
        
     if (children.isEmpty())
@@ -2120,6 +2265,8 @@ static RenderObject* rendererForView(NSView* view)
         return 0;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return 0;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
         const AccessibilityObject::AccessibilityChildrenVector& children = m_object->children();
@@ -2138,6 +2285,8 @@ static RenderObject* rendererForView(NSView* view)
         return nil;
 
     m_object->updateBackingStore();
+    if (!m_object)
+        return nil;
     
     if ([attribute isEqualToString:NSAccessibilityChildrenAttribute]) {
         if (m_object->children().isEmpty()) {
diff --git a/WebCore/accessibility/win/AXObjectCacheWin.cpp b/WebCore/accessibility/win/AXObjectCacheWin.cpp
index e39d5a5..a1bdcc0 100644
--- a/WebCore/accessibility/win/AXObjectCacheWin.cpp
+++ b/WebCore/accessibility/win/AXObjectCacheWin.cpp
@@ -28,6 +28,11 @@
 #include "AXObjectCache.h"
 
 #include "AccessibilityObject.h"
+#include "Document.h"
+#include "Page.h"
+#include "RenderObject.h"
+
+using namespace std;
 
 namespace WebCore {
 
@@ -46,12 +51,86 @@ void AXObjectCache::attachWrapper(AccessibilityObject*)
     // software requests them via get_accChild.
 }
 
-void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&)
+void AXObjectCache::handleScrolledToAnchor(const Node* anchorNode)
+{
+    // The anchor node may not be accessible. Post the notification for the
+    // first accessible object.
+    postPlatformNotification(AccessibilityObject::firstAccessibleObjectFromNode(anchorNode), AXScrolledToAnchor);
+}
+
+void AXObjectCache::postPlatformNotification(AccessibilityObject* obj, AXNotification notification)
 {
+    if (!obj)
+        return;
+
+    Document* document = obj->document();
+    if (!document)
+        return;
+
+    Page* page = document->page();
+    if (!page || !page->chrome()->platformPageClient())
+        return;
+
+    DWORD msaaEvent;
+    switch (notification) {
+        case AXFocusedUIElementChanged:
+            msaaEvent = EVENT_OBJECT_FOCUS;
+            break;
+
+        case AXScrolledToAnchor:
+            msaaEvent = EVENT_SYSTEM_SCROLLINGSTART;
+            break;
+
+        default:
+            return;
+    }
+
+    // Windows will end up calling get_accChild() on the root accessible
+    // object for the WebView, passing the child ID that we specify below. We
+    // negate the AXID so we know that the caller is passing the ID of an
+    // element, not the index of a child element.
+
+    ASSERT(obj->axObjectID() >= 1);
+    ASSERT(obj->axObjectID() <= numeric_limits<LONG>::max());
+
+    NotifyWinEvent(msaaEvent, page->chrome()->platformPageClient(), OBJID_CLIENT, -static_cast<LONG>(obj->axObjectID()));
 }
 
-void AXObjectCache::handleFocusedUIElementChanged()
+AXID AXObjectCache::platformGenerateAXID() const
 {
+    static AXID lastUsedID = 0;
+
+    // Generate a new ID. Windows accessibility relies on a positive AXID,
+    // ranging from 1 to LONG_MAX.
+    AXID objID = lastUsedID;
+    do {
+        ++objID;
+        objID %= std::numeric_limits<LONG>::max();
+    } while (objID == 0 || HashTraits<AXID>::isDeletedValue(objID) || m_idsInUse.contains(objID));
+
+    ASSERT(objID >= 1 && objID <= std::numeric_limits<LONG>::max());
+
+    lastUsedID = objID;
+
+    return objID;
+}
+
+void AXObjectCache::handleFocusedUIElementChanged(RenderObject*, RenderObject* newFocusedRenderer)
+{
+    if (!newFocusedRenderer)
+        return;
+
+    Page* page = newFocusedRenderer->document()->page();
+    if (!page || !page->chrome()->platformPageClient())
+        return;
+
+    AccessibilityObject* focusedObject = focusedUIElementForPage(page);
+    if (!focusedObject)
+        return;
+
+    ASSERT(!focusedObject->accessibilityIsIgnored());
+
+    postPlatformNotification(focusedObject, AXFocusedUIElementChanged);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/DOMObjectWithSVGContext.h b/WebCore/bindings/js/DOMObjectWithSVGContext.h
index 570548d..3d435cb 100644
--- a/WebCore/bindings/js/DOMObjectWithSVGContext.h
+++ b/WebCore/bindings/js/DOMObjectWithSVGContext.h
@@ -40,7 +40,7 @@ namespace WebCore {
         SVGElement* context() const { return m_context.get(); }
 
     protected:
-        DOMObjectWithSVGContext(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
+        DOMObjectWithSVGContext(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject*, SVGElement* context)
             : DOMObject(structure)
             , m_context(context)
         {
diff --git a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
index 003f544..9411ad8 100644
--- a/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSAbstractWorkerCustom.cpp
@@ -44,30 +44,17 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSAbstractWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onerror());
-
-    typedef AbstractWorker::EventListenersMap EventListenersMap;
-    typedef AbstractWorker::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 JSValue JSAbstractWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -76,10 +63,12 @@ JSValue JSAbstractWorker::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index abd5ad5..14457c4 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -48,7 +48,8 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
         if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(deprecatedParseURL(attrValue))) {
-            if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
+            Document* contentDocument = static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument();
+            if (contentDocument && !checkNodeSecurity(exec, contentDocument))
                 return;
         }
     }
@@ -58,4 +59,16 @@ void JSAttr::setValue(ExecState* exec, JSValue value)
     setDOMException(exec, ec);
 }
 
+void JSAttr::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->ownerElement()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSAudioConstructor.cpp b/WebCore/bindings/js/JSAudioConstructor.cpp
index 87a3880..174cc11 100644
--- a/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSHTMLAudioElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSCSSRuleListCustom.cpp b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
new file mode 100644
index 0000000..be3a9a2
--- /dev/null
+++ b/WebCore/bindings/js/JSCSSRuleListCustom.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All right reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCSSRuleList.h"
+
+#include "CSSRuleList.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCSSRuleList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSRuleList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
+}
diff --git a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 280ec93..4a137d3 100644
--- a/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,8 @@
 #include "JSCSSStyleDeclarationCustom.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
-#include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
 #include "PlatformString.h"
 #include <runtime/StringObjectThatMasqueradesAsUndefined.h>
@@ -40,6 +40,21 @@ using namespace WTF;
 
 namespace WebCore {
 
+void JSCSSStyleDeclaration::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    CSSStyleDeclaration* declaration = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    if (declaration->isMutableStyleDeclaration()) {
+        CSSMutableStyleDeclaration* mutableDeclaration = static_cast<CSSMutableStyleDeclaration*>(declaration);
+        CSSMutableStyleDeclaration::const_iterator end = mutableDeclaration->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = mutableDeclaration->begin(); it != end; ++it)
+            markDOMObjectWrapper(markStack, globalData, it->value());
+    }
+}
+
 // Check for a CSS prefix.
 // Passed prefix is all lowercase.
 // First character of the prefix within the property name may be upper or lowercase.
diff --git a/WebCore/bindings/js/JSCallbackData.cpp b/WebCore/bindings/js/JSCallbackData.cpp
new file mode 100644
index 0000000..d08f760
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSCallbackData.h"
+
+#include "Document.h"
+#include "JSDOMBinding.h"
+
+using namespace JSC;
+    
+namespace WebCore {
+
+void JSCallbackData::deleteData(void* context)
+{
+    delete static_cast<JSCallbackData*>(context);
+}
+
+JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedException)
+{
+    ASSERT(callback());
+    ASSERT(globalObject());
+
+    ExecState* exec = globalObject()->globalExec();
+    
+    JSValue function = callback()->get(exec, Identifier(exec, "handleEvent"));
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone) {
+        callType = callback()->getCallData(callData);
+        if (callType == CallTypeNone)
+            return JSValue();
+        function = callback();
+    }
+    
+    globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = call(exec, function, callType, callData, callback(), args);
+    globalObject()->globalData()->timeoutChecker.stop();
+
+    Document::updateStyleForAllDocuments();
+
+    if (exec->hadException()) {
+        reportCurrentException(exec);
+        if (raisedException)
+            *raisedException = true;
+        return result;
+    }
+    
+    return result;
+}
+    
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCallbackData.h b/WebCore/bindings/js/JSCallbackData.h
new file mode 100644
index 0000000..4fc9f84
--- /dev/null
+++ b/WebCore/bindings/js/JSCallbackData.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSCallbackData_h
+#define JSCallbackData_h
+
+#include "JSDOMGlobalObject.h"
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+// We have to clean up this data on the main thread because unprotecting a
+// JSObject on a non-main thread without synchronization would corrupt the heap
+// (and synchronization would be slow).
+
+class JSCallbackData {
+public:
+    static void deleteData(void*);
+
+    JSCallbackData(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+        : m_callback(callback)
+        , m_globalObject(globalObject)
+    {
+    }
+    
+    ~JSCallbackData()
+    {
+        ASSERT(isMainThread());
+    }
+
+    JSC::JSObject* callback() { return m_callback.get(); }
+    JSDOMGlobalObject* globalObject() { return m_globalObject.get(); }
+    
+    JSC::JSValue invokeCallback(JSC::MarkedArgumentBuffer&, bool* raisedException = 0);
+
+private:
+    JSC::ProtectedPtr<JSC::JSObject> m_callback;
+    JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
+};
+
+} // namespace WebCore
+
+#endif // JSCallbackData_h
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
new file mode 100644
index 0000000..93d53ca
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasArrayBufferConstructor.h"
+
+#include "Document.h"
+#include "CanvasArrayBuffer.h"
+#include "JSCanvasArrayBuffer.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasArrayBufferConstructor::s_info = { "CanvasArrayBufferConstructor", 0, 0, 0 };
+
+JSCanvasArrayBufferConstructor::JSCanvasArrayBufferConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasArrayBufferConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasArrayBufferPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasArrayBuffer(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasArrayBufferConstructor* jsConstructor = static_cast<JSCanvasArrayBufferConstructor*>(constructor);
+
+    unsigned int size = 0;
+    if (args.size() == 1) {
+        size = (unsigned int)args.at(0).toInt32(exec);
+        if (isnan(size))
+            size = 0;
+    }
+    return asObject(toJS(exec, jsConstructor->globalObject(), CanvasArrayBuffer::create(size)));
+}
+
+JSC::ConstructType JSCanvasArrayBufferConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasArrayBuffer;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
new file mode 100644
index 0000000..5f1254e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayBufferConstructor.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasArrayBufferConstructor_h
+#define JSCanvasArrayBufferConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+#include "JSCanvasArrayBuffer.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+    class CanvasArray;
+
+    // Template function used by CanvasXXXArrayConstructors
+    template<class C, typename T>
+    PassRefPtr<CanvasArray> construct(JSC::ExecState* exec, const JSC::ArgList& args)
+    {
+        // There are 3 constructors:
+        //
+        //  1) (in int size)
+        //  2) (in CanvasArrayBuffer buffer, [Optional] in int offset, [Optional] in unsigned int length)
+        //  3) (in sequence<T>) - This ends up being a JS "array-like" object
+        //
+        RefPtr<C> arrayObject;
+        
+        // For the 0 args case, just create an object without a buffer 
+        if (args.size() < 1)
+            return C::create(0, 0, 0);
+        
+        if (args.at(0).isObject()) {
+            RefPtr<CanvasArrayBuffer> buffer = toCanvasArrayBuffer(args.at(0));
+            if (buffer) {
+                int offset = (args.size() > 1) ? args.at(1).toInt32(exec) : 0;
+                unsigned int length = (args.size() > 2) ? static_cast<unsigned int>(args.at(2).toInt32(exec)) : 0;
+                return C::create(buffer, offset, length);
+            }
+            
+            JSC::JSObject* array = asObject(args.at(0));
+            int length = array->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+            void* tempValues;
+            if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues)) {
+                throwError(exec, JSC::GeneralError);
+                return 0;
+            }
+            
+            OwnFastMallocPtr<T> values(static_cast<T*>(tempValues));
+            for (int i = 0; i < length; ++i) {
+                JSC::JSValue v = array->get(exec, i);
+                if (exec->hadException())
+                    return 0;
+                values.get()[i] = static_cast<T>(v.toNumber(exec));
+            }
+            
+            return C::create(values.get(), length);
+        }
+        
+        unsigned size = static_cast<unsigned>(args.at(0).toInt32(exec));
+        return C::create(size);
+    }
+
+    class JSCanvasArrayBufferConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasArrayBufferConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasArrayBufferConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasArrayCustom.cpp b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
new file mode 100644
index 0000000..4aa1547
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasArrayCustom.cpp
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "config.h"
+#include "JSCanvasArray.h"
+
+#include "CanvasArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasArray* object)
+{
+    if (!object)
+        return jsUndefined();
+        
+    
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
new file mode 100644
index 0000000..ec1d66d
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasByteArrayConstructor::s_info = { "CanvasByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasByteArrayConstructor::JSCanvasByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasByteArrayConstructor* jsConstructor = static_cast<JSCanvasByteArrayConstructor*>(constructor);
+    RefPtr<CanvasByteArray> array = static_cast<CanvasByteArray*>(construct<CanvasByteArray, signed char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.h b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
index cd6c2cb..4d5dc11 100644
--- a/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/WebCore/bindings/js/JSCanvasByteArrayConstructor.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,44 +23,24 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef JSNamedNodesCollection_h
-#define JSNamedNodesCollection_h
+#ifndef JSCanvasByteArrayConstructor_h
+#define JSCanvasByteArrayConstructor_h
 
 #include "JSDOMBinding.h"
-#include <wtf/Vector.h>
+#include "JSDocument.h"
 
 namespace WebCore {
 
-    class Node;
-
-    // Internal class, used for the collection return by e.g. document.forms.myinput
-    // when multiple nodes have the same name.
-    class JSNamedNodesCollection : public DOMObjectWithGlobalPointer {
+    class JSCanvasByteArrayConstructor : public DOMConstructorObject {
     public:
-        JSNamedNodesCollection(JSC::ExecState*, JSDOMGlobalObject*, const Vector<RefPtr<Node> >&);
-
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-
-        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+        JSCanvasByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
-        {
-            return globalObject->objectPrototype();
-        }
-
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
-        {
-            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-        }
-
     private:
-        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        OwnPtr<Vector<RefPtr<Node> > > m_nodes;
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
 
-} // namespace WebCore
+}
 
-#endif // JSNamedNodesCollection_h
+#endif // JSCanvasByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..04697ce
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasByteArray.h"
+
+#include "CanvasByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
new file mode 100644
index 0000000..15e39c2
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasFloatArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasFloatArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasFloatArrayConstructor::s_info = { "CanvasFloatArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasFloatArrayConstructor::JSCanvasFloatArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasFloatArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasFloatArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasFloatArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasFloatArrayConstructor* jsConstructor = static_cast<JSCanvasFloatArrayConstructor*>(constructor);
+    RefPtr<CanvasFloatArray> array = static_cast<CanvasFloatArray*>(construct<CanvasFloatArray, float>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasFloatArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasFloatArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
new file mode 100644
index 0000000..efea250
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasFloatArrayConstructor_h
+#define JSCanvasFloatArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasFloatArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasFloatArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasFloatArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..20cd805
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasFloatArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasFloatArray.h"
+
+#include "CanvasFloatArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasFloatArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<float>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasFloatArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasFloatArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
new file mode 100644
index 0000000..6d57912
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasIntArrayConstructor::s_info = { "CanvasIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasIntArrayConstructor::JSCanvasIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasIntArrayConstructor* jsConstructor = static_cast<JSCanvasIntArrayConstructor*>(constructor);
+    RefPtr<CanvasIntArray> array = static_cast<CanvasIntArray*>(construct<CanvasIntArray, int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
new file mode 100644
index 0000000..5e19652
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasIntArrayConstructor_h
+#define JSCanvasIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..8442b87
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasIntArray.h"
+
+#include "CanvasIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
new file mode 100644
index 0000000..be10ac0
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasNumberArrayCustom.cpp
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasNumberArray.h"
+
+#include "CanvasNumberArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasNumberArray::getByIndex(JSC::ExecState* exec, unsigned int index)
+{
+    JSC::JSValue result = jsNumber(exec, impl()->item(index));
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 398a6799..bb3500b 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -67,27 +67,31 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 
 JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->strokeStyle());        
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->strokeStyle());        
 }
 
 void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
-    impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
-    return toJS(exec, impl()->fillStyle());
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    return toJS(exec, context->fillStyle());
 }
 
 void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
-    impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
+    context->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
 JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -124,7 +128,7 @@ JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = named color
     // number arg = gray color
@@ -162,7 +166,7 @@ JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgLis
 
 JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     if (args.size() <= 4)
         context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
@@ -176,7 +180,7 @@ JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& a
 
 JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // DrawImage has three variants:
     //     drawImage(img, dx, dy)
@@ -264,7 +268,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
     
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -284,7 +288,7 @@ JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const Arg
 
 JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     switch (args.size()) {
         case 3:
@@ -330,7 +334,7 @@ JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& ar
 
 JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     JSValue value = args.at(0);
     if (!value.isObject())
@@ -362,7 +366,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
     // putImageData has two variants
     // putImageData(ImageData, x, y)
     // putImageData(ImageData, x, y, dirtyX, dirtyY, dirtyWidth, dirtyHeight)
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
@@ -377,7 +381,7 @@ JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList&
 
 JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
@@ -395,7 +399,7 @@ JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& arg
 
 JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
-    CanvasRenderingContext2D* context = impl();
+    CanvasRenderingContext2D* context = static_cast<CanvasRenderingContext2D*>(impl());
 
     // string arg = text to draw
     // number arg = x
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..3938ba1
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,443 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasRenderingContext3D.h"
+
+#include "CanvasRenderingContext3D.h"
+#include "ExceptionCode.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "JSCanvasFloatArray.h"
+#include "JSCanvasIntArray.h"
+#include "JSHTMLCanvasElement.h"
+#include "JSHTMLImageElement.h"
+#include "JSWebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/OwnFastMallocPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSCanvasRenderingContext3D::bufferData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned usage = args.at(2).toInt32(exec);
+
+    // If argument 1 is a number, we are initializing this buffer to that size
+    if (!args.at(1).isObject()) {
+        unsigned int count = args.at(1).toInt32(exec);
+        static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, count, usage);
+        return jsUndefined();
+    }
+
+    CanvasArray* array = toCanvasArray(args.at(1));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferData(target, array, usage);
+    return jsUndefined();
+}
+
+JSValue JSCanvasRenderingContext3D::bufferSubData(JSC::ExecState* exec, JSC::ArgList const& args)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned offset = args.at(1).toInt32(exec);
+    
+    CanvasArray* array = toCanvasArray(args.at(2));
+    
+    static_cast<CanvasRenderingContext3D*>(impl())->bufferSubData(target, offset, array);
+    return jsUndefined();
+}
+
+// void texImage2DHTML(in unsigned long target, in unsigned long level, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 3)
+        return throwError(exec, SyntaxError);
+
+    ExceptionCode ec = 0;
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    unsigned level = args.at(1).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+    
+    if (args.size() > 5) {
+        // This must be the bare array case.
+        if (args.size() != 9)
+            return throwError(exec, SyntaxError);
+            
+        unsigned internalformat = args.at(2).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned width = args.at(3).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned height = args.at(4).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned border = args.at(5).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned format = args.at(6).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        unsigned type = args.at(7).toInt32(exec);
+        if (exec->hadException())    
+            return jsUndefined();
+
+        CanvasArray* array = toCanvasArray(args.at(8));
+        if (exec->hadException())    
+            return jsUndefined();
+            
+        if (!array)
+            return throwError(exec, TypeError);
+        
+        // FIXME: Need to check to make sure CanvasArray is a CanvasByteArray or CanvasShortArray,
+        // depending on the passed type parameter.
+        
+        context->texImage2D(target, level, internalformat, width, height, border, format, type, array, ec);
+        return jsUndefined();
+    }
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(2);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texImage2D(target, level, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+// void texSubImage2DHTML(in unsigned long target, in unsigned long level, in unsigned long xoff, in unsigned long yoff, in unsigned long width, in unsigned long height, in HTMLImageElement image);
+JSValue JSCanvasRenderingContext3D::texSubImage2D(ExecState* exec, const ArgList& args)
+{ 
+    if (args.size() < 7 || args.size() > 9)
+        return throwError(exec, SyntaxError);
+
+    CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(impl());    
+    unsigned target = args.at(0).toInt32(exec);
+    unsigned level = args.at(1).toInt32(exec);
+    unsigned xoff = args.at(2).toInt32(exec);
+    unsigned yoff = args.at(3).toInt32(exec);
+    unsigned width = args.at(4).toInt32(exec);
+    unsigned height = args.at(5).toInt32(exec);
+    
+    // The image parameter can be a <img> or <canvas> element.
+    JSValue value = args.at(6);
+    if (!value.isObject())
+        return throwError(exec, TypeError);
+    JSObject* o = asObject(value);
+    
+    bool flipY = (args.size() > 3) ? args.at(3).toBoolean(exec) : false;
+    bool premultiplyAlpha = (args.size() > 4) ? args.at(3).toBoolean(exec) : false;
+    
+    ExceptionCode ec = 0;
+    if (o->inherits(&JSHTMLImageElement::s_info)) {
+        HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, imgElt, flipY, premultiplyAlpha, ec);
+    } else if (o->inherits(&JSHTMLCanvasElement::s_info)) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
+        context->texSubImage2D(target, level, xoff, yoff, width, height, canvas, flipY, premultiplyAlpha, ec);
+    } else {
+        setDOMException(exec, TYPE_MISMATCH_ERR);
+    }
+    
+    return jsUndefined();    
+}
+
+template<typename T>
+void toArray(JSC::ExecState* exec, JSC::JSValue value, T*& array, int& size)
+{
+    array = 0;
+    
+    if (!value.isObject())
+        return;
+        
+    JSC::JSObject* object = asObject(value);
+    int length = object->get(exec, JSC::Identifier(exec, "length")).toInt32(exec);
+    void* tempValues;
+    if (!tryFastMalloc(length * sizeof(T)).getValue(tempValues))
+        return;
+    
+    T* values = static_cast<T*>(tempValues);
+    for (int i = 0; i < length; ++i) {
+        JSC::JSValue v = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        values[i] = static_cast<T>(v.toNumber(exec));
+    }
+
+    array = values;
+    size = length;
+}
+
+enum DataFunctionToCall {
+    f_uniform1v, f_uniform2v, f_uniform3v, f_uniform4v,
+    f_vertexAttrib1v, f_vertexAttrib2v, f_vertexAttrib3v, f_vertexAttrib4v
+};
+
+enum DataFunctionMatrixToCall {
+    f_uniformMatrix2fv, f_uniformMatrix3fv, f_uniformMatrix4fv
+};
+
+static JSC::JSValue dataFunctionf(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1fv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2fv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3fv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4fv(location, canvasArray.get()); break;
+            case f_vertexAttrib1v: context->vertexAttrib1fv(location, canvasArray.get()); break;
+            case f_vertexAttrib2v: context->vertexAttrib2fv(location, canvasArray.get()); break;
+            case f_vertexAttrib3v: context->vertexAttrib3fv(location, canvasArray.get()); break;
+            case f_vertexAttrib4v: context->vertexAttrib4fv(location, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1fv(location, array, size); break;
+        case f_uniform2v: context->uniform2fv(location, array, size); break;
+        case f_uniform3v: context->uniform3fv(location, array, size); break;
+        case f_uniform4v: context->uniform4fv(location, array, size); break;
+        case f_vertexAttrib1v: context->vertexAttrib1fv(location, array, size); break;
+        case f_vertexAttrib2v: context->vertexAttrib2fv(location, array, size); break;
+        case f_vertexAttrib3v: context->vertexAttrib3fv(location, array, size); break;
+        case f_vertexAttrib4v: context->vertexAttrib4fv(location, array, size); break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctioni(DataFunctionToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 2)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasIntArray> canvasArray = toCanvasIntArray(args.at(1));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniform1v: context->uniform1iv(location, canvasArray.get()); break;
+            case f_uniform2v: context->uniform2iv(location, canvasArray.get()); break;
+            case f_uniform3v: context->uniform3iv(location, canvasArray.get()); break;
+            case f_uniform4v: context->uniform4iv(location, canvasArray.get()); break;
+            default: break;
+        }
+        return jsUndefined();
+    }
+    
+    int* array;
+    int size;
+    toArray<int>(exec, args.at(1), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniform1v: context->uniform1iv(location, array, size); break;
+        case f_uniform2v: context->uniform2iv(location, array, size); break;
+        case f_uniform3v: context->uniform3iv(location, array, size); break;
+        case f_uniform4v: context->uniform4iv(location, array, size); break;
+        default: break;
+    }
+    return jsUndefined();
+}
+
+static JSC::JSValue dataFunctionMatrix(DataFunctionMatrixToCall f, JSC::ExecState* exec, const JSC::ArgList& args, CanvasRenderingContext3D* context)
+{
+    if (args.size() != 3)
+        return throwError(exec, SyntaxError);
+
+    long location = args.at(0).toInt32(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    bool transpose = args.at(1).toBoolean(exec);
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    RefPtr<CanvasFloatArray> canvasArray = toCanvasFloatArray(args.at(2));
+    if (exec->hadException())    
+        return jsUndefined();
+        
+    if (canvasArray) {
+        switch(f) {
+            case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, canvasArray.get()); break;
+            case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, canvasArray.get()); break;
+        }
+        return jsUndefined();
+    }
+    
+    float* array;
+    int size;
+    toArray<float>(exec, args.at(2), array, size);
+    
+    if (!array)
+        return throwError(exec, TypeError);
+
+    switch(f) {
+        case f_uniformMatrix2fv: context->uniformMatrix2fv(location, transpose, array, size); break;
+        case f_uniformMatrix3fv: context->uniformMatrix3fv(location, transpose, array, size); break;
+        case f_uniformMatrix4fv: context->uniformMatrix4fv(location, transpose, array, size); break;
+    }
+    return jsUndefined();
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform1iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform2iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform3iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniform4iv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctioni(f_uniform4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix2fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix3fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::uniformMatrix4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionMatrix(f_uniformMatrix4fv, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib1fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib1v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib2fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib2v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib3fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib3v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+JSC::JSValue JSCanvasRenderingContext3D::vertexAttrib4fv(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return dataFunctionf(f_vertexAttrib4v, exec, args, static_cast<CanvasRenderingContext3D*>(impl()));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
new file mode 100644
index 0000000..0cd2aa3
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCanvasRenderingContext.h"
+
+#include "CanvasRenderingContext2D.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "CanvasRenderingContext3D.h"
+#include "JSCanvasRenderingContext3D.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasRenderingContext* object)
+{
+    if (!object)
+        return jsUndefined();
+
+#if ENABLE(3D_CANVAS)
+    if (object->is3d())
+        return getDOMObjectWrapper<JSCanvasRenderingContext3D>(exec, globalObject, static_cast<CanvasRenderingContext3D*>(object));
+#endif
+    ASSERT(object->is2d());
+    return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, globalObject, static_cast<CanvasRenderingContext2D*>(object));
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
new file mode 100644
index 0000000..a885b7b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasShortArray.h"
+#include "JSCanvasArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasShortArrayConstructor::s_info = { "CanvasShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasShortArrayConstructor::JSCanvasShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasShortArrayConstructor* jsConstructor = static_cast<JSCanvasShortArrayConstructor*>(constructor);
+    RefPtr<CanvasShortArray> array = static_cast<CanvasShortArray*>(construct<CanvasShortArray, short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
new file mode 100644
index 0000000..df21825
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasShortArrayConstructor_h
+#define JSCanvasShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..21af0a6
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasShortArray.h"
+
+#include "CanvasShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<signed short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
new file mode 100644
index 0000000..5d0800e
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedByteArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedByteArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedByteArrayConstructor::s_info = { "CanvasUnsignedByteArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedByteArrayConstructor::JSCanvasUnsignedByteArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedByteArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedByteArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedByteArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedByteArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedByteArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedByteArray> array = static_cast<CanvasUnsignedByteArray*>(construct<CanvasUnsignedByteArray, unsigned char>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedByteArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedByteArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
new file mode 100644
index 0000000..9cfb721
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedByteArrayConstructor_h
+#define JSCanvasUnsignedByteArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedByteArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedByteArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedByteArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..f2b0c74
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedByteArray.h"
+
+#include "CanvasUnsignedByteArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedByteArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned char>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedByteArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedByteArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
new file mode 100644
index 0000000..5f145a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedIntArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedIntArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedIntArrayConstructor::s_info = { "CanvasUnsignedIntArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedIntArrayConstructor::JSCanvasUnsignedIntArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedIntArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedIntArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedIntArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedIntArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedIntArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedIntArray> array = static_cast<CanvasUnsignedIntArray*>(construct<CanvasUnsignedIntArray, unsigned int>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedIntArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedIntArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
new file mode 100644
index 0000000..6016159
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedIntArrayConstructor_h
+#define JSCanvasUnsignedIntArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedIntArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedIntArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedIntArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..95a80a7
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedIntArray.h"
+
+#include "CanvasUnsignedIntArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedIntArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned int>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedIntArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedIntArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
new file mode 100644
index 0000000..9735693
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+
+#include "Document.h"
+#include "CanvasUnsignedShortArray.h"
+#include "JSCanvasArrayBuffer.h"
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasUnsignedShortArray.h"
+#include <runtime/Error.h>
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSCanvasUnsignedShortArrayConstructor::s_info = { "CanvasUnsignedShortArrayConstructor", &JSCanvasArray::s_info, 0, 0 };
+
+JSCanvasUnsignedShortArrayConstructor::JSCanvasUnsignedShortArrayConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSCanvasUnsignedShortArrayConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSCanvasUnsignedShortArrayPrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructCanvasUnsignedShortArray(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    JSCanvasUnsignedShortArrayConstructor* jsConstructor = static_cast<JSCanvasUnsignedShortArrayConstructor*>(constructor);
+    RefPtr<CanvasUnsignedShortArray> array = static_cast<CanvasUnsignedShortArray*>(construct<CanvasUnsignedShortArray, unsigned short>(exec, args).get());
+    return asObject(toJS(exec, jsConstructor->globalObject(), array.get()));
+}
+
+JSC::ConstructType JSCanvasUnsignedShortArrayConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructCanvasUnsignedShortArray;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
new file mode 100644
index 0000000..23c197f
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSCanvasUnsignedShortArrayConstructor_h
+#define JSCanvasUnsignedShortArrayConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+    class JSCanvasUnsignedShortArrayConstructor : public DOMConstructorObject {
+    public:
+        JSCanvasUnsignedShortArrayConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+}
+
+#endif // JSCanvasUnsignedShortArrayConstructor_h
diff --git a/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..290cd4b
--- /dev/null
+++ b/WebCore/bindings/js/JSCanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "JSCanvasUnsignedShortArray.h"
+
+#include "CanvasUnsignedShortArray.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSCanvasUnsignedShortArray::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
+{
+    impl()->set(index, static_cast<unsigned short>(value.toInt32(exec)));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, JSDOMGlobalObject* globalObject, CanvasUnsignedShortArray* object)
+{
+    return getDOMObjectWrapper<JSCanvasUnsignedShortArray>(exec, globalObject, object);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.cpp b/WebCore/bindings/js/JSCustomPositionCallback.cpp
index ec2d8e3..07788a8 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -35,42 +35,20 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionCallback::JSCustomPositionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
-    JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
     RefPtr<JSCustomPositionCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), geoposition));
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.cpp
 
     globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
@@ -81,6 +59,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition)
     }
     
     Document::updateStyleForAllDocuments();
+=======
+    m_data.invokeCallback(args);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.cpp
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionCallback.h b/WebCore/bindings/js/JSCustomPositionCallback.h
index 9c8fe86..dff34fe 100644
--- a/WebCore/bindings/js/JSCustomPositionCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionCallback.h
@@ -26,31 +26,33 @@
 #ifndef JSCustomPositionCallback_h
 #define JSCustomPositionCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class Geoposition;
+class JSDOMGlobalObject;
 
 class JSCustomPositionCallback : public PositionCallback {
 public:
-    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionCallback(callback, globalObject));
+    }
     
+<<<<<<< HEAD:WebCore/bindings/js/JSCustomPositionCallback.h
     virtual void handleEvent(Geoposition*);
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSCustomPositionCallback.h
 private:
-    JSCustomPositionCallback(JSC::JSObject* callback, Frame*);
+    JSCustomPositionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    virtual void handleEvent(Geoposition*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index cda5738..bd64deb 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -35,51 +35,21 @@ namespace WebCore {
     
 using namespace JSC;
 
-JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomPositionErrorCallback::JSCustomPositionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(callback, globalObject)
 {
 }
 
 void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-    
-    if (!m_frame->script()->isEnabled())
-        return;
+    RefPtr<JSCustomPositionErrorCallback> protect(this);
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-    
     JSC::JSLock lock(SilenceAssertionsOnly);
-    
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-    
-    RefPtr<JSCustomPositionErrorCallback> protect(this);
-    
+    ExecState* exec = m_data.globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), positionError));
     
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-    
-    if (exec->hadException())
-        reportCurrentException(exec);
-    
-    Document::updateStyleForAllDocuments();
+    m_data.invokeCallback(args);
 }
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomPositionErrorCallback.h b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
index 9f143a2..59328ca 100644
--- a/WebCore/bindings/js/JSCustomPositionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomPositionErrorCallback.h
@@ -26,31 +26,26 @@
 #ifndef JSCustomPositionErrorCallback_h
 #define JSCustomPositionErrorCallback_h
 
+#include "JSCallbackData.h"
 #include "PositionErrorCallback.h"
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
     
-class Frame;
 class PositionError;
 
 class JSCustomPositionErrorCallback : public PositionErrorCallback {
 public:
-    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomPositionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomPositionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomPositionErrorCallback(callback, globalObject));
+    }
     
-    virtual void handleEvent(PositionError*);
-
 private:
-    JSCustomPositionErrorCallback(JSC::JSObject* callback, Frame*);
-
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCustomPositionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
+    virtual void handleEvent(PositionError*);
+    
+    JSCallbackData m_data;
 };
     
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index d0943de..1f6bd95 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,6 +28,7 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
@@ -35,60 +36,38 @@
 #include "JSSQLResultSet.h"
 #include "JSSQLTransaction.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementCallback::JSCustomSQLStatementCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
     
-void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+JSCustomSQLStatementCallback::~JSCustomSQLStatementCallback()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLResultSet* resultSet, bool& raisedException)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), resultSet));
-        
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-
-        raisedException = true;
-    }
 
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index c380670..259aecf 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -31,32 +31,29 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSCallbackData.h"
 #include "SQLStatementCallback.h"
-
-#include <runtime/JSObject.h>
-#include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
 class SQLResultSet;
 
 class JSCustomSQLStatementCallback : public SQLStatementCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLStatementCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLStatementCallback();
 
     virtual void handleEvent(SQLTransaction*, SQLResultSet*, bool& raisedException);
 
 private:
-    JSCustomSQLStatementCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 6c831ac..6178509 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -32,75 +32,51 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
 #include "JSSQLTransaction.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLStatementErrorCallback::JSCustomSQLStatementErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-        
-    if (!m_frame->script()->isEnabled())
-        return true;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
+JSCustomSQLStatementErrorCallback::~JSCustomSQLStatementErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_callback->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return true;
-        }
-    }
+bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLError* error)
+{
+    ASSERT(m_data);
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-        
-    JSValue result;
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
-    else
-        result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-            
+    
+    bool raisedException = false;
+    JSValue result = m_data->invokeCallback(args, &raisedException);
+    if (raisedException) {
         // The spec says:
         // "If the error callback returns false, then move on to the next statement..."
         // "Otherwise, the error callback did not return false, or there was no error callback"
         // Therefore an exception and returning true are the same thing - so, return true on an exception
         return true;
     }
-        
-    Document::updateStyleForAllDocuments();
-
     return result.toBoolean(exec);
 }
 
diff --git a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index e563393..ac4e45f 100644
--- a/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -31,32 +31,31 @@
 
 #if ENABLE(DATABASE)
 
+#include "JSDOMGlobalObject.h"
 #include "SQLStatementErrorCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
-    
-class Frame;
+
+class JSCallbackData;    
 class SQLError;
     
 class JSCustomSQLStatementErrorCallback : public SQLStatementErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLStatementErrorCallback(callback, frame)); }
-        
+    static PassRefPtr<JSCustomSQLStatementErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLStatementErrorCallback(callback, globalObject));
+    }
+
+    virtual ~JSCustomSQLStatementErrorCallback();
+
     virtual bool handleEvent(SQLTransaction*, SQLError*);
 
 private:
-    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLStatementErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 3d42f81..456022f 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -32,9 +32,11 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
+#include "JSDOMGlobalObject.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
 #include <wtf/MainThread.h>
 #include <wtf/RefCountedLeakCounter.h>
@@ -47,39 +49,17 @@ using namespace JSC;
 static WTF::RefCountedLeakCounter counter("JSCustomSQLTransactionCallback");
 #endif
 
-// We have to clean up the data on the main thread for two reasons:
-//
-//     1) Can't deref a Frame on a non-main thread.
-//     2) Unprotecting the JSObject on a non-main thread would register that thread
-//        for JavaScript garbage collection, which could unnecessarily slow things down.
-
-class JSCustomSQLTransactionCallback::Data {
-public:
-    Data(JSObject* callback, Frame* frame) : m_callback(callback), m_frame(frame) { }
-    JSObject* callback() { return m_callback; }
-    Frame* frame() { return m_frame.get(); }
-
-private:
-    ProtectedPtr<JSObject> m_callback;
-    RefPtr<Frame> m_frame;
-};
-
-JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, Frame* frame)
-    : m_data(new Data(callback, frame))
+JSCustomSQLTransactionCallback::JSCustomSQLTransactionCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 #ifndef NDEBUG
     counter.increment();
 #endif
 }
 
-void JSCustomSQLTransactionCallback::deleteData(void* context)
-{
-    delete static_cast<Data*>(context);
-}
-
 JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 {
-    callOnMainThread(deleteData, m_data);
+    callOnMainThread(JSCallbackData::deleteData, m_data);
 #ifndef NDEBUG
     m_data = 0;
     counter.decrement();
@@ -89,51 +69,14 @@ JSCustomSQLTransactionCallback::~JSCustomSQLTransactionCallback()
 void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bool& raisedException)
 {
     ASSERT(m_data);
-    ASSERT(m_data->callback());
-    ASSERT(m_data->frame());
 
-    if (!m_data->frame()->script()->isEnabled())
-        return;
-
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_data->frame()->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
-    CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
-    CallData callbackCallData;
-    CallType callbackCallType = CallTypeNone;
-
-    if (handleEventCallType == CallTypeNone) {
-        callbackCallType = m_data->callback()->getCallData(callbackCallData);
-        if (callbackCallType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-    }
-        
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), transaction));
-
-    globalObject->globalData()->timeoutChecker.start();
-    if (handleEventCallType != CallTypeNone)
-        call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
-    else
-        call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException()) {
-        reportCurrentException(exec);
-        
-        raisedException = true;
-    }
-        
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args, &raisedException);
 }
     
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 22c367c..f142e59 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -32,7 +32,6 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionCallback.h"
-
 #include <wtf/PassRefPtr.h>
 
 namespace JSC {
@@ -42,22 +41,24 @@ namespace JSC {
 namespace WebCore {
 
 class Frame;
+class JSCallbackData;
+class JSDOMGlobalObject;
 
 class JSCustomSQLTransactionCallback : public SQLTransactionCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionCallback(callback, globalObject));
+    }
 
     virtual ~JSCustomSQLTransactionCallback();
     
     virtual void handleEvent(SQLTransaction*, bool& raisedException);
 
 private:
-    JSCustomSQLTransactionCallback(JSC::JSObject* callback, Frame*);
-
-    static void deleteData(void*);
+    JSCustomSQLTransactionCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
 
-    class Data;
-    Data* m_data;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 2d41bb8..331e014 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -32,59 +32,40 @@
 #if ENABLE(DATABASE)
 
 #include "Frame.h"
-#include "ScriptController.h"
+#include "JSCallbackData.h"
 #include "JSSQLError.h"
+#include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
-    
-void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
-{
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-
-    if (!m_frame->script()->isEnabled())
-        return;
 
-    // FIXME: This is likely the wrong globalObject (for prototype chains at least)
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-
-    JSC::JSLock lock(SilenceAssertionsOnly);
+JSCustomSQLTransactionErrorCallback::~JSCustomSQLTransactionErrorCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
 
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+{
+    ASSERT(m_data);
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
 
+    JSC::JSLock lock(SilenceAssertionsOnly);
+    ExecState* exec = m_data->globalObject()->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, deprecatedGlobalObjectForPrototype(exec), error));
-
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-
-    if (exec->hadException())
-        reportCurrentException(exec);
-
-    Document::updateStyleForAllDocuments();
+    m_data->invokeCallback(args);
 }
 
 }
diff --git a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index be3df29..54bf33b 100644
--- a/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -32,31 +32,30 @@
 #if ENABLE(DATABASE)
 
 #include "SQLTransactionErrorCallback.h"
-
-#include <runtime/JSObject.h>
+#include "JSDOMGlobalObject.h"
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
-namespace JSC {
-    class JSObject;
-}
-
 namespace WebCore {
 
-class Frame;
+class JSCallbackData;
 class SQLError;
 
 class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
-    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
+    static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, globalObject));
+    }
+    
+    virtual ~JSCustomSQLTransactionErrorCallback();
     
     virtual void handleEvent(SQLError*);
 
 private:
-    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
+    JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, JSDOMGlobalObject* globalObject);
 
-    JSC::ProtectedPtr<JSC::JSObject> m_callback;
-    RefPtr<Frame> m_frame;
+    JSCallbackData* m_data;
 };
 
 }
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.cpp b/WebCore/bindings/js/JSCustomVoidCallback.cpp
index b4e525b..0edd66f 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -30,70 +30,38 @@
 #include "JSCustomVoidCallback.h"
 
 #include "Frame.h"
+#include "JSCallbackData.h"
 #include "JSDOMWindowCustom.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
     
 using namespace JSC;
     
-JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, Frame* frame)
-    : m_callback(callback)
-    , m_frame(frame)
+JSCustomVoidCallback::JSCustomVoidCallback(JSObject* callback, JSDOMGlobalObject* globalObject)
+    : m_data(new JSCallbackData(callback, globalObject))
 {
 }
+
+JSCustomVoidCallback::~JSCustomVoidCallback()
+{
+    callOnMainThread(JSCallbackData::deleteData, m_data);
+#ifndef NDEBUG
+    m_data = 0;
+#endif
+}
     
 void JSCustomVoidCallback::handleEvent()
 {
-    ASSERT(m_callback);
-    ASSERT(m_frame);
-       
-    if (!m_frame->script()->isEnabled())
-        return;
-        
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
-        
-    JSC::JSLock lock(SilenceAssertionsOnly);
-        
-    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
-    CallData callData;
-    CallType callType = function.getCallData(callData);
-    if (callType == CallTypeNone) {
-        callType = m_callback->getCallData(callData);
-        if (callType == CallTypeNone) {
-            // FIXME: Should an exception be thrown here?
-            return;
-        }
-        function = m_callback;
-    }
-        
+    ASSERT(m_data);
+
     RefPtr<JSCustomVoidCallback> protect(this);
         
+    JSC::JSLock lock(SilenceAssertionsOnly);
     MarkedArgumentBuffer args;
-    
-    globalObject->globalData()->timeoutChecker.start();
-    call(exec, function, callType, callData, m_callback, args);
-    globalObject->globalData()->timeoutChecker.stop();
-        
-    if (exec->hadException())
-        reportCurrentException(exec);
-        
-    Document::updateStyleForAllDocuments();
-}
- 
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
-{
-    JSObject* object = value.getObject();
-    if (!object)
-        return 0;
-    
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return 0;
-    
-    return JSCustomVoidCallback::create(object, frame);
+    m_data->invokeCallback(args);
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSCustomVoidCallback.h b/WebCore/bindings/js/JSCustomVoidCallback.h
index 9cd7c34..4b8d7ea 100644
--- a/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -29,33 +29,31 @@
 #ifndef JSCustomVoidCallback_h
 #define JSCustomVoidCallback_h
 
+#include "JSDOMGlobalObject.h"
 #include "VoidCallback.h"
-
-#include <runtime/JSObject.h>
 #include <runtime/Protect.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
+
+class JSCallbackData;
+
+class JSCustomVoidCallback : public VoidCallback {
+public: 
+    static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, JSDOMGlobalObject* globalObject)
+    {
+        return adoptRef(new JSCustomVoidCallback(callback, globalObject));
+    }
     
-    class Frame;
+    virtual ~JSCustomVoidCallback();
     
-    class JSCustomVoidCallback : public VoidCallback {
-    public: 
-        static PassRefPtr<JSCustomVoidCallback> create(JSC::JSObject* callback, Frame* frame)
-        {
-            return adoptRef(new JSCustomVoidCallback(callback, frame));
-        }
-        
-        virtual void handleEvent();
-        
-    private:
-        JSCustomVoidCallback(JSC::JSObject* callback, Frame*);
-
-        JSC::ProtectedPtr<JSC::JSObject> m_callback;
-        RefPtr<Frame> m_frame;
-    };
-
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
+    virtual void handleEvent();
+    
+private:
+    JSCustomVoidCallback(JSC::JSObject* callback, JSDOMGlobalObject*);
+
+    JSCallbackData* m_data;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 4476be5..da4a53a 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -49,13 +49,13 @@ PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecSta
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
-    
-    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()));
+
+    return adoptRef(new JSCustomXPathNSResolver(resolverObject, asJSDOMWindow(exec->dynamicGlobalObject())));
 }
 
-JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, Frame* frame)
+JSCustomXPathNSResolver::JSCustomXPathNSResolver(JSObject* customResolver, JSDOMWindow* globalObject)
     : m_customResolver(customResolver)
-    , m_frame(frame)
+    , m_globalObject(globalObject)
 {
 }
 
@@ -67,15 +67,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 {
     ASSERT(m_customResolver);
 
-    if (!m_frame)
-        return String();
-    if (!m_frame->script()->isEnabled())
-        return String();
-
     JSLock lock(SilenceAssertionsOnly);
 
-    JSGlobalObject* globalObject = m_frame->script()->globalObject();
-    ExecState* exec = globalObject->globalExec();
+    ExecState* exec = m_globalObject->globalExec();
         
     JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
@@ -84,7 +78,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Pass actual line number and source URL.
-            m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
+            m_globalObject->impl()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "XPathNSResolver does not have a lookupNamespaceURI method.", 0, String());
             return String();
         }
         function = m_customResolver;
@@ -95,9 +89,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->globalData()->timeoutChecker.start();
+    m_globalObject->globalData()->timeoutChecker.start();
     JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    m_globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
diff --git a/WebCore/bindings/js/JSCustomXPathNSResolver.h b/WebCore/bindings/js/JSCustomXPathNSResolver.h
index 44c44f9..7d66494 100644
--- a/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -41,6 +41,7 @@ namespace JSC {
 namespace WebCore {
 
     class Frame;
+    class JSDOMWindow;
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
@@ -51,10 +52,11 @@ namespace WebCore {
         virtual String lookupNamespaceURI(const String& prefix);
 
     private:
-        JSCustomXPathNSResolver(JSC::JSObject*, Frame*);
+        JSCustomXPathNSResolver(JSC::JSObject*, JSDOMWindow*);
 
-        JSC::JSObject* m_customResolver; // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the object.
-        RefPtr<Frame> m_frame;
+        // JSCustomXPathNSResolvers are always temporary, thus no need to GC protect the objects.
+        JSC::JSObject* m_customResolver;
+        JSDOMWindow* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 109308c..49ef5e3 100644
--- a/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -42,28 +42,6 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSDOMApplicationCache::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, m_impl->onchecking());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onnoupdate());
-    markIfNotNull(markStack, m_impl->ondownloading());
-    markIfNotNull(markStack, m_impl->onprogress());
-    markIfNotNull(markStack, m_impl->onupdateready());
-    markIfNotNull(markStack, m_impl->oncached());
-    markIfNotNull(markStack, m_impl->onobsolete());
-
-    typedef DOMApplicationCache::EventListenersMap EventListenersMap;
-    typedef DOMApplicationCache::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
-}
-
 #if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
 
 JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
@@ -112,10 +90,12 @@ JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -124,10 +104,12 @@ JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgLis
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 566b986..515c088 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -28,6 +28,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLAudioElement.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLScriptElement.h"
 #include "HTMLNames.h"
@@ -42,6 +43,8 @@
 #include "RangeException.h"
 #include "ScriptController.h"
 #include "XMLHttpRequestException.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 #include <wtf/StdLibExtras.h>
 
@@ -264,18 +267,48 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
     Node* node = jsNode->impl();
 
     if (node->inDocument()) {
-        // 1. If a node is in the document, and its wrapper has custom properties,
+        // If a node is in the document, and its wrapper has custom properties,
         // the wrapper is observable because future access to the node through the
         // DOM must reflect those properties.
         if (jsNode->hasCustomProperties())
             return true;
 
-        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // If a node is in the document, and has event listeners, its wrapper is
         // observable because its wrapper is responsible for marking those event listeners.
-        if (node->eventListeners().size())
+        if (node->hasEventListeners())
             return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+
+        // If a node owns another object with a wrapper with custom properties,
+        // the wrapper must be treated as observable, because future access to
+        // those objects through the DOM must reflect those properties.
+        // FIXME: It would be better if this logic could be in the node next to
+        // the custom markChildren functions rather than here.
+        if (node->isElementNode()) {
+            if (NamedNodeMap* attributes = static_cast<Element*>(node)->attributeMap()) {
+                if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), attributes)) {
+                    if (wrapper->hasCustomProperties())
+                        return true;
+                }
+            }
+            if (node->isStyledElement()) {
+                if (CSSMutableStyleDeclaration* style = static_cast<StyledElement*>(node)->inlineStyleDecl()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), style)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+            if (static_cast<Element*>(node)->hasTagName(canvasTag)) {
+                if (CanvasRenderingContext* context = static_cast<HTMLCanvasElement*>(node)->renderingContext()) {
+                    if (DOMObject* wrapper = getCachedDOMObjectWrapper(*jsNode->globalObject()->globalData(), context)) {
+                        if (wrapper->hasCustomProperties())
+                            return true;
+                    }
+                }
+            }
+        }
     } else {
-        // 3. If a wrapper is the last reference to an image or script element
+        // If a wrapper is the last reference to an image or script element
         // that is loading but not in the document, the wrapper is observable
         // because it is the only thing keeping the image element alive, and if
         // the image element is destroyed, its load event will not fire.
@@ -290,6 +323,11 @@ static inline bool isObservableThroughDOM(JSNode* jsNode)
 #endif
     }
 
+    // If a node is firing event listeners, its wrapper is observable because
+    // its wrapper is responsible for marking those event listeners.
+    if (node->isFiringEventListeners())
+        return true;
+
     return false;
 }
 
@@ -348,6 +386,9 @@ void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocum
 
 void markDOMObjectWrapper(MarkStack& markStack, JSGlobalData& globalData, void* object)
 {
+    // FIXME: This could be changed to only mark wrappers that are "observable"
+    // as markDOMNodesForDocument does, allowing us to collect more wrappers,
+    // but doing this correctly would be challenging.
     if (!object)
         return;
     DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, object);
@@ -559,7 +600,7 @@ Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInf
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
@@ -571,7 +612,7 @@ Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
     return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(ExecState* exec, NonNullPassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
     return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
 }
@@ -589,4 +630,33 @@ void cacheDOMConstructor(ExecState* exec, const ClassInfo* classInfo, JSObject*
     constructors.set(classInfo, constructor);
 }
 
+JSC::JSObject* toJSSequence(ExecState* exec, JSValue value, unsigned& length)
+{
+    JSObject* object = value.getObject();
+    if (!object) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+    JSValue lengthValue = object->get(exec, exec->propertyNames().length);
+    if (exec->hadException())
+        return 0;
+
+    if (lengthValue.isUndefinedOrNull()) {
+        throwError(exec, TypeError);
+        return 0;
+    }
+
+    length = lengthValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return object;
+}
+
+bool DOMObject::defineOwnProperty(ExecState* exec, const Identifier&, PropertyDescriptor&, bool)
+{
+    throwError(exec, TypeError, "defineProperty is not supported on DOM Objects");
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index 64cfc3a..9c0ad7e 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -26,7 +26,6 @@
 #include "Document.h" // For DOMConstructorWithDocument
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
-#include <runtime/JSFunction.h>
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -51,17 +50,19 @@ namespace WebCore {
     // Base class for all objects in this binding except Window.
     class DOMObject : public JSC::JSObject {
     protected:
-        explicit DOMObject(PassRefPtr<JSC::Structure> structure) 
+        explicit DOMObject(NonNullPassRefPtr<JSC::Structure> structure) 
             : JSObject(structure)
         {
         }
 
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, bool);
+
 #ifndef NDEBUG
         virtual ~DOMObject();
 #endif
     };
 
-    // FIXME: This class should colapse into DOMObject once all DOMObjects are
+    // FIXME: This class should collapse into DOMObject once all DOMObjects are
     // updated to store a globalObject pointer.
     class DOMObjectWithGlobalPointer : public DOMObject {
     public:
@@ -73,8 +74,13 @@ namespace WebCore {
             return m_globalObject->scriptExecutionContext();
         }
 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+        {
+            return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::HasStandardGetOwnPropertySlot));
+        }
+
     protected:
-        DOMObjectWithGlobalPointer(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMObjectWithGlobalPointer(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObject(structure)
             , m_globalObject(globalObject)
         {
@@ -83,7 +89,7 @@ namespace WebCore {
             // needing to reach through the frame to get to the Document*.  See bug 27640.
             // ASSERT(globalObject->scriptExecutionContext());
         }
-        virtual ~DOMObjectWithGlobalPointer() {}
+        virtual ~DOMObjectWithGlobalPointer() { }
 
         void markChildren(JSC::MarkStack& markStack)
         {
@@ -104,7 +110,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorObject(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorObject(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMObjectWithGlobalPointer(structure, globalObject)
         {
         }
@@ -120,7 +126,7 @@ namespace WebCore {
         }
 
     protected:
-        DOMConstructorWithDocument(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
+        DOMConstructorWithDocument(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject)
             : DOMConstructorObject(structure, globalObject)
         {
             ASSERT(globalObject->scriptExecutionContext()->isDocument());
@@ -141,9 +147,9 @@ namespace WebCore {
     void markDOMObjectWrapper(JSC::MarkStack&, JSC::JSGlobalData& globalData, void* object);
 
     JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
-    JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSC::ExecState*, NonNullPassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
@@ -277,6 +283,9 @@ namespace WebCore {
         return toJS(exec, globalObject, ptr.get());
     }
 
+    // Validates that the passed object is a sequence type per section 4.1.13 of the WebIDL spec.
+    JSC::JSObject* toJSSequence(JSC::ExecState*, JSC::JSValue, unsigned&);
+
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
     // Helpers for Window, History, and Location classes to implement cross-domain policy.
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.cpp b/WebCore/bindings/js/JSDOMGlobalObject.cpp
index 68a1db9..372684c 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -40,24 +40,11 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData()
-    : evt(0)
-{
-}
-
-JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
+JSDOMGlobalObject::JSDOMGlobalObject(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject::JSDOMGlobalObjectData* data, JSObject* thisValue)
     : JSGlobalObject(structure, data, thisValue)
 {
 }
 
-JSDOMGlobalObject::~JSDOMGlobalObject()
-{
-    JSListenersMap::iterator it = d()->jsEventListeners.begin();
-    JSListenersMap::iterator end = d()->jsEventListeners.end();
-    for (; it != end; ++it)
-        it->second->clearGlobalObject();
-}
-
 void JSDOMGlobalObject::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
@@ -71,37 +58,12 @@ void JSDOMGlobalObject::markChildren(MarkStack& markStack)
         markStack.append(it2->second);
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
-{
-    if (!val.isObject())
-        return 0;
-
-    return d()->jsEventListeners.get(asObject(val));
-}
-
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
-{
-    if (JSEventListener* listener = findJSEventListener(val))
-        return listener;
-
-    if (!val.isObject())
-        return 0;
-
-    // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, false).get();
-}
-
 PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
     if (!val.isObject())
         return 0;
 
-    return JSEventListener::create(asObject(val), this, true).get();
-}
-
-JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
-{
-    return d()->jsEventListeners;
+    return JSEventListener::create(asObject(val), true).get();
 }
 
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
@@ -114,6 +76,11 @@ Event* JSDOMGlobalObject::currentEvent() const
     return d()->evt;
 }
 
+void JSDOMGlobalObject::destroyJSDOMGlobalObjectData(void* jsDOMGlobalObjectData)
+{
+    delete static_cast<JSDOMGlobalObjectData*>(jsDOMGlobalObjectData);
+}
+
 JSDOMGlobalObject* toJSDOMGlobalObject(Document* document)
 {
     return toJSDOMWindow(document->frame());
diff --git a/WebCore/bindings/js/JSDOMGlobalObject.h b/WebCore/bindings/js/JSDOMGlobalObject.h
index 855691c..ce26857 100644
--- a/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -45,8 +45,7 @@ namespace WebCore {
     protected:
         struct JSDOMGlobalObjectData;
 
-        JSDOMGlobalObject(PassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
-        virtual ~JSDOMGlobalObject();
+        JSDOMGlobalObject(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObjectData*, JSC::JSObject* thisValue);
 
     public:
         JSDOMStructureMap& structures() { return d()->structures; }
@@ -54,20 +53,10 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValue);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
-
-        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
-        // These listeners cannot be removed through the removeEventListener API.
+        // Creates a JS EventListener for an "onXXX" event attribute. These
+        // listeners cannot be removed through the removeEventListener API.
         PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
-
-        JSListenersMap& jsEventListeners();
-
         // Make binding code generation easier.
         JSDOMGlobalObject* globalObject() { return this; }
 
@@ -78,17 +67,27 @@ namespace WebCore {
 
     protected:
         struct JSDOMGlobalObjectData : public JSC::JSGlobalObject::JSGlobalObjectData {
-            JSDOMGlobalObjectData();
+            JSDOMGlobalObjectData()
+                : JSGlobalObjectData(destroyJSDOMGlobalObjectData)
+                , evt(0)
+            {
+            }
+
+            JSDOMGlobalObjectData(Destructor destructor)
+                : JSGlobalObjectData(destructor)
+                , evt(0)
+            {
+            }
 
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::JSListenersMap jsEventListeners;
-
             Event* evt;
         };
 
     private:
+        static void destroyJSDOMGlobalObjectData(void*);
+
         JSDOMGlobalObjectData* d() const { return static_cast<JSDOMGlobalObjectData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index df6068a..a04ef89 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -42,13 +42,7 @@ namespace WebCore {
 
 const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
-JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
-    : impl(window)
-    , shell(shell)
-{
-}
-
-JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+JSDOMWindowBase::JSDOMWindowBase(NonNullPassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
     GlobalPropertyInfo staticGlobals[] = {
@@ -113,7 +107,7 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
-#if !ENABLE(JAVASCRIPT_DEBUGGER)
+#if !ENABLE(JAVASCRIPT_DEBUGGER) || !ENABLE(INSPECTOR)
     return false;
 #else
     Frame* frame = impl()->frame();
@@ -167,11 +161,19 @@ JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
     if (!globalData) {
         globalData = JSGlobalData::createLeaked().releaseRef();
         globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
+#ifndef NDEBUG
+        globalData->mainThreadOnly = true;
+#endif
     }
 
     return globalData;
 }
 
+void JSDOMWindowBase::destroyJSDOMWindowBaseData(void* jsDOMWindowBaseData)
+{
+    delete static_cast<JSDOMWindowBaseData*>(jsDOMWindowBaseData);
+}
+
 // JSDOMGlobalObject* is ignored, accesing a window in any context will
 // use that DOMWindow's prototype chain.
 JSValue toJS(ExecState* exec, JSDOMGlobalObject*, DOMWindow* domWindow)
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index 84cc81f..52c3c1d 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -43,7 +43,7 @@ namespace WebCore {
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     protected:
-        JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+        JSDOMWindowBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
         void updateDocument();
@@ -76,7 +76,12 @@ namespace WebCore {
 
     private:
         struct JSDOMWindowBaseData : public JSDOMGlobalObjectData {
-            JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+            JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
+                : JSDOMGlobalObjectData(destroyJSDOMWindowBaseData)
+                , impl(window)
+                , shell(shell)
+            {
+            }
 
             RefPtr<DOMWindow> impl;
             JSDOMWindowShell* shell;
@@ -85,6 +90,8 @@ namespace WebCore {
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
+        static void destroyJSDOMWindowBaseData(void*);
+
         JSDOMWindowBaseData* d() const { return static_cast<JSDOMWindowBaseData*>(JSC::JSVariableObject::d); }
     };
 
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 9798972..47339d4 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -38,29 +38,53 @@
 #include "JSDOMWindowShell.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSEventSourceConstructor.h"
 #include "JSHTMLCollection.h"
 #include "JSHistory.h"
 #include "JSImageConstructor.h"
 #include "JSLocation.h"
 #include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSMessagePortCustom.h"
 #include "JSOptionConstructor.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "JSSharedWorkerConstructor.h"
+#endif
+
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasArrayBufferConstructor.h"
+#include "JSCanvasByteArrayConstructor.h"
+#include "JSCanvasUnsignedByteArrayConstructor.h"
+#include "JSCanvasIntArrayConstructor.h"
+#include "JSCanvasUnsignedIntArrayConstructor.h"
+#include "JSCanvasShortArrayConstructor.h"
+#include "JSCanvasUnsignedShortArrayConstructor.h"
+#include "JSCanvasFloatArrayConstructor.h"
+#endif
 #include "JSWebKitCSSMatrixConstructor.h"
 #include "JSWebKitPointConstructor.h"
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocketConstructor.h"
+#endif
 #include "JSWorkerConstructor.h"
 #include "JSXMLHttpRequestConstructor.h"
 #include "JSXSLTProcessorConstructor.h"
 #include "Location.h"
 #include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PlatformScreen.h"
 #include "RegisteredEventListener.h"
 #include "ScheduledAction.h"
 #include "ScriptController.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "SharedWorkerRepository.h"
 #include "WindowFeatures.h"
+#include <runtime/Error.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -72,7 +96,7 @@ void JSDOMWindow::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markEventListeners(markStack, impl()->eventListeners());
+    impl()->markEventListeners(markStack);
 
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
@@ -271,6 +295,150 @@ bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindow::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+    
+    const HashEntry* entry;
+    
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            descriptor.setDescriptor(jsBoolean(true), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            PropertySlot slot;
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+        descriptor.setUndefined();
+        return true;
+    }
+
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+    if (allowsAccess && JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    PropertySlot slot;
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    descriptor.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                PropertySlot slot;
+                slot.setCustom(this, objectToStringFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+                return true;
+            }
+        }
+    }
+    
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        slot.setCustom(this, entry->propertyGetter());
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+        return true;
+    }
+    
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        PropertySlot slot;
+        slot.setCustom(this, childFrameGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertyDescriptor(exec, propertyName, descriptor)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                descriptor.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        PropertySlot slot;
+        slot.setCustomIndex(this, i, indexGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            PropertySlot slot;
+            slot.setCustom(this, namedItemGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!impl()->frame())
@@ -306,6 +474,14 @@ void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
     Base::getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindow::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    // Only allow the window to enumerated by frames in the same origin.
+    if (!allowsAccessFrom(exec))
+        return;
+    Base::getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     // Only allow getting property attributes properties by frames in the same origin.
@@ -314,7 +490,7 @@ bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& prope
     return Base::getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -324,15 +500,23 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     if (propertyName == "location")
         return;
 
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
     // Only allow defining setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
-    Base::defineSetter(exec, propertyName, setterFunction);
+    Base::defineSetter(exec, propertyName, setterFunction, attributes);
+}
+
+bool JSDOMWindow::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    // Only allow defining properties in this way by frames in the same origin, as it allows setters to be introduced.
+    if (!allowsAccessFrom(exec))
+        return false;
+    return Base::defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
 }
 
 JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
@@ -398,16 +582,16 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
@@ -424,6 +608,13 @@ JSValue JSDOMWindow::event(ExecState* exec) const
     return toJS(exec, event);
 }
 
+#if ENABLE(EVENTSOURCE)
+JSValue JSDOMWindow::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSDOMWindow::image(ExecState* exec) const
 {
     return getDOMConstructor<JSImageConstructor>(exec, this);
@@ -453,6 +644,48 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
+#if ENABLE(3D_CANVAS)
+JSValue JSDOMWindow::canvasArrayBuffer(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasArrayBufferConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedByteArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedByteArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedIntArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedIntArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasUnsignedShortArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasUnsignedShortArrayConstructor>(exec, this);
+}
+ 
+JSValue JSDOMWindow::canvasFloatArray(ExecState* exec) const
+{
+    return getDOMConstructor<JSCanvasFloatArrayConstructor>(exec, this);
+}
+#endif
+ 
 JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -482,7 +715,24 @@ JSValue JSDOMWindow::worker(ExecState* exec) const
 #if ENABLE(SHARED_WORKERS)
 JSValue JSDOMWindow::sharedWorker(ExecState* exec) const
 {
-    return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    if (SharedWorkerRepository::isAvailable())
+        return getDOMConstructor<JSSharedWorkerConstructor>(exec, this);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+JSValue JSDOMWindow::webSocket(ExecState* exec) const
+{
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Settings* settings = frame->settings();
+    if (!settings)
+        return jsUndefined();
+    if (!settings->experimentalWebSocketsEnabled())
+        return jsUndefined();
+    return getDOMConstructor<JSWebSocketConstructor>(exec, this);
 }
 #endif
 
@@ -521,7 +771,7 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
 
@@ -529,13 +779,13 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
         newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
         bool userGesture = processingUserGesture(exec);
 
         if (created)
             newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
     }
 
     return newFrame;
@@ -543,6 +793,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
 
 JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -555,9 +809,6 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
     Page* page = frame->page();
 
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
-
     // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
     // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
     if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
@@ -575,13 +826,13 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
         topOrParent = true;
     }
     if (topOrParent) {
-        if (!shouldAllowNavigation(exec, frame))
-            return jsUndefined();
-
         String completedURL;
         if (!urlString.isEmpty())
             completedURL = completeURL(exec, urlString).string();
 
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
         const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
             bool userGesture = processingUserGesture(exec);
@@ -591,13 +842,12 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
         }
         return toJS(exec, frame->domWindow());
     }
 
     // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
     FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
                          windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
     DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
@@ -617,6 +867,10 @@ JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 
 JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
@@ -630,10 +884,6 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
         return jsUndefined();
 
-    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
-    JSValue dialogArgs = args.at(1);
-    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
-
     HashMap<String, String> features;
     DOMWindow::parseModalDialogFeatures(featureArgs, features);
 
@@ -687,7 +937,15 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
     JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
     dialogFrame->page()->chrome()->runModal();
 
-    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
+    Identifier returnValue(exec, "returnValue");
+    if (dialogWindow->allowsAccessFromNoErrorMessage(exec)) {
+        PropertySlot slot;
+        // This is safe, we have already performed the origin security check and we are
+        // not interested in any of the DOM properties of the window.
+        if (dialogWindow->JSGlobalObject::getOwnPropertySlot(exec, returnValue, slot))
+            return slot.getValue(exec, returnValue);
+    }
+    return jsUndefined();
 }
 
 JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
@@ -695,19 +953,23 @@ JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
     DOMWindow* window = impl();
 
     DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
-    String message = args.at(0).toString(exec);
+    PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
 
     if (exec->hadException())
         return jsUndefined();
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+    MessagePortArray messagePorts;
+    if (args.size() > 2)
+        fillMessagePortArray(exec, args.at(1), messagePorts);
+    if (exec->hadException())
+        return jsUndefined();
 
     String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
     if (exec->hadException())
         return jsUndefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    window->postMessage(message, &messagePorts, targetOrigin, source, ec);
     setDOMException(exec, ec);
 
     return jsUndefined();
@@ -788,9 +1050,11 @@ JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -800,9 +1064,11 @@ JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(1)))
-        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSDOMWindowShell.cpp b/WebCore/bindings/js/JSDOMWindowShell.cpp
index efffd42..3c3ff4c 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -88,6 +88,11 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool JSDOMWindowShell::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return m_window->getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
@@ -98,6 +103,11 @@ void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& prop
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
 
+bool JSDOMWindowShell::defineOwnProperty(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    return m_window->defineOwnProperty(exec, propertyName, descriptor, shouldThrow);
+}
+
 bool JSDOMWindowShell::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->deleteProperty(exec, propertyName);
@@ -108,19 +118,24 @@ void JSDOMWindowShell::getPropertyNames(ExecState* exec, PropertyNameArray& prop
     m_window->getPropertyNames(exec, propertyNames);
 }
 
+void JSDOMWindowShell::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_window->getOwnPropertyNames(exec, propertyNames);
+}
+
 bool JSDOMWindowShell::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     return m_window->getPropertyAttributes(exec, propertyName, attributes);
 }
 
-void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSDOMWindowShell::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
-    m_window->defineGetter(exec, propertyName, getterFunction);
+    m_window->defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
-void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction, unsigned attributes)
 {
-    m_window->defineSetter(exec, propertyName, setterFunction);
+    m_window->defineSetter(exec, propertyName, setterFunction, attributes);
 }
 
 JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
diff --git a/WebCore/bindings/js/JSDOMWindowShell.h b/WebCore/bindings/js/JSDOMWindowShell.h
index 0506283..23af340 100644
--- a/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/WebCore/bindings/js/JSDOMWindowShell.h
@@ -67,13 +67,16 @@ namespace WebCore {
         virtual void markChildren(JSC::MarkStack&);
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
         virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
-        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
-        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
+        virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);
+        virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
         virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
diff --git a/WebCore/bindings/js/JSDatabaseCustom.cpp b/WebCore/bindings/js/JSDatabaseCustom.cpp
index af3b066..0932cca 100644
--- a/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -52,17 +52,13 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     String oldVersion = args.at(0).toString(exec);
     String newVersion = args.at(1).toString(exec);
 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
     JSObject* object;
     if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
     
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject())));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     if (!args.at(3).isNull()) {
@@ -71,24 +67,25 @@ JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<VoidCallback> successCallback;
     if (!args.at(4).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(4));
-        if (!successCallback) {
+        if (!(object = args.at(4).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
-    
+
     m_impl->changeVersion(oldVersion, newVersion, callback.release(), errorCallback.release(), successCallback.release());
     
     return jsUndefined();
 }
 
-JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+static JSValue createTransaction(ExecState* exec, const ArgList& args, Database* database, JSDOMGlobalObject* globalObject, bool readOnly)
 {
     JSObject* object;
     
@@ -96,12 +93,8 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
- 
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    
-    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
+     
+    RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, globalObject));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
     if (args.size() > 1 && !args.at(1).isNull()) {
@@ -110,22 +103,33 @@ JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
 
-        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLTransactionErrorCallback::create(object, globalObject);
     }
 
     RefPtr<VoidCallback> successCallback;
     if (args.size() > 2 && !args.at(2).isNull()) {
-        successCallback = toVoidCallback(exec, args.at(2));
-        if (!successCallback) {
+        if (!(object = args.at(2).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
+
+        successCallback = JSCustomVoidCallback::create(object, globalObject);
     }
     
-    m_impl->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return jsUndefined();
 }
+
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), false);
+}
     
+JSValue JSDatabase::readTransaction(ExecState* exec, const ArgList& args)
+{
+    return createTransaction(exec, args, m_impl.get(), static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()), true);
+}
+
 }
+
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
index 657f9b3..fbee5ef 100644
--- a/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSDedicatedWorkerContextCustom.cpp
@@ -35,15 +35,16 @@
 
 #include "JSDedicatedWorkerContext.h"
 
+#include "JSDOMBinding.h"
+#include "JSMessagePortCustom.h"
+
 using namespace JSC;
 
 namespace WebCore {
 
-void JSDedicatedWorkerContext::markChildren(MarkStack& markStack)
+JSC::JSValue JSDedicatedWorkerContext::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
 {
-    Base::markChildren(markStack);
-
-    markIfNotNull(markStack, impl()->onmessage());
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
new file mode 100644
index 0000000..493d7bd
--- /dev/null
+++ b/WebCore/bindings/js/JSDesktopNotificationsCustom.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Document.h"
+#include "JSCustomVoidCallback.h"
+#include "JSEventListener.h"
+#include "JSNotification.h"
+#include "JSNotificationCenter.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSNotificationCenter::requestPermission(ExecState* exec, const ArgList& args)
+{
+    // Permission request is only valid from page context.
+    ScriptExecutionContext* context = impl()->context();
+    if (context->isWorkerContext())
+        return throwError(exec, SyntaxError);
+
+    if (!args.at(0).isObject())
+        return throwError(exec, TypeError);
+
+    PassRefPtr<JSCustomVoidCallback> callback = JSCustomVoidCallback::create(args.at(0).getObject(), static_cast<Document*>(context)->frame());
+
+    impl()->requestPermission(callback);
+    return jsUndefined();
+}
+
+JSValue JSNotification::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener)), globalObject, false), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSNotification::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), globalObject, false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+
+} // namespace
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index 39a1fc5..d7f8725 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -24,6 +24,10 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
@@ -35,6 +39,8 @@
 #include "SVGDocument.h"
 #endif
 
+#include <wtf/GetPtr.h>
+
 using namespace JSC;
 
 namespace WebCore {
@@ -42,8 +48,14 @@ namespace WebCore {
 void JSDocument::markChildren(MarkStack& markStack)
 {
     JSNode::markChildren(markStack);
-    markDOMNodesForDocument(markStack, impl());
-    markActiveObjectsForContext(markStack, *Heap::heap(this)->globalData(), impl());
+
+    Document* document = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMNodesForDocument(markStack, document);
+    markActiveObjectsForContext(markStack, globalData, document);
+    markDOMObjectWrapper(markStack, globalData, document->implementation());
+    markDOMObjectWrapper(markStack, globalData, document->styleSheets());
 }
 
 JSValue JSDocument::location(ExecState* exec) const
@@ -76,7 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index 47793d0..fb64ff2 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,15 +51,27 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+void JSElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    Element* element = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, element->attributeMap());
+    if (element->isStyledElement())
+        markDOMObjectWrapper(markStack, globalData, static_cast<StyledElement*>(element)->inlineStyleDecl());
+}
+
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
     if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
-        HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
-        if (!checkNodeSecurity(exec, frame->contentDocument()))
+        Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
-} 
+}
 
 JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSEventCustom.cpp b/WebCore/bindings/js/JSEventCustom.cpp
index 804c529..c64ddc9 100644
--- a/WebCore/bindings/js/JSEventCustom.cpp
+++ b/WebCore/bindings/js/JSEventCustom.cpp
@@ -38,6 +38,7 @@
 #include "JSMouseEvent.h"
 #include "JSMutationEvent.h"
 #include "JSOverflowEvent.h"
+#include "JSPageTransitionEvent.h"
 #include "JSProgressEvent.h"
 #include "JSTextEvent.h"
 #include "JSUIEvent.h"
@@ -51,6 +52,7 @@
 #include "MouseEvent.h"
 #include "MutationEvent.h"
 #include "OverflowEvent.h"
+#include "PageTransitionEvent.h"
 #include "ProgressEvent.h"
 #include "TextEvent.h"
 #include "UIEvent.h"
@@ -120,6 +122,8 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Event* event)
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, OverflowEvent, event);
     else if (event->isMessageEvent())
         wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, MessageEvent, event);
+    else if (event->isPageTransitionEvent())
+        wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, PageTransitionEvent, event);
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, globalObject, XMLHttpRequestProgressEvent, event);
diff --git a/WebCore/bindings/js/JSEventListener.cpp b/WebCore/bindings/js/JSEventListener.cpp
index 42e0281..4f273fe 100644
--- a/WebCore/bindings/js/JSEventListener.cpp
+++ b/WebCore/bindings/js/JSEventListener.cpp
@@ -31,22 +31,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
-    : m_jsFunction(function)
-    , m_globalObject(globalObject)
+JSEventListener::JSEventListener(JSObject* function, bool isAttribute)
+    : EventListener(JSEventListenerType)
+    , m_jsFunction(function)
     , m_isAttribute(isAttribute)
 {
-    if (!m_isAttribute && m_jsFunction)
-        globalObject->jsEventListeners().set(m_jsFunction, this);
 }
 
 JSEventListener::~JSEventListener()
 {
-    if (!m_isAttribute && m_jsFunction && m_globalObject)
-        m_globalObject->jsEventListeners().remove(m_jsFunction);
 }
 
-JSObject* JSEventListener::jsFunction() const
+JSObject* JSEventListener::jsFunction(ScriptExecutionContext*) const
 {
     return m_jsFunction;
 }
@@ -55,30 +51,24 @@ void JSEventListener::markJSFunction(MarkStack& markStack)
 {
     if (m_jsFunction)
         markStack.append(m_jsFunction);
-    if (m_globalObject)
-        markStack.append(m_globalObject);
 }
 
-void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
+    ASSERT(scriptExecutionContext);
+    if (!scriptExecutionContext)
+        return;
+
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(scriptExecutionContext);
     if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    // Null check as clearGlobalObject() can clear this and we still get called back by
-    // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
-    // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
-    ASSERT(globalObject);
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(scriptExecutionContext);
     if (!globalObject)
         return;
 
-    ScriptExecutionContext* scriptExecutionContext = globalObject->scriptExecutionContext();
-    if (!scriptExecutionContext)
-        return;
-
     if (scriptExecutionContext->isDocument()) {
         JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
@@ -113,26 +103,14 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
         Event* savedEvent = globalObject->currentEvent();
         globalObject->setCurrentEvent(event);
 
-        // If this event handler is the first JavaScript to execute, then the
-        // dynamic global object should be set to the global object of the
-        // window in which the event occurred.
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValue retval;
-        if (handleEventFunction) {
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
-        } else {
-            JSValue thisValue;
-            if (isWindowEvent)
-                thisValue = globalObject->toThisObject(exec);
-            else
-                thisValue = toJS(exec, globalObject, event->currentTarget());
-            globalObject->globalData()->timeoutChecker.start();
-            retval = call(exec, jsFunction, callType, callData, thisValue, args);
-        }
-        globalObject->globalData()->timeoutChecker.stop();
+        globalData->timeoutChecker.start();
+        JSValue retval = handleEventFunction
+            ? call(exec, handleEventFunction, callType, callData, jsFunction, args)
+            : call(exec, jsFunction, callType, callData, toJS(exec, globalObject, event->currentTarget()), args);
+        globalData->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
@@ -154,18 +132,15 @@ void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
     }
 }
 
-bool JSEventListener::reportError(const String& message, const String& url, int lineNumber)
+bool JSEventListener::reportError(ScriptExecutionContext* context, const String& message, const String& url, int lineNumber)
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    JSObject* jsFunction = this->jsFunction();
+    JSObject* jsFunction = this->jsFunction(context);
     if (!jsFunction)
         return false;
 
-    JSDOMGlobalObject* globalObject = m_globalObject;
-    if (!globalObject)
-        return false;
-
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(context);
     ExecState* exec = globalObject->globalExec();
 
     CallData callData;
@@ -179,17 +154,14 @@ bool JSEventListener::reportError(const String& message, const String& url, int
     args.append(jsString(exec, url));
     args.append(jsNumber(exec, lineNumber));
 
-    // If this event handler is the first JavaScript to execute, then the
-    // dynamic global object should be set to the global object of the
-    // window in which the event occurred.
     JSGlobalData* globalData = globalObject->globalData();
     DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);    
 
     JSValue thisValue = globalObject->toThisObject(exec);
 
-    globalObject->globalData()->timeoutChecker.start();
+    globalData->timeoutChecker.start();
     JSValue returnValue = call(exec, jsFunction, callType, callData, thisValue, args);
-    globalObject->globalData()->timeoutChecker.stop();
+    globalData->timeoutChecker.stop();
 
     // If an error occurs while handling the script error, it should be bubbled up.
     if (exec->hadException()) {
@@ -206,4 +178,11 @@ bool JSEventListener::virtualisAttribute() const
     return m_isAttribute;
 }
 
+bool JSEventListener::operator==(const EventListener& listener)
+{
+    if (const JSEventListener* jsEventListener = JSEventListener::cast(&listener))
+        return m_jsFunction == jsEventListener->m_jsFunction && m_isAttribute == jsEventListener->m_isAttribute;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSEventListener.h b/WebCore/bindings/js/JSEventListener.h
index 7929169..285a9c4 100644
--- a/WebCore/bindings/js/JSEventListener.h
+++ b/WebCore/bindings/js/JSEventListener.h
@@ -30,30 +30,38 @@ namespace WebCore {
 
     class JSEventListener : public EventListener {
     public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
+            return adoptRef(new JSEventListener(listener, isAttribute));
         }
+
+        static const JSEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const JSEventListener*>(listener)
+                : 0;
+        }
+
         virtual ~JSEventListener();
-        void clearGlobalObject() { m_globalObject = 0; }
+
+        virtual bool operator==(const EventListener& other);
 
         // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
         bool isAttribute() const { return m_isAttribute; }
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
 
     private:
         virtual void markJSFunction(JSC::MarkStack&);
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool reportError(const String& message, const String& url, int lineNumber);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
+        virtual bool reportError(ScriptExecutionContext*, const String& message, const String& url, int lineNumber);
         virtual bool virtualisAttribute() const;
         void clearJSFunctionInline();
 
     protected:
-        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
+        JSEventListener(JSC::JSObject* function, bool isAttribute);
 
         mutable JSC::JSObject* m_jsFunction;
-        JSDOMGlobalObject* m_globalObject;
         bool m_isAttribute;
     };
 
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.cpp b/WebCore/bindings/js/JSEventSourceConstructor.cpp
new file mode 100644
index 0000000..c6e4825
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSourceConstructor.h"
+
+#include "EventSource.h"
+#include "ExceptionCode.h"
+#include "JSEventSource.h"
+#include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSEventSourceConstructor);
+
+const ClassInfo JSEventSourceConstructor::s_info = { "EventSourceContructor", 0, 0, 0 };
+
+JSEventSourceConstructor::JSEventSourceConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
+    : DOMConstructorObject(JSEventSourceConstructor::createStructure(globalObject->objectPrototype()), globalObject)
+{
+    putDirect(exec->propertyNames().prototype, JSEventSourcePrototype::self(exec, globalObject), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructEventSource(ExecState* exec, JSObject* constructor, const ArgList& args)
+{
+    if (args.size() < 1)
+        return throwError(exec, SyntaxError, "Not enough arguments");
+
+    UString url = args.at(0).toString(exec);
+    if (exec->hadException())
+        return 0;
+
+    JSEventSourceConstructor* jsConstructor =  static_cast<JSEventSourceConstructor*>(constructor);
+    ScriptExecutionContext* context = jsConstructor->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "EventSource constructor associated document is unavailable");
+
+    ExceptionCode ec = 0;
+    RefPtr<EventSource> eventSource = EventSource::create(url, context, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return 0;
+    }
+
+    return asObject(toJS(exec, jsConstructor->globalObject(), eventSource.release()));
+}
+
+ConstructType JSEventSourceConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructEventSource;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventSourceConstructor.h b/WebCore/bindings/js/JSEventSourceConstructor.h
new file mode 100644
index 0000000..b2f3cb5
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceConstructor.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSEventSourceConstructor_h
+#define JSEventSourceConstructor_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSDOMBinding.h"
+
+namespace WebCore {
+
+    class JSEventSourceConstructor : public DOMConstructorObject {
+    public:
+        JSEventSourceConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        static const JSC::ClassInfo s_info;
+
+    private:
+        virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+        virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // JSEventSourceConstructor_h
diff --git a/WebCore/bindings/js/JSEventSourceCustom.cpp b/WebCore/bindings/js/JSEventSourceCustom.cpp
new file mode 100644
index 0000000..404bf11
--- /dev/null
+++ b/WebCore/bindings/js/JSEventSourceCustom.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "JSEventSource.h"
+
+#include "EventSource.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSEventSource::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+JSValue JSEventSource::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/bindings/js/JSEventTarget.cpp b/WebCore/bindings/js/JSEventTarget.cpp
index c34e10e..0421d10 100644
--- a/WebCore/bindings/js/JSEventTarget.cpp
+++ b/WebCore/bindings/js/JSEventTarget.cpp
@@ -33,16 +33,29 @@
 #include "JSEventListener.h"
 #include "JSMessagePort.h"
 #include "JSNode.h"
+#if ENABLE(SHARED_WORKERS)
+
 #include "JSSharedWorker.h"
 #include "JSSharedWorkerContext.h"
+#endif
+
 #include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "MessagePort.h"
+
+#if ENABLE(SHARED_WORKERS)
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
+#endif
+
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
 
+#if ENABLE(EVENTSOURCE)
+#include "EventSource.h"
+#include "JSEventSource.h"
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 #include "DOMApplicationCache.h"
 #include "JSDOMApplicationCache.h"
@@ -60,6 +73,16 @@
 #include "Worker.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "JSNotification.h"
+#include "Notification.h"
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+#include "JSWebSocket.h"
+#include "WebSocket.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -69,6 +92,11 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
     if (!target)
         return jsNull();
     
+#if ENABLE(EVENTSOURCE)
+    if (EventSource* eventSource = target->toEventSource())
+        return toJS(exec, globalObject, eventSource);
+#endif
+
 #if ENABLE(SVG)
     // SVGElementInstance supports both toSVGElementInstance and toNode since so much mouse handling code depends on toNode returning a valid node.
     if (SVGElementInstance* instance = target->toSVGElementInstance())
@@ -111,6 +139,16 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
         return toJSDOMGlobalObject(workerContext);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    if (Notification* notification = target->toNotification())
+        return toJS(exec, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    if (WebSocket* webSocket = target->toWebSocket())
+        return toJS(exec, webSocket);
+#endif
+
     ASSERT_NOT_REACHED();
     return jsNull();
 }
@@ -118,7 +156,7 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EventTarget* targ
 EventTarget* toEventTarget(JSC::JSValue value)
 {
     #define CONVERT_TO_EVENT_TARGET(type) \
-        if (value.isObject(&JS##type::s_info)) \
+        if (value.inherits(&JS##type::s_info)) \
             return static_cast<JS##type*>(asObject(value))->impl();
 
     CONVERT_TO_EVENT_TARGET(Node)
@@ -126,9 +164,13 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
     CONVERT_TO_EVENT_TARGET(MessagePort)
 
-    if (value.isObject(&JSDOMWindowShell::s_info))
+    if (value.inherits(&JSDOMWindowShell::s_info))
         return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
 
+#if ENABLE(EVENTSOURCE)
+    CONVERT_TO_EVENT_TARGET(EventSource)
+#endif
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
 #endif
@@ -147,6 +189,14 @@ EventTarget* toEventTarget(JSC::JSValue value)
     CONVERT_TO_EVENT_TARGET(SharedWorkerContext)
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    CONVERT_TO_EVENT_TARGET(Notification)
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    CONVERT_TO_EVENT_TARGET(WebSocket)
+#endif
+
     return 0;
 }
 
diff --git a/WebCore/bindings/js/JSGeolocationCustom.cpp b/WebCore/bindings/js/JSGeolocationCustom.cpp
index 280fd2f..23a4c00 100644
--- a/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -41,34 +41,58 @@ using namespace std;
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionCallback> createPositionCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionCallback::create(object, frame);
+=======
+    return JSCustomPositionCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
 static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSValue value)
+=======
+static PassRefPtr<PositionErrorCallback> createPositionErrorCallback(ExecState* exec, JSDOMGlobalObject* globalObject, JSValue value)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 {
     // Argument is optional (hence undefined is allowed), and null is allowed.
     if (value.isUndefinedOrNull())
         return 0;
 
     // The spec specifies 'FunctionOnly' for this object.
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (!value.isObject(&InternalFunction::info)) {
+=======
+    if (!value.inherits(&InternalFunction::info)) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
     }
 
     JSObject* object = asObject(value);
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     Frame* frame = toJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
     return JSCustomPositionErrorCallback::create(object, frame);
+=======
+    return JSCustomPositionErrorCallback::create(object, globalObject);
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
 }
 
 static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
@@ -139,12 +163,20 @@ JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
@@ -161,12 +193,20 @@ JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, args.at(0));
+=======
+    RefPtr<PositionCallback> positionCallback = createPositionCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(0));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
     ASSERT(positionCallback);
 
+<<<<<<< HEAD:WebCore/bindings/js/JSGeolocationCustom.cpp
     RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, args.at(1));
+=======
+    RefPtr<PositionErrorCallback> positionErrorCallback = createPositionErrorCallback(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), args.at(1));
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/JSGeolocationCustom.cpp
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/WebCore/bindings/js/JSHTMLAllCollection.h b/WebCore/bindings/js/JSHTMLAllCollection.h
index 7363e5c..e6fe7f5 100644
--- a/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -35,7 +35,7 @@ namespace WebCore {
 
     class JSHTMLAllCollection : public JSHTMLCollection {
     public:
-        JSHTMLAllCollection(PassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
+        JSHTMLAllCollection(NonNullPassRefPtr<JSC::Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<HTMLCollection> collection)
             : JSHTMLCollection(structure, globalObject, collection)
         {
         }
diff --git a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index 37561af..30892e0 100644
--- a/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLAppletElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
new file mode 100644
index 0000000..8ecd287
--- /dev/null
+++ b/WebCore/bindings/js/JSHTMLCanvasElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLCanvasElement.h"
+
+#include "HTMLCanvasElement.h"
+#include "JSCanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)
+#include "JSCanvasRenderingContext3D.h"
+#endif
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+void JSHTMLCanvasElement::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(impl());
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    markDOMObjectWrapper(markStack, globalData, canvas->renderingContext());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index dd9af74..8ffddf7 100644
--- a/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -23,12 +23,13 @@
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "JSDOMBinding.h"
 #include "JSHTMLAllCollection.h"
 #include "JSHTMLOptionsCollection.h"
-#include "JSNamedNodesCollection.h"
 #include "JSNode.h"
+#include "JSNodeList.h"
 #include "Node.h"
-#include "JSDOMBinding.h"
+#include "StaticNodeList.h"
 #include <wtf/Vector.h>
 
 using namespace JSC;
@@ -42,11 +43,13 @@ static JSValue getNamedItems(ExecState* exec, JSHTMLCollection* collection, cons
 
     if (namedItems.isEmpty())
         return jsUndefined();
-
     if (namedItems.size() == 1)
         return toJS(exec, collection->globalObject(), namedItems[0].get());
 
-    return new (exec) JSNamedNodesCollection(exec, collection->globalObject(), namedItems);
+    // FIXME: HTML5 specifies that this should be a DynamicNodeList.
+    // FIXME: HTML5 specifies that non-HTMLOptionsCollection collections should return
+    // the first matching item instead of a NodeList.
+    return toJS(exec, collection->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 // HTMLCollections are strange objects, they support both get and call,
diff --git a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2570bc6..bce3ffb 100644
--- a/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Ident
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLEmbedElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index ffa2d57..de9ec4a 100644
--- a/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -30,7 +30,8 @@
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "JSDOMWindowCustom.h"
-#include "JSNamedNodesCollection.h"
+#include "JSNodeList.h"
+#include "StaticNodeList.h"
 
 using namespace JSC;
 
@@ -47,15 +48,17 @@ JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propert
 {
     JSHTMLElement* jsForm = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     HTMLFormElement* form = static_cast<HTMLFormElement*>(jsForm->impl());
-    
+
     Vector<RefPtr<Node> > namedItems;
     form->getNamedElements(propertyName, namedItems);
     
+    if (namedItems.isEmpty())
+        return jsUndefined();
     if (namedItems.size() == 1)
         return toJS(exec, namedItems[0].get());
-    if (namedItems.size() > 1) 
-        return new (exec) JSNamedNodesCollection(exec, jsForm->globalObject(), namedItems);
-    return jsUndefined();
+
+    // FIXME: HTML5 specifies that this should be a RadioNodeList.
+    return toJS(exec, jsForm->globalObject(), StaticNodeList::adopt(namedItems).get());
 }
 
 JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index c8aea9f..6e01513 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -32,16 +32,20 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
     if (protocolIsJavaScript(deprecatedParseURL(value))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
     }
     return true;
@@ -55,8 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
     if (!allowSettingJavascriptURL(exec, imp, srcValue))
         return;
 
-    imp->setSrc(srcValue);
-    return;
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
@@ -68,7 +71,6 @@ void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
         return;
 
     imp->setLocation(locationValue);
-    return;
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 8e32381..60ea45e 100644
--- a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -32,12 +32,15 @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
@@ -45,11 +48,12 @@ void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
     String srcValue = valueToStringWithNullCheck(exec, value);
 
     if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        if (!checkNodeSecurity(exec, imp->contentDocument()))
+        Document* contentDocument = imp->contentDocument();
+        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return;
     }
 
-    imp->setSrc(srcValue);
+    imp->setAttribute(srcAttr, srcValue);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 6b47622..e5166ee 100644
--- a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "HTMLInputElement.h"
 #include "Settings.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index a99e46c..1bfb51f 100644
--- a/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -38,6 +38,11 @@ bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Iden
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
+bool JSHTMLObjectElement::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return runtimeObjectCustomGetOwnPropertyDescriptor(exec, propertyName, descriptor, this);
+}
+
 bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
diff --git a/WebCore/bindings/js/JSHistoryCustom.cpp b/WebCore/bindings/js/JSHistoryCustom.cpp
index a3b15e1..b24b1ff 100644
--- a/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -31,6 +31,7 @@
 
 #include "Frame.h"
 #include "History.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -92,6 +93,52 @@ bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool JSHistory::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // When accessing History cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, impl()->frame(), message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSHistoryPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        PropertySlot slot;
+        // Allow access to back(), forward() and go() from any frame.
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsHistoryPrototypeFunctionBack) {
+                slot.setCustom(this, nonCachingStaticBackFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionForward) {
+                slot.setCustom(this, nonCachingStaticForwardFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            } else if (entry->function() == jsHistoryPrototypeFunctionGo) {
+                slot.setCustom(this, nonCachingStaticGoFunctionGetter);
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+                return true;
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            PropertySlot slot;
+            slot.setCustom(this, objectToStringFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    printErrorMessageForFrame(impl()->frame(), message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
@@ -108,12 +155,12 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSHistory::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSImageConstructor.cpp b/WebCore/bindings/js/JSImageConstructor.cpp
index faaaf41..0f4a991 100644
--- a/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/WebCore/bindings/js/JSImageConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index fff7aee..ed79427 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectedObjectWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectorCallbackWrapper.h"
 #include <runtime/JSGlobalObject.h>
 #include <wtf/StdLibExtras.h>
@@ -69,7 +71,7 @@ JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrapp
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
 
-JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectedObjectWrapper::JSInspectedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     WrapperMap* wrapperMap = wrappers().get(unwrappedGlobalObject());
@@ -125,3 +127,5 @@ JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectedObjectWrapper.h b/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 201feb6..ad97035 100644
--- a/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -38,7 +38,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     private:
-        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsGetProperty() const { return true; }
         virtual bool allowsSetProperty() const { return true; }
diff --git a/WebCore/bindings/js/JSInspectorBackendCustom.cpp b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
index b2eb2d1..73fa268 100644
--- a/WebCore/bindings/js/JSInspectorBackendCustom.cpp
+++ b/WebCore/bindings/js/JSInspectorBackendCustom.cpp
@@ -33,6 +33,8 @@
 #include "config.h"
 #include "JSInspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Console.h"
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -51,6 +53,10 @@
 #include "JSRange.h"
 #include "Node.h"
 #include "Page.h"
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "JSStorage.h"
+#endif
 #include "TextIterator.h"
 #include "VisiblePosition.h"
 #include <runtime/JSArray.h>
@@ -70,21 +76,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+JSValue JSInspectorBackend::highlightDOMNode(JSC::ExecState* exec, const JSC::ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
-        return jsUndefined();
-
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return jsUndefined();
-
-    impl()->highlight(node);
-
+    impl()->highlight(args.at(0).toInt32(exec));
     return jsUndefined();
 }
 
@@ -125,27 +122,20 @@ JSValue JSInspectorBackend::search(ExecState* exec, const ArgList& args)
 }
 
 #if ENABLE(DATABASE)
-JSValue JSInspectorBackend::databaseTableNames(ExecState* exec, const ArgList& args)
+JSValue JSInspectorBackend::databaseForId(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
 
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
-    if (!wrapper)
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
         return jsUndefined();
 
-    Database* database = toDatabase(wrapper->unwrappedObject());
+    Database* database = impl()->databaseForId(args.at(0).toInt32(exec));
     if (!database)
         return jsUndefined();
-
-    MarkedArgumentBuffer result;
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i)
-        result.append(jsString(exec, tableNames[i]));
-
-    return constructArray(exec, result);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, database));
 }
 #endif
 
@@ -257,7 +247,7 @@ JSValue JSInspectorBackend::currentCallFrame(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     // FIXME: I am not sure if this is actually needed. Can we just use exec?
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+    ExecState* globalExec = callFrame->scopeChain()->globalObject->globalExec();
 
     JSLock lock(SilenceAssertionsOnly);
     return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
@@ -280,4 +270,94 @@ JSValue JSInspectorBackend::profiles(JSC::ExecState* exec, const JSC::ArgList&)
 
 #endif
 
+JSValue JSInspectorBackend::nodeForId(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    Node* node = impl()->nodeForId(args.at(0).toInt32(exec));
+    if (!node)
+        return jsUndefined();
+
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSLock lock(SilenceAssertionsOnly);
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(ic->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), toJS(exec, deprecatedGlobalObjectForPrototype(inspectedWindow->globalExec()), node));
+}
+
+JSValue JSInspectorBackend::wrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    return impl()->wrapObject(ScriptValue(args.at(0)), args.at(1).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::unwrapObject(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return impl()->unwrapObject(args.at(0).toString(exec)).jsValue();
+}
+
+JSValue JSInspectorBackend::pushNodePathToFrontend(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    bool selectInUI = args.at(1).toBoolean(exec);
+    return jsNumber(exec, impl()->pushNodePathToFrontend(node, selectInUI));
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorBackend::selectDatabase(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (database)
+        impl()->selectDatabase(database);
+    return jsUndefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+JSValue JSInspectorBackend::selectDOMStorage(ExecState*, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+    InspectorController* ic = impl()->inspectorController();
+    if (!ic)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Storage* storage = toStorage(wrapper->unwrappedObject());
+    if (storage)
+        impl()->selectDOMStorage(storage);
+    return jsUndefined();
+}
+#endif
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 0e14109..9c4330d 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSInspectorCallbackWrapper.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "JSInspectedObjectWrapper.h"
 #include <wtf/StdLibExtras.h>
 
@@ -73,10 +75,10 @@ JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwra
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, asObject(wrap(unwrappedExec, prototype))->inheritorID());
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
 }
 
-JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSInspectorCallbackWrapper::JSInspectorCallbackWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSQuarantinedObjectWrapper(unwrappedExec, unwrappedObject, structure)
 {
     ASSERT(!wrappers().contains(unwrappedObject));
@@ -105,3 +107,5 @@ JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExe
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index cfc2fb6..be28063 100644
--- a/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -40,7 +40,7 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
     protected:
-        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSInspectorCallbackWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual bool allowsCallAsFunction() const { return true; }
 
diff --git a/WebCore/bindings/js/JSLazyEventListener.cpp b/WebCore/bindings/js/JSLazyEventListener.cpp
index 7caff2b..0d6cb57 100644
--- a/WebCore/bindings/js/JSLazyEventListener.cpp
+++ b/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -23,6 +23,7 @@
 #include "Frame.h"
 #include "JSNode.h"
 #include <runtime/FunctionConstructor.h>
+#include <runtime/JSFunction.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -34,12 +35,13 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
 #endif
 
-JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
+    : JSEventListener(0, true)
     , m_functionName(functionName)
     , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_parsed(false)
+    , m_sourceURL(sourceURL)
     , m_lineNumber(lineNumber)
     , m_originalNode(node)
 {
@@ -66,23 +68,43 @@ JSLazyEventListener::~JSLazyEventListener()
 #endif
 }
 
-JSObject* JSLazyEventListener::jsFunction() const
+JSObject* JSLazyEventListener::jsFunction(ScriptExecutionContext* executionContext) const
 {
-    parseCode();
+    parseCode(executionContext);
     return m_jsFunction;
 }
 
-void JSLazyEventListener::parseCode() const
+void JSLazyEventListener::parseCode(ScriptExecutionContext* executionContext) const
 {
+    ASSERT(executionContext);
+    ASSERT(executionContext->isDocument());
+    if (!executionContext)
+        return;
+
     if (m_parsed)
         return;
 
-    ScriptExecutionContext* executionContext = m_globalObject->scriptExecutionContext();
-    ASSERT(executionContext);
-    if (!executionContext)
+    Frame* frame = static_cast<Document*>(executionContext)->frame();
+    if (!frame)
         return;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return;
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(executionContext);
+    if (!globalObject)
+        return;
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    if (m_originalNode) {
+        JSLock lock(SilenceAssertionsOnly);
+        // FIXME: Should pass the global object associated with the node
+        toJS(globalObject->globalExec(), globalObject, m_originalNode);
+    }
+
     if (executionContext->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject);
         Frame* frame = window->impl()->frame();
         if (!frame)
             return;
@@ -94,16 +116,13 @@ void JSLazyEventListener::parseCode() const
 
     m_parsed = true;
 
-    ExecState* exec = m_globalObject->globalExec();
+    ExecState* exec = globalObject->globalExec();
 
     MarkedArgumentBuffer args;
-    UString sourceURL(executionContext->url().string());
     args.append(jsNontrivialString(exec, m_eventParameterName));
     args.append(jsString(exec, m_code));
 
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), m_sourceURL, m_lineNumber); // FIXME: is globalExec ok?
 
     JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
 
@@ -117,7 +136,7 @@ void JSLazyEventListener::parseCode() const
         // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
         ScopeChain scope = listenerAsFunction->scope();
 
-        JSValue thisObj = toJS(exec, m_globalObject, m_originalNode);
+        JSValue thisObj = toJS(exec, globalObject, m_originalNode);
         if (thisObj.isObject()) {
             static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
             listenerAsFunction->setScope(scope);
@@ -128,6 +147,7 @@ void JSLazyEventListener::parseCode() const
     m_functionName = String();
     m_code = String();
     m_eventParameterName = String();
+    m_sourceURL = String();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSLazyEventListener.h b/WebCore/bindings/js/JSLazyEventListener.h
index a5304cf..e3137b8 100644
--- a/WebCore/bindings/js/JSLazyEventListener.h
+++ b/WebCore/bindings/js/JSLazyEventListener.h
@@ -29,24 +29,25 @@ namespace WebCore {
 
     class JSLazyEventListener : public JSEventListener {
     public:
-        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, Node* node, const String& sourceURL, int lineNumber)
         {
-            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, node, sourceURL, lineNumber));
         }
         virtual ~JSLazyEventListener();
 
     private:
-        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, Node*, const String& sourceURL, int lineNumber);
 
-        virtual JSC::JSObject* jsFunction() const;
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const;
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        void parseCode() const;
+        void parseCode(ScriptExecutionContext*) const;
 
         mutable String m_functionName;
         mutable String m_eventParameterName;
         mutable String m_code;
         mutable bool m_parsed;
+        mutable String m_sourceURL;
         int m_lineNumber;
         Node* m_originalNode;
     };
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index d7d32f4..c76a2b1 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -31,6 +31,7 @@
 #include "KURL.h"
 #include "Location.h"
 #include "ScriptController.h"
+#include <runtime/JSFunction.h>
 #include <runtime/PrototypeFunction.h>
 
 using namespace JSC;
@@ -93,6 +94,51 @@ bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& p
     return true;
 }
 
+bool JSLocation::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    Frame* frame = impl()->frame();
+    if (!frame) {
+        descriptor.setUndefined();
+        return true;
+    }
+    
+    // When accessing Location cross-domain, functions are always the native built-in ones.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
+    
+    // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
+    // allowed, return false so the normal lookup will take place.
+    String message;
+    if (allowsAccessFromFrame(exec, frame, message))
+        return false;
+    
+    // Check for the few functions that we allow, even when called cross-domain.
+    const HashEntry* entry = JSLocationPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    PropertySlot slot;
+    if (entry && (entry->attributes() & Function)) {
+        if (entry->function() == jsLocationPrototypeFunctionReplace) {
+            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionReload) {
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
+            slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());
+            return true;
+        }
+    }
+    
+    // FIXME: Other implementers of the Window cross-domain scheme (Window, History) allow toString,
+    // but for now we have decided not to, partly because it seems silly to return "[Object Location]" in
+    // such cases when normally the string form of Location would be the URL.
+    
+    printErrorMessageForFrame(frame, message);
+    descriptor.setUndefined();
+    return true;
+}
+
 bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
@@ -128,19 +174,19 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSLocation::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
         return;
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
-void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
@@ -150,7 +196,7 @@ static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bo
         return;
 
     if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
-        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
 }
 
 void JSLocation::setHref(ExecState* exec, JSValue value)
@@ -158,13 +204,13 @@ void JSLocation::setHref(ExecState* exec, JSValue value)
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    if (!shouldAllowNavigation(exec, frame))
-        return;
-
     KURL url = completeURL(exec, value.toString(exec));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
@@ -262,13 +308,13 @@ JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
@@ -280,7 +326,7 @@ JSValue JSLocation::reload(ExecState* exec, const ArgList&)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture(exec));
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
@@ -290,13 +336,13 @@ JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
     if (!frame)
         return jsUndefined();
 
-    if (!shouldAllowNavigation(exec, frame))
-        return jsUndefined();
-
     KURL url = completeURL(exec, args.at(0).toString(exec));
     if (url.isNull())
         return jsUndefined();
 
+    if (!shouldAllowNavigation(exec, frame))
+        return jsUndefined();
+
     // We want a new history item if this JS was called via a user gesture
     navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
@@ -316,11 +362,11 @@ bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propert
     return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
 }
 
-void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction, unsigned attributes)
 {
     if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
         return;
-    Base::defineGetter(exec, propertyName, getterFunction);
+    Base::defineGetter(exec, propertyName, getterFunction, attributes);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 25a5cb2..9721ba3 100644
--- a/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -30,6 +30,7 @@
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
 #include "MessageChannel.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSMessageEventCustom.cpp b/WebCore/bindings/js/JSMessageEventCustom.cpp
new file mode 100644
index 0000000..2e7b2d0
--- /dev/null
+++ b/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSMessageEvent.h"
+
+#include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "JSEventTarget.h"
+#include "JSMessagePortCustom.h"
+#include "MessageEvent.h"
+#include <runtime/JSArray.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSMessageEvent::ports(ExecState* exec) const
+{
+    MessagePortArray* ports = static_cast<MessageEvent*>(impl())->ports();
+    if (!ports || ports->isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    for (size_t i = 0; i < ports->size(); i++)
+        list.append(toJS(exec, globalObject(), (*ports)[i].get()));
+    return constructArray(exec, list);
+}
+
+JSC::JSValue JSMessageEvent::initMessageEvent(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    PassRefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(exec, args.at(3));
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    OwnPtr<MessagePortArray> messagePorts;
+    if (!args.at(7).isUndefinedOrNull()) {
+        messagePorts = new MessagePortArray();
+        fillMessagePortArray(exec, args.at(7), *messagePorts);
+        if (exec->hadException())
+            return jsUndefined();
+    }
+
+    MessageEvent* event = static_cast<MessageEvent*>(this->impl());
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePorts.release());
+    return jsUndefined();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.cpp b/WebCore/bindings/js/JSMessagePortCustom.cpp
index c3316c5..210c93e 100644
--- a/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -28,11 +28,14 @@
 
 #include "AtomicString.h"
 #include "Event.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSMessagePortCustom.h"
 #include "MessagePort.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -42,8 +45,6 @@ void JSMessagePort::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
-    markIfNotNull(markStack, m_impl->onmessage());
-
     // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
     if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
@@ -51,13 +52,7 @@ void JSMessagePort::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    typedef MessagePort::EventListenersMap EventListenersMap;
-    typedef MessagePort::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
@@ -65,10 +60,12 @@ JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -77,11 +74,54 @@ JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSC::JSValue JSMessagePort::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
+}
+
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+{
+    // Convert from the passed-in JS array-like object to a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    if (value.isUndefinedOrNull()) {
+        portArray.resize(0);
+        return;
+    }
+
+    // Validation of sequence types, per WebIDL spec 4.1.13.
+    unsigned length;
+    JSObject* object = toJSSequence(exec, value, length);
+    if (exec->hadException())
+        return;
+
+    portArray.resize(length);
+    for (unsigned i = 0 ; i < length; ++i) {
+        JSValue value = object->get(exec, i);
+        if (exec->hadException())
+            return;
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (value.isUndefinedOrNull()) {
+            setDOMException(exec, INVALID_STATE_ERR);
+            return;
+        }
+
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        RefPtr<MessagePort> port = toMessagePort(value);
+        if (!port) {
+            throwError(exec, TypeError);
+            return;
+        }
+        portArray[i] = port.release();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSMessagePortCustom.h b/WebCore/bindings/js/JSMessagePortCustom.h
new file mode 100644
index 0000000..17b1eae
--- /dev/null
+++ b/WebCore/bindings/js/JSMessagePortCustom.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSMessagePortCustom_h
+#define JSMessagePortCustom_h
+
+#include "MessagePort.h"
+#include <runtime/JSValue.h>
+
+namespace WebCore {
+
+    typedef int ExceptionCode;
+
+    class String;
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
+    // May generate an exception via the passed ExecState.
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+
+    // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
+    template <typename T>
+    inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, const JSC::ArgList& args, T* impl)
+    {
+        PassRefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, args.at(0));
+        MessagePortArray portArray;
+        fillMessagePortArray(exec, args.at(1), portArray);
+        if (exec->hadException())
+            return JSC::jsUndefined();
+
+        ExceptionCode ec = 0;
+        impl->postMessage(message, &portArray, ec);
+        setDOMException(exec, ec);
+        return JSC::jsUndefined();
+    }
+
+}
+#endif // JSMessagePortCustom_h
diff --git a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index 7bd95b4..1974ab0 100644
--- a/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,10 +27,9 @@
 #include "JSNamedNodeMap.h"
 
 #include "JSNode.h"
+
+#include "Element.h"
 #include "NamedNodeMap.h"
-#include "Node.h"
-#include "PlatformString.h"
-#include "JSDOMBinding.h"
 
 using namespace JSC;
 
@@ -47,4 +46,16 @@ JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyNa
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
 }
 
+void JSNamedNodeMap::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    // Mark the element so that this will work to access the attribute even if the last
+    // other reference goes away.
+    if (Element* element = impl()->element()) {
+        if (JSNode* wrapper = getCachedDOMNodeWrapper(element->document(), element))
+            markStack.append(wrapper);
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSNamedNodesCollection.cpp b/WebCore/bindings/js/JSNamedNodesCollection.cpp
deleted file mode 100644
index f36a7d6..0000000
--- a/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "JSNamedNodesCollection.h"
-
-#include "AtomicString.h"
-#include "Element.h"
-#include "JSNode.h"
-#include "NamedNodeMap.h"
-
-namespace WebCore {
-
-using namespace JSC;
-
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
-
-const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
-
-// Such a collection is usually very short-lived, it only exists
-// for constructs like document.forms.<name>[1],
-// so it shouldn't be a problem that it's storing all the nodes (with the same name). (David)
-JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, JSDOMGlobalObject* globalObject, const Vector<RefPtr<Node> >& nodes)
-    : DOMObjectWithGlobalPointer(getDOMStructure<JSNamedNodesCollection>(exec, globalObject), globalObject)
-    , m_nodes(new Vector<RefPtr<Node> >(nodes))
-{
-}
-
-JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return jsNumber(exec, thisObj->m_nodes->size());
-}
-
-JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
-    return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
-}
-
-bool JSNamedNodesCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    if (propertyName == exec->propertyNames().length) {
-        slot.setCustom(this, lengthGetter);
-        return true;
-    }
-
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok);
-    if (ok && index < m_nodes->size()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
-
-    // For IE compatibility, we need to be able to look up elements in a
-    // document.formName.name result by id as well as be index.
-
-    AtomicString atomicPropertyName = propertyName;
-    for (unsigned i = 0; i < m_nodes->size(); i++) {
-        Node* node = (*m_nodes)[i].get();
-        if (node->hasAttributes() && node->attributes()->id() == atomicPropertyName) {
-            slot.setCustomIndex(this, i, indexGetter);
-            return true;
-        }
-    }
-
-    return DOMObjectWithGlobalPointer::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-} // namespace WebCore
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index cf884b9..52f21e7 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -110,25 +110,37 @@ JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 
 JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+        
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->document());
+    Document* document = impl()->document();
+    if (!document)
+        return jsUndefined();
+
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(document);
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -138,10 +150,10 @@ void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
 
 void JSNode::markChildren(MarkStack& markStack)
 {
-    Node* node = m_impl.get();
-
     Base::markChildren(markStack);
-    markEventListeners(markStack, node->eventListeners());
+
+    Node* node = m_impl.get();
+    node->markEventListeners(markStack);
 
     // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
     // the document, we need to mark the document, but we don't need to explicitly
diff --git a/WebCore/bindings/js/JSNodeFilterCustom.cpp b/WebCore/bindings/js/JSNodeFilterCustom.cpp
index 09fd110..2a99a93 100644
--- a/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -48,7 +48,7 @@ JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 
 PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value.isObject(&JSNodeFilter::s_info))
+    if (value.inherits(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/WebCore/bindings/js/JSOptionConstructor.cpp b/WebCore/bindings/js/JSOptionConstructor.cpp
index 2b8bd5d..7da0666 100644
--- a/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -25,6 +25,7 @@
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
 #include "Text.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.cpp b/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 56b0eca..ada2a77 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -86,6 +86,22 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
+bool runtimeObjectCustomGetOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, JSHTMLElement* element)
+{
+    RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element->impl());
+    if (!runtimeObject)
+        return false;
+    if (!runtimeObject->hasProperty(exec, propertyName))
+        return false;
+    PropertySlot slot;
+    slot.setCustom(element, runtimeObjectPropertyGetter);
+    // While we don't know what the plugin allows, we do know that we prevent
+    // enumeration or deletion of properties, so we mark plugin properties
+    // as DontEnum | DontDelete
+    descriptor.setDescriptor(slot.getValue(exec, propertyName), DontEnum | DontDelete);
+    return true;
+}
+
 bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
diff --git a/WebCore/bindings/js/JSPluginElementFunctions.h b/WebCore/bindings/js/JSPluginElementFunctions.h
index 8c9dfa7..a5a323a 100644
--- a/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -33,6 +33,7 @@ namespace WebCore {
     JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
+    bool runtimeObjectCustomGetOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&, JSHTMLElement*);
     bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index 5f4dfd4..a0551a1 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -56,7 +56,7 @@ JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifi
     return v;
 }
 
-JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
+JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, NonNullPassRefPtr<Structure> structure)
     : JSObject(structure)
     , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
@@ -138,6 +138,26 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
+bool JSQuarantinedObjectWrapper::getOwnPropertyDescriptor(ExecState* exec, const Identifier& identifier, PropertyDescriptor& descriptor)
+{
+    if (!allowsGetProperty()) {
+        descriptor.setUndefined();
+        return true;
+    }
+
+    PropertyDescriptor unwrappedDescriptor;
+    bool result = m_unwrappedObject->getOwnPropertyDescriptor(unwrappedExecState(), identifier, unwrappedDescriptor);
+
+    if (unwrappedDescriptor.isAccessorDescriptor()) {
+        descriptor.setAccessorDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.getter()),
+                                         wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.setter()),
+                                         unwrappedDescriptor.attributes());
+    } else
+        descriptor.setDescriptor(wrapOutgoingValue(unwrappedExecState(), unwrappedDescriptor.value()), unwrappedDescriptor.attributes());
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
@@ -158,6 +178,33 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSVal
     transferExceptionToExecState(exec);
 }
 
+bool JSQuarantinedObjectWrapper::defineOwnProperty(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor, bool shouldThrow)
+{
+    if (!allowsSetProperty())
+        return false;
+
+    PropertyDescriptor wrappedDescriptor;
+    if (descriptor.isDataDescriptor()) {
+        wrappedDescriptor.setValue(prepareIncomingValue(exec, descriptor.value()));
+        if (wrappedDescriptor.writablePresent())
+            wrappedDescriptor.setWritable(descriptor.writable());
+    } else if (descriptor.isAccessorDescriptor()) {
+        if (descriptor.getter())
+            wrappedDescriptor.setGetter(prepareIncomingValue(exec, descriptor.getter()));
+        if (descriptor.setter())
+            wrappedDescriptor.setSetter(prepareIncomingValue(exec, descriptor.setter()));
+    }
+    if (wrappedDescriptor.enumerablePresent())
+        wrappedDescriptor.setEnumerable(descriptor.enumerable());
+    if (wrappedDescriptor.configurablePresent())
+        wrappedDescriptor.setConfigurable(descriptor.configurable());
+    
+    bool result = m_unwrappedObject->defineOwnProperty(unwrappedExecState(), propertyName, wrappedDescriptor, shouldThrow);
+    
+    transferExceptionToExecState(exec);
+    return result;
+}
+
 bool JSQuarantinedObjectWrapper::deleteProperty(ExecState* exec, const Identifier& identifier)
 {
     if (!allowsDeleteProperty())
@@ -270,8 +317,16 @@ void JSQuarantinedObjectWrapper::getPropertyNames(ExecState*, PropertyNameArray&
 {
     if (!allowsGetPropertyNames())
         return;
-
+    
     m_unwrappedObject->getPropertyNames(unwrappedExecState(), array);
 }
 
+void JSQuarantinedObjectWrapper::getOwnPropertyNames(ExecState*, PropertyNameArray& array)
+{
+    if (!allowsGetPropertyNames())
+        return;
+
+    m_unwrappedObject->getOwnPropertyNames(unwrappedExecState(), array);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index 08935e7..94a92bd 100644
--- a/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -51,16 +51,18 @@ namespace WebCore {
         }
 
     protected:
-        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, PassRefPtr<JSC::Structure>);
+        JSQuarantinedObjectWrapper(JSC::ExecState* unwrappedExec, JSC::JSObject* unwrappedObject, NonNullPassRefPtr<JSC::Structure>);
 
         virtual void markChildren(JSC::MarkStack&);
 
     private:
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
+        virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);
 
         virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
         virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
+        virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -69,8 +71,9 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
         virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
-
+        
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+        virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
         virtual JSC::UString className() const { return m_unwrappedObject->className(); }
 
diff --git a/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index dbe8e3c..e022401 100644
--- a/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -95,8 +95,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            callback = JSCustomSQLStatementCallback::create(object, frame);
+        callback = JSCustomSQLStatementCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
@@ -107,8 +106,7 @@ JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
             return jsUndefined();
         }
         
-        if (Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame())
-            errorCallback = JSCustomSQLStatementErrorCallback::create(object, frame);
+        errorCallback = JSCustomSQLStatementErrorCallback::create(object, static_cast<JSDOMGlobalObject*>(exec->dynamicGlobalObject()));
     }
     
     ExceptionCode ec = 0;
diff --git a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index 6e77f9b..571e302 100644
--- a/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -54,9 +54,11 @@ JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& a
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
-        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -66,9 +68,11 @@ JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
-        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
+        return jsUndefined();
 
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
index e2f1136..c05b3d2 100644
--- a/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSSharedWorkerConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSSharedWorker.h"
 #include "SharedWorker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
@@ -56,11 +57,14 @@ static JSObject* constructSharedWorker(ExecState* exec, JSObject* constructor, c
 {
     JSSharedWorkerConstructor* jsConstructor = static_cast<JSSharedWorkerConstructor*>(constructor);
 
-    if (args.size() < 2)
+    if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     UString scriptURL = args.at(0).toString(exec);
-    UString name = args.at(1).toString(exec);
+    UString name;
+    if (args.size() > 1)
+        name = args.at(1).toString(exec);
+
     if (exec->hadException())
         return 0;
 
diff --git a/WebCore/bindings/js/JSStorageCustom.cpp b/WebCore/bindings/js/JSStorageCustom.cpp
index 07cf2f8..e416d35 100644
--- a/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/WebCore/bindings/js/JSStorageCustom.cpp
@@ -64,13 +64,13 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return true;
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i)));
         
-    Base::getPropertyNames(exec, propertyNames);
+    Base::getOwnPropertyNames(exec, propertyNames);
 }
 
 bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
diff --git a/WebCore/bindings/js/JSStyleSheetCustom.cpp b/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 43249dc..d711b6f 100644
--- a/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -56,12 +56,19 @@ void JSStyleSheet::markChildren(MarkStack& markStack)
 {
     Base::markChildren(markStack);
 
+    StyleSheet* sheet = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = sheet->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, sheet->item(i));
+
     // This prevents us from having a style sheet with a dangling ownerNode pointer.
     // A better solution would be to handle this on the DOM side -- if the style sheet
     // is kept around, then we want the node to stay around too. One possibility would
     // be to make ref/deref on the style sheet ref/deref the node instead, but there's
     // a lot of disentangling of the CSS DOM objects that would need to happen first.
-    if (Node* ownerNode = impl()->ownerNode()) {
+    if (Node* ownerNode = sheet->ownerNode()) {
         if (JSNode* ownerNodeWrapper = getCachedDOMNodeWrapper(ownerNode->document(), ownerNode))
             markStack.append(ownerNodeWrapper);
     }
diff --git a/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index 1da6418..7bf9389 100644
--- a/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
+void JSStyleSheetList::markChildren(MarkStack& markStack)
+{
+    Base::markChildren(markStack);
+
+    StyleSheetList* list = impl();
+    JSGlobalData& globalData = *Heap::heap(this)->globalData();
+
+    unsigned length = list->length();
+    for (unsigned i = 0; i < length; ++i)
+        markDOMObjectWrapper(markStack, globalData, list->item(i));
+}
+
 bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheetList, const Identifier& propertyName)
 {
     return styleSheetList->getNamedItem(propertyName);
diff --git a/WebCore/bindings/js/JSWebSocketConstructor.cpp b/WebCore/bindings/js/JSWebSocketConstructor.cpp
index ca2e104..5b34765 100644
--- a/WebCore/bindings/js/JSWebSocketConstructor.cpp
+++ b/WebCore/bindings/js/JSWebSocketConstructor.cpp
@@ -37,6 +37,7 @@
 #include "JSWebSocket.h"
 #include "ScriptExecutionContext.h"
 #include "WebSocket.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 3aa4b8b..d305502 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -38,19 +38,12 @@
 #include "KURL.h"
 #include "WebSocket.h"
 #include "NotImplemented.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-void JSWebSocket::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
-    if (m_impl->readyState() != WebSocket::CLOSED)
-        markIfNotNull(markStack, m_impl->onmessage());
-    // FIXME: mark if EventListeners is registered.
-}
-
 // Custom functions
 JSValue JSWebSocket::send(ExecState* exec, const ArgList& args)
 {
diff --git a/WebCore/bindings/js/JSWorkerConstructor.cpp b/WebCore/bindings/js/JSWorkerConstructor.cpp
index 9943cfb..69c05e7 100644
--- a/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -34,6 +34,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSWorker.h"
 #include "Worker.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSWorkerContextBase.cpp b/WebCore/bindings/js/JSWorkerContextBase.cpp
index 1e4df42..741a269 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -44,7 +44,7 @@ ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
 
 const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
-JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
+JSWorkerContextBase::JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
     , m_impl(impl)
 {
diff --git a/WebCore/bindings/js/JSWorkerContextBase.h b/WebCore/bindings/js/JSWorkerContextBase.h
index a9a6e63..45238f1 100644
--- a/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/WebCore/bindings/js/JSWorkerContextBase.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class JSWorkerContextBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
     public:
-        JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
+        JSWorkerContextBase(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
diff --git a/WebCore/bindings/js/JSWorkerContextCustom.cpp b/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 919c81f..e1c8a8c 100644
--- a/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -43,6 +43,10 @@
 #include "WorkerNavigator.h"
 #include <interpreter/Interpreter.h>
 
+#if ENABLE(EVENTSOURCE)
+#include "JSEventSourceConstructor.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
@@ -58,15 +62,7 @@ void JSWorkerContext::markChildren(MarkStack& markStack)
     markDOMObjectWrapper(markStack, globalData, impl()->optionalLocation());
     markDOMObjectWrapper(markStack, globalData, impl()->optionalNavigator());
 
-    markIfNotNull(markStack, impl()->onerror());
-
-    typedef WorkerContext::EventListenersMap EventListenersMap;
-    typedef WorkerContext::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = impl()->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    impl()->markEventListeners(markStack);
 }
 
 bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -77,6 +73,21 @@ bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifi
     return false;
 }
 
+bool JSWorkerContext::getOwnPropertyDescriptorDelegate(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertyDescriptor(exec, propertyName, descriptor))
+        return true;
+    return false;
+}
+
+#if ENABLE(EVENTSOURCE)
+JSValue JSWorkerContext::eventSource(ExecState* exec) const
+{
+    return getDOMConstructor<JSEventSourceConstructor>(exec, this);
+}
+#endif
+
 JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
     return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
@@ -107,19 +118,21 @@ JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 
 JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
 JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSEventListener* listener = findJSEventListener(args.at(1));
-    if (!listener)
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSWorkerCustom.cpp b/WebCore/bindings/js/JSWorkerCustom.cpp
index f5c394b..09b881a 100644
--- a/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -30,17 +30,16 @@
 #include "JSWorker.h"
 
 #include "JSDOMGlobalObject.h"
+#include "JSMessagePortCustom.h"
 #include "Worker.h"
 
 using namespace JSC;
 
 namespace WebCore {
-    
-void JSWorker::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
 
-    markIfNotNull(markStack, static_cast<Worker*>(impl())->onmessage());
+JSC::JSValue JSWorker::postMessage(JSC::ExecState* exec, const JSC::ArgList& args)
+{
+    return handlePostMessage(exec, args, impl());
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index a644c9e..91fff9a 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -23,6 +23,7 @@
 #include "JSXMLHttpRequest.h"
 #include "ScriptExecutionContext.h"
 #include "XMLHttpRequest.h"
+#include <runtime/Error.h>
 
 using namespace JSC;
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index a591fae..4b44db2 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -59,20 +59,7 @@ void JSXMLHttpRequest::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onreadystatechange());
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequest::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequest::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 // Custom functions
@@ -123,9 +110,9 @@ JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
         JSValue val = args.at(0);
         if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val.isObject(&JSDocument::s_info))
+        else if (val.inherits(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val.isObject(&JSFile::s_info))
+        else if (val.inherits(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
             impl()->send(val.toString(exec), ec);
@@ -168,10 +155,12 @@ JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -180,10 +169,12 @@ JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& ar
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index cb6d5f2..dab0a3e 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -51,19 +51,7 @@ void JSXMLHttpRequestUpload::markChildren(MarkStack& markStack)
             markStack.append(wrapper);
     }
 
-    markIfNotNull(markStack, m_impl->onabort());
-    markIfNotNull(markStack, m_impl->onerror());
-    markIfNotNull(markStack, m_impl->onload());
-    markIfNotNull(markStack, m_impl->onloadstart());
-    markIfNotNull(markStack, m_impl->onprogress());
-    
-    typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
-    typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
-    EventListenersMap& eventListeners = m_impl->eventListeners();
-    for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
-            (*vecIter)->markJSFunction(markStack);
-    }
+    m_impl->markEventListeners(markStack);
 }
 
 JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
@@ -71,10 +59,12 @@ JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList&
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    impl()->addEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
@@ -83,10 +73,12 @@ JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgLi
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
-    if (!listener)
+
+    JSValue listener = args.at(1);
+    if (!listener.isObject())
         return jsUndefined();
-    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    impl()->removeEventListener(args.at(0).toString(exec), JSEventListener::create(asObject(listener), false).get(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index 01e53a6..441bbc9 100644
--- a/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -49,7 +49,7 @@ namespace WebCore {
 JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -62,7 +62,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 {
     JSValue nodeVal = args.at(0);
     JSValue docVal = args.at(1);
-    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info) && docVal.inherits(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -74,7 +74,7 @@ JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& arg
 JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
     JSValue nodeVal = args.at(0);
-    if (nodeVal.isObject(&JSNode::s_info)) {
+    if (nodeVal.inherits(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
diff --git a/WebCore/bindings/js/ScriptCachedFrameData.cpp b/WebCore/bindings/js/ScriptCachedFrameData.cpp
index 8852611..77b8ca4 100644
--- a/WebCore/bindings/js/ScriptCachedFrameData.cpp
+++ b/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -86,7 +86,7 @@ void ScriptCachedFrameData::clear()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    if (!m_window) {
+    if (m_window) {
         m_window = 0;
         gcController().garbageCollectSoon();
     }
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/js/ScriptCallFrame.cpp
index 58168d0..09752d1 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -40,7 +40,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index 8908155..6de9b75 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -33,6 +33,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 #include "XSSAuditor.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
@@ -84,12 +85,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
     String sourceURL = jsSourceCode.provider()->url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return JSValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return JSValue();
     }
@@ -130,6 +126,14 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     return JSValue();
 }
 
+void ScriptController::evaluateInIsolatedWorld(unsigned /* worldID */, const Vector<ScriptSourceCode>& sourceCode) 
+{
+    // FIXME: Actually support isolated worlds!
+    unsigned size = sourceCode.size();
+    for (unsigned i = 0; i < size; ++i)
+        evaluate(sourceCode[i]);
+}
+
 void ScriptController::clearWindowShell()
 {
     if (!m_windowShell)
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 4528495..56e8f0c 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -81,6 +81,7 @@ public:
     }
 
     ScriptValue evaluate(const ScriptSourceCode&);
+    void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
 
     void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
     int eventHandlerLineNumber() { return m_handlerLineNumber; }
diff --git a/WebCore/bindings/js/ScriptControllerHaiku.cpp b/WebCore/bindings/js/ScriptControllerHaiku.cpp
index b573b97..3fe471d 100644
--- a/WebCore/bindings/js/ScriptControllerHaiku.cpp
+++ b/WebCore/bindings/js/ScriptControllerHaiku.cpp
@@ -28,8 +28,8 @@
 #include "ScriptController.h"
 
 #include "PluginView.h"
-#include "runtime_root.h"
 #include "runtime.h"
+#include "runtime_root.h"
 
 
 namespace WebCore {
diff --git a/WebCore/bindings/js/ScriptEventListener.cpp b/WebCore/bindings/js/ScriptEventListener.cpp
index 878c535..0b0047b 100644
--- a/WebCore/bindings/js/ScriptEventListener.cpp
+++ b/WebCore/bindings/js/ScriptEventListener.cpp
@@ -33,12 +33,11 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "EventListener.h"
 #include "JSNode.h"
 #include "Frame.h"
 #include "XSSAuditor.h"
 
-#include <runtime/JSLock.h>
-
 using namespace JSC;
 
 namespace WebCore {
@@ -54,29 +53,25 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribu
 {
     ASSERT(node);
 
-    Frame* frame = node->document()->frame();
-    if (!frame)
-        return 0;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController->isEnabled())
-        return 0;
-
-    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
-        // This script is not safe to execute.
-        return 0;
-    }
+    int lineNumber = 1;
+    String sourceURL;
     
-    JSDOMWindow* globalObject = scriptController->globalObject();
-
-    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
-    {
-        JSLock lock(SilenceAssertionsOnly);
-        // FIXME: Should pass the global object associated with the node
-        toJS(globalObject->globalExec(), globalObject, node);
+    // FIXME: We should be able to provide accurate source information for frameless documents, too (e.g. for importing nodes from XMLHttpRequest.responseXML).
+    if (Frame* frame = node->document()->frame()) {
+        ScriptController* scriptController = frame->script();
+        if (!scriptController->isEnabled())
+            return 0;
+
+        if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+            // This script is not safe to execute.
+            return 0;
+        }
+
+        lineNumber = scriptController->eventHandlerLineNumber();
+        sourceURL = node->document()->url().string();
     }
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), node, sourceURL, lineNumber);
 }
 
 PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -84,19 +79,29 @@ PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attri
     if (!frame)
         return 0;
 
+    int lineNumber = 1;
+    String sourceURL;
+    
     ScriptController* scriptController = frame->script();
     if (!scriptController->isEnabled())
         return 0;
-    
+
     if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
         // This script is not safe to execute.
         return 0;
     }
 
-    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
-    JSDOMWindow* globalObject = scriptController->globalObject();
+    lineNumber = scriptController->eventHandlerLineNumber();
+    sourceURL = frame->document()->url().string();
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), 0, sourceURL, lineNumber);
+}
 
-    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+String getEventListenerHandlerBody(ScriptExecutionContext* context, ScriptState* scriptState, EventListener* eventListener)
+{
+    JSC::JSObject* functionObject = eventListener->jsFunction(context);
+    if (!functionObject)
+        return "";
+    return functionObject->toString(scriptState);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptEventListener.h b/WebCore/bindings/js/ScriptEventListener.h
index 8299d29..3396541 100644
--- a/WebCore/bindings/js/ScriptEventListener.h
+++ b/WebCore/bindings/js/ScriptEventListener.h
@@ -32,17 +32,20 @@
 #define ScriptEventListener_h
 
 #include "JSLazyEventListener.h"
+#include "ScriptState.h"
 
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
     class Attribute;
+    class EventListener;
     class Frame;
     class Node;
 
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
     PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState*, EventListener*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptObject.cpp b/WebCore/bindings/js/ScriptObject.cpp
index beadc4a..aaf4163 100644
--- a/WebCore/bindings/js/ScriptObject.cpp
+++ b/WebCore/bindings/js/ScriptObject.cpp
@@ -106,6 +106,14 @@ bool ScriptObject::set(const char* name, int value)
     return handleException(m_scriptState);
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    JSLock lock(SilenceAssertionsOnly);
+    PutPropertySlot slot;
+    jsObject()->put(m_scriptState, Identifier(m_scriptState, name), jsNumber(m_scriptState, value), slot);
+    return handleException(m_scriptState);
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -127,7 +135,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const S
     return handleException(scriptState);
 }
 
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+=======
+#if ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorBackend* value)
 {
     JSLock lock(SilenceAssertionsOnly);
@@ -135,7 +147,11 @@ bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, Inspect
     globalObject->putDirect(Identifier(scriptState, name), toJS(scriptState, globalObject, value));
     return handleException(scriptState);
 }
+<<<<<<< HEAD:WebCore/bindings/js/ScriptObject.cpp
 #endif
+=======
+#endif // ENABLE(INSPECTOR)
+>>>>>>> webkit.org at 49305:WebCore/bindings/js/ScriptObject.cpp
 
 bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
 {
diff --git a/WebCore/bindings/js/ScriptObject.h b/WebCore/bindings/js/ScriptObject.h
index 50b63ad..31381f3 100644
--- a/WebCore/bindings/js/ScriptObject.h
+++ b/WebCore/bindings/js/ScriptObject.h
@@ -52,6 +52,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
@@ -63,7 +64,9 @@ namespace WebCore {
     class ScriptGlobalObject {
     public:
         static bool set(ScriptState*, const char* name, const ScriptObject&);
+#if ENABLE(INSPECTOR)
         static bool set(ScriptState*, const char* name, InspectorBackend*);
+#endif
         static bool get(ScriptState*, const char* name, ScriptObject&);
         static bool remove(ScriptState*, const char* name);
     private:
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
index 89553ef..b48556e 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "ScriptObjectQuarantine.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "Document.h"
 #include "Frame.h"
 #include "JSDOMBinding.h"
@@ -38,6 +40,7 @@
 #include "JSNode.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include <runtime/JSLock.h>
 
@@ -80,10 +83,11 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
 #endif
 
 #if ENABLE(DOM_STORAGE)
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
     JSDOMGlobalObject* globalObject = toJSDOMWindow(frame);
     ExecState* exec = globalObject->globalExec();
@@ -123,3 +127,5 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
 
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/bindings/js/ScriptObjectQuarantine.h b/WebCore/bindings/js/ScriptObjectQuarantine.h
index d70acd7..df52379 100644
--- a/WebCore/bindings/js/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -37,7 +37,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -49,7 +48,7 @@ namespace WebCore {
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
 #endif
 #if ENABLE(DOM_STORAGE)
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
 #endif
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
diff --git a/WebCore/bindings/js/ScriptValue.cpp b/WebCore/bindings/js/ScriptValue.cpp
index d427cee..6eac102 100644
--- a/WebCore/bindings/js/ScriptValue.cpp
+++ b/WebCore/bindings/js/ScriptValue.cpp
@@ -74,4 +74,11 @@ bool ScriptValue::isUndefined() const
     return m_value.get().isUndefined();
 }
 
+bool ScriptValue::isObject() const
+{
+    if (!m_value)
+        return false;
+    return m_value.get().isObject();
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/js/ScriptValue.h b/WebCore/bindings/js/ScriptValue.h
index 209ce06..19bb693 100644
--- a/WebCore/bindings/js/ScriptValue.h
+++ b/WebCore/bindings/js/ScriptValue.h
@@ -50,6 +50,7 @@ public:
     bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool isObject() const;
     bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
new file mode 100644
index 0000000..48cd92d
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -0,0 +1,839 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "SerializedScriptValue.h"
+
+#include <runtime/DateInstance.h>
+#include <runtime/ExceptionHelpers.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/HashTraits.h>
+#include <wtf/Vector.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+class SerializedObject : public SharedSerializedData
+{
+public:
+    typedef Vector<RefPtr<StringImpl> > PropertyNameList;
+    typedef Vector<SerializedScriptValueData> ValueList;
+
+    void set(const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        ASSERT(m_names.size() == m_values.size());
+        m_names.append(String(propertyName.ustring()).crossThreadString().impl());
+        m_values.append(value);
+    }
+
+    PropertyNameList& names() { return m_names; }
+
+    ValueList& values() { return m_values; }
+
+    static PassRefPtr<SerializedObject> create()
+    {
+        return adoptRef(new SerializedObject);
+    }
+
+    void clear()
+    {
+        m_names.clear();
+        m_values.clear();
+    }
+
+private:
+    SerializedObject() { }
+    PropertyNameList m_names;
+    ValueList m_values;
+};
+
+class SerializedArray : public SharedSerializedData
+{
+    typedef HashMap<unsigned, SerializedScriptValueData, DefaultHash<unsigned>::Hash, WTF::UnsignedWithZeroKeyHashTraits<unsigned> > SparseMap;
+public:
+    void setIndex(unsigned index, const SerializedScriptValueData& value)
+    {
+        ASSERT(index < m_length);
+        if (index == m_compactStorage.size())
+            m_compactStorage.append(value);
+        else
+            m_sparseStorage.set(index, value);
+    }
+
+    bool canDoFastRead(unsigned index) const
+    {
+        ASSERT(index < m_length);
+        return index < m_compactStorage.size();
+    }
+
+    const SerializedScriptValueData& getIndex(unsigned index)
+    {
+        ASSERT(index < m_compactStorage.size());
+        return m_compactStorage[index];
+    }
+
+    SerializedScriptValueData getSparseIndex(unsigned index, bool& hasIndex)
+    {
+        ASSERT(index >= m_compactStorage.size());
+        ASSERT(index < m_length);
+        SparseMap::iterator iter = m_sparseStorage.find(index);
+        if (iter == m_sparseStorage.end()) {
+            hasIndex = false;
+            return SerializedScriptValueData();
+        }
+        hasIndex = true;
+        return iter->second;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    static PassRefPtr<SerializedArray> create(unsigned length)
+    {
+        return adoptRef(new SerializedArray(length));
+    }
+
+    void clear()
+    {
+        m_compactStorage.clear();
+        m_sparseStorage.clear();
+        m_length = 0;
+    }
+private:
+    SerializedArray(unsigned length)
+        : m_length(length)
+    {
+    }
+
+    Vector<SerializedScriptValueData> m_compactStorage;
+    SparseMap m_sparseStorage;
+    unsigned m_length;
+};
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedObject> data)
+    : m_type(ObjectType)
+    , m_sharedData(data)
+{
+}
+
+SerializedScriptValueData::SerializedScriptValueData(RefPtr<SerializedArray> data)
+    : m_type(ArrayType)
+    , m_sharedData(data)
+{
+}
+
+SerializedArray* SharedSerializedData::asArray()
+{
+    return static_cast<SerializedArray*>(this);
+}
+
+SerializedObject* SharedSerializedData::asObject()
+{
+    return static_cast<SerializedObject*>(this);
+}
+
+static const unsigned maximumFilterRecursion = 40000;
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember,
+    ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+template <typename TreeWalker> typename TreeWalker::OutputType walk(TreeWalker& context, typename TreeWalker::InputType in)
+{
+    typedef typename TreeWalker::InputObject InputObject;
+    typedef typename TreeWalker::InputArray InputArray;
+    typedef typename TreeWalker::OutputObject OutputObject;
+    typedef typename TreeWalker::OutputArray OutputArray;
+    typedef typename TreeWalker::InputType InputType;
+    typedef typename TreeWalker::OutputType OutputType;
+    typedef typename TreeWalker::PropertyList PropertyList;
+
+    Vector<uint32_t, 16> indexStack;
+    Vector<uint32_t, 16> lengthStack;
+    Vector<PropertyList, 16> propertyStack;
+    Vector<InputObject, 16> inputObjectStack;
+    Vector<InputArray, 16> inputArrayStack;
+    Vector<OutputObject, 16> outputObjectStack;
+    Vector<OutputArray, 16> outputArrayStack;
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    InputType inValue = in;
+    OutputType outValue = context.null();
+
+    unsigned tickCount = context.ticksUntilNextCheck();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(context.isArray(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+
+                InputArray inArray = context.asInputArray(inValue);
+                unsigned length = context.length(inArray);
+                OutputArray outArray = context.createOutputArray(length);
+                if (!context.startArray(inArray, outArray))
+                    return context.null();
+                inputArrayStack.append(inArray);
+                outputArrayStack.append(outArray);
+                indexStack.append(0);
+                lengthStack.append(length);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputArray array = inputArrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == lengthStack.last()) {
+                    InputArray inArray = inputArrayStack.last();
+                    OutputArray outArray = outputArrayStack.last();
+                    context.endArray(inArray, outArray);
+                    outValue = outArray;
+                    inputArrayStack.removeLast();
+                    outputArrayStack.removeLast();
+                    indexStack.removeLast();
+                    lengthStack.removeLast();
+                    break;
+                }
+                if (context.canDoFastRead(array, index))
+                    inValue = context.getIndex(array, index);
+                else {
+                    bool hasIndex = false;
+                    inValue = context.getSparseIndex(array, index, hasIndex);
+                    if (!hasIndex) {
+                        indexStack.last()++;
+                        goto arrayStartVisitMember;
+                    }
+                }
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                OutputArray outArray = outputArrayStack.last();
+                context.putProperty(outArray, indexStack.last(), outValue);
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(context.isObject(inValue));
+                if (inputObjectStack.size() + inputArrayStack.size() > maximumFilterRecursion) {
+                    context.throwStackOverflow();
+                    return context.null();
+                }
+                InputObject inObject = context.asInputObject(inValue);
+                OutputObject outObject = context.createOutputObject();
+                if (!context.startObject(inObject, outObject))
+                    return context.null();
+                inputObjectStack.append(inObject);
+                outputObjectStack.append(outObject);
+                indexStack.append(0);
+                context.getPropertyNames(inObject, propertyStack);
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                if (!--tickCount) {
+                    if (context.didTimeOut()) {
+                        context.throwInterruptedException();
+                        return context.null();
+                    }
+                    tickCount = context.ticksUntilNextCheck();
+                }
+
+                InputObject object = inputObjectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyList& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    InputObject inObject = inputObjectStack.last();
+                    OutputObject outObject = outputObjectStack.last();
+                    context.endObject(inObject, outObject);
+                    outValue = outObject;
+                    inputObjectStack.removeLast();
+                    outputObjectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                inValue = context.getProperty(object, properties[index], index);
+
+                if (context.shouldTerminate())
+                    return context.null();
+
+                if (OutputType transformed = context.convertIfTerminal(inValue))
+                    outValue = transformed;
+                else {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                }
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                context.putProperty(outputObjectStack.last(), propertyStack.last()[indexStack.last()], outValue);
+                if (context.shouldTerminate())
+                    return context.null();
+
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (OutputType transformed = context.convertIfTerminal(inValue)) {
+                    outValue = transformed;
+                    break;
+                }
+                if (context.isArray(inValue))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+
+        state = stateStack.last();
+        stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (context.didTimeOut()) {
+                context.throwInterruptedException();
+                return context.null();
+            }
+            tickCount = context.ticksUntilNextCheck();
+        }
+    }
+    return outValue;
+}
+
+struct BaseWalker {
+    BaseWalker(ExecState* exec)
+        : m_exec(exec)
+        , m_timeoutChecker(exec->globalData().timeoutChecker)
+    {
+        m_timeoutChecker.reset();
+    }
+    ExecState* m_exec;
+    TimeoutChecker m_timeoutChecker;
+    MarkedArgumentBuffer m_gcBuffer;
+
+    bool shouldTerminate()
+    {
+        return m_exec->hadException();
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return m_timeoutChecker.ticksUntilNextCheck();
+    }
+
+    bool didTimeOut()
+    {
+        return m_timeoutChecker.didTimeOut(m_exec);
+    }
+
+    void throwStackOverflow()
+    {
+        m_exec->setException(createStackOverflowError(m_exec));
+    }
+
+    void throwInterruptedException()
+    {
+        m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+    }
+};
+
+struct SerializingTreeWalker : public BaseWalker {
+    typedef JSValue InputType;
+    typedef JSArray* InputArray;
+    typedef JSObject* InputObject;
+    typedef SerializedScriptValueData OutputType;
+    typedef RefPtr<SerializedArray> OutputArray;
+    typedef RefPtr<SerializedObject> OutputObject;
+    typedef PropertyNameArray PropertyList;
+
+    SerializingTreeWalker(ExecState* exec)
+        : BaseWalker(exec)
+    {
+    }
+
+    OutputType null() { return SerializedScriptValueData(); }
+
+    bool isArray(JSValue value)
+    {
+        if (!value.isObject())
+            return false;
+        JSObject* object = asObject(value);
+        return isJSArray(&m_exec->globalData(), object) || object->inherits(&JSArray::info);
+    }
+
+    bool isObject(JSValue value)
+    {
+        return value.isObject();
+    }
+
+    JSArray* asInputArray(JSValue value)
+    {
+        return asArray(value);
+    }
+
+    JSObject* asInputObject(JSValue value)
+    {
+        return asObject(value);
+    }
+
+    PassRefPtr<SerializedArray> createOutputArray(unsigned length)
+    {
+        return SerializedArray::create(length);
+    }
+
+    PassRefPtr<SerializedObject> createOutputObject()
+    {
+        return SerializedObject::create();
+    }
+
+    uint32_t length(JSValue array)
+    {
+        ASSERT(array.isObject());
+        JSObject* object = asObject(array);
+        return object->get(m_exec, m_exec->propertyNames().length).toUInt32(m_exec);
+    }
+
+    bool canDoFastRead(JSArray* array, unsigned index)
+    {
+        return isJSArray(&m_exec->globalData(), array) && array->canGetIndex(index);
+    }
+
+    JSValue getIndex(JSArray* array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    JSValue getSparseIndex(JSObject* object, unsigned propertyName, bool& hasIndex)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot)) {
+            hasIndex = true;
+            return slot.getValue(m_exec, propertyName);
+        }
+        hasIndex = false;
+        return jsNull();
+    }
+
+    JSValue getProperty(JSObject* object, const Identifier& propertyName, unsigned)
+    {
+        PropertySlot slot(object);
+        if (object->getOwnPropertySlot(m_exec, propertyName, slot))
+            return slot.getValue(m_exec, propertyName);
+        return jsNull();
+    }
+
+    SerializedScriptValueData convertIfTerminal(JSValue value)
+    {
+        if (!value.isCell())
+            return SerializedScriptValueData(value);
+
+        if (value.isString())
+            return SerializedScriptValueData(asString(value)->value());
+
+        if (value.isNumber())
+            return SerializedScriptValueData(SerializedScriptValueData::NumberType, value.uncheckedGetNumber());
+
+        if (value.isObject() && asObject(value)->inherits(&DateInstance::info))
+            return SerializedScriptValueData(SerializedScriptValueData::DateType, asDateInstance(value)->internalNumber());
+
+        if (isArray(value))
+            return SerializedScriptValueData();
+
+        CallData unusedData;
+        if (value.isObject() && value.getCallData(unusedData) == CallTypeNone)
+            return SerializedScriptValueData();
+
+        // Any other types are expected to serialize as null.
+        return SerializedScriptValueData(jsNull());
+    }
+
+    void getPropertyNames(JSObject* object, Vector<PropertyNameArray, 16>& propertyStack)
+    {
+        propertyStack.append(PropertyNameArray(m_exec));
+        object->getOwnPropertyNames(m_exec, propertyStack.last());
+    }
+
+    void putProperty(RefPtr<SerializedArray> array, unsigned propertyName, const SerializedScriptValueData& value)
+    {
+        array->setIndex(propertyName, value);
+    }
+
+    void putProperty(RefPtr<SerializedObject> object, const Identifier& propertyName, const SerializedScriptValueData& value)
+    {
+        object->set(propertyName, value);
+    }
+
+    bool startArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inArray).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inArray);
+        return true;
+    }
+
+    void endArray(JSArray* inArray, RefPtr<SerializedArray>)
+    {
+        m_cycleDetector.remove(inArray);
+        m_gcBuffer.removeLast();
+    }
+
+    bool startObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        // Cycle detection
+        if (!m_cycleDetector.add(inObject).second) {
+            m_exec->setException(createTypeError(m_exec, "Cannot post cyclic structures."));
+            return false;
+        }
+        m_gcBuffer.append(inObject);
+        return true;
+    }
+
+    void endObject(JSObject* inObject, RefPtr<SerializedObject>)
+    {
+        m_cycleDetector.remove(inObject);
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    HashSet<JSObject*> m_cycleDetector;
+};
+
+SerializedScriptValueData SerializedScriptValueData::serialize(ExecState* exec, JSValue inValue)
+{
+    SerializingTreeWalker context(exec);
+    return walk<SerializingTreeWalker>(context, inValue);
+}
+
+
+struct DeserializingTreeWalker : public BaseWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef JSValue OutputType;
+    typedef JSArray* OutputArray;
+    typedef JSObject* OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    DeserializingTreeWalker(ExecState* exec, bool mustCopy)
+        : BaseWalker(exec)
+        , m_mustCopy(mustCopy)
+    {
+    }
+
+    OutputType null() { return jsNull(); }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    JSArray* createOutputArray(unsigned length)
+    {
+        JSArray* array = constructEmptyArray(m_exec);
+        array->setLength(length);
+        return array;
+    }
+
+    JSObject* createOutputObject()
+    {
+        return constructEmptyObject(m_exec);
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    JSValue convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return JSValue();
+            case SerializedScriptValueData::StringType:
+                return jsString(m_exec, value.asString().crossThreadString());
+            case SerializedScriptValueData::ImmediateType:
+                return value.asImmediate();
+            case SerializedScriptValueData::NumberType:
+                return jsNumber(m_exec, value.asDouble());
+            case SerializedScriptValueData::DateType:
+                return new (m_exec) DateInstance(m_exec, value.asDouble());
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(JSArray* array, unsigned propertyName, JSValue value)
+    {
+        array->put(m_exec, propertyName, value);
+    }
+
+    void putProperty(JSObject* object, const RefPtr<StringImpl> propertyName, JSValue value)
+    {
+        object->putDirect(Identifier(m_exec, String(propertyName)), value);
+    }
+
+    bool startArray(RefPtr<SerializedArray>, JSArray* outArray)
+    {
+        m_gcBuffer.append(outArray);
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray>, JSArray*)
+    {
+        m_gcBuffer.removeLast();
+    }
+    bool startObject(RefPtr<SerializedObject>, JSObject* outObject)
+    {
+        m_gcBuffer.append(outObject);
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject>, JSObject*)
+    {
+        m_gcBuffer.removeLast();
+    }
+
+private:
+    bool m_mustCopy;
+};
+
+JSValue SerializedScriptValueData::deserialize(ExecState* exec, bool mustCopy) const
+{
+    DeserializingTreeWalker context(exec, mustCopy);
+    return walk<DeserializingTreeWalker>(context, *this);
+}
+
+struct TeardownTreeWalker {
+    typedef SerializedScriptValueData InputType;
+    typedef RefPtr<SerializedArray> InputArray;
+    typedef RefPtr<SerializedObject> InputObject;
+    typedef bool OutputType;
+    typedef bool OutputArray;
+    typedef bool OutputObject;
+    typedef SerializedObject::PropertyNameList PropertyList;
+
+    bool shouldTerminate()
+    {
+        return false;
+    }
+
+    unsigned ticksUntilNextCheck()
+    {
+        return 0xFFFFFFFF;
+    }
+
+    bool didTimeOut()
+    {
+        return false;
+    }
+
+    void throwStackOverflow()
+    {
+    }
+
+    void throwInterruptedException()
+    {
+    }
+
+    bool null() { return false; }
+
+    bool isArray(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ArrayType;
+    }
+
+    bool isObject(const SerializedScriptValueData& value)
+    {
+        return value.type() == SerializedScriptValueData::ObjectType;
+    }
+
+    SerializedArray* asInputArray(const SerializedScriptValueData& value)
+    {
+        return value.asArray();
+    }
+
+    SerializedObject* asInputObject(const SerializedScriptValueData& value)
+    {
+        return value.asObject();
+    }
+
+    bool createOutputArray(unsigned)
+    {
+        return false;
+    }
+
+    bool createOutputObject()
+    {
+        return false;
+    }
+
+    uint32_t length(RefPtr<SerializedArray> array)
+    {
+        return array->length();
+    }
+
+    bool canDoFastRead(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->canDoFastRead(index);
+    }
+
+    SerializedScriptValueData getIndex(RefPtr<SerializedArray> array, unsigned index)
+    {
+        return array->getIndex(index);
+    }
+
+    SerializedScriptValueData getSparseIndex(RefPtr<SerializedArray> array, unsigned propertyName, bool& hasIndex)
+    {
+        return array->getSparseIndex(propertyName, hasIndex);
+    }
+
+    SerializedScriptValueData getProperty(RefPtr<SerializedObject> object, const RefPtr<StringImpl>& propertyName, unsigned propertyIndex)
+    {
+        ASSERT(object->names()[propertyIndex] == propertyName);
+        UNUSED_PARAM(propertyName);
+        return object->values()[propertyIndex];
+    }
+
+    bool convertIfTerminal(SerializedScriptValueData& value)
+    {
+        switch (value.type()) {
+            case SerializedScriptValueData::ArrayType:
+            case SerializedScriptValueData::ObjectType:
+                return false;
+            case SerializedScriptValueData::StringType:
+            case SerializedScriptValueData::ImmediateType:
+            case SerializedScriptValueData::NumberType:
+                return true;
+            default:
+                ASSERT_NOT_REACHED();
+                return JSValue();
+        }
+    }
+
+    void getPropertyNames(RefPtr<SerializedObject> object, Vector<SerializedObject::PropertyNameList, 16>& properties)
+    {
+        properties.append(object->names());
+    }
+
+    void putProperty(bool, unsigned, bool)
+    {
+    }
+
+    void putProperty(bool, const RefPtr<StringImpl>&, bool)
+    {
+    }
+
+    bool startArray(RefPtr<SerializedArray>, bool)
+    {
+        return true;
+    }
+    void endArray(RefPtr<SerializedArray> array, bool)
+    {
+        array->clear();
+    }
+    bool startObject(RefPtr<SerializedObject>, bool)
+    {
+        return true;
+    }
+    void endObject(RefPtr<SerializedObject> object, bool)
+    {
+        object->clear();
+    }
+};
+
+void SerializedScriptValueData::tearDownSerializedData()
+{
+    if (m_sharedData && m_sharedData->refCount() > 1)
+        return;
+    TeardownTreeWalker context;
+    walk<TeardownTreeWalker>(context, *this);
+}
+
+}
diff --git a/WebCore/bindings/js/SerializedScriptValue.h b/WebCore/bindings/js/SerializedScriptValue.h
new file mode 100644
index 0000000..f8a126f
--- /dev/null
+++ b/WebCore/bindings/js/SerializedScriptValue.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+
+namespace WebCore {
+    class SerializedObject;
+    class SerializedArray;
+
+    class SharedSerializedData : public RefCounted<SharedSerializedData> {
+    public:
+        virtual ~SharedSerializedData() { }
+        SerializedArray* asArray();
+        SerializedObject* asObject();
+    };
+
+    class SerializedScriptValue;
+
+    class SerializedScriptValueData {
+    public:
+        enum SerializedType {
+            EmptyType,
+            DateType,
+            NumberType,
+            ImmediateType,
+            ObjectType,
+            ArrayType,
+            StringType
+        };
+
+        SerializedType type() const { return m_type; }
+        static SerializedScriptValueData serialize(JSC::ExecState*, JSC::JSValue);
+        JSC::JSValue deserialize(JSC::ExecState*, bool mustCopy) const;
+
+        ~SerializedScriptValueData()
+        {
+            if (m_sharedData)
+                tearDownSerializedData();
+        }
+
+        SerializedScriptValueData()
+            : m_type(EmptyType)
+        {
+        }
+
+        explicit SerializedScriptValueData(const String& string)
+            : m_type(StringType)
+            , m_string(string.crossThreadString()) // FIXME: Should be able to just share the Rep
+        {
+        }
+
+        explicit SerializedScriptValueData(JSC::JSValue value)
+            : m_type(ImmediateType)
+        {
+            ASSERT(!value.isCell());
+            m_data.m_immediate = JSC::JSValue::encode(value);
+        }
+
+        SerializedScriptValueData(SerializedType type, double value)
+            : m_type(type)
+        {
+            m_data.m_double = value;
+        }
+
+        SerializedScriptValueData(RefPtr<SerializedObject>);
+        SerializedScriptValueData(RefPtr<SerializedArray>);
+
+        JSC::JSValue asImmediate() const
+        {
+            ASSERT(m_type == ImmediateType);
+            return JSC::JSValue::decode(m_data.m_immediate);
+        }
+
+        double asDouble() const
+        {
+            ASSERT(m_type == NumberType || m_type == DateType);
+            return m_data.m_double;
+        }
+
+        String asString() const
+        {
+            ASSERT(m_type == StringType);
+            return m_string;
+        }
+
+        SerializedObject* asObject() const
+        {
+            ASSERT(m_type == ObjectType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asObject();
+        }
+
+        SerializedArray* asArray() const
+        {
+            ASSERT(m_type == ArrayType);
+            ASSERT(m_sharedData);
+            return m_sharedData->asArray();
+        }
+
+        operator bool() const { return m_type != EmptyType; }
+
+        SerializedScriptValueData release()
+        {
+            SerializedScriptValueData result = *this;
+            *this = SerializedScriptValueData();
+            return result;
+        }
+
+    private:
+        void tearDownSerializedData();
+        SerializedType m_type;
+        RefPtr<SharedSerializedData> m_sharedData;
+        String m_string;
+        union {
+            double m_double;
+            JSC::EncodedJSValue m_immediate;
+        } m_data;
+    };
+
+    class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+    public:
+        static PassRefPtr<SerializedScriptValue> create(JSC::ExecState* exec, JSC::JSValue value)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData::serialize(exec, value)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create(String string)
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData(string)));
+        }
+
+        static PassRefPtr<SerializedScriptValue> create()
+        {
+            return adoptRef(new SerializedScriptValue(SerializedScriptValueData()));
+        }
+
+        PassRefPtr<SerializedScriptValue> release()
+        {
+            PassRefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_value));
+            m_value = SerializedScriptValueData();
+            result->m_mustCopy = true;
+            return result;
+        }
+
+        String toString()
+        {
+            if (m_value.type() != SerializedScriptValueData::StringType)
+                return "";
+            return m_value.asString();
+        }
+
+        JSC::JSValue deserialize(JSC::ExecState* exec)
+        {
+            if (!m_value)
+                return JSC::jsNull();
+            return m_value.deserialize(exec, m_mustCopy);
+        }
+
+        ~SerializedScriptValue() {}
+
+    private:
+        SerializedScriptValue(SerializedScriptValueData value)
+            : m_value(value)
+            , m_mustCopy(false)
+        {
+        }
+
+        SerializedScriptValueData m_value;
+        bool m_mustCopy;
+    };
+}
+
+#endif // SerializedScriptValue_h
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 62bf1de..63a3b2a 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -29,21 +29,23 @@
 #import "DOMInternal.h" // import first to make the private/public trick work
 #import "DOM.h"
 
-#import "DOMRangeInternal.h"
 #import "DOMElementInternal.h"
-#import "DOMNodeInternal.h"
 #import "DOMHTMLCanvasElement.h"
+#import "DOMNodeInternal.h"
+#import "DOMPrivate.h"
+#import "DOMRangeInternal.h"
 #import "Frame.h"
-#import "HTMLNames.h"
 #import "HTMLElement.h"
-#import "RenderImage.h"
+#import "HTMLNames.h"
 #import "NodeFilter.h"
+#import "RenderImage.h"
 #import "WebScriptObjectPrivate.h"
 #import <wtf/HashMap.h>
 
 #if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVG.h"
 #import "SVGElementInstance.h"
+#import "SVGNames.h"
 #endif
 
 using namespace JSC;
@@ -154,9 +156,6 @@ static void createElementClassMap()
     addElementClass(SVGNames::circleTag, [DOMSVGCircleElement class]);
     addElementClass(SVGNames::clipPathTag, [DOMSVGClipPathElement class]);
     addElementClass(SVGNames::cursorTag, [DOMSVGCursorElement class]);
-#if ENABLE(SVG_FONTS)
-    addElementClass(SVGNames::definition_srcTag, [DOMSVGDefinitionSrcElement class]);
-#endif
     addElementClass(SVGNames::defsTag, [DOMSVGDefsElement class]);
     addElementClass(SVGNames::descTag, [DOMSVGDescElement class]);
     addElementClass(SVGNames::ellipseTag, [DOMSVGEllipseElement class]);
@@ -359,20 +358,6 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
     return renderer->absoluteBoundingBoxRect();
 }
 
-- (NSArray *)textRects
-{
-    // FIXME: Could we move this function to WebCore::Node and autogenerate?
-    core(self)->document()->updateLayoutIgnorePendingStylesheets();
-    if (!core(self)->renderer())
-        return nil;
-    RefPtr<Range> range = Range::create(core(self)->document());
-    WebCore::ExceptionCode ec = 0;
-    range->selectNodeContents(core(self), ec);
-    Vector<WebCore::IntRect> rects;
-    range->textRects(rects);
-    return kit(rects);
-}
-
 - (NSArray *)lineBoxRects
 {
     return [self textRects];
@@ -392,6 +377,19 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
     return frame->nodeImage(node);
 }
 
+- (NSArray *)textRects
+{
+    // FIXME: Could we move this function to WebCore::Node and autogenerate?
+    core(self)->document()->updateLayoutIgnorePendingStylesheets();
+    if (!core(self)->renderer())
+        return nil;
+    RefPtr<Range> range = Range::create(core(self)->document());
+    WebCore::ExceptionCode ec = 0;
+    range->selectNodeContents(core(self), ec);
+    Vector<WebCore::IntRect> rects;
+    range->textRects(rects);
+    return kit(rects);
+}
 @end
 
 @implementation DOMRange (DOMRangeExtensions)
diff --git a/WebCore/bindings/objc/DOMCSS.mm b/WebCore/bindings/objc/DOMCSS.mm
index 0149273..22a9cb2 100644
--- a/WebCore/bindings/objc/DOMCSS.mm
+++ b/WebCore/bindings/objc/DOMCSS.mm
@@ -47,6 +47,7 @@
 #import "DOMStyleSheetInternal.h"
 #import "DOMWebKitCSSKeyframeRule.h"
 #import "DOMWebKitCSSKeyframesRule.h"
+#import "DOMWebKitCSSTransformValue.h"
 
 #if ENABLE(SVG_DOM_OBJC_BINDINGS)
 #import "DOMSVGPaint.h"
@@ -102,6 +103,8 @@ Class kitClass(WebCore::CSSValue* impl)
         case WebCore::CSSValue::CSS_PRIMITIVE_VALUE:
             return [DOMCSSPrimitiveValue class];
         case WebCore::CSSValue::CSS_VALUE_LIST:
+            if (impl->isWebKitCSSTransformValue())
+                return [DOMWebKitCSSTransformValue class];
             return [DOMCSSValueList class];
         case WebCore::CSSValue::CSS_INHERIT:
         case WebCore::CSSValue::CSS_INITIAL:
diff --git a/WebCore/bindings/objc/DOMInternal.h b/WebCore/bindings/objc/DOMInternal.h
index 48f5d2f..72f63d2 100644
--- a/WebCore/bindings/objc/DOMInternal.h
+++ b/WebCore/bindings/objc/DOMInternal.h
@@ -61,7 +61,6 @@ namespace WebCore {
 
 // Create an NSMapTable mapping from pointers to ObjC objects held with zeroing weak references.
 NSMapTable* createWrapperCache();
-NSMapTable* createWrapperCacheWithIntegerKeys(); // Same, but from integers to ObjC objects.
 
 id createDOMWrapper(JSC::JSObject*, PassRefPtr<JSC::Bindings::RootObject> origin, PassRefPtr<JSC::Bindings::RootObject> current);
 
diff --git a/WebCore/bindings/objc/DOMInternal.mm b/WebCore/bindings/objc/DOMInternal.mm
index 9b26e59..993a3ad 100644
--- a/WebCore/bindings/objc/DOMInternal.mm
+++ b/WebCore/bindings/objc/DOMInternal.mm
@@ -49,18 +49,6 @@ NSMapTable* createWrapperCache()
 #endif
 }
 
-NSMapTable* createWrapperCacheWithIntegerKeys()
-{
-#ifdef BUILDING_ON_TIGER
-    return NSCreateMapTable(NSIntMapKeyCallBacks, NSNonRetainedObjectMapValueCallBacks, 0);
-#else
-    // NSMapTable with zeroing weak pointers is the recommended way to build caches like this under garbage collection.
-    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsIntegerPersonality;
-    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsZeroingWeakMemory | NSPointerFunctionsObjectPersonality;
-    return [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
-#endif
-}
-
 NSObject* getDOMWrapper(DOMObjectInternal* impl)
 {
     if (!DOMWrapperCache)
diff --git a/WebCore/bindings/objc/DOMSVG.h b/WebCore/bindings/objc/DOMSVG.h
index f1321d8..cb74544 100644
--- a/WebCore/bindings/objc/DOMSVG.h
+++ b/WebCore/bindings/objc/DOMSVG.h
@@ -50,7 +50,6 @@
 #import <WebCore/DOMSVGColor.h>
 #import <WebCore/DOMSVGComponentTransferFunctionElement.h>
 #import <WebCore/DOMSVGCursorElement.h>
-#import <WebCore/DOMSVGDefinitionSrcElement.h>
 #import <WebCore/DOMSVGDefsElement.h>
 #import <WebCore/DOMSVGDescElement.h>
 #import <WebCore/DOMSVGDocument.h>
diff --git a/WebCore/bindings/objc/ObjCEventListener.h b/WebCore/bindings/objc/ObjCEventListener.h
index 6056b01..434ef45 100644
--- a/WebCore/bindings/objc/ObjCEventListener.h
+++ b/WebCore/bindings/objc/ObjCEventListener.h
@@ -39,13 +39,22 @@ namespace WebCore {
     public:
         static PassRefPtr<ObjCEventListener> wrap(id <DOMEventListener>);
 
+        static const ObjCEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == ObjCEventListenerType
+                ? static_cast<const ObjCEventListener*>(listener)
+                : 0;
+        }
+
+        virtual bool operator==(const EventListener& other);
+
     private:
         static ObjCEventListener* find(id <DOMEventListener>);
 
         ObjCEventListener(id <DOMEventListener>);
         virtual ~ObjCEventListener();
 
-        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
 
         id <DOMEventListener> m_listener;
     };
diff --git a/WebCore/bindings/objc/ObjCEventListener.mm b/WebCore/bindings/objc/ObjCEventListener.mm
index 77c6ad2..d73ac30 100644
--- a/WebCore/bindings/objc/ObjCEventListener.mm
+++ b/WebCore/bindings/objc/ObjCEventListener.mm
@@ -56,7 +56,8 @@ PassRefPtr<ObjCEventListener> ObjCEventListener::wrap(id <DOMEventListener> list
 }
 
 ObjCEventListener::ObjCEventListener(id <DOMEventListener> listener)
-    : m_listener([listener retain])
+    : EventListener(ObjCEventListenerType)
+    , m_listener([listener retain])
 {
     ListenerMap* map = listenerMap;
     if (!map) {
@@ -72,9 +73,16 @@ ObjCEventListener::~ObjCEventListener()
     [m_listener release];
 }
 
-void ObjCEventListener::handleEvent(Event* event, bool)
+void ObjCEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     [m_listener handleEvent:kit(event)];
 }
 
+bool ObjCEventListener::operator==(const EventListener& listener)
+{
+    if (const ObjCEventListener* objCEventListener = ObjCEventListener::cast(&listener))
+        return m_listener == objCEventListener->m_listener;
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/scripts/CodeGenerator.pm b/WebCore/bindings/scripts/CodeGenerator.pm
index 341c607..92bd390 100644
--- a/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/WebCore/bindings/scripts/CodeGenerator.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2005 Nikolas Zimmermann <wildfox@kde.org>
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -23,12 +24,16 @@
 
 package CodeGenerator;
 
+use File::Find;
+
 my $useDocument = "";
 my $useGenerator = "";
 my $useOutputDir = "";
 my $useDirectories = "";
 my $useLayerOnTop = 0;
 my $preprocessor;
+my $writeDependencies = 0;
+my $defines = "";
 
 my $codeGenerator = 0;
 
@@ -54,12 +59,8 @@ my %svgAnimatedTypeHash = ("SVGAnimatedAngle" => 1, "SVGAnimatedBoolean" => 1,
                            "SVGAnimatedRect" => 1, "SVGAnimatedString" => 1,
                            "SVGAnimatedTransformList" => 1);
 
-# Helpers for 'ScanDirectory'
-my $endCondition = 0;
-my $foundFilename = "";
-my @foundFilenames = ();
-my $ignoreParent = 1;
-my $defines = "";
+# Cache of IDL file pathnames.
+my $idlFiles;
 
 # Default constructor
 sub new
@@ -72,6 +73,7 @@ sub new
     $useOutputDir = shift;
     $useLayerOnTop = shift;
     $preprocessor = shift;
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -95,7 +97,7 @@ sub ProcessDocument
 
     # Dynamically load external code generation perl module
     require $ifaceName . ".pm";
-    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor);
+    $codeGenerator = $ifaceName->new($object, $useOutputDir, $useLayerOnTop, $preprocessor, $writeDependencies);
     unless (defined($codeGenerator)) {
         my $classes = $useDocument->classes;
         foreach my $class (@$classes) {
@@ -116,100 +118,83 @@ sub ProcessDocument
     $codeGenerator->finish();
 }
 
-# Necessary for V8 bindings to determine whether an interface is descendant from Node.
-# Node descendants are treated differently by DOMMap and this allows inferring the
-# type statically. See more at the original change: http://codereview.chromium.org/3195.
-# FIXME: Figure out a way to eliminate this JS bindings dichotomy.
-sub FindParentsRecursively
+sub ForAllParents
 {
     my $object = shift;
     my $dataNode = shift;
-    my @parents = ($dataNode->name);
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
-
-        $endCondition = 0;
-        $foundFilename = "";
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
-        }
+    my $beforeRecursion = shift;
+    my $afterRecursion = shift;
+    my $parentsOnly = shift;
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+    my $recurse;
+    $recurse = sub {
+        my $interface = shift;
 
-           # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor, 1);
+        for (@{$interface->parents}) {
+            my $interfaceName = $object->StripModule($_);
+            my $parentInterface = $object->ParseInterface($interfaceName, $parentsOnly);
 
-            foreach my $class (@{$document->classes}) {
-                @parents = (@parents, FindParentsRecursively($object, $class));
+            if ($beforeRecursion) {
+                &$beforeRecursion($parentInterface) eq 'prune' and next;
             }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n")
+            &$recurse($parentInterface);
+            &$afterRecursion($parentInterface) if $afterRecursion;
         }
-    }
-    return @parents;
+    };
+
+    &$recurse($dataNode);
 }
 
 sub AddMethodsConstantsAndAttributesFromParentClasses
 {
-    # For the passed interface, recursively parse all parent
-    # IDLs in order to find out all inherited properties/methods.
+    # Add to $dataNode all of its inherited interface members, except for those
+    # inherited through $dataNode's first listed parent.  If an array reference
+    # is passed in as $parents, the names of all ancestor interfaces visited
+    # will be appended to the array.  If $collectDirectParents is true, then
+    # even the names of $dataNode's first listed parent and its ancestors will
+    # be appended to $parents.
 
     my $object = shift;
     my $dataNode = shift;
+    my $parents = shift;
+    my $collectDirectParents = shift;
 
-    my @parents = @{$dataNode->parents};
-    my $parentsMax = @{$dataNode->parents};
+    my $first = 1;
 
-    my $constantsRef = $dataNode->constants;
-    my $functionsRef = $dataNode->functions;
-    my $attributesRef = $dataNode->attributes;
+    $object->ForAllParents($dataNode, sub {
+        my $interface = shift;
 
-    foreach (@{$dataNode->parents}) {
-        if ($ignoreParent) {
+        if ($first) {
             # Ignore first parent class, already handled by the generation itself.
-            $ignoreParent = 0;
-            next;
-        }
-
-        my $interface = $object->StripModule($_);
-
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+            $first = 0;
+
+            if ($collectDirectParents) {
+                # Just collect the names of the direct ancestor interfaces,
+                # if necessary.
+                push(@$parents, $interface->name);
+                $object->ForAllParents($interface, sub {
+                    my $interface = shift;
+                    push(@$parents, $interface->name);
+                }, undef, 1);
+            }
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
+            # Prune the recursion here.
+            return 'prune';
         }
 
-        if ($foundFilename ne "") {
-            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
-
-            # Step #2: Parse the found IDL file (in quiet mode).
-            my $parser = IDLParser->new(1);
-            my $document = $parser->Parse($foundFilename, $defines, $preprocessor);
+        # Collect the name of this additional parent.
+        push(@$parents, $interface->name) if $parents;
 
-            foreach my $class (@{$document->classes}) {
-                # Step #3: Enter recursive parent search
-                AddMethodsConstantsAndAttributesFromParentClasses($object, $class);
+        print "  |  |>  -> Inheriting "
+            . @{$interface->constants} . " constants, "
+            . @{$interface->functions} . " functions, "
+            . @{$interface->attributes} . " attributes...\n  |  |>\n" if $verbose;
 
-                # Step #4: Collect constants & functions & attributes of this parent-class
-                my $constantsMax = @{$class->constants};
-                my $functionsMax = @{$class->functions};
-                my $attributesMax = @{$class->attributes};
-
-                print "  |  |>  -> Inheriting $constantsMax constants, $functionsMax functions, $attributesMax attributes...\n  |  |>\n" if $verbose;
-
-                # Step #5: Concatenate data
-                push(@$constantsRef, $_) foreach (@{$class->constants});
-                push(@$functionsRef, $_) foreach (@{$class->functions});
-                push(@$attributesRef, $_) foreach (@{$class->attributes});
-            }
-        } else {
-            die("Could NOT find specified parent interface \"$interface\"!\n");
-        }
-    }
+        # Add this parent's members to $dataNode.
+        push(@{$dataNode->constants}, @{$interface->constants});
+        push(@{$dataNode->functions}, @{$interface->functions});
+        push(@{$dataNode->attributes}, @{$interface->attributes});
+    });
 }
 
 sub GetMethodsAndAttributesFromParentClasses
@@ -220,76 +205,67 @@ sub GetMethodsAndAttributesFromParentClasses
     my $object = shift;
     my $dataNode = shift;
 
-    my @parents = @{$dataNode->parents};
-
-    return if @{$dataNode->parents} == 0;
-
     my @parentList = ();
 
-    foreach (@{$dataNode->parents}) {
-        my $interface = $object->StripModule($_);
+    $object->ForAllParents($dataNode, undef, sub {
+        my $interface = shift;
 
-        # Step #1: Find the IDL file associated with 'interface'
-        $endCondition = 0;
-        $foundFilename = "";
+        my $hash = {
+            "name" => $interface->name,
+            "functions" => $interface->functions,
+            "attributes" => $interface->attributes
+        };
 
-        foreach (@{$useDirectories}) {
-            $object->ScanDirectory("${interface}.idl", $_, $_, 0) if $foundFilename eq "";
-        }
-
-        die("Could NOT find specified parent interface \"$interface\"!\n") if $foundFilename eq "";
-
-        print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+        unshift(@parentList, $hash);
+    });
 
-        # Step #2: Parse the found IDL file (in quiet mode).
-        my $parser = IDLParser->new(1);
-        my $document = $parser->Parse($foundFilename, $defines);
+    return @parentList;
+}
 
-        foreach my $class (@{$document->classes}) {
-            # Step #3: Enter recursive parent search
-            push(@parentList, GetMethodsAndAttributesFromParentClasses($object, $class));
+sub IDLFileForInterface
+{
+    my $object = shift;
+    my $interfaceName = shift;
 
-            # Step #4: Collect constants & functions & attributes of this parent-class
+    unless ($idlFiles) {
+        my $sourceRoot = $ENV{SOURCE_ROOT};
+        my @directories = map { $_ = "$sourceRoot/$_" if $sourceRoot && -d "$sourceRoot/$_"; $_ } @$useDirectories;
 
-            # print "  |  |>  -> Inheriting $functionsMax functions amd $attributesMax attributes...\n  |  |>\n" if $verbose;
-            my $hash = {
-                "name" => $class->name,
-                "functions" => $class->functions,
-                "attributes" => $class->attributes
-            };
+        $idlFiles = { };
 
-            # Step #5: Concatenate data
-            unshift(@parentList, $hash);
-        }
+        my $wanted = sub {
+            $idlFiles->{$1} = $File::Find::name if /^([A-Z].*)\.idl$/;
+            $File::Find::prune = 1 if /^\../;
+        };
+        find($wanted, @directories);
     }
 
-    return @parentList;
+    return $idlFiles->{$interfaceName};
 }
 
 sub ParseInterface
 {
-    my ($object, $interfaceName) = @_;
+    my $object = shift;
+    my $interfaceName = shift;
+    my $parentsOnly = shift;
 
-    # Step #1: Find the IDL file associated with 'interface'
-    $endCondition = 0;
-    $foundFilename = "";
+    return undef if $interfaceName eq 'Object';
 
-    foreach (@{$useDirectories}) {
-        $object->ScanDirectory("${interfaceName}.idl", $_, $_, 0) if $foundFilename eq "";
-    }
-    die "Could NOT find specified parent interface \"$interfaceName\"!\n" if $foundFilename eq "";
+    # Step #1: Find the IDL file associated with 'interface'
+    my $filename = $object->IDLFileForInterface($interfaceName)
+        or die("Could NOT find IDL file for interface \"$interfaceName\"!\n");
 
-    print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interfaceName\"\n" if $verbose;
+    print "  |  |>  Parsing parent IDL \"$filename\" for interface \"$interfaceName\"\n" if $verbose;
 
     # Step #2: Parse the found IDL file (in quiet mode).
     my $parser = IDLParser->new(1);
-    my $document = $parser->Parse($foundFilename, $defines);
+    my $document = $parser->Parse($filename, $defines, $preprocessor, $parentsOnly);
 
     foreach my $interface (@{$document->classes}) {
         return $interface if $interface->name eq $interfaceName;
     }
 
-    die "Interface definition not found";
+    die("Could NOT find interface definition for $interface in $filename");
 }
 
 # Helpers for all CodeGenerator***.pm modules
@@ -348,56 +324,6 @@ sub IsSVGAnimatedType
     return 0; 
 }
 
-# Internal Helper
-sub ScanDirectory
-{
-    my $object = shift;
-
-    my $interface = shift;
-    my $directory = shift;
-    my $useDirectory = shift;
-    my $reportAllFiles = shift;
-
-    return if ($endCondition eq 1) and ($reportAllFiles eq 0);
-
-    my $sourceRoot = $ENV{SOURCE_ROOT};
-    my $thisDir = $sourceRoot ? "$sourceRoot/$directory" : $directory;
-
-    if (!opendir(DIR, $thisDir)) {
-        opendir(DIR, $directory) or die "[ERROR] Can't open directory $thisDir or $directory: \"$!\"\n";
-        $thisDir = $directory;
-    }
-
-    my @names = readdir(DIR) or die "[ERROR] Cant't read directory $thisDir \"$!\"\n";
-    closedir(DIR);
-
-    foreach my $name (@names) {
-        # Skip if we already found the right file or
-        # if we encounter 'exotic' stuff (ie. '.', '..', '.svn')
-        next if ($endCondition eq 1) or ($name =~ /^\./);
-
-        # Recurisvely enter directory
-        if (-d "$thisDir/$name") {
-            $object->ScanDirectory($interface, "$directory/$name", $useDirectory, $reportAllFiles);
-            next;
-        }
-
-        # Check wheter we found the desired file
-        my $condition = ($name eq $interface);
-        $condition = 1 if ($interface eq "allidls") and ($name =~ /\.idl$/);
-
-        if ($condition) {
-            $foundFilename = "$thisDir/$name";
-
-            if ($reportAllFiles eq 0) {
-                $endCondition = 1;
-            } else {
-                push(@foundFilenames, $foundFilename);
-            }
-        }
-    }
-}
-
 # Uppercase the first letter while respecting WebKit style guidelines. 
 # E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
 sub WK_ucfirst
diff --git a/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 6641305..4d5cb96 100644
--- a/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -326,9 +326,8 @@ sub AddIncludesForTypeInCPPImplementation
 
 sub GetAdditionalInterfaces
 {
+    # This function does nothing, but it stays here for future multiple inheritance support.
     my $type = $codeGenerator->StripModule(shift);
-
-    return ("EventTarget") if $type eq "Node";
     return ();
 }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 1918aef..095c75f 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@ use File::stat;
 
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -34,6 +36,7 @@ my %headerIncludes = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -66,6 +69,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -100,9 +106,16 @@ sub GenerateInterface
     # Open files for writing
     my $headerFileName = "$outputDir/JS$name.h";
     my $implFileName = "$outputDir/JS$name.cpp";
+    my $depsFileName = "$outputDir/JS$name.dep";
+
+    # Remove old dependency file.
+    unlink($depsFileName);
 
     open($IMPL, ">$implFileName") || die "Couldn't open file $implFileName";
     open($HEADER, ">$headerFileName") || die "Couldn't open file $headerFileName";
+    if (@depsContent) {
+        open($DEPS, ">$depsFileName") || die "Couldn't open file $depsFileName";
+    }
 }
 
 # Params: 'idlDocument' struct
@@ -300,11 +313,11 @@ sub GenerateGetOwnPropertySlotBody
         &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@getOwnPropertySlotImpl, "    bool ok;\n");
         push(@getOwnPropertySlotImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
         push(@getOwnPropertySlotImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
-        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@getOwnPropertySlotImpl, "        slot.setValue(getByIndex(exec, index));\n");
         } else {
             push(@getOwnPropertySlotImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
@@ -348,6 +361,99 @@ sub GenerateGetOwnPropertySlotBody
     return @getOwnPropertySlotImpl;
 }
 
+sub GenerateGetOwnPropertyDescriptorBody
+{
+    my ($dataNode, $interfaceName, $className, $implClassName, $hasAttributes, $inlined) = @_;
+    
+    my $namespaceMaybe = ($inlined ? "JSC::" : "");
+    
+    my @getOwnPropertyDescriptorImpl = ();
+    
+    if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
+        push(@getOwnPropertyDescriptorImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return false;\n\n");
+    }
+    
+    my $manualLookupGetterGeneration = sub {
+        my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
+        if ($requiresManualLookup) {
+            push(@getOwnPropertyDescriptorImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertyDescriptorImpl, "    if (entry) {\n");
+            push(@getOwnPropertyDescriptorImpl, "        PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
+            push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), entry->attributes());\n");
+            push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+            push(@getOwnPropertyDescriptorImpl, "    }\n");
+        }
+    };
+    
+    if (!$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    bool ok;\n");
+        push(@getOwnPropertyDescriptorImpl, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
+        push(@getOwnPropertyDescriptorImpl, "    if (ok && index < static_cast<$implClassName*>(impl())->length()) {\n");
+        if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(getByIndex(exec, index), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+            push(@getOwnPropertyDescriptorImpl, "        slot.setCustomIndex(this, index, indexGetter);\n");
+            # Assume that if there's a setter, the index will be writable
+            if ($dataNode->extendedAttributes->{"HasIndexSetter"} || $dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete);\n");
+            } else {
+                push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ${namespaceMaybe}DontDelete | ${namespaceMaybe}ReadOnly);\n");
+            }
+        }
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
+        push(@getOwnPropertyDescriptorImpl, "        ${namespaceMaybe}PropertySlot slot;\n");
+        push(@getOwnPropertyDescriptorImpl, "        slot.setCustom(this, nameGetter);\n");
+        push(@getOwnPropertyDescriptorImpl, "        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+        push(@getOwnPropertyDescriptorImpl, "    }\n");
+        if ($inlined) {
+            $headerIncludes{"AtomicString.h"} = 1;
+        } else {
+            $implIncludes{"AtomicString.h"} = 1;
+        }
+    }
+    
+    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
+    }
+    
+    if ($dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}) {
+        push(@getOwnPropertyDescriptorImpl, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+        push(@getOwnPropertyDescriptorImpl, "        return true;\n");
+    }
+    
+    if ($hasAttributes) {
+        if ($inlined) {
+            die "Cannot inline if NoStaticTables is set." if ($dataNode->extendedAttributes->{"NoStaticTables"});
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, s_info.staticPropHashTable, this, propertyName, descriptor);\n");
+        } else {
+            push(@getOwnPropertyDescriptorImpl, "    return ${namespaceMaybe}getStaticValueDescriptor<$className, Base>(exec, " . hashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+    } else {
+        push(@getOwnPropertyDescriptorImpl, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");
+    }
+    
+    return @getOwnPropertyDescriptorImpl;
+}
+
 sub GenerateHeader
 {
     my $object = shift;
@@ -356,11 +462,12 @@ sub GenerateHeader
     my $interfaceName = $dataNode->name;
     my $className = "JS$interfaceName";
     my $implClassName = $interfaceName;
+    my @ancestorInterfaceNames = ();
 
     # We only support multiple parents with SVG (for now).
     if (@{$dataNode->parents} > 1) {
         die "A class can't have more than one parent" unless $interfaceName =~ /SVG/;
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
@@ -369,7 +476,9 @@ sub GenerateHeader
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $needsSVGContext = IsSVGTypeNeedingContextParameter($interfaceName);
-
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
+    
     # - Add default header template
     @headerContentHeader = split("\r", $headerTemplate);
 
@@ -431,17 +540,17 @@ sub GenerateHeader
 
     # Constructor
     if ($interfaceName eq "DOMWindow") {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>, JSDOMWindowShell*);\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, PassRefPtr<$implType>);\n");
     } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>, SVGElement* context);\n");
     } else {
-        push(@headerContent, "    $className(PassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
+        push(@headerContent, "    $className(NonNullPassRefPtr<JSC::Structure>, JSDOMGlobalObject*, PassRefPtr<$implType>);\n");
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $eventTarget or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
     push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
@@ -452,6 +561,7 @@ sub GenerateHeader
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -460,8 +570,10 @@ sub GenerateHeader
     # Getters
     if ($hasGetter) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
-        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
     }
 
     # Check if we have any writable properties
@@ -503,8 +615,8 @@ sub GenerateHeader
             "    }\n\n");
     }
 
-    # Custom mark function
-    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $dataNode->extendedAttributes->{"CustomMarkFunction"};
+    # markChildren function
+    push(@headerContent, "    virtual void markChildren(JSC::MarkStack&);\n\n") if $needsMarkChildren;
 
     # Custom pushEventHandlerScope function
     push(@headerContent, "    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;\n\n") if $dataNode->extendedAttributes->{"CustomPushEventHandlerScope"};
@@ -515,17 +627,23 @@ sub GenerateHeader
     # Custom deleteProperty function
     push(@headerContent, "    virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);\n") if $dataNode->extendedAttributes->{"CustomDeleteProperty"};
 
-    # Custom getPropertyNames function
-    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"});
+    # Custom getPropertyNames function exists on DOMWindow
+    push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $interfaceName eq "DOMWindow";
+
+    # Custom defineProperty function exists on DOMWindow
+    push(@headerContent, "    virtual bool defineOwnProperty(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&, bool shouldThrow);\n") if $interfaceName eq "DOMWindow";
+
+    # Custom getOwnPropertyNames function
+    push(@headerContent, "    virtual void getOwnPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"});    
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineGetter"};
 
     # Custom defineSetter function
-    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
+    push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
     push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
@@ -599,7 +717,7 @@ sub GenerateHeader
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
         push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
-    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
         push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
@@ -621,6 +739,10 @@ sub GenerateHeader
         push(@headerContent, "{\n");
         push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
         push(@headerContent, "}\n\n");
+        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)\n");
+        push(@headerContent, "{\n");
+        push(@headerContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
+        push(@headerContent, "}\n\n");
     }
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"} || $dataNode->extendedAttributes->{"CustomToJS"}) {
@@ -662,11 +784,19 @@ sub GenerateHeader
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
     if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    virtual bool getOwnPropertyDescriptor(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n");
         push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertyDescriptorDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertyDescriptor&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
 
         push(@headerContent,
             "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
+            "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType" . ($needsMarkChildren ? "" : ", JSC::HasDefaultMark") . "));\n" .
+            "    }\n");
+    } elsif ($dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@headerContent,
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
+            "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
@@ -676,9 +806,9 @@ sub GenerateHeader
     }
 
     # Custom defineGetter function
-    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction, unsigned attributes);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
 
-    push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
+    push(@headerContent, "    ${className}Prototype(NonNullPassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
     push(@headerContent, "};\n\n");
 
@@ -718,6 +848,12 @@ sub GenerateHeader
     push(@headerContent, "\n} // namespace WebCore\n\n");
     push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditional;
     push(@headerContent, "#endif\n");
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 sub GenerateImplementation
@@ -734,6 +870,8 @@ sub GenerateImplementation
     my $parentClassName = GetParentClassName($dataNode);
     my $conditional = $dataNode->extendedAttributes->{"Conditional"};
     my $visibleClassName = GetVisibleClassName($interfaceName);
+    my $eventTarget = $dataNode->extendedAttributes->{"EventTarget"};
+    my $needsMarkChildren = $dataNode->extendedAttributes->{"CustomMarkFunction"} || $dataNode->extendedAttributes->{"EventTarget"};
 
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
@@ -749,7 +887,7 @@ sub GenerateImplementation
     AddIncludesForSVGAnimatedType($interfaceName) if $className =~ /^JSSVGAnimated/;
 
     $implIncludes{"<wtf/GetPtr.h>"} = 1;
-    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"};
+    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"};
 
     AddIncludesForType($interfaceName);
 
@@ -933,6 +1071,25 @@ sub GenerateImplementation
             push(@implContent, "    return getStaticPropertySlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         }
         push(@implContent, "}\n\n");
+
+        push(@implContent, "bool ${className}Prototype::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+        push(@implContent, "{\n");
+        
+        if ($dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (getOwnPropertyDescriptorDelegate(exec, propertyName, descriptor))\n");
+            push(@implContent, "        return true;\n");
+        }
+        
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);\n");        
+        } elsif ($numConstants eq 0) {
+            push(@implContent, "    return getStaticFunctionDescriptor<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } elsif ($numFunctions eq 0) {
+            push(@implContent, "    return getStaticValueDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        } else {
+            push(@implContent, "    return getStaticPropertyDescriptor<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, descriptor);\n");
+        }
+        push(@implContent, "}\n\n");
     }
 
     if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
@@ -980,15 +1137,15 @@ sub GenerateImplementation
     # Constructor
     if ($interfaceName eq "DOMWindow") {
         AddIncludesForType("JSDOMWindowShell");
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
         push(@implContent, "    : $parentClassName(structure, impl, shell)\n");
     } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
         AddIncludesForType($interfaceName);
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, PassRefPtr<$implType> impl)\n");
         push(@implContent, "    : $parentClassName(structure, impl)\n");
     } else {
         my $contextArg = $needsSVGContext ? ", SVGElement* context" : "";
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
+        push(@implContent, "${className}::$className(NonNullPassRefPtr<Structure> structure, JSDOMGlobalObject* globalObject, PassRefPtr<$implType> impl$contextArg)\n");
         if ($hasParent) {
             push(@implContent, "    : $parentClassName(structure, globalObject, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
         } else {
@@ -1000,17 +1157,17 @@ sub GenerateImplementation
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent || $interfaceName eq "DOMWindow") {
+    if (!$hasParent || $eventTarget) {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
+        if ($eventTarget) {
+            $implIncludes{"RegisteredEventListener.h"} = 1;
+            push(@implContent, "    impl()->invalidateEventListeners();\n");
+        }
+
         if ($interfaceName eq "Node") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
-             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
-        } elsif ($interfaceName eq "DOMWindow") {
-             $implIncludes{"RegisteredEventListener.h"} = 1;
-             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(impl()->document(), impl());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -1021,7 +1178,7 @@ sub GenerateImplementation
                     push(@implContent, "    JSSVGDynamicPODTypeWrapperCache<$podType, $animatedType>::forgetWrapper(m_impl.get());\n");
                 }
             }
-            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
+            push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), impl());\n");
         }
 
         push(@implContent, "}\n\n");
@@ -1034,6 +1191,14 @@ sub GenerateImplementation
         push(@implContent, "{\n    forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<${implClassName}*>(impl()));\n}\n\n");
     }
 
+    if ($needsMarkChildren && !$dataNode->extendedAttributes->{"CustomMarkFunction"}) {
+        push(@implContent, "void ${className}::markChildren(MarkStack& markStack)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    Base::markChildren(markStack);\n");
+        push(@implContent, "    impl()->markEventListeners(markStack);\n");
+        push(@implContent, "}\n\n");
+    }
+
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
         push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
@@ -1049,6 +1214,7 @@ sub GenerateImplementation
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}
                  || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
@@ -1061,14 +1227,18 @@ sub GenerateImplementation
             push(@implContent, "{\n");
             push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
             push(@implContent, "}\n\n");
+            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
+            push(@implContent, "{\n");
+            push(@implContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
+            push(@implContent, "}\n\n");
         }
 
-        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) 
+        if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) 
                 && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
             push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)\n");
             push(@implContent, "{\n");
             push(@implContent, "    if (propertyName < static_cast<$implClassName*>(impl())->length()) {\n");
-            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
                 push(@implContent, "        slot.setValue(getByIndex(exec, propertyName));\n");
             } else {
                 push(@implContent, "        slot.setCustomIndex(this, propertyName, indexGetter);\n");
@@ -1124,7 +1294,11 @@ sub GenerateImplementation
                     push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(castedThis->impl());\n");
                     push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
-                    push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction())\n");
+                    if ($implClassName eq "Document" || $implClassName eq "WorkerContext" || $implClassName eq "SharedWorkerContext" || $implClassName eq "DedicatedWorkerContext") {
+                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp))\n");
+                    } else {
+                        push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction(imp->scriptExecutionContext()))\n");
+                    }
                     push(@implContent, "            return jsFunction;\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
@@ -1333,14 +1507,14 @@ sub GenerateImplementation
         }
     }
 
-    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-        push(@implContent, "void ${className}::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
+    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
+        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
         push(@implContent, "{\n");
-        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
         }
-        push(@implContent, "     Base::getPropertyNames(exec, propertyNames);\n");
+        push(@implContent, "     Base::getOwnPropertyNames(exec, propertyNames);\n");
         push(@implContent, "}\n\n");
     }
 
@@ -1373,7 +1547,7 @@ sub GenerateImplementation
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
-                push(@implContent, "    if (!thisValue.isObject(&${className}::s_info))\n");
+                push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
                 push(@implContent, "    $className* castedThisObj = static_cast<$className*>(asObject(thisValue));\n");
             }
@@ -1507,6 +1681,17 @@ sub GenerateImplementation
             $implIncludes{"Node.h"} = 1;
         }
     }
+    
+    if ($dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
+        push(@implContent, "\nJSValue ${className}::getByIndex(ExecState* exec, unsigned index)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return jsNumber(exec, static_cast<$implClassName*>(impl())->item(index));\n");
+        push(@implContent, "}\n");
+        if ($interfaceName eq "HTMLCollection") {
+            $implIncludes{"JSNode.h"} = 1;
+            $implIncludes{"Node.h"} = 1;
+        }
+    }
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !$dataNode->extendedAttributes->{"CustomToJS"}) {
         if ($podType) {
@@ -1537,7 +1722,7 @@ sub GenerateImplementation
 
         push(@implContent, "{\n");
 
-        push(@implContent, "    return value.isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
+        push(@implContent, "    return value.inherits(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
         if ($podType and $podType ne "float") {
             push(@implContent, "$podType();\n}\n");
         } else {
@@ -1657,6 +1842,11 @@ sub JSValueToNative
         return "$value.toString(exec)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create(exec, $value)";
+    }
+
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
     $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
@@ -1762,6 +1952,9 @@ sub NativeToJSValue
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
         $implIncludes{"$joinedName.h"} = 1;
+    } elsif ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "$value->deserialize(exec)";
     } else {
         # Default, include header with same name.
         $implIncludes{"JS$type.h"} = 1;
@@ -2021,6 +2214,15 @@ sub WriteData
         @headerContent = ();
         %headerIncludes = ();
     }
+
+    if (defined($DEPS)) {
+        # Write dependency file.
+        print $DEPS @depsContent;
+        close($DEPS);
+        undef($DEPS);
+
+        @depsContent = ();
+    }
 }
 
 sub constructorFor
@@ -2041,6 +2243,7 @@ public:
         putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
@@ -2074,6 +2277,11 @@ bool ${constructorClassName}::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, slot);
 }
 
+bool ${constructorClassName}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    return getStaticValueDescriptor<${constructorClassName}, DOMObject>(exec, &${constructorClassName}Table, this, propertyName, descriptor);
+}
+
 EOF
 
     $implJSCInclude{"JSNumberCell.h"} = 1; # FIXME: What is this for?
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index f449e19..317086b 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -4,6 +4,7 @@
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -28,6 +29,7 @@ use File::stat;
 # Global Variables
 my $module = "";
 my $outputDir = "";
+my $writeDependencies = 0;
 my %publicInterfaces = ();
 my $newPublicClass = 0;
 my $interfaceAvailabilityVersion = "";
@@ -49,6 +51,7 @@ my @internalHeaderContent = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
+my @depsContent = ();
 
 # Hashes
 my %protocolTypeHash = ("XPathNSResolver" => 1, "EventListener" => 1, "EventTarget" => 1, "NodeFilter" => 1,
@@ -194,6 +197,9 @@ sub new
 
     $codeGenerator = shift;
     $outputDir = shift;
+    shift; # $useLayerOnTop
+    shift; # $preprocessor
+    $writeDependencies = shift;
 
     bless($reference, $object);
     return $reference;
@@ -305,7 +311,7 @@ sub GetClassName
     my $name = $codeGenerator->StripModule(shift);
 
     # special cases
-    return "NSString" if $codeGenerator->IsStringType($name);
+    return "NSString" if $codeGenerator->IsStringType($name) or $name eq "SerializedScriptValue";
     return "NS$name" if IsNativeObjCType($name);
     return "BOOL" if $name eq "boolean";
     return "unsigned" if $name eq "unsigned long";
@@ -486,6 +492,11 @@ sub GetObjCTypeGetter
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
+    
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "WebCore::SerializedScriptValue::create(WebCore::String($argName))";
+    }
     return "core($argName)";
 }
 
@@ -601,6 +612,11 @@ sub AddIncludesForType
         return;
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return;
+    }
+
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
@@ -976,8 +992,10 @@ sub GenerateImplementation
     my $object = shift;
     my $dataNode = shift;
 
+    my @ancestorInterfaceNames = ();
+
     if (@{$dataNode->parents} > 1) {
-        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+        $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@ancestorInterfaceNames);
     }
 
     my $interfaceName = $dataNode->name;
@@ -1204,6 +1222,9 @@ sub GenerateImplementation
             } elsif ($idlType eq "Color") {
                 $getterContentHead = "WebCore::nsColor($getterContentHead";
                 $getterContentTail .= ")";
+            } elsif ($attribute->signature->type eq "SerializedScriptValue") {
+                $getterContentHead = "$getterContentHead";
+                $getterContentTail .= "->toString()";                
             } elsif (ConversionNeeded($attribute->signature->type)) {
                 $getterContentHead = "kit(WTF::getPtr($getterContentHead";
                 $getterContentTail .= "))";
@@ -1438,6 +1459,8 @@ sub GenerateImplementation
                     push(@functionContent, "        return $toReturn;\n");
                     push(@functionContent, "    return nil;\n");
                 }
+            } elsif ($returnType eq "SerializedScriptValue") {
+                $content = "foo";
             } else {
                 if (ConversionNeeded($function->signature->type)) {
                     if ($codeGenerator->IsPodType($function->signature->type)) {
@@ -1543,6 +1566,12 @@ sub GenerateImplementation
 
     # - End the ifdef conditional if necessary
     push(@implContent, "\n#endif // ${conditionalString}\n") if $conditional;
+
+    # - Generate dependencies.
+    if ($writeDependencies && @ancestorInterfaceNames) {
+        push(@depsContent, "$className.h : ", join(" ", map { "$_.idl" } @ancestorInterfaceNames), "\n");
+        push(@depsContent, map { "$_.idl :\n" } @ancestorInterfaceNames); 
+    }
 }
 
 # Internal helper
@@ -1556,12 +1585,14 @@ sub WriteData
     my $privateHeaderFileName = "$outputDir/" . $name . "Private.h";
     my $implFileName = "$outputDir/" . $name . ".mm";
     my $internalHeaderFileName = "$outputDir/" . $name . "Internal.h";
+    my $depsFileName = "$outputDir/" . $name . ".dep";
 
     # Remove old files.
     unlink($headerFileName);
     unlink($privateHeaderFileName);
     unlink($implFileName);
     unlink($internalHeaderFileName);
+    unlink($depsFileName);
 
     # Write public header.
     open(HEADER, ">$headerFileName") or die "Couldn't open file $headerFileName";
@@ -1624,6 +1655,14 @@ sub WriteData
 
        @internalHeaderContent = ();
     }
+
+    # Write dependency file.
+    if (@depsContent) {
+        open(DEPS, ">$depsFileName") or die "Couldn't open file $depsFileName";
+        print DEPS @depsContent;
+        close(DEPS);
+        @depsContent = ();
+    }
 }
 
 1;
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 439f368..b65da53 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -5,6 +5,7 @@
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
 # Copyright (C) 2007, 2008, 2009 Google Inc.
+# Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 #
 # This file is part of the KDE project
 #
@@ -90,26 +91,6 @@ sub leftShift($$) {
     return (($value << $distance) & 0xFFFFFFFF);
 }
 
-# Uppercase the first letter, while respecting WebKit style guidelines.
-# E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
-sub WK_ucfirst
-{
-    my $param = shift;
-    my $ret = ucfirst($param);
-    $ret =~ s/Xml/XML/ if $ret =~ /^Xml[^a-z]/;
-    return $ret;
-}
-
-# Lowercase the first letter while respecting WebKit style guidelines.
-# URL becomes url, but SetURL becomes setURL.
-sub WK_lcfirst
-{
-    my $param = shift;
-    my $ret = lcfirst($param);
-    $ret =~ s/uRL/url/;
-    return $ret;
-}
-
 # Workaround for V8 bindings difference where RGBColor is not a POD type.
 sub IsPodType
 {
@@ -266,7 +247,7 @@ sub GenerateHeader
 
     # Copy contents of parent classes except the first parent or if it is
     # EventTarget.
-    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode, \@allParents, 1);
 
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
@@ -345,6 +326,28 @@ sub IsNodeSubType
     return 0;
 }
 
+sub GetHiddenDependencyIndex
+{
+    my $dataNode = shift;
+    my $attribute = shift;
+    my $name = $dataNode->name;
+    return "V8Custom::kNodeEventListenerCacheIndex" if IsNodeSubType($dataNode);
+    return "V8Custom::kSVGElementInstanceEventListenerCacheIndex" if $name eq "SVGElementInstance";
+    return "V8Custom::kAbstractWorkerRequestCacheIndex" if $name eq "AbstractWorker";
+    return "V8Custom::kWorkerRequestCacheIndex" if $name eq "Worker";
+    return "V8Custom::kDedicatedWorkerContextRequestCacheIndex" if $name eq "DedicatedWorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "WorkerContext";
+    return "V8Custom::kWorkerContextRequestCacheIndex" if $name eq "SharedWorkerContext";
+    return "V8Custom::kMessagePortRequestCacheIndex" if $name eq "MessagePort";
+    return "V8Custom::kWebSocketCacheIndex" if $name eq "WebSocket";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequest";
+    return "V8Custom::kXMLHttpRequestCacheIndex" if $name eq "XMLHttpRequestUpload";
+    return "V8Custom::kDOMApplicationCacheCacheIndex" if $name eq "DOMApplicationCache";
+    return "V8Custom::kNotificationRequestCacheIndex" if $name eq "Notification";
+    return "V8Custom::kDOMWindowEventListenerCacheIndex" if $name eq "DOMWindow";
+    die "Unexpected name " . $name . " when generating " . $attribute;
+}
+
 sub HolderToNative
 {
     my $dataNode = shift;
@@ -513,11 +516,17 @@ END
         }
 
     } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
     if (holder.IsEmpty()) return v8::Undefined();
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -543,7 +552,7 @@ END
         $attrName = $attribute->signature->extendedAttributes->{"v8referenceattr"};
     }
 
-    my $getterFunc = WK_lcfirst($attrName);
+    my $getterFunc = $codeGenerator->WK_lcfirst($attrName);
     $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
 
     my $returnType = GetTypeFromSignature($attribute->signature);
@@ -582,7 +591,7 @@ END
         my $getter = $getterString;
         $getter =~ s/imp->//;
         $getter =~ s/\(\)//;
-        my $setter = "set" . WK_ucfirst($getter);
+        my $setter = "set" . $codeGenerator->WK_ucfirst($getter);
 
         my $implClassIsAnimatedType = $codeGenerator->IsSVGAnimatedType($implClassName);
         if (not $implClassIsAnimatedType and $codeGenerator->IsPodTypeWithWriteableProperties($attrType) and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
@@ -607,6 +616,10 @@ END
         }
 
     } else {
+        if ($attribute->signature->type eq "EventListener" && $dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return v8::Undefined();\n");
+        }
         push(@implContentDecls, "    $nativeType v = ");
 
         push(@implContentDecls, "$getterString;\n");
@@ -685,11 +698,17 @@ sub GenerateNormalAttrSetter
         push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
 
     } elsif ($attrExt->{"v8OnProto"}) {
+      if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+      } else {
         # perform lookup first
         push(@implContentDecls, <<END);
     v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
-    if (holder.IsEmpty()) return v8::Undefined();
+    if (holder.IsEmpty()) return;
 END
+      }
         HolderToNative($dataNode, $implClassName, $classIndex);
     } else {
         push(@implContentDecls, <<END);
@@ -699,7 +718,15 @@ END
     }
 
     my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
-    push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    if ($attribute->signature->type eq "EventListener") {
+        if ($dataNode->name eq "DOMWindow") {
+            push(@implContentDecls, "    if (!imp->document())\n");
+            push(@implContentDecls, "      return;\n");
+        }
+        push(@implContentDecls, "    $nativeType v = V8DOMWrapper::getEventListener(imp, value, true, ListenerFindOrCreate);\n");
+    } else {
+        push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+    }
 
     my $result = "";
     if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
@@ -724,13 +751,27 @@ END
     if ($implClassName eq "double") {
         push(@implContentDecls, "    *imp = $result;\n");
     } else {
-        my $implSetterFunctionName = WK_ucfirst($attrName);
+        my $implSetterFunctionName = $codeGenerator->WK_ucfirst($attrName);
         my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
         my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
         if ($reflect || $reflectURL) {
             $implIncludes{"HTMLNames.h"} = 1;
             my $contentAttributeName = ($reflect || $reflectURL) eq "1" ? $attrName : ($reflect || $reflectURL);
             push(@implContentDecls, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $result");
+        } elsif ($attribute->signature->type eq "EventListener") {
+            $implIncludes{"V8AbstractEventListener.h"} = 1;
+            $implIncludes{"V8CustomBinding.h"} = 1;
+            $cacheIndex = GetHiddenDependencyIndex($dataNode, $attrName);
+            push(@implContentDecls, "    $nativeType old = imp->$attrName();\n");
+            push(@implContentDecls, "    V8AbstractEventListener* oldListener = old ? V8AbstractEventListener::cast(old.get()) : 0;\n");
+            push(@implContentDecls, "    if (oldListener) {\n");
+            push(@implContentDecls, "      v8::Local<v8::Object> oldListenerObject = oldListener->getExistingListenerObject();\n");
+            push(@implContentDecls, "      if (!oldListenerObject.IsEmpty())\n");
+            push(@implContentDecls, "        removeHiddenDependency(holder, oldListenerObject, $cacheIndex);\n");
+            push(@implContentDecls, "    }\n");
+            push(@implContentDecls, "    imp->set$implSetterFunctionName($result);\n");
+            push(@implContentDecls, "    if ($result)\n");
+            push(@implContentDecls, "      createHiddenDependency(holder, value, $cacheIndex");
         } else {
             push(@implContentDecls, "    imp->set$implSetterFunctionName(" . $result);
         }
@@ -779,7 +820,7 @@ sub GenerateNewFunctionTemplate
         my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
                          $function->signature->extendedAttributes->{"V8Custom"};
         if ($customFunc eq 1) {
-            $customFunc = $interfaceName . WK_ucfirst($name);
+            $customFunc = $interfaceName . $codeGenerator->WK_ucfirst($name);
         }
         return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
     } else {
@@ -841,6 +882,11 @@ END
         push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
         $implIncludes{"ScriptCallStack.h"} = 1;
     }
+    if ($function->signature->extendedAttributes->{"SVGCheckSecurityDocument"}) {
+        push(@implContentDecls,
+"    if (!V8Proxy::checkNodeSecurity(imp->getSVGDocument(ec)))\n" .
+"      return v8::Undefined();\n");
+    }
 
     my $paramIndex = 0;
     foreach my $parameter (@{$function->parameters}) {
@@ -893,7 +939,8 @@ END
 
 sub GenerateBatchedAttributeData
 {
-    my $interfaceName = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
     my $attributes = shift;
 
     foreach my $attribute (@$attributes) {
@@ -926,7 +973,7 @@ sub GenerateBatchedAttributeData
             "";
         if ($customAccessor eq 1) {
             # use the naming convension, interface + (capitalize) attr name
-            $customAccessor = $interfaceName . WK_ucfirst($attrName);
+            $customAccessor = $interfaceName . $codeGenerator->WK_ucfirst($attrName);
         }
 
         my $getter;
@@ -950,79 +997,41 @@ sub GenerateBatchedAttributeData
             my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
             $constructorType =~ s/Constructor$//;
             my $constructorIndex = uc($constructorType);
-            $data = "V8ClassIndex::${constructorIndex}";
-            $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
-            $setter = "0";
-            $propAttr = "v8::ReadOnly";
-
-        # EventListeners
-        } elsif ($attribute->signature->type eq "EventListener") {
-            if ($interfaceName eq "DOMWindow") {
-                $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
-                $getter = "V8Custom::v8NodeEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8NodeEventHandlerAccessorSetter";
-            } elsif ($interfaceName eq "DOMApplicationCache") {
-                $getter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorGetter";
-                $setter = "V8Custom::v8DOMApplicationCacheEventHandlerAccessorSetter";
-            } else {
+            if ($customAccessor) {
                 $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-                if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                    $setter = "0";
-                    $propAttr = "v8::ReadOnly";
-                } else {
-                    $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-                }
-            }
-
-        # Custom Getter and Setter
-        } elsif ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
-            if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
-                $setter = "0";
-                $propAttr = "v8::ReadOnly";
             } else {
-                $hasCustomSetter = 1;
-                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+                $data = "V8ClassIndex::${constructorIndex}";
+                $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
             }
+            $setter = "0";
+            $propAttr = "v8::ReadOnly";
 
-        # Custom Setter
-        } elsif ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"}) {
-            $hasCustomSetter = 1;
+        } else {
+            # Default Getter and Setter
             $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
-
-        # Custom Getter
-        } elsif ($attrExt->{"CustomGetter"}) {
-            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
             $setter = "${interfaceName}Internal::${attrName}AttrSetter";
 
-        # Replaceable
-        } elsif ($attrExt->{"Replaceable"}) {
-            # Replaceable accessor is put on instance template with ReadOnly attribute.
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "0";
-
-            # Mark to avoid duplicate v8::ReadOnly flags in output.
-            $hasCustomSetter = 1;
-
-            # Handle the special case of window.top being marked upstream as Replaceable.
-            # FIXME: Investigate why [Replaceable] is not marked as ReadOnly
-            # upstream and reach parity.
-            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
-                $propAttr .= "|v8::ReadOnly";
+            # Custom Setter
+            if ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+                $hasCustomSetter = 1;
+                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
             }
 
-        # Normal
-        } else {
-            $getter = "${interfaceName}Internal::${attrName}AttrGetter";
-            $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+            # Custom Getter
+            if ($attrExt->{"CustomGetter"} || $attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+                $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+            }
         }
 
+        # Replaceable
         if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
             $setter = "0";
-            $propAttr .= "|v8::ReadOnly";
+            # Handle the special case of window.top being marked as Replaceable.
+            # FIXME: Investigate whether we could treat window.top as replaceable 
+            # and allow shadowing without it being a security hole.
+            if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) { 
+                $propAttr .= "|v8::ReadOnly";
+            }
         }
 
         # Read only attributes
@@ -1068,8 +1077,6 @@ sub GenerateImplementation
     my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
     my $conditionalString = GenerateConditionalString($dataNode);
 
-    @allParents = $codeGenerator->FindParentsRecursively($dataNode);
-
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
 
@@ -1104,20 +1111,16 @@ sub GenerateImplementation
 
         # Generate special code for the constructor attributes.
         if ($attrType =~ /Constructor$/) {
-            $hasConstructors = 1;
+            if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                $implIncludes{"V8CustomBinding.h"} = 1;
+            } else {
+                $hasConstructors = 1;
+            }
             next;
         }
 
-        # Make EventListeners always custom.
-        # FIXME: make the perl code capable of generating the
-        #   event setters/getters.  For now, WebKit has started removing the
-        #   [Custom] attribute, so just automatically insert it to avoid forking
-        #   other files.  This should be okay because we can't generate stubs
-        #   for any event getter/setters anyway.
-        if ($attrType eq "EventListener") {
-            $attribute->signature->extendedAttributes->{"Custom"} = 1;
-            $implIncludes{"V8CustomBinding.h"} = 1;
-            next;
+        if ($attrType eq "EventListener" && $interfaceName eq "DOMWindow") {
+            $attribute->signature->extendedAttributes->{"v8OnProto"} = 1;
         }
 
         # Do not generate accessor if this is a custom attribute.  The
@@ -1186,7 +1189,7 @@ sub GenerateImplementation
         # Put the attributes that disallow shadowing on the shadow object.
         $attributes = \@normal;
         push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, \@disallows_shadowing);
+        GenerateBatchedAttributeData($dataNode, \@disallows_shadowing);
         push(@implContent, "};\n");
     }
 
@@ -1194,7 +1197,7 @@ sub GenerateImplementation
     if (@$attributes) {
         $has_attributes = 1;
         push(@implContent, "static const BatchedAttribute ${interfaceName}_attrs[] = {\n");
-        GenerateBatchedAttributeData($interfaceName, $attributes);
+        GenerateBatchedAttributeData($dataNode, $attributes);
         push(@implContent, "};\n");
     }
 
@@ -1472,7 +1475,7 @@ sub GenerateFunctionCallString()
             $paramName = "SVGPODListItem<" . GetNativeType($paramType, 1) . ">::copy($paramName)";
         }
 
-        if ($parameter->type eq "NodeFilter") {
+        if ($parameter->type eq "NodeFilter" || $parameter->type eq "XPathNSResolver") {
             $functionString .= "$paramName.get()";
         } else {
             $functionString .= $paramName;
@@ -1590,7 +1593,7 @@ sub GetTypeFromSignature
     my $signature = shift;
 
     my $type = $codeGenerator->StripModule($signature->type);
-    if (($type eq "DOMString") && $signature->extendedAttributes->{"V8Custom"}) {
+    if (($type eq "DOMString") && $signature->extendedAttributes->{"HintAtomic"}) {
         $type = "AtomicString";
     }
 
@@ -1605,6 +1608,11 @@ sub GetNativeTypeFromSignature
 
     my $type = GetTypeFromSignature($signature);
 
+    if ($type eq "unsigned long" and $signature->extendedAttributes->{"IsIndex"}) {
+        # Special-case index arguments because we need to check that they aren't < 0.
+        return "int";
+    }
+
     return GetNativeType($type, $isParameter);
 }
 
@@ -1612,7 +1620,24 @@ sub IsRefPtrType
 {
     my $type = shift;
     return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasArray";
+    return 1 if $type eq "CanvasArrayBuffer";
+    return 1 if $type eq "CanvasBooleanArray";
+    return 1 if $type eq "CanvasByteArray";
+    return 1 if $type eq "CanvasBuffer";
+    return 1 if $type eq "CanvasFloatArray";
+    return 1 if $type eq "CanvasFramebuffer";
     return 1 if $type eq "CanvasGradient";
+    return 1 if $type eq "CanvasIntArray";
+    return 1 if $type eq "CanvasObject";
+    return 1 if $type eq "CanvasProgram";
+    return 1 if $type eq "CanvasRenderbuffer";
+    return 1 if $type eq "CanvasShader";
+    return 1 if $type eq "CanvasShortArray";
+    return 1 if $type eq "CanvasTexture";
+    return 1 if $type eq "CanvasUnsignedByteArray";
+    return 1 if $type eq "CanvasUnsignedIntArray";
+    return 1 if $type eq "CanvasUnsignedShortArray";
     return 1 if $type eq "ClientRect";
     return 1 if $type eq "ClientRectList";
     return 1 if $type eq "CDATASection";
@@ -1636,6 +1661,7 @@ sub IsRefPtrType
     return 1 if $type eq "Element";
     return 1 if $type eq "EntityReference";
     return 1 if $type eq "Event";
+    return 1 if $type eq "EventListener";
     return 1 if $type eq "FileList";
     return 1 if $type eq "HTMLCollection";
     return 1 if $type eq "HTMLDocument";
@@ -1653,6 +1679,7 @@ sub IsRefPtrType
     return 1 if $type eq "Plugin";
     return 1 if $type eq "ProcessingInstruction";
     return 1 if $type eq "Range";
+    return 1 if $type eq "RGBColor";
     return 1 if $type eq "Text";
     return 1 if $type eq "TextMetrics";
     return 1 if $type eq "TimeRanges";
@@ -1708,7 +1735,8 @@ sub GetNativeType
 
     return "int" if $type eq "int";
     return "int" if $type eq "short" or $type eq "unsigned short";
-    return "int" if $type eq "long" or $type eq "unsigned long";
+    return "unsigned" if $type eq "unsigned long";
+    return "int" if $type eq "long";
     return "unsigned long long" if $type eq "unsigned long long";
     return "bool" if $type eq "boolean";
     return "String" if $type eq "DOMString";
@@ -1729,6 +1757,9 @@ sub GetNativeType
     # temporary hack
     return "RefPtr<NodeFilter>" if $type eq "NodeFilter";
 
+    # necessary as resolvers could be constructed on fly.
+    return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
+
     return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
 
     # Default, assume native type is a pointer with same type name as idl type
@@ -1739,6 +1770,19 @@ sub GetNativeType
 my %typeCanFailConversion = (
     "AtomicString" => 0,
     "Attr" => 1,
+    "CanvasArray" => 0,
+    "CanvasBuffer" => 0,
+    "CanvasByteArray" => 0,
+    "CanvasFloatArray" => 0,
+    "CanvasFramebuffer" => 0,
+    "CanvasGradient" => 0,
+    "CanvasIntArray" => 0,
+    "CanvasPixelArray" => 0,
+    "CanvasProgram" => 0,
+    "CanvasRenderbuffer" => 0,
+    "CanvasShader" => 0,
+    "CanvasShortArray" => 0,
+    "CanvasTexture" => 0,
     "CompareHow" => 0,
     "DataGridColumn" => 0,
     "DOMString" => 0,
@@ -1748,8 +1792,11 @@ my %typeCanFailConversion = (
     "Event" => 0,
     "EventListener" => 0,
     "EventTarget" => 0,
+    "HTMLCanvasElement" => 0,
     "HTMLElement" => 0,
+    "HTMLImageElement" => 0,
     "HTMLOptionElement" => 0,
+    "HTMLVideoElement" => 0,
     "Node" => 0,
     "NodeFilter" => 0,
     "MessagePort" => 0,
@@ -1837,7 +1884,11 @@ sub JSValueToNative
     return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
     return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
 
-    return "v8ValueToAtomicWebCoreString($value)" if $type eq "AtomicString";
+    if ($type eq "AtomicString") {
+        return "v8ValueToAtomicWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
+        return "v8ValueToAtomicWebCoreString($value)";
+    }
+
     return "toWebCoreString($value)" if $type eq "DOMUserData";
     if ($type eq "DOMString") {
         return "toWebCoreStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
@@ -1845,6 +1896,11 @@ sub JSValueToNative
         return "toWebCoreString($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"SerializedScriptValue.h"} = 1;
+        return "SerializedScriptValue::create($value)";
+    }
+
     if ($type eq "NodeFilter") {
         return "V8DOMWrapper::wrapNativeNodeFilter($value)";
     }
@@ -1866,6 +1922,10 @@ sub JSValueToNative
         return "V8Node::HasInstance($value) ? V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast($value)) : 0";
     }
 
+    if ($type eq "XPathNSResolver") {
+        return "V8DOMWrapper::getXPathNSResolver($value)";
+    }
+
     AddIncludesForType($type);
     # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
 
@@ -1917,10 +1977,16 @@ sub CreateCustomSignature
         if ($first) { $first = 0; }
         else { $result .= ", "; }
         if (IsWrapperType($parameter->type)) {
-            my $type = $parameter->type;
-            my $header = GetV8HeaderName($type);
-            $implIncludes{$header} = 1;
-            $result .= "V8${type}::GetRawTemplate()";
+            if ($parameter->type eq "XPathNSResolver") {
+                # Special case for XPathNSResolver.  All other browsers accepts a callable,
+                # so, even though it's against IDL, accept objects here.
+                $result .= "v8::Handle<v8::FunctionTemplate>()";
+            } else {
+                my $type = $parameter->type;
+                my $header = GetV8HeaderName($type);
+                $implIncludes{$header} = 1;
+                $result .= "V8${type}::GetRawTemplate()";
+            }
         } else {
             $result .= "v8::Handle<v8::FunctionTemplate>()";
         }
@@ -2063,12 +2129,17 @@ sub ReturnNativeToJSValue
         return "return V8DOMWrapper::convertEventListenerToV8Object($value)";
     }
 
+    if ($type eq "SerializedScriptValue") {
+        $implIncludes{"$type.h"} = 1;
+        return "return v8String($value->toString())";
+    }
+
     if ($type eq "DedicatedWorkerContext" or $type eq "WorkerContext" or $type eq "SharedWorkerContext") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         return "return WorkerContextExecutionProxy::convertWorkerContextToV8Object($value)";
     }
 
-    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator") {
+    if ($type eq "WorkerLocation" or $type eq "WorkerNavigator" or $type eq "NotificationCenter") {
         $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
         my $classIndex = uc($type);
 
diff --git a/WebCore/bindings/scripts/IDLParser.pm b/WebCore/bindings/scripts/IDLParser.pm
index c4cb041..4abdb45 100644
--- a/WebCore/bindings/scripts/IDLParser.pm
+++ b/WebCore/bindings/scripts/IDLParser.pm
@@ -309,7 +309,11 @@ sub ParseInterface
                 $methodException =~ s/\s+//g;
                 @{$newDataNode->raisesExceptions} = split(/,/, $methodException);
 
-                my @params = split(/,/, $methodSignature);
+                # Split arguments at commas but only if the comma
+                # is not within attribute brackets, expressed here
+                # as being followed by a ']' without a preceding '['.
+                # Note that this assumes that attributes don't nest.
+                my @params = split(/,(?![^[]*\])/, $methodSignature);
                 foreach(@params) {
                     my $line = $_;
 
diff --git a/WebCore/bindings/scripts/generate-bindings.pl b/WebCore/bindings/scripts/generate-bindings.pl
index 9c374bf..c7adeb3 100755
--- a/WebCore/bindings/scripts/generate-bindings.pl
+++ b/WebCore/bindings/scripts/generate-bindings.pl
@@ -42,12 +42,14 @@ my $outputDirectory;
 my $generator;
 my $defines;
 my $preprocessor;
+my $writeDependencies;
 
 GetOptions('include=s@' => \@idlDirectories,
            'outputDir=s' => \$outputDirectory,
            'generator=s' => \$generator,
            'defines=s' => \$defines,
-           'preprocessor=s' => \$preprocessor);
+           'preprocessor=s' => \$preprocessor,
+           'write-dependencies' => \$writeDependencies);
 
 my $idlFile = $ARGV[0];
 
@@ -65,5 +67,5 @@ my $parser = IDLParser->new(1);
 my $document = $parser->Parse($idlFile, $defines, $preprocessor);
 
 # Generate desired output for given IDL file.
-my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor);
+my $codeGen = CodeGenerator->new(\@idlDirectories, $generator, $outputDirectory, 0, $preprocessor, $writeDependencies);
 $codeGen->ProcessDocument($document, $defines);
diff --git a/WebCore/bindings/v8/DOMObjectsInclude.h b/WebCore/bindings/v8/DOMObjectsInclude.h
index 6f36f3b..682ce79 100644
--- a/WebCore/bindings/v8/DOMObjectsInclude.h
+++ b/WebCore/bindings/v8/DOMObjectsInclude.h
@@ -33,11 +33,30 @@
 
 #include "AbstractWorker.h"
 #include "BarInfo.h"
+#include "BeforeLoadEvent.h"
+#include "CanvasArray.h"
+#include "CanvasArrayBuffer.h"
+#include "CanvasBuffer.h"
+#include "CanvasByteArray.h"
+#include "CanvasFloatArray.h"
+#include "CanvasFramebuffer.h"
 #include "CanvasGradient.h"
+#include "CanvasIntArray.h"
+#include "CanvasObject.h"
 #include "CanvasPattern.h"
 #include "CanvasPixelArray.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext.h"
 #include "CanvasRenderingContext2D.h"
+#include "CanvasRenderingContext3D.h"
+#include "CanvasShader.h"
+#include "CanvasShortArray.h"
+#include "CanvasUnsignedByteArray.h"
+#include "CanvasUnsignedIntArray.h"
+#include "CanvasUnsignedShortArray.h"
 #include "CanvasStyle.h"
+#include "CanvasTexture.h"
 #include "CharacterData.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
@@ -106,6 +125,7 @@
 #include "NodeIterator.h"
 #include "OverflowEvent.h"
 #include "Page.h"
+#include "PageTransitionEvent.h"
 #include "Plugin.h"
 #include "PluginArray.h"
 #include "ProcessingInstruction.h"
@@ -135,7 +155,6 @@
 #include "V8HTMLElement.h"
 #include "V8LazyEventListener.h"
 #include "V8NodeFilterCondition.h"
-#include "V8ObjectEventListener.h"
 #include "ValidityState.h"
 #include "VoidCallback.h"
 #include "WebKitAnimationEvent.h"
@@ -215,10 +234,15 @@
 #include "V8SVGPODTypeWrapper.h"
 #endif // SVG
 
+<<<<<<< HEAD:WebCore/bindings/v8/DOMObjectsInclude.h
 #if ENABLE(TOUCH_EVENTS)
 #include "Touch.h"
 #include "TouchList.h"
 #include "TouchEvent.h"
+=======
+#if ENABLE(WEB_SOCKETS)
+#include "WebSocket.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DOMObjectsInclude.h
 #endif
 
 #if ENABLE(WORKERS)
@@ -229,6 +253,11 @@
 #include "WorkerNavigator.h"
 #endif // WORKERS
 
+#if ENABLE(NOTIFICATIONS)
+#include "Notification.h"
+#include "NotificationCenter.h"
+#endif // NOTIFICATIONS
+
 #if ENABLE(XPATH)
 #include "XPathEvaluator.h"
 #endif // XPATH
diff --git a/WebCore/bindings/v8/DateExtension.cpp b/WebCore/bindings/v8/DateExtension.cpp
new file mode 100644
index 0000000..778a15a
--- /dev/null
+++ b/WebCore/bindings/v8/DateExtension.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DateExtension.h"
+
+#include "V8Proxy.h"
+#include "V8HiddenPropertyName.h"
+
+namespace WebCore {
+
+DateExtension* DateExtension::extension;
+
+static const char* dateExtensionName = "v8/DateExtension";
+static const char* dateExtensionScript =
+    "(function () {"
+    "  var counter;"
+    "  var orig_getTime;"
+    "  function getTimeOverride() {"
+    "    if (++counter > 1000)"
+    "      OnSleepDetected();"
+    "    return orig_getTime.call(this);"
+    "  };"
+    "  function enableSleepDetection(enable) {"
+    "    if (enable) {"
+    "      counter = 0;"
+    "      orig_getTime = Date.prototype.getTime;"
+    "      Date.prototype.getTime = getTimeOverride;"
+    "    } else {"
+    "      Date.prototype.getTime = orig_getTime;"
+    "    }"
+    "  };"
+    "  native function Setup();"
+    "  native function OnSleepDetected();"
+    "  Setup(Date, enableSleepDetection);"
+    "})()";
+
+DateExtension::DateExtension() : v8::Extension(dateExtensionName, dateExtensionScript)
+{
+}
+
+DateExtension* DateExtension::get()
+{
+    if (!extension)
+        extension = new DateExtension();
+    return extension;
+}
+
+void DateExtension::setAllowSleep(bool allow)
+{
+    v8::Local<v8::Value> result = V8Proxy::retrieve()->context()->Global()->Get(v8::String::New("Date"));
+    if (result.IsEmpty())
+        return;
+
+    v8::Handle<v8::Object> dateObject = v8::Handle<v8::Object>::Cast(result);
+    if (dateObject.IsEmpty())
+        return;
+
+    v8::Local<v8::Value> sleepFunctionHandle = dateObject->GetHiddenValue(V8HiddenPropertyName::sleepFunction());
+    if (sleepFunctionHandle.IsEmpty() || !sleepFunctionHandle->IsFunction())
+        return;
+
+    v8::Handle<v8::Value> argv[1];
+    argv[0] = v8::String::New(allow ? "false" : "true");
+    v8::Handle<v8::Function>::Cast(sleepFunctionHandle)->Call(v8::Object::New(), 1, argv);
+}
+
+v8::Handle<v8::FunctionTemplate> DateExtension::GetNativeFunction(v8::Handle<v8::String> name)
+{
+    if (name->Equals(v8::String::New("Setup")))
+        return v8::FunctionTemplate::New(Setup);
+    if (name->Equals(v8::String::New("OnSleepDetected")))
+        return v8::FunctionTemplate::New(OnSleepDetected);
+
+    return v8::Handle<v8::FunctionTemplate>();
+}
+
+v8::Handle<v8::Value> DateExtension::Setup(const v8::Arguments& args)
+{
+    if (args.Length() != 2 || !args[0]->IsObject() || !args[1]->IsFunction())
+        return v8::Undefined();
+
+    v8::Handle<v8::Object> dateObject = v8::Handle<v8::Object>::Cast(args[0]);
+    v8::Handle<v8::Function> enableSleepDetectionFunction = v8::Handle<v8::Function>::Cast(args[1]);
+
+    dateObject->SetHiddenValue(V8HiddenPropertyName::sleepFunction(), enableSleepDetectionFunction);
+    return v8::Undefined();
+}
+
+v8::Handle<v8::Value> DateExtension::OnSleepDetected(const v8::Arguments&)
+{
+    v8::V8::TerminateExecution();
+    return v8::Undefined();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/bindings/v8/DateExtension.h b/WebCore/bindings/v8/DateExtension.h
new file mode 100644
index 0000000..2bccac4
--- /dev/null
+++ b/WebCore/bindings/v8/DateExtension.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DateExtension_h
+#define DateExtension_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+// Prevent "sleep" calls in unload handlers.
+class DateExtension : public v8::Extension {
+public:
+    static DateExtension* get();
+    void setAllowSleep(bool allow);
+
+private:
+    DateExtension();
+    virtual v8::Handle<v8::FunctionTemplate> GetNativeFunction(v8::Handle<v8::String>);
+    static v8::Handle<v8::Value> Setup(const v8::Arguments&);
+    static v8::Handle<v8::Value> OnSleepDetected(const v8::Arguments&);
+
+    static DateExtension* extension;
+};
+
+} // namespace WebCore
+
+#endif  // DateExtension_h
diff --git a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
index e52a505..1dec0b1 100644
--- a/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+++ b/WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
@@ -33,10 +33,28 @@
 
 #include "bindings/V8Attr.cpp"
 #include "bindings/V8BarInfo.cpp"
+#include "bindings/V8BeforeLoadEvent.cpp"
+#include "bindings/V8CanvasArray.cpp"
+#include "bindings/V8CanvasArrayBuffer.cpp"
+#include "bindings/V8CanvasBuffer.cpp"
+#include "bindings/V8CanvasByteArray.cpp"
+#include "bindings/V8CanvasFloatArray.cpp"
+#include "bindings/V8CanvasFramebuffer.cpp"
 #include "bindings/V8CanvasGradient.cpp"
+#include "bindings/V8CanvasIntArray.cpp"
 #include "bindings/V8CanvasPattern.cpp"
 #include "bindings/V8CanvasPixelArray.cpp"
+#include "bindings/V8CanvasProgram.cpp"
+#include "bindings/V8CanvasRenderbuffer.cpp"
+#include "bindings/V8CanvasRenderingContext.cpp"
 #include "bindings/V8CanvasRenderingContext2D.cpp"
+#include "bindings/V8CanvasRenderingContext3D.cpp"
+#include "bindings/V8CanvasShader.cpp"
+#include "bindings/V8CanvasShortArray.cpp"
+#include "bindings/V8CanvasTexture.cpp"
+#include "bindings/V8CanvasUnsignedByteArray.cpp"
+#include "bindings/V8CanvasUnsignedIntArray.cpp"
+#include "bindings/V8CanvasUnsignedShortArray.cpp"
 #include "bindings/V8CDATASection.cpp"
 #include "bindings/V8CharacterData.cpp"
 #include "bindings/V8ClientRect.cpp"
@@ -174,7 +192,10 @@
 #include "bindings/V8NodeIterator.cpp"
 #include "bindings/V8NodeList.cpp"
 #include "bindings/V8Notation.cpp"
+#include "bindings/V8Notification.cpp"
+#include "bindings/V8NotificationCenter.cpp"
 #include "bindings/V8OverflowEvent.cpp"
+#include "bindings/V8PageTransitionEvent.cpp"
 #include "bindings/V8Plugin.cpp"
 #include "bindings/V8PluginArray.cpp"
 #include "bindings/V8ProcessingInstruction.cpp"
@@ -251,7 +272,6 @@
 #include "bindings/V8SVGClipPathElement.cpp"
 #include "bindings/V8SVGColor.cpp"
 #include "bindings/V8SVGCursorElement.cpp"
-#include "bindings/V8SVGDefinitionSrcElement.cpp"
 #include "bindings/V8SVGDefsElement.cpp"
 #include "bindings/V8SVGDescElement.cpp"
 #include "bindings/V8SVGDocument.cpp"
@@ -337,12 +357,35 @@
 #include "bindings/V8SVGUseElement.cpp"
 #include "bindings/V8SVGViewElement.cpp"
 #include "bindings/V8SVGZoomEvent.cpp"
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
+=======
+#include "bindings/V8Text.cpp"
+#include "bindings/V8TextEvent.cpp"
+#include "bindings/V8TextMetrics.cpp"
+#include "bindings/V8TimeRanges.cpp"
+#include "bindings/V8TreeWalker.cpp"
+#include "bindings/V8UIEvent.cpp"
+#include "bindings/V8ValidityState.cpp"
+#include "bindings/V8WebKitAnimationEvent.cpp"
+#include "bindings/V8WebKitCSSKeyframeRule.cpp"
+#include "bindings/V8WebKitCSSKeyframesRule.cpp"
+#include "bindings/V8WebKitCSSMatrix.cpp"
+#include "bindings/V8WebKitCSSTransformValue.cpp"
+#include "bindings/V8WebKitPoint.cpp"
+#include "bindings/V8WebKitTransitionEvent.cpp"
+#if ENABLE(WEB_SOCKETS)
+#include "bindings/V8WebSocket.cpp"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 #endif
+<<<<<<< HEAD:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 
 #if ENABLE(WORKERS)
 #include "bindings/V8AbstractWorker.cpp"
 #include "bindings/V8DedicatedWorkerContext.cpp"
 #include "bindings/V8SharedWorker.cpp"
+=======
+#include "bindings/V8WheelEvent.cpp"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/DerivedSourcesAllInOne.cpp
 #include "bindings/V8Worker.cpp"
 #include "bindings/V8WorkerContext.cpp"
 #include "bindings/V8WorkerLocation.cpp"
diff --git a/WebCore/bindings/v8/NPV8Object.cpp b/WebCore/bindings/v8/NPV8Object.cpp
index cb2a6c1..13403ec 100644
--- a/WebCore/bindings/v8/NPV8Object.cpp
+++ b/WebCore/bindings/v8/NPV8Object.cpp
@@ -276,7 +276,7 @@ bool _NPN_EvaluateHelper(NPP npp, bool popupsAllowed, NPObject* npObject, NPStri
         filename = "npscript";
 
     WebCore::String script = WebCore::String::fromUTF8(npScript->UTF8Characters, npScript->UTF8Length);
-    v8::Local<v8::Value> v8result = proxy->evaluate(WebCore::ScriptSourceCode(script, WebCore::KURL(filename)), 0);
+    v8::Local<v8::Value> v8result = proxy->evaluate(WebCore::ScriptSourceCode(script, WebCore::KURL(WebCore::ParsedURLString, filename)), 0);
 
     if (v8result.IsEmpty())
         return false;
@@ -413,8 +413,12 @@ bool _NPN_HasMethod(NPP npp, NPObject* npObject, NPIdentifier methodName)
 
 void _NPN_SetException(NPObject* npObject, const NPUTF8 *message)
 {
-    if (npObject->_class != npScriptObjectClass)
+    if (npObject->_class != npScriptObjectClass) {
+        // We won't be able to find a proper scope for this exception, so just throw it.
+        // This is consistent with JSC, which throws a global exception all the time.
+        V8Proxy::throwError(V8Proxy::GeneralError, message);
         return;
+    }
     v8::HandleScope handleScope;
     v8::Handle<v8::Context> context = toV8Context(0, npObject);
     if (context.IsEmpty())
diff --git a/WebCore/bindings/v8/OwnHandle.h b/WebCore/bindings/v8/OwnHandle.h
index 6580674..17c551c 100644
--- a/WebCore/bindings/v8/OwnHandle.h
+++ b/WebCore/bindings/v8/OwnHandle.h
@@ -45,15 +45,13 @@ namespace WebCore {
         v8::Handle<T> get() const { return m_handle; }
         void set(v8::Handle<T> handle) { clear(); m_handle = v8::Persistent<T>::New(handle); }
 
-        // FIXME: What if we release a weak handle?  Won't the callback do the wrong thing?
-        v8::Persistent<T> release() { v8::Persistent<T> result = m_handle; m_handle.Clear(); return result; }
-        void adopt(v8::Persistent<T> handle) { clear(); m_handle = handle; }
-
         // Note: This is clear in the OwnPtr sense, not the v8::Handle sense.
         void clear()
         {
             if (m_handle.IsEmpty())
                 return;
+            if (m_handle.IsWeak())
+                m_handle.ClearWeak();
             m_handle.Dispose();
             m_handle.Clear();
         }
diff --git a/WebCore/bindings/v8/ScheduledAction.cpp b/WebCore/bindings/v8/ScheduledAction.cpp
index 44e8a37..268e177 100644
--- a/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/WebCore/bindings/v8/ScheduledAction.cpp
@@ -44,8 +44,9 @@
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(v8::Handle<v8::Function> func, int argc, v8::Handle<v8::Value> argv[])
-    : m_code(String(), KURL(), 0)
+ScheduledAction::ScheduledAction(v8::Handle<v8::Context> context, v8::Handle<v8::Function> func, int argc, v8::Handle<v8::Value> argv[])
+    : m_context(context)
+    , m_code(String(), KURL(), 0)
 {
     m_function = v8::Persistent<v8::Function>::New(func);
 
@@ -107,7 +108,7 @@ void ScheduledAction::execute(V8Proxy* proxy)
 
     LOCK_V8;
     v8::HandleScope handleScope;
-    v8::Local<v8::Context> v8Context = proxy->context();
+    v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context.get());
     if (v8Context.IsEmpty())
         return; // JS may not be enabled.
 
@@ -136,7 +137,7 @@ void ScheduledAction::execute(WorkerContext* workerContext)
     if (!m_function.IsEmpty() && m_function->IsFunction()) {
         LOCK_V8;
         v8::HandleScope handleScope;
-        v8::Local<v8::Context> v8Context = scriptController->proxy()->context();
+        v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context.get());
         ASSERT(!v8Context.IsEmpty());
         v8::Context::Scope scope(v8Context);
         m_function->Call(v8Context->Global(), m_argc, m_argv);
diff --git a/WebCore/bindings/v8/ScheduledAction.h b/WebCore/bindings/v8/ScheduledAction.h
index 53694c7..003885f 100644
--- a/WebCore/bindings/v8/ScheduledAction.h
+++ b/WebCore/bindings/v8/ScheduledAction.h
@@ -31,7 +31,9 @@
 #ifndef ScheduledAction_h
 #define ScheduledAction_h
 
+#include "OwnHandle.h"
 #include "ScriptSourceCode.h"
+#include "V8GCController.h"
 
 #include <v8.h>
 
@@ -44,9 +46,10 @@ namespace WebCore {
 
     class ScheduledAction {
     public:
-        ScheduledAction(v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
-        explicit ScheduledAction(const WebCore::String& code, const KURL& url = KURL())
-            : m_argc(0)
+        ScheduledAction(v8::Handle<v8::Context>, v8::Handle<v8::Function>, int argc, v8::Handle<v8::Value> argv[]);
+        explicit ScheduledAction(v8::Handle<v8::Context> context, const WebCore::String& code, const KURL& url = KURL())
+            : m_context(context)
+            , m_argc(0)
             , m_argv(0)
             , m_code(code, url)
         {
@@ -61,6 +64,7 @@ namespace WebCore {
         void execute(WorkerContext*);
 #endif
 
+        OwnHandle<v8::Context> m_context;
         v8::Persistent<v8::Function> m_function;
         int m_argc;
         v8::Persistent<v8::Value>* m_argv;
diff --git a/WebCore/bindings/v8/ScriptCallFrame.cpp b/WebCore/bindings/v8/ScriptCallFrame.cpp
index ab30862..4c29814 100644
--- a/WebCore/bindings/v8/ScriptCallFrame.cpp
+++ b/WebCore/bindings/v8/ScriptCallFrame.cpp
@@ -42,7 +42,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber, const v8::Arguments& arguments, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(urlString)
+    , m_sourceURL(ParsedURLString, urlString)
     , m_lineNumber(lineNumber)
 {
     for (int i = 0; i < arguments.Length(); ++i)
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 48c5115..d2c1db2 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -51,7 +51,6 @@
 #include "npruntime_priv.h"
 #include "NPV8Object.h"
 #include "ScriptSourceCode.h"
-#include "ScriptState.h"
 #include "Widget.h"
 #include "XSSAuditor.h"
 
@@ -96,7 +95,6 @@ ScriptController::ScriptController(Frame* frame)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
-    , m_scriptState(new ScriptState(frame))
     , m_proxy(new V8Proxy(frame))
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
@@ -186,9 +184,14 @@ bool ScriptController::processingUserGesture() const
     return false;
 }
 
-void ScriptController::evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup)
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources)
 {
-    m_proxy->evaluateInNewWorld(sources, extensionGroup);
+    m_proxy->evaluateInIsolatedWorld(worldID, sources, 0);
+}
+
+void ScriptController::evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup)
+{
+    m_proxy->evaluateInIsolatedWorld(worldID, sources, extensionGroup);
 }
 
 void ScriptController::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int extensionGroup)
@@ -202,12 +205,7 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
     LOCK_V8;
     String sourceURL = sourceCode.url();
     
-    if (sourceURL.isNull() && !m_XSSAuditor->canEvaluateJavaScriptURL(sourceCode.source())) {
-        // This JavaScript URL is not safe to be evaluated.
-        return ScriptValue();
-    }
-    
-    if (!sourceURL.isNull() && !m_XSSAuditor->canEvaluate(sourceCode.source())) {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
         // This script is not safe to be evaluated.
         return ScriptValue();
     }
@@ -343,7 +341,7 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
     return V8ScriptInstance::create(wrapper);
 }
 
-void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
+void ScriptController::cleanupScriptObjectsForPlugin(Widget* nativeHandle)
 {
     PluginObjectMap::iterator it = m_pluginObjects.find(nativeHandle);
     if (it == m_pluginObjects.end())
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index d614619..9658b05 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -46,7 +46,6 @@ namespace WebCore {
     class Frame;
     class HTMLPlugInElement;
     class ScriptSourceCode;
-    class ScriptState;
     class String;
     class Widget;
     class XSSAuditor;
@@ -65,11 +64,19 @@ namespace WebCore {
         // as a string.
         ScriptValue evaluate(const ScriptSourceCode&);
 
-        // Executes JavaScript in a new world associated with the web frame. The
-        // script gets its own global scope, its own prototypes for intrinsic
-        // JavaScript objects (String, Array, and so-on), and its own wrappers for
-        // all DOM nodes and DOM constructors.
-        void evaluateInNewWorld(const Vector<ScriptSourceCode>&, int extensionGroup);
+        void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&);
+
+        // Executes JavaScript in an isolated world. The script gets its own global scope,
+        // its own prototypes for intrinsic JavaScript objects (String, Array, and so-on),
+        // and its own wrappers for all DOM nodes and DOM constructors.
+        //
+        // If an isolated world with the specified ID already exists, it is reused.
+        // Otherwise, a new world is created.
+        //
+        // If the worldID is 0, a new world is always created.
+        //
+        // FIXME: Get rid of extensionGroup here.
+        void evaluateInIsolatedWorld(unsigned worldID, const Vector<ScriptSourceCode>&, int extensionGroup);
 
         // Executes JavaScript in a new context associated with the web frame. The
         // script gets its own global scope and its own prototypes for intrinsic
@@ -86,8 +93,6 @@ namespace WebCore {
         // with what JSC does as well.
         ScriptController* windowShell() { return this; }
 
-        ScriptState* state() const { return m_scriptState.get(); }
-
         XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
         void collectGarbage();
@@ -146,7 +151,7 @@ namespace WebCore {
         void updateSecurityOrigin();
         void clearScriptObjects();
         void updatePlatformScriptObjects();
-        void cleanupScriptObjectsForPlugin(void*);
+        void cleanupScriptObjectsForPlugin(Widget*);
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
         NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
@@ -160,9 +165,8 @@ namespace WebCore {
         bool m_processingTimerCallback;
         bool m_paused;
 
-        OwnPtr<ScriptState> m_scriptState;
         OwnPtr<V8Proxy> m_proxy;
-        typedef HashMap<void*, NPObject*> PluginObjectMap;
+        typedef HashMap<Widget*, NPObject*> PluginObjectMap;
 
         // A mapping between Widgets and their corresponding script object.
         // This list is used so that when the plugin dies, we can immediately
diff --git a/WebCore/bindings/v8/ScriptEventListener.cpp b/WebCore/bindings/v8/ScriptEventListener.cpp
index 7a8aa64..16ca70f 100644
--- a/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -33,7 +33,11 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "EventListener.h"
 #include "Frame.h"
+#include "ScriptScope.h"
+#include "V8AbstractEventListener.h"
+#include "V8Binding.h"
 #include "XSSAuditor.h"
 
 namespace WebCore {
@@ -68,4 +72,18 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
     return V8LazyEventListener::create(frame, attr->value(), attr->localName().string(), frame->document()->isSVGDocument());
 }
 
+String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState* scriptState, EventListener* listener)
+{
+    if (listener->type() != EventListener::JSEventListenerType)
+        return "";
+
+    ScriptScope scope(scriptState);
+    V8AbstractEventListener* v8Listener = static_cast<V8AbstractEventListener*>(listener);
+    v8::Handle<v8::Object> function = v8Listener->getListenerObject();
+    if (function.IsEmpty())
+        return "";
+
+    return toWebCoreStringWithNullCheck(function);
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/ScriptEventListener.h b/WebCore/bindings/v8/ScriptEventListener.h
index 0171120..ce12a53 100644
--- a/WebCore/bindings/v8/ScriptEventListener.h
+++ b/WebCore/bindings/v8/ScriptEventListener.h
@@ -38,11 +38,14 @@
 namespace WebCore {
 
     class Attribute;
+    class EventListener;
     class Frame;
     class Node;
+    class ScriptState;
 
     PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node*, Attribute*);
     PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+    String getEventListenerHandlerBody(ScriptExecutionContext*, ScriptState*, EventListener*);
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 2fa43d5..9ff6b8c 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -31,8 +31,6 @@
 #include "config.h"
 #include "ScriptFunctionCall.h"
 
-#include "Document.h"
-#include "Frame.h"
 #include "ScriptScope.h"
 #include "ScriptState.h"
 #include "ScriptString.h"
@@ -40,19 +38,13 @@
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include "V8Utilities.h"
 
 #include <v8.h>
 #include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
-static void reportException(ScriptState* scriptState, v8::TryCatch &exceptionCatcher)
-{
-    v8::Local<v8::Message> message = exceptionCatcher.Message();
-    scriptState->frame()->document()->reportException(toWebCoreString(message->Get()), message->GetLineNumber(), toWebCoreString(message->GetScriptResourceName()));
-    exceptionCatcher.Reset();
-}
-
 ScriptFunctionCall::ScriptFunctionCall(ScriptState* scriptState, const ScriptObject& thisObject, const String& name)
     : m_scriptState(scriptState)
     , m_thisObject(thisObject)
diff --git a/WebCore/bindings/v8/ScriptObject.cpp b/WebCore/bindings/v8/ScriptObject.cpp
index b6943bd..ac8051d 100644
--- a/WebCore/bindings/v8/ScriptObject.cpp
+++ b/WebCore/bindings/v8/ScriptObject.cpp
@@ -97,6 +97,13 @@ bool ScriptObject::set(const char* name, int value)
     return scope.success();
 }
 
+bool ScriptObject::set(const char* name, unsigned value)
+{
+    ScriptScope scope(m_scriptState);
+    v8Object()->Set(v8::String::New(name), v8::Number::New(value));
+    return scope.success();
+}
+
 bool ScriptObject::set(const char* name, bool value)
 {
     ScriptScope scope(m_scriptState);
diff --git a/WebCore/bindings/v8/ScriptObject.h b/WebCore/bindings/v8/ScriptObject.h
index dcee3a5..f741f89 100644
--- a/WebCore/bindings/v8/ScriptObject.h
+++ b/WebCore/bindings/v8/ScriptObject.h
@@ -53,6 +53,7 @@ namespace WebCore {
         bool set(const char* name, double);
         bool set(const char* name, long long);
         bool set(const char* name, int);
+        bool set(const char* name, unsigned);
         bool set(const char* name, bool);
 
         static ScriptObject createNew(ScriptState*);
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
index 053cf68..5dd0dc5 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.cpp
@@ -35,9 +35,11 @@
 #include "Document.h"
 #include "DOMWindow.h"
 #include "Frame.h"
+#include "InspectorController.h"
 #include "Page.h"
 #include "ScriptObject.h"
 #include "ScriptValue.h"
+#include "Storage.h"
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
@@ -61,10 +63,11 @@ bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObj
     return false;
 }
 
-bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject)
 {
-    ASSERT(frame);
     ASSERT(storage);
+    Frame* frame = storage->frame();
+    ASSERT(frame);
 
 #if ENABLE(DOM_STORAGE)
     v8::HandleScope handleScope;
@@ -73,7 +76,8 @@ bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& qu
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8Storage = V8DOMWrapper::convertToV8Object(V8ClassIndex::STORAGE, storage);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Storage)));
 #else
     ASSERT_NOT_REACHED();
     quarantinedObject = ScriptObject();
@@ -94,7 +98,8 @@ bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8Node = V8DOMWrapper::convertNodeToV8Object(node);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8Node)));
 
     return true;
 }
@@ -111,7 +116,8 @@ bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedO
     v8::Context::Scope scope(context);
 
     v8::Handle<v8::Value> v8DomWindow = V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, domWindow);
-    quarantinedObject = ScriptObject(frame->script()->state(), v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
+    ScriptState* scriptState = frame->page()->inspectorController()->frontendScriptState();
+    quarantinedObject = ScriptObject(scriptState, v8::Local<v8::Object>(v8::Object::Cast(*v8DomWindow)));
 
     return true;
 }
diff --git a/WebCore/bindings/v8/ScriptObjectQuarantine.h b/WebCore/bindings/v8/ScriptObjectQuarantine.h
index 3b7ccff..712dd9b 100644
--- a/WebCore/bindings/v8/ScriptObjectQuarantine.h
+++ b/WebCore/bindings/v8/ScriptObjectQuarantine.h
@@ -42,7 +42,6 @@ namespace WebCore {
 
     class Database;
     class DOMWindow;
-    class Frame;
     class Node;
     class ScriptObject;
     class ScriptValue;
@@ -51,7 +50,7 @@ namespace WebCore {
     ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
 
     bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
-    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(Storage* storage, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
     bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
 
diff --git a/WebCore/bindings/v8/ScriptScope.cpp b/WebCore/bindings/v8/ScriptScope.cpp
index 52cab10..727ab25 100644
--- a/WebCore/bindings/v8/ScriptScope.cpp
+++ b/WebCore/bindings/v8/ScriptScope.cpp
@@ -36,14 +36,13 @@
 #include "Document.h"
 #include "Frame.h"
 #include "V8Binding.h"
-#include "V8Proxy.h"
 
 #include <v8.h>
 
 namespace WebCore {
 
 ScriptScope::ScriptScope(ScriptState* scriptState, bool reportExceptions)
-    : m_context(V8Proxy::context(scriptState->frame()))
+    : m_context(scriptState->context())
     , m_scope(m_context)
     , m_scriptState(scriptState)
     , m_reportExceptions(reportExceptions)
diff --git a/WebCore/bindings/v8/ScriptSourceCode.h b/WebCore/bindings/v8/ScriptSourceCode.h
index fea387a..5c16168 100644
--- a/WebCore/bindings/v8/ScriptSourceCode.h
+++ b/WebCore/bindings/v8/ScriptSourceCode.h
@@ -50,7 +50,7 @@ public:
     // Not sure if that matters.
     ScriptSourceCode(CachedScript* cs)
         : m_source(cs->script())
-        , m_url(cs->url())
+        , m_url(ParsedURLString, cs->url())
         , m_startLine(1)
     {
     }
diff --git a/WebCore/bindings/v8/ScriptState.cpp b/WebCore/bindings/v8/ScriptState.cpp
index b9e240c..99557b5 100644
--- a/WebCore/bindings/v8/ScriptState.cpp
+++ b/WebCore/bindings/v8/ScriptState.cpp
@@ -42,9 +42,22 @@ namespace WebCore {
 
 ScriptState::ScriptState(Frame* frame)
     : m_frame(frame)
+    , m_context(v8::Persistent<v8::Context>::New(V8Proxy::mainWorldContext(frame)))
 {
 }
 
+ScriptState::ScriptState(Frame* frame, v8::Handle<v8::Context> context)
+    : m_frame(frame)
+    , m_context(v8::Persistent<v8::Context>::New(context))
+{
+}
+
+ScriptState::~ScriptState()
+{
+    m_context.Dispose();
+    m_context.Clear();
+}
+
 ScriptState* scriptStateFromNode(Node* node)
 {
     // This should be never reached with V8 bindings (WebKit only uses it
@@ -55,7 +68,9 @@ ScriptState* scriptStateFromNode(Node* node)
 
 ScriptState* scriptStateFromPage(Page* page)
 {
-    return page->mainFrame()->script()->state();
+    // This should be never reached with V8 bindings.
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 }
diff --git a/WebCore/bindings/v8/ScriptState.h b/WebCore/bindings/v8/ScriptState.h
index 8fbcfa3..e44e914 100644
--- a/WebCore/bindings/v8/ScriptState.h
+++ b/WebCore/bindings/v8/ScriptState.h
@@ -32,16 +32,19 @@
 #define ScriptState_h
 
 #include <v8.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
     class Node;
     class Page;
     class Frame;
 
-    class ScriptState {
+    class ScriptState : public Noncopyable {
     public:
         ScriptState() { }
         ScriptState(Frame* frame);
+        ScriptState(Frame* frame, v8::Handle<v8::Context> context);
+        ~ScriptState();
 
         bool hadException() { return !m_exception.IsEmpty(); }
         void setException(v8::Local<v8::Value> exception)
@@ -51,10 +54,15 @@ namespace WebCore {
         v8::Local<v8::Value> exception() { return m_exception; }
 
         Frame* frame() const { return m_frame; }
+        v8::Local<v8::Context> context() const
+        {
+            return v8::Local<v8::Context>::New(m_context);
+        }
 
     private:
         v8::Local<v8::Value> m_exception;
         Frame* m_frame;
+        v8::Persistent<v8::Context> m_context;
     };
 
     ScriptState* scriptStateFromNode(Node*);
diff --git a/WebCore/bindings/v8/ScriptValue.h b/WebCore/bindings/v8/ScriptValue.h
index 004851b..a429593 100644
--- a/WebCore/bindings/v8/ScriptValue.h
+++ b/WebCore/bindings/v8/ScriptValue.h
@@ -110,7 +110,12 @@ public:
     {
         return m_value->IsUndefined();
     }
-    
+
+    bool isObject() const
+    {
+        return m_value->IsObject();
+    }
+
     bool hasNoValue() const
     {
         return m_value.IsEmpty();
@@ -128,7 +133,7 @@ public:
         m_value.Clear();
     }
 
-    ~ScriptValue() 
+    virtual ~ScriptValue() 
     {
         clear();
     }
diff --git a/WebCore/bindings/v8/SerializedScriptValue.h b/WebCore/bindings/v8/SerializedScriptValue.h
new file mode 100644
index 0000000..26a4199
--- /dev/null
+++ b/WebCore/bindings/v8/SerializedScriptValue.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SerializedScriptValue_h
+#define SerializedScriptValue_h
+
+#include "ScriptValue.h"
+#include "V8Binding.h"
+#include <v8.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+public:
+    static PassRefPtr<SerializedScriptValue> create(String string)
+    {
+        return adoptRef(new SerializedScriptValue(string));
+    }
+
+    static PassRefPtr<SerializedScriptValue> create()
+    {
+        return adoptRef(new SerializedScriptValue());
+    }
+
+    PassRefPtr<SerializedScriptValue> release()
+    {
+        RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data));
+        m_data = String();
+        return result.release();
+    }
+
+    String toString()
+    {
+        return m_data;
+    }
+
+private:
+    SerializedScriptValue(String string)
+        : m_data(string)
+    {
+    }
+
+    SerializedScriptValue() { }
+    String m_data;
+};
+
+} // namespace WebCore
+
+#endif // SerializedScriptValue_h
diff --git a/WebCore/bindings/v8/SharedPersistent.h b/WebCore/bindings/v8/SharedPersistent.h
new file mode 100644
index 0000000..c1232ae
--- /dev/null
+++ b/WebCore/bindings/v8/SharedPersistent.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SharedPersistent_h
+#define SharedPersistent_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+    // A shareable reference to a v8 persistent handle.  Using a shared
+    // persistent any number of objects can share a reference to a v8
+    // object and when it should no longer be accessible the object's
+    // owner can clear it.
+    template <typename T>
+    class SharedPersistent : public WTF::RefCounted<SharedPersistent<T> > {
+    public:
+        void set(v8::Persistent<T> value)
+        {
+            m_value = value;
+        }
+        v8::Persistent<T> get()
+        {
+            return m_value;
+        }
+        void disposeHandle()
+        {
+            if (!m_value.IsEmpty()) {
+              m_value.Dispose();
+              m_value.Clear();
+            }
+        }
+        static PassRefPtr<SharedPersistent<T> > create(v8::Persistent<T> value)
+        {
+            return adoptRef(new SharedPersistent<T>(value));
+        }
+        static PassRefPtr<SharedPersistent<T> > create()
+        {
+            return create(v8::Persistent<T>());
+        }
+    private:
+        explicit SharedPersistent(v8::Persistent<T> value) : m_value(value) { }
+        v8::Persistent<T> m_value;
+    };
+
+} // namespace WebCore
+
+#endif // SharedPersistent_h
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 0c81846..032b6b9 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -31,17 +31,30 @@
 #include "config.h"
 #include "V8AbstractEventListener.h"
 
+#include "DateExtension.h"
 #include "Document.h"
 #include "Event.h"
 #include "Frame.h"
 #include "Tokenizer.h"
 #include "V8Binding.h"
+#include "V8EventListenerList.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
 
 namespace WebCore {
 
-V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
-    : m_isAttribute(isAttribute)
+static void weakEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
+{
+    V8AbstractEventListener* listener = static_cast<V8AbstractEventListener*>(parameter);
+    listener->disposeListenerObject();
+}
+
+V8AbstractEventListener::V8AbstractEventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, bool isAttribute)
+    : EventListener(JSEventListenerType)
+    , m_isWeak(true)
+    , m_isAttribute(isAttribute)
     , m_frame(frame)
+    , m_guard(guard)
     , m_lineNumber(0)
     , m_columnNumber(0)
 {
@@ -51,8 +64,7 @@ V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
     // We might be called directly from the parser.
     v8::HandleScope handleScope;
 
-    m_context.set(V8Proxy::context(m_frame));
-    m_context.makeWeak();
+    m_context = V8Proxy::shared_context(m_frame);
 
     // Get the position in the source if any.
     if (m_isAttribute && m_frame->document()->tokenizer()) {
@@ -61,52 +73,17 @@ V8AbstractEventListener::V8AbstractEventListener(Frame* frame, bool isAttribute)
     }
 }
 
-void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Context, Event* event, v8::Handle<v8::Value> jsEvent, bool isWindowEvent)
+V8AbstractEventListener::~V8AbstractEventListener()
 {
-    // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
-    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
-    v8::Local<v8::Value> returnValue;
-
-    {
-        // Catch exceptions thrown in the event handler so they do not propagate to javascript code that caused the event to fire.
-        v8::TryCatch tryCatch;
-        tryCatch.SetVerbose(true);
-
-        // Save the old 'event' property so we can restore it later.
-        v8::Local<v8::Value> savedEvent = v8Context->Global()->GetHiddenValue(eventSymbol);
-        tryCatch.Reset();
-
-        // Make the event available in the global object, so DOMWindow can expose it.
-        v8Context->Global()->SetHiddenValue(eventSymbol, jsEvent);
-        tryCatch.Reset();
-
-        // Call the event handler.
-        returnValue = callListenerFunction(jsEvent, event, isWindowEvent);
-        tryCatch.Reset();
-
-        // Restore the old event. This must be done for all exit paths through this method.
-        if (savedEvent.IsEmpty())
-            v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
-        else
-            v8Context->Global()->SetHiddenValue(eventSymbol, savedEvent);
-        tryCatch.Reset();
+    if (!m_listener.IsEmpty()) {
+        v8::HandleScope scope;
+        v8::Local<v8::Object> listener = v8::Local<v8::Object>::New(m_listener);
+        V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
-
-    ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
-
-    if (returnValue.IsEmpty())
-        return;
-
-    if (!returnValue->IsNull() && !returnValue->IsUndefined() && event->storesResultAsString())
-        event->storeResult(toWebCoreString(returnValue));
-
-    // Prevent default action if the return value is false;
-    // FIXME: Add example, and reference to bug entry.
-    if (m_isAttribute && returnValue->IsBoolean() && !returnValue->BooleanValue())
-        event->preventDefault();
+    disposeListenerObject();
 }
 
-void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+void V8AbstractEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext, Event* event)
 {
     // EventListener could be disconnected from the frame.
     if (disconnected())
@@ -119,7 +96,12 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
     LOCK_V8;
     v8::HandleScope handleScope;
 
-    v8::Handle<v8::Context> v8Context = m_context.get();
+    if (!m_context)
+        return;
+
+    // Create a new local handle since the persistent handle stored in
+    // m_context may be disposed before we're done.
+    v8::Handle<v8::Context> v8Context = v8::Local<v8::Context>::New(m_context->get());
     if (v8Context.IsEmpty())
         return;
 
@@ -132,7 +114,7 @@ void V8AbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = V8DOMWrapper::convertEventToV8Object(event);
 
-    invokeEventHandler(v8Context, event, jsEvent, isWindowEvent);
+    invokeEventHandler(v8Context, event, jsEvent);
 
     Document::updateStyleForAllDocuments();
 }
@@ -148,14 +130,83 @@ void V8AbstractEventListener::disposeListenerObject()
     }
 }
 
-v8::Local<v8::Object> V8AbstractEventListener::getReceiverObject(Event* event, bool isWindowEvent)
+void V8AbstractEventListener::setListenerObject(v8::Handle<v8::Object> listener)
+{
+    disposeListenerObject();
+    m_listener = v8::Persistent<v8::Object>::New(listener);
+#ifndef NDEBUG
+    V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
+#endif
+    if (m_isWeak)
+        m_listener.MakeWeak(this, &weakEventListenerCallback);
+}
+
+void V8AbstractEventListener::invokeEventHandler(v8::Handle<v8::Context> v8Context, Event* event, v8::Handle<v8::Value> jsEvent)
+{
+    // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
+    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Local<v8::Value> returnValue;
+
+    // In beforeunload/unload handlers, we want to avoid sleeps which do tight loops of calling Date.getTime().
+    if (event->type() == "beforeunload" || event->type() == "unload")
+        DateExtension::get()->setAllowSleep(false);
+
+    {
+        // Catch exceptions thrown in the event handler so they do not propagate to javascript code that caused the event to fire.
+        v8::TryCatch tryCatch;
+        tryCatch.SetVerbose(true);
+
+        // Save the old 'event' property so we can restore it later.
+        v8::Local<v8::Value> savedEvent = v8Context->Global()->GetHiddenValue(eventSymbol);
+        tryCatch.Reset();
+
+        // Make the event available in the global object, so DOMWindow can expose it.
+        v8Context->Global()->SetHiddenValue(eventSymbol, jsEvent);
+        tryCatch.Reset();
+
+        // Call the event handler.
+        tryCatch.SetVerbose(false); // We do not want to report the exception to the inspector console.
+        returnValue = callListenerFunction(jsEvent, event);
+        if (!tryCatch.CanContinue())
+            return;
+
+        // If an error occurs while handling the event, it should be reported.
+        if (tryCatch.HasCaught()) {
+            reportException(0, tryCatch);
+            tryCatch.Reset();
+        }
+
+        // Restore the old event. This must be done for all exit paths through this method.
+        tryCatch.SetVerbose(true);
+        if (savedEvent.IsEmpty())
+            v8Context->Global()->SetHiddenValue(eventSymbol, v8::Undefined());
+        else
+            v8Context->Global()->SetHiddenValue(eventSymbol, savedEvent);
+        tryCatch.Reset();
+    }
+
+    if (event->type() == "beforeunload" || event->type() == "unload")
+        DateExtension::get()->setAllowSleep(true);
+
+    ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
+
+    if (returnValue.IsEmpty())
+        return;
+
+    if (!returnValue->IsNull() && !returnValue->IsUndefined() && event->storesResultAsString())
+        event->storeResult(toWebCoreString(returnValue));
+
+    // Prevent default action if the return value is false;
+    // FIXME: Add example, and reference to bug entry.
+    if (m_isAttribute && returnValue->IsBoolean() && !returnValue->BooleanValue())
+        event->preventDefault();
+}
+
+v8::Local<v8::Object> V8AbstractEventListener::getReceiverObject(Event* event)
 {
     if (!m_listener.IsEmpty() && !m_listener->IsFunction())
         return v8::Local<v8::Object>::New(m_listener);
 
-    if (isWindowEvent)
-        return v8::Context::GetCurrent()->Global();
-
     EventTarget* target = event->currentTarget();
     v8::Handle<v8::Value> value = V8DOMWrapper::convertEventTargetToV8Object(target);
     if (value.IsEmpty())
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.h b/WebCore/bindings/v8/V8AbstractEventListener.h
index 1521941..c7736be 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.h
+++ b/WebCore/bindings/v8/V8AbstractEventListener.h
@@ -33,12 +33,39 @@
 
 #include "EventListener.h"
 #include "OwnHandle.h"
+#include "SharedPersistent.h"
 #include <v8.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
     class Event;
     class Frame;
+    class V8Proxy;
+
+    // Shared by listener objects and V8Proxy so that V8Proxy can
+    // silence listeners when needed.
+    class V8ListenerGuard : public RefCounted<V8ListenerGuard> {
+      public:
+        static PassRefPtr<V8ListenerGuard> create()
+        {
+            return adoptRef(new V8ListenerGuard);
+        }
+
+        bool isDisconnected() const { return m_disconnected; }
+
+        void disconnectListeners()
+        {
+            m_disconnected = true;
+        }
+
+      private:
+        V8ListenerGuard()
+            : m_disconnected(false) { }
+
+        bool m_disconnected;
+    };
 
     // There are two kinds of event listeners: HTML or non-HMTL. onload,
     // onfocus, etc (attributes) are always HTML event handler type; Event
@@ -50,54 +77,94 @@ namespace WebCore {
     // but ALLOWs duplicated non-HTML event handlers.
     class V8AbstractEventListener : public EventListener {
     public:
-        virtual ~V8AbstractEventListener() { }
+        virtual ~V8AbstractEventListener();
+
+        static const V8AbstractEventListener* cast(const EventListener* listener)
+        {
+            return listener->type() == JSEventListenerType
+                ? static_cast<const V8AbstractEventListener*>(listener)
+                : 0;
+        }
+
+        static V8AbstractEventListener* cast(EventListener* listener)
+        {
+            return const_cast<V8AbstractEventListener*>(cast(const_cast<const EventListener*>(listener)));
+        }
+
+        // Implementation of EventListener interface.
+
+        virtual bool operator==(const EventListener& other) { return this == &other; }
+
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
 
         // Returns the owner frame of the listener.
         Frame* frame() { return m_frame; }
 
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        void invokeEventHandler(v8::Handle<v8::Context>, Event*, v8::Handle<v8::Value> jsEvent, bool isWindowEvent);
+        virtual bool isLazy() const { return false; }
 
         // Returns the listener object, either a function or an object.
-        virtual v8::Local<v8::Object> getListenerObject()
+        v8::Local<v8::Object> getListenerObject()
         {
+            prepareListenerObject();
             return v8::Local<v8::Object>::New(m_listener);
         }
 
+        v8::Local<v8::Object> getExistingListenerObject()
+        {
+            return v8::Local<v8::Object>::New(m_listener);
+        }
+
+        bool hasExistingListenerObject()
+        {
+            return !m_listener.IsEmpty();
+        }
+
         // Dispose listener object and clear the handle.
         void disposeListenerObject();
 
-        virtual bool disconnected() const { return !m_frame; }
+        // Detach the listener from its owner frame.
+        void disconnectFrame() { m_frame = 0; }
 
-        virtual bool isObjectListener() const { return false; }
+        virtual bool disconnected() const { return m_guard && m_guard->isDisconnected(); }
 
     protected:
-        v8::Persistent<v8::Object> m_listener;
+        V8AbstractEventListener(Frame*, PassRefPtr<V8ListenerGuard>, bool isAttribute);
 
-        // Indicates if this is an HTML type listener.
-        bool m_isAttribute;
+        virtual void prepareListenerObject() { }
 
-    private:
-        V8AbstractEventListener(Frame*, bool isInline);
+        void setListenerObject(v8::Handle<v8::Object> listener);
 
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*, bool isWindowEvent) = 0;
+        void invokeEventHandler(v8::Handle<v8::Context>, Event*, v8::Handle<v8::Value> jsEvent);
 
         // Get the receiver object to use for event listener call.
-        v8::Local<v8::Object> getReceiverObject(Event*, bool isWindowEvent);
+        v8::Local<v8::Object> getReceiverObject(Event*);
+
+        int lineNumber() const { return m_lineNumber; }
+
+    private:
+        // Implementation of EventListener function.
+        virtual bool virtualisAttribute() const { return m_isAttribute; }
+
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*) = 0;
+
+        v8::Persistent<v8::Object> m_listener;
+
+        // Indicates if the above handle is weak.
+        bool m_isWeak;
+
+        // Indicates if this is an HTML type listener.
+        bool m_isAttribute;
 
         // Frame to which the event listener is attached to. An event listener must be destroyed before its owner frame is
         // deleted. See fast/dom/replaceChild.html
         // FIXME: this could hold m_frame live until the event listener is deleted.
         Frame* m_frame;
-        OwnHandle<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
+        RefPtr<V8ListenerGuard> m_guard;
 
         // Position in the HTML source for HTML event listeners.
         int m_lineNumber;
         int m_columnNumber;
-
-        friend class V8EventListener;
-        friend class V8ObjectEventListener;
-        friend class V8LazyEventListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Binding.cpp b/WebCore/bindings/v8/V8Binding.cpp
index 0da910b..7d84243 100644
--- a/WebCore/bindings/v8/V8Binding.cpp
+++ b/WebCore/bindings/v8/V8Binding.cpp
@@ -55,7 +55,8 @@ public:
 #ifndef NDEBUG
         m_threadId = WTF::currentThread();
 #endif
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
     }
 
     explicit WebCoreStringResource(const AtomicString& string)
@@ -65,7 +66,8 @@ public:
 #ifndef NDEBUG
         m_threadId = WTF::currentThread();
 #endif
-        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+        ASSERT(!string.isNull());
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * string.length());
     }
 
     virtual ~WebCoreStringResource()
@@ -73,18 +75,18 @@ public:
 #ifndef NDEBUG
         ASSERT(m_threadId == WTF::currentThread());
 #endif
-        int reducedExternalMemory = -2 * length();
-        if (!m_plainString.impl()->inTable())
+        int reducedExternalMemory = -2 * m_plainString.length();
+        if (m_plainString.impl() != m_atomicString.impl() && !m_atomicString.isNull())
             reducedExternalMemory *= 2;
         v8::V8::AdjustAmountOfExternalAllocatedMemory(reducedExternalMemory);
     }
 
-    const uint16_t* data() const
+    virtual const uint16_t* data() const
     {
-        return reinterpret_cast<const uint16_t*>(m_plainString.characters());
+        return reinterpret_cast<const uint16_t*>(m_plainString.impl()->characters());
     }
 
-    size_t length() const { return m_plainString.length(); }
+    virtual size_t length() const { return m_plainString.impl()->length(); }
 
     String webcoreString() { return m_plainString; }
 
@@ -95,12 +97,17 @@ public:
 #endif
         if (m_atomicString.isNull()) {
             m_atomicString = AtomicString(m_plainString);
-            if (!m_plainString.impl()->inTable())
-                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * length());
+            ASSERT(!m_atomicString.isNull());
+            if (m_plainString.impl() != m_atomicString.impl())
+                v8::V8::AdjustAmountOfExternalAllocatedMemory(2 * m_atomicString.length());
         }
         return m_atomicString;
     }
 
+    // Returns right string type based on a dummy parameter.
+    String string(String) { return webcoreString(); }
+    AtomicString string(AtomicString) { return atomicString(); }
+
     static WebCoreStringResource* toStringResource(v8::Handle<v8::String> v8String)
     {
         return static_cast<WebCoreStringResource*>(v8String->GetExternalStringResource());
@@ -121,12 +128,17 @@ private:
 #endif
 };
 
-String v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external,
-        StringType type)
+enum ExternalMode {
+    Externalize,
+    DoNotExternalize
+};
+
+template <typename StringType>
+static StringType v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode external)
 {
     WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
     if (stringResource)
-        return stringResource->webcoreString();
+        return stringResource->string(StringType());
 
     int length = v8String->Length();
     if (!length) {
@@ -134,44 +146,42 @@ String v8StringToWebCoreString(v8::Handle<v8::String> v8String, ExternalMode ext
         return StringImpl::empty();
     }
 
-    UChar* buffer;
-    String result = String::createUninitialized(length, buffer);
-    v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
-
-    if (type == AtomicStringType)
-        result = AtomicString(result);
+    StringType result;
+    static const int inlineBufferSize = 16;
+    if (length <= inlineBufferSize) {
+        UChar inlineBuffer[inlineBufferSize];
+        v8String->Write(reinterpret_cast<uint16_t*>(inlineBuffer), 0, length);
+        result = StringType(inlineBuffer, length);
+    } else {
+        UChar* buffer;
+        String tmp = String::createUninitialized(length, buffer);
+        v8String->Write(reinterpret_cast<uint16_t*>(buffer), 0, length);
+        result = StringType(tmp);
+    }
 
-    if (external == Externalize) {
-        WebCoreStringResource* resource = new WebCoreStringResource(result);
-        if (!v8String->MakeExternal(resource)) {
+    if (external == Externalize && v8String->CanMakeExternal()) {
+        stringResource = new WebCoreStringResource(result);
+        if (!v8String->MakeExternal(stringResource)) {
             // In case of a failure delete the external resource as it was not used.
-            delete resource;
+            delete stringResource;
         }
     }
     return result;
 }
 
-AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
+String v8StringToWebCoreString(v8::Handle<v8::String> v8String)
 {
-    WebCoreStringResource* stringResource = WebCoreStringResource::toStringResource(v8String);
-    if (!stringResource) {
-        // If this string hasn't been externalized, we force it now.
-        String plain = v8StringToWebCoreString(v8String, Externalize, AtomicStringType);
-        // If the string is empty there's no room to cache an atomic
-        // string so we bail out.
-        if (plain.isEmpty())
-            return plain;
-        stringResource = WebCoreStringResource::toStringResource(v8String);
-        ASSERT(stringResource != NULL);
-    }
-    return stringResource->atomicString();
+    return v8StringToWebCoreString<String>(v8String, Externalize);
 }
 
-String v8ValueToWebCoreString(v8::Handle<v8::Value> object)
+AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String> v8String)
 {
-    if (object->IsString())
-        return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(object), Externalize, PlainStringType);
+    return v8StringToWebCoreString<AtomicString>(v8String, Externalize);
+}
 
+String v8NonStringValueToWebCoreString(v8::Handle<v8::Value> object)
+{
+    ASSERT(!object->IsString());
     if (object->IsInt32()) {
         int value = object->Int32Value();
         // Most numbers used are <= 100. Even if they aren't used there's very little in using the space.
@@ -197,6 +207,7 @@ String v8ValueToWebCoreString(v8::Handle<v8::Value> object)
         throwError(block.Exception());
         return StringImpl::empty();
     }
+<<<<<<< HEAD:WebCore/bindings/v8/V8Binding.cpp
     return v8StringToWebCoreString(v8String, DoNotExternalize, PlainStringType);
 }
 
@@ -206,11 +217,15 @@ AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> v8Value)
         return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(v8Value));
     String string = v8ValueToWebCoreString(v8Value);
     return AtomicString(string);
+=======
+    return v8StringToWebCoreString<String>(v8String, DoNotExternalize);
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Binding.cpp
 }
 
-v8::Handle<v8::String> v8String(const String& string)
+AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value> object)
 {
-    return v8ExternalString(string);
+    ASSERT(!object->IsString());
+    return AtomicString(v8NonStringValueToWebCoreString(object));
 }
 
 static bool stringImplCacheEnabled = false;
@@ -261,7 +276,7 @@ v8::Local<v8::String> v8ExternalString(const String& string)
     StringCache& stringCache = getStringCache();
     v8::String* cachedV8String = stringCache.get(stringImpl);
     if (cachedV8String)
-        return v8::Local<v8::String>(cachedV8String);
+        return v8::Local<v8::String>::New(v8::Handle<v8::String>(cachedV8String));
 
     v8::Local<v8::String> newString = makeExternalString(string);
     if (newString.IsEmpty())
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index 4f36f00..a09102d 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -31,6 +31,7 @@
 #ifndef V8Binding_h
 #define V8Binding_h
 
+#include "AtomicString.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
 
@@ -38,32 +39,31 @@
 
 namespace WebCore {
 
-    enum ExternalMode {
-        Externalize,
-        DoNotExternalize
-    };
-
-    enum StringType {
-        PlainStringType,
-        AtomicStringType
-    };
-
     // Convert v8 types to a WebCore::String. If the V8 string is not already
     // an external string then it is transformed into an external string at this
     // point to avoid repeated conversions.
-    String v8StringToWebCoreString(v8::Handle<v8::String>, ExternalMode mode, StringType type);
-    String v8ValueToWebCoreString(v8::Handle<v8::Value>);
+    String v8StringToWebCoreString(v8::Handle<v8::String>);
+    String v8NonStringValueToWebCoreString(v8::Handle<v8::Value>);
+    inline String v8ValueToWebCoreString(v8::Handle<v8::Value> value)
+    {
+        if (value->IsString())
+            return v8StringToWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8NonStringValueToWebCoreString(value);
+    }
 
     // Convert v8 types to a WebCore::AtomicString.
     AtomicString v8StringToAtomicWebCoreString(v8::Handle<v8::String>);
-    AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value>);
-
-    // Convert a string to a V8 string.
-    v8::Handle<v8::String> v8String(const String&);
+    AtomicString v8NonStringValueToAtomicWebCoreString(v8::Handle<v8::Value>);
+    inline AtomicString v8ValueToAtomicWebCoreString(v8::Handle<v8::Value> value)
+    {
+        if (value->IsString())
+            return v8StringToAtomicWebCoreString(v8::Handle<v8::String>::Cast(value));
+        return v8NonStringValueToAtomicWebCoreString(value);
+    }
 
-    inline String toString(const String& string)

-    {

-        return string;

+    inline String toString(const String& string)
+    {
+        return string;
     }
 
     // Return a V8 external string that shares the underlying buffer with the given
@@ -71,6 +71,12 @@ namespace WebCore {
     // underlying buffer alive while the string is still live in the V8 engine.
     v8::Local<v8::String> v8ExternalString(const String&);
 
+    // Convert a string to a V8 string.
+    inline v8::Handle<v8::String> v8String(const String& string)
+    {
+        return v8ExternalString(string);
+    }
+
     // Enables caching v8 wrappers created for WebCore::StringImpl.  Currently this cache requires
     // all the calls (both to convert WebCore::String to v8::String and to GC the handle)
     // to be performed on the main thread.
@@ -145,7 +151,7 @@ namespace WebCore {
     {
         return value ? v8::True() : v8::False();
     }
-   
+
     inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
     {
         if (value->IsNull()) 
@@ -153,6 +159,13 @@ namespace WebCore {
         return v8ValueToWebCoreString(value);
     }
 
+    inline AtomicString v8ValueToAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        if (value->IsNull())
+            return AtomicString();
+        return v8ValueToAtomicWebCoreString(value);
+    }
+
     inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
     {
         if (value->IsNull() || value->IsUndefined())
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index 8a9741a..df8e833 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -31,21 +31,31 @@
 #include "config.h"
 #include "V8DOMWrapper.h"
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8DOMWrapper.cpp
 #if PLATFORM(CHROMIUM)
 #include "ChromiumBridge.h"
 #endif
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8DOMWrapper.cpp
 #include "CSSMutableStyleDeclaration.h"
+#include "ChromiumBridge.h"
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "Notification.h"
+#include "SVGElementInstance.h"
 #include "ScriptController.h"
+#include "V8AbstractEventListener.h"
 #include "V8Binding.h"
 #include "V8Collection.h"
 #include "V8CustomBinding.h"
+#include "V8CustomEventListener.h"
 #include "V8DOMMap.h"
 #include "V8DOMWindow.h"
+#include "V8EventListenerList.h"
 #include "V8Index.h"
 #include "V8IsolatedWorld.h"
+#include "V8Proxy.h"
 #include "WorkerContextExecutionProxy.h"
 
 #include <algorithm>
@@ -337,6 +347,7 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
 
         descriptor->PrototypeTemplate()->SetNamedPropertyHandler(USE_NAMED_PROPERTY_GETTER(DOMWindow));
         descriptor->PrototypeTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(DOMWindow));
+        descriptor->PrototypeTemplate()->SetInternalFieldCount(V8Custom::kDOMWindowInternalFieldCount);
 
         descriptor->SetHiddenPrototype(true);
 
@@ -381,6 +392,24 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
         break;
     }
 
+#if ENABLE(NOTIFICATIONS)
+    case V8ClassIndex::NOTIFICATION: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kNotificationInternalFieldCount);
+        break;
+    }
+#endif // NOTIFICATIONS
+
+#if ENABLE(SVG)
+    case V8ClassIndex::SVGELEMENTINSTANCE: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kSVGElementInstanceInternalFieldCount);
+        break;
+    }
+#endif
+
 #if ENABLE(WORKERS)
     case V8ClassIndex::ABSTRACTWORKER: {
         // Reserve one more internal field for keeping event listeners.
@@ -424,20 +453,42 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     }
 #endif
 
+#if ENABLE(3D_CANVAS)
     // The following objects are created from JavaScript.
-    case V8ClassIndex::DOMPARSER:
-        descriptor->SetCallHandler(USE_CALLBACK(DOMParserConstructor));
+    case V8ClassIndex::CANVASARRAYBUFFER:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasArrayBufferConstructor));
         break;
-#if ENABLE(VIDEO)
-    case V8ClassIndex::HTMLAUDIOELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLAudioElementConstructor));
+    case V8ClassIndex::CANVASBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasByteArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasByteArray));
         break;
-#endif
-    case V8ClassIndex::HTMLIMAGEELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLImageElementConstructor));
+    case V8ClassIndex::CANVASFLOATARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasFloatArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasFloatArray), USE_INDEXED_PROPERTY_SETTER(CanvasFloatArray));
+        break;
+    case V8ClassIndex::CANVASINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasIntArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasIntArray));
+        break;
+    case V8ClassIndex::CANVASSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasShortArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasShortArray));
         break;
-    case V8ClassIndex::HTMLOPTIONELEMENT:
-        descriptor->SetCallHandler(USE_CALLBACK(HTMLOptionElementConstructor));
+    case V8ClassIndex::CANVASUNSIGNEDBYTEARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedByteArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray));
+        break;
+    case V8ClassIndex::CANVASUNSIGNEDINTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedIntArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray));
+        break;
+    case V8ClassIndex::CANVASUNSIGNEDSHORTARRAY:
+        descriptor->SetCallHandler(USE_CALLBACK(CanvasUnsignedShortArrayConstructor));
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray), USE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray));
+        break;
+#endif
+    case V8ClassIndex::DOMPARSER:
+        descriptor->SetCallHandler(USE_CALLBACK(DOMParserConstructor));
         break;
     case V8ClassIndex::WEBKITCSSMATRIX:
         descriptor->SetCallHandler(USE_CALLBACK(WebKitCSSMatrixConstructor));
@@ -445,6 +496,15 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::WEBKITPOINT:
         descriptor->SetCallHandler(USE_CALLBACK(WebKitPointConstructor));
         break;
+#if ENABLE(WEB_SOCKETS)
+    case V8ClassIndex::WEBSOCKET: {
+        // Reserve one more internal field for keeping event listeners.
+        v8::Local<v8::ObjectTemplate> instanceTemplate = descriptor->InstanceTemplate();
+        instanceTemplate->SetInternalFieldCount(V8Custom::kWebSocketInternalFieldCount);
+        descriptor->SetCallHandler(USE_CALLBACK(WebSocketConstructor));
+        break;
+    }
+#endif
     case V8ClassIndex::XMLSERIALIZER:
         descriptor->SetCallHandler(USE_CALLBACK(XMLSerializerConstructor));
         break;
@@ -482,6 +542,9 @@ v8::Persistent<v8::FunctionTemplate> V8DOMWrapper::getTemplate(V8ClassIndex::V8W
     case V8ClassIndex::CLIENTRECTLIST:
         descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(ClientRectList));
         break;
+    case V8ClassIndex::FILELIST:
+        descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(FileList));
+        break;
 #if ENABLE(DATAGRID)
     case V8ClassIndex::DATAGRIDCOLUMNLIST:
         descriptor->InstanceTemplate()->SetIndexedPropertyHandler(USE_INDEXED_PROPERTY_GETTER(DataGridColumnList));
@@ -534,6 +597,16 @@ v8::Local<v8::Function> V8DOMWrapper::getConstructor(V8ClassIndex::V8WrapperType
     if (!frame)
         return v8::Local<v8::Function>();
 
+#if ENABLE(WEB_SOCKETS)
+    // Make typeof(window.WebSocket) == 'undefined' when
+    // experimentalWebSocketEnabled is false.
+    if (type == V8ClassIndex::WEBSOCKET) {
+        Settings* settings = frame->settings();
+        if (!settings || !settings->experimentalWebSocketsEnabled())
+            return v8::Local<v8::Function>();
+    }
+#endif
+
     v8::Handle<v8::Context> context = V8Proxy::context(frame);
     if (context.IsEmpty())
         return v8::Local<v8::Function>();
@@ -562,6 +635,7 @@ v8::Handle<v8::Value> V8DOMWrapper::convertToV8Object(V8ClassIndex::V8WrapperTyp
 
     // These objects can be constructed under WorkerContextExecutionProxy.  They need special
     // handling, since if we proceed below V8Proxy::retrieve() will get called and will crash.
+    // TODO(ukai): websocket?
     if ((type == V8ClassIndex::DOMCOREEXCEPTION
          || type == V8ClassIndex::RANGEEXCEPTION
          || type == V8ClassIndex::EVENTEXCEPTION
@@ -982,7 +1056,6 @@ V8ClassIndex::V8WrapperType V8DOMWrapper::htmlElementType(HTMLElement* element)
 
 #if ENABLE(SVG_FONTS)
 #define FOR_EACH_FONTS_TAG(macro) \
-    macro(definition-src, DEFINITIONSRC) \
     macro(font-face, FONTFACE) \
     macro(font-face-format, FONTFACEFORMAT) \
     macro(font-face-name, FONTFACENAME) \
@@ -1105,6 +1178,8 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventToV8Object(Event* event)
         type = V8ClassIndex::OVERFLOWEVENT;
     else if (event->isMessageEvent())
         type = V8ClassIndex::MESSAGEEVENT;
+    else if (event->isPageTransitionEvent())
+        type = V8ClassIndex::PAGETRANSITIONEVENT;
     else if (event->isProgressEvent()) {
         if (event->isXMLHttpRequestProgressEvent())
             type = V8ClassIndex::XMLHTTPREQUESTPROGRESSEVENT;
@@ -1155,30 +1230,30 @@ static const V8ClassIndex::V8WrapperType mapping[] = {
     V8ClassIndex::NODE,                   // XPATH_NAMESPACE_NODE
 };
 
-// Caller checks node is not null.
-v8::Handle<v8::Value> V8DOMWrapper::convertNodeToV8Object(Node* node)
+v8::Handle<v8::Value> V8DOMWrapper::convertDocumentToV8Object(Document* document)
 {
-    if (!node)
-        return v8::Null();
-
     // Find a proxy for this node.
     //
     // Note that if proxy is found, we might initialize the context which can
     // instantiate a document wrapper.  Therefore, we get the proxy before
     // checking if the node already has a wrapper.
-    V8Proxy* proxy = 0;
-    Document* document = node->document();
-    if (document) {
-        Frame* frame = document->frame();
-        proxy = V8Proxy::retrieve(frame);
-        if (proxy)
-            proxy->initContextIfNeeded();
-    }
+    V8Proxy* proxy = V8Proxy::retrieve(document->frame());
+    if (proxy)
+        proxy->initContextIfNeeded();
 
     DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
-    v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
-    if (!wrapper.IsEmpty())
-        return wrapper;
+    v8::Handle<v8::Object> wrapper = domNodeMap.get(document);
+    if (wrapper.IsEmpty())
+        return convertNewNodeToV8Object(document, proxy, domNodeMap);
+
+    return wrapper;
+}
+
+// Caller checks node is not null.
+v8::Handle<v8::Value> V8DOMWrapper::convertNewNodeToV8Object(Node* node, V8Proxy* proxy, DOMWrapperMap<Node>& domNodeMap)
+{
+    if (!proxy && node->document())
+        proxy = V8Proxy::retrieve(node->document()->frame());
 
     bool isDocument = false; // document type node has special handling
     V8ClassIndex::V8WrapperType type;
@@ -1272,6 +1347,18 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
         return convertToV8Object(V8ClassIndex::WORKER, worker);
 #endif // WORKERS
 
+#if ENABLE(NOTIFICATIONS)
+    Notification* notification = target->toNotification();
+    if (notification)
+        return convertToV8Object(V8ClassIndex::NOTIFICATION, notification);
+#endif
+
+#if ENABLE(WEB_SOCKETS)
+    WebSocket* webSocket = target->toWebSocket();
+    if (webSocket)
+        return convertToV8Object(V8ClassIndex::WEBSOCKET, webSocket);
+#endif
+
     Node* node = target->toNode();
     if (node)
         return convertNodeToV8Object(node);
@@ -1322,6 +1409,98 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventListenerToV8Object(EventListener
     return v8listener->getListenerObject();
 }
 
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    ScriptExecutionContext* context = node->scriptExecutionContext();
+    if (!context)
+        return 0;
+
+    V8Proxy* proxy = V8Proxy::retrieve(context);
+    // The document might be created using createDocument, which does
+    // not have a frame, use the active frame.
+    if (!proxy)
+        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
+
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    return getEventListener(element->correspondingElement(), value, isAttribute, lookup);
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (worker->scriptExecutionContext()->isWorkerContext()) {
+        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+        ASSERT(workerContextProxy);
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+    }
+
+    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
+#if ENABLE(NOTIFICATIONS)
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(Notification* notification, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (notification->scriptExecutionContext()->isWorkerContext()) {
+        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+        ASSERT(workerContextProxy);
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+    }
+
+    V8Proxy* proxy = V8Proxy::retrieve(notification->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+#endif
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(WorkerContext* workerContext, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    WorkerContextExecutionProxy* workerContextProxy = workerContext->script()->proxy();
+    if (workerContextProxy)
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(XMLHttpRequestUpload* upload, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    return getEventListener(upload->associatedXMLHttpRequest(), value, isAttribute, lookup);
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    V8Proxy* proxy = V8Proxy::retrieve(eventTarget->scriptExecutionContext());
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
+    if (workerContextProxy)
+        return workerContextProxy->findOrCreateEventListener(value, isAttribute, lookup == ListenerFindOnly);
+#endif
+
+    return 0;
+}
+
+PassRefPtr<EventListener> V8DOMWrapper::getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup)
+{
+    if (proxy)
+        return (lookup == ListenerFindOnly) ? V8EventListenerList::findWrapper(value, isAttribute) : V8EventListenerList::findOrCreateWrapper<V8EventListener>(proxy->frame(), proxy->listenerGuard(), value, isAttribute);
+
+    return 0;
+}
+
 v8::Handle<v8::Value> V8DOMWrapper::convertDOMImplementationToV8Object(DOMImplementation* impl)
 {
     v8::Handle<v8::Object> result = instantiateV8Object(V8ClassIndex::DOMIMPLEMENTATION, V8ClassIndex::DOMIMPLEMENTATION, impl);
diff --git a/WebCore/bindings/v8/V8DOMWrapper.h b/WebCore/bindings/v8/V8DOMWrapper.h
index 57b3a69..2257688 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.h
+++ b/WebCore/bindings/v8/V8DOMWrapper.h
@@ -31,13 +31,18 @@
 #ifndef V8DOMWrapper_h
 #define V8DOMWrapper_h
 
+#include "Document.h"
 #include "Event.h"
 #include "Node.h"
 #include "NodeFilter.h"
 #include "PlatformString.h" // for WebCore::String
 #include "V8CustomBinding.h"
+#include "V8CustomXPathNSResolver.h"
+#include "V8DOMMap.h"
 #include "V8Index.h"
 #include "V8Utilities.h"
+#include "V8XPathNSResolver.h"
+#include "XPathNSResolver.h"
 #include <v8.h>
 
 namespace WebCore {
@@ -86,8 +91,16 @@ namespace WebCore {
     class StyleSheetList;
     class V8EventListener;
     class V8ObjectEventListener;
+#if ENABLE(WEB_SOCKETS)
+    class WebSocket;
+#endif
     class WorkerContext;
 
+    enum ListenerLookupType {
+        ListenerFindOnly,
+        ListenerFindOrCreate,
+    };
+
     class V8DOMWrapper {
     public:
 #ifndef NDEBUG
@@ -134,7 +147,26 @@ namespace WebCore {
             return convertNodeToV8Object(node.get());
         }
 
-        static v8::Handle<v8::Value> convertNodeToV8Object(Node*);
+        static v8::Handle<v8::Value> convertNodeToV8Object(Node* node)
+        {
+            if (!node)
+                return v8::Null();
+
+            Document* document = node->document();
+            if (node == document)
+                return convertDocumentToV8Object(document);
+
+            DOMWrapperMap<Node>& domNodeMap = getDOMNodeMap();
+            v8::Handle<v8::Object> wrapper = domNodeMap.get(node);
+            if (wrapper.IsEmpty())
+                return convertNewNodeToV8Object(node, 0, domNodeMap);
+
+            return wrapper;
+        }
+
+        static v8::Handle<v8::Value> convertDocumentToV8Object(Document*);
+
+        static v8::Handle<v8::Value> convertNewNodeToV8Object(Node*, V8Proxy*, DOMWrapperMap<Node>&);
 
         template <class C>
         static C* convertToNativeObject(V8ClassIndex::V8WrapperType type, v8::Handle<v8::Object> object)
@@ -184,13 +216,43 @@ namespace WebCore {
         static v8::Handle<v8::Value> convertEventTargetToV8Object(EventTarget*);
 
         // Wrap and unwrap JS event listeners.
-        static v8::Handle<v8::Value> convertEventListenerToV8Object(PassRefPtr<Event> eventListener)
+        static v8::Handle<v8::Value> convertEventListenerToV8Object(PassRefPtr<EventListener> eventListener)
         {
             return convertEventListenerToV8Object(eventListener.get());
         }
 
         static v8::Handle<v8::Value> convertEventListenerToV8Object(EventListener*);
 
+        static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(SVGElementInstance* element, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+#if ENABLE(NOTIFICATIONS)
+        static PassRefPtr<EventListener> getEventListener(Notification* notification, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+#endif
+
+        static PassRefPtr<EventListener> getEventListener(WorkerContext* workerContext, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(XMLHttpRequestUpload* upload, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(EventTarget* eventTarget, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+        static PassRefPtr<EventListener> getEventListener(V8Proxy* proxy, v8::Local<v8::Value> value, bool isAttribute, ListenerLookupType lookup);
+
+
+        // XPath-related utilities
+        static RefPtr<XPathNSResolver> getXPathNSResolver(v8::Handle<v8::Value> value)
+        {
+            RefPtr<XPathNSResolver> resolver;
+            if (V8XPathNSResolver::HasInstance(value))
+                resolver = convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(value));
+            else if (value->IsObject())
+                resolver = V8CustomXPathNSResolver::create(value->ToObject());
+            return resolver;
+        }
+
         // DOMImplementation is a singleton and it is handled in a special
         // way. A wrapper is generated per document and stored in an
         // internal field of the document.
diff --git a/WebCore/bindings/v8/V8EventListenerList.cpp b/WebCore/bindings/v8/V8EventListenerList.cpp
index c9aaa12..e37d630 100644
--- a/WebCore/bindings/v8/V8EventListenerList.cpp
+++ b/WebCore/bindings/v8/V8EventListenerList.cpp
@@ -31,165 +31,6 @@
 #include "config.h"
 #include "V8EventListenerList.h"
 
-#include "V8CustomEventListener.h"
-
 namespace WebCore {
 
-V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list)
-    : m_list(list)
-    , m_vectorIndex(0)
-    , m_iter(list->m_table.begin())
-{
-}
-
-V8EventListenerListIterator::V8EventListenerListIterator(V8EventListenerList* list, bool shouldSeekToEnd)
-    : m_list(list)
-    , m_vectorIndex(0)
-    , m_iter(list->m_table.begin())
-{
-    if (shouldSeekToEnd)
-        seekToEnd();
-}
-
-V8EventListenerListIterator::~V8EventListenerListIterator() { }
-
-void V8EventListenerListIterator::operator++()
-{
-    if (m_iter != m_list->m_table.end()) {
-        Vector<V8EventListener*>* vector = m_iter->second;
-        if (m_vectorIndex + 1 < vector->size()) {
-            m_vectorIndex++;
-            return;
-        }
-        m_vectorIndex = 0;
-        ++m_iter;
-    }
-}
-
-bool V8EventListenerListIterator::operator==(const V8EventListenerListIterator& other)
-{
-    return other.m_iter == m_iter && other.m_vectorIndex == m_vectorIndex && other.m_list == m_list;
-}
-
-bool V8EventListenerListIterator::operator!=(const V8EventListenerListIterator& other)
-{
-    return !operator==(other);
-}
-
-V8EventListener* V8EventListenerListIterator::operator*()
-{
-    if (m_iter != m_list->m_table.end()) {
-        Vector<V8EventListener*>* vector = m_iter->second;
-        if (m_vectorIndex < vector->size())
-            return vector->at(m_vectorIndex);
-    }
-    return 0;
-}
-
-void V8EventListenerListIterator::seekToEnd()
-{
-    m_iter = m_list->m_table.end();
-    m_vectorIndex = 0;
-}
-
-
-V8EventListenerList::V8EventListenerList()
-{
-}
-
-V8EventListenerList::~V8EventListenerList()
-{
-}
-
-V8EventListenerListIterator V8EventListenerList::begin()
-{
-    return iterator(this);
-}
-
-V8EventListenerListIterator V8EventListenerList::end()
-{
-    return iterator(this, true);
-}
-
-
-static int getKey(v8::Local<v8::Object> object)
-{
-    // 0 is a sentinel value for the HashMap key, so we map it to 1.
-    int hash = object->GetIdentityHash();
-    if (!hash)
-        return 1;
-    return hash;
-}
-
-void V8EventListenerList::add(V8EventListener* listener)
-{
-    ASSERT(v8::Context::InContext());
-    v8::HandleScope handleScope;
-
-    v8::Local<v8::Object> object = listener->getListenerObject();
-    int key = getKey(object);
-    Vector<V8EventListener*>* vector = m_table.get(key);
-    if (!vector) {
-        vector = new Vector<V8EventListener*>();
-        m_table.set(key, vector);
-    }
-    vector->append(listener);
-    m_reverseTable.set(listener, key);
-}
-
-void V8EventListenerList::remove(V8EventListener* listener)
-{
-    if (m_reverseTable.contains(listener)) {
-        int key = m_reverseTable.get(listener);
-        Vector<V8EventListener*>* vector = m_table.get(key);
-        if (!vector)
-            return;
-        for (size_t j = 0; j < vector->size(); j++) {
-            if (vector->at(j) == listener) {
-                vector->remove(j);
-                if (!vector->size()) {
-                    m_table.remove(key);
-                    delete vector;
-                    vector = 0;
-                }
-                m_reverseTable.remove(listener);
-                return;
-            }
-        }
-    }
-}
-
-void V8EventListenerList::clear()
-{
-    m_table.clear();
-    m_reverseTable.clear();
-}
-
-V8EventListener* V8EventListenerList::find(v8::Local<v8::Object> object, bool isAttribute)
-{
-    ASSERT(v8::Context::InContext());
-    int key = getKey(object);
-
-    Vector<V8EventListener*>* vector = m_table.get(key);
-    if (!vector)
-        return 0;
-
-    for (size_t i = 0; i < vector->size(); i++) {
-        V8EventListener* element = vector->at(i);
-        if (isAttribute == element->isAttribute() && object == element->getListenerObject())
-            return element;
-    }
-    return 0;
-}
-
-PassRefPtr<V8EventListener> V8EventListenerList::findWrapper(v8::Local<v8::Value> object, bool isAttribute)
-{
-    ASSERT(v8::Context::InContext());
-    if (!object->IsObject())
-        return 0;
-
-    // FIXME: Should this be v8::Local<v8::Object>::Cast instead?
-    return find(object->ToObject(), isAttribute);
-}
-
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8EventListenerList.h b/WebCore/bindings/v8/V8EventListenerList.h
index 4255050..506e5dc 100644
--- a/WebCore/bindings/v8/V8EventListenerList.h
+++ b/WebCore/bindings/v8/V8EventListenerList.h
@@ -32,92 +32,74 @@
 #define V8EventListenerList_h
 
 #include <v8.h>
-#include <wtf/Vector.h>
-#include <wtf/HashMap.h>
 
 #include "PassRefPtr.h"
+#include "V8CustomEventListener.h"
+#include "V8HiddenPropertyName.h"
 
 namespace WebCore {
     class Frame;
     class V8EventListener;
-    class V8EventListenerListIterator;
 
-    // This is a container for V8EventListener objects that uses the identity hash of the v8::Object to
-    // speed up lookups
+    // This is a container for V8EventListener objects that uses hidden properties of v8::Object to speed up lookups.
     class V8EventListenerList {
     public:
-        // Because v8::Object identity hashes are not guaranteed to be unique, we unfortunately can't just map
-        // an int to V8EventListener. Instead we define a HashMap of int to Vector of V8EventListener
-        // called a ListenerMultiMap.
-        typedef Vector<V8EventListener*>* Values;
-        struct ValuesTraits : HashTraits<Values> {
-            static const bool needsDestruction = true;
-        };
-        typedef HashMap<int, Values, DefaultHash<int>::Hash, HashTraits<int>, ValuesTraits> ListenerMultiMap;
-
-        V8EventListenerList();
-        ~V8EventListenerList();
-
-        friend class V8EventListenerListIterator;
-        typedef V8EventListenerListIterator iterator;        
-
-        iterator begin();
-        iterator end();
-
-        void add(V8EventListener*);
-        void remove(V8EventListener*);
-        V8EventListener* find(v8::Local<v8::Object>, bool isAttribute);
-        void clear();
-        size_t size() { return m_table.size(); }
-
-        PassRefPtr<V8EventListener> findWrapper(v8::Local<v8::Value>, bool isAttribute);
-        template<typename WrapperType>
-        PassRefPtr<V8EventListener> findOrCreateWrapper(Frame*, v8::Local<v8::Value>, bool isAttribute);
+        static PassRefPtr<V8EventListener> findWrapper(v8::Local<v8::Value> value, bool isAttribute)
+        {
+            ASSERT(v8::Context::InContext());
+            if (!value->IsObject())
+                return 0;
 
-    private:
-        ListenerMultiMap m_table;
+            v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+            return doFindWrapper(v8::Local<v8::Object>::Cast(value), wrapperProperty);
+        }
 
-        // we also keep a reverse mapping of V8EventListener to v8::Object identity hash,
-        // in order to speed up removal by V8EventListener
-        HashMap<V8EventListener*, int> m_reverseTable;
-    };
+        template<typename WrapperType, typename ContextType>
+        static PassRefPtr<V8EventListener> findOrCreateWrapper(ContextType*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Value>, bool isAttribute);
+
+        static void clearWrapper(v8::Handle<v8::Object> listenerObject, bool isAttribute)
+        {
+            v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+            listenerObject->DeleteHiddenValue(wrapperProperty);
+        }
 
-    class V8EventListenerListIterator {
-    public:
-        ~V8EventListenerListIterator();
-        void operator++();
-        bool operator==(const V8EventListenerListIterator&);
-        bool operator!=(const V8EventListenerListIterator&);
-        V8EventListener* operator*();
     private:
-        friend class V8EventListenerList;
-        explicit V8EventListenerListIterator(V8EventListenerList*);
-        V8EventListenerListIterator(V8EventListenerList*, bool shouldSeekToEnd);
-        void seekToEnd();
-
-        V8EventListenerList* m_list;
-        V8EventListenerList::ListenerMultiMap::iterator m_iter;
-        size_t m_vectorIndex;
+        static V8EventListener* doFindWrapper(v8::Local<v8::Object> object, v8::Handle<v8::String> wrapperProperty)
+        {
+            ASSERT(v8::Context::InContext());
+            v8::HandleScope scope;
+            v8::Local<v8::Value> listener = object->GetHiddenValue(wrapperProperty);
+            if (listener.IsEmpty())
+                return 0;
+            return static_cast<V8EventListener*>(v8::External::Unwrap(listener));
+        }
+
+        static inline v8::Handle<v8::String> getHiddenProperty(bool isAttribute)
+        {
+            return isAttribute ? V8HiddenPropertyName::attributeListener() : V8HiddenPropertyName::listener();
+        }
     };
 
-    template<typename WrapperType>
-    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(Frame* frame, v8::Local<v8::Value> object, bool isAttribute)
+    template<typename WrapperType, typename ContextType>
+    PassRefPtr<V8EventListener> V8EventListenerList::findOrCreateWrapper(ContextType* context, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Value> value, bool isAttribute)
     {
         ASSERT(v8::Context::InContext());
-        if (!object->IsObject())
+        if (!value->IsObject())
             return 0;
 
-        // FIXME: Should this be v8::Local<v8::Object>::Cast instead?
-        V8EventListener* wrapper = find(object->ToObject(), isAttribute);
+        v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(value);
+        v8::Handle<v8::String> wrapperProperty = getHiddenProperty(isAttribute);
+
+        V8EventListener* wrapper = doFindWrapper(object, wrapperProperty);
         if (wrapper)
             return wrapper;
 
-        // Create a new one, and add to cache.
-        RefPtr<WrapperType> newListener = WrapperType::create(frame, v8::Local<v8::Object>::Cast(object), isAttribute);
-        add(newListener.get());
+        PassRefPtr<V8EventListener> wrapperPtr = WrapperType::create(context, guard, object, isAttribute);
+        if (wrapperPtr)
+            object->SetHiddenValue(wrapperProperty, v8::External::Wrap(wrapperPtr.get()));
 
-        return newListener;
-    };
+        return wrapperPtr;
+    }
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.cpp b/WebCore/bindings/v8/V8HiddenPropertyName.cpp
index 16ac232..d83573f 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.cpp
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.cpp
@@ -33,22 +33,21 @@
 
 namespace WebCore {
 
-v8::Handle<v8::String> V8HiddenPropertyName::objectPrototype()
-{
-    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::objectPrototype");
-
-    return *string;
+#define V8_AS_STRING(x) V8_AS_STRING_IMPL(x)
+#define V8_AS_STRING_IMPL(x) #x
+
+#define V8_DEFINE_PROPERTY(name) \
+v8::Handle<v8::String> V8HiddenPropertyName::name() \
+{ \
+    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::" V8_AS_STRING(name)); \
+    return *string; \
 }
 
-v8::Handle<v8::String> V8HiddenPropertyName::isolatedWorld()
-{
-    static v8::Persistent<v8::String>* string = createString("WebCore::V8HiddenPropertyName::isolatedWorld");
-
-    return *string;
-}
+V8_HIDDEN_PROPERTIES(V8_DEFINE_PROPERTY);
 
 v8::Persistent<v8::String>* V8HiddenPropertyName::createString(const char* key)
 {
+    v8::HandleScope scope;
     return new v8::Persistent<v8::String>(v8::Persistent<v8::String>::New(v8::String::NewSymbol(key)));
 }
 
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.h b/WebCore/bindings/v8/V8HiddenPropertyName.h
index 874b525..5ef89cb 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -35,10 +35,19 @@
 
 namespace WebCore {
 
+#define V8_HIDDEN_PROPERTIES(V) \
+    V(objectPrototype) \
+    V(isolatedWorld) \
+    V(listener) \
+    V(attributeListener) \
+    V(sleepFunction) \
+    V(toStringString)
+
     class V8HiddenPropertyName {
     public:
-        static v8::Handle<v8::String> objectPrototype();
-        static v8::Handle<v8::String> isolatedWorld();
+#define V8_DECLARE_PROPERTY(name) static v8::Handle<v8::String> name();
+        V8_HIDDEN_PROPERTIES(V8_DECLARE_PROPERTY);
+#undef V8_DECLARE_PROPERTY
 
     private:
         static v8::Persistent<v8::String>* createString(const char* key);
diff --git a/WebCore/bindings/v8/V8Index.cpp b/WebCore/bindings/v8/V8Index.cpp
index 9efbc3d..1d2b9c0 100644
--- a/WebCore/bindings/v8/V8Index.cpp
+++ b/WebCore/bindings/v8/V8Index.cpp
@@ -33,6 +33,8 @@
 
 #include "V8Attr.h"
 #include "V8BarInfo.h"
+#include "V8BeforeLoadEvent.h"
+#include "V8CanvasRenderingContext.h"
 #include "V8CanvasRenderingContext2D.h"
 #include "V8CanvasGradient.h"
 #include "V8CanvasPattern.h"
@@ -107,6 +109,7 @@
 #include "V8HTMLHtmlElement.h"
 #include "V8HTMLIFrameElement.h"
 #include "V8HTMLImageElement.h"
+#include "V8HTMLImageElementConstructor.h"
 #include "V8HTMLInputElement.h"
 #include "V8HTMLIsIndexElement.h"
 #include "V8HTMLLabelElement.h"
@@ -121,6 +124,7 @@
 #include "V8HTMLOListElement.h"
 #include "V8HTMLOptGroupElement.h"
 #include "V8HTMLOptionElement.h"
+#include "V8HTMLOptionElementConstructor.h"
 #include "V8HTMLParagraphElement.h"
 #include "V8HTMLParamElement.h"
 #include "V8HTMLPreElement.h"
@@ -179,6 +183,7 @@
 #include "V8Navigator.h"
 #include "V8MimeType.h"
 #include "V8MimeTypeArray.h"
+#include "V8PageTransitionEvent.h"
 #include "V8Plugin.h"
 #include "V8PluginArray.h"
 #include "V8Range.h"
@@ -254,7 +259,6 @@
 #endif
 
 #if ENABLE(SVG_FONTS)
-#include "V8SVGDefinitionSrcElement.h"
 #include "V8SVGFontFaceElement.h"
 #include "V8SVGFontFaceFormatElement.h"
 #include "V8SVGFontFaceNameElement.h"
@@ -370,6 +374,7 @@
 
 #if ENABLE(VIDEO)
 #include "V8HTMLAudioElement.h"
+#include "V8HTMLAudioElementConstructor.h"
 #include "V8HTMLMediaElement.h"
 #include "V8HTMLSourceElement.h"
 #include "V8HTMLVideoElement.h"
@@ -377,6 +382,10 @@
 #include "V8TimeRanges.h"
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+#include "V8WebSocket.h"
+#endif
+
 #if ENABLE(WORKERS)
 #include "V8AbstractWorker.h"
 #include "V8DedicatedWorkerContext.h"
@@ -386,10 +395,16 @@
 #include "V8WorkerNavigator.h"
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#include "V8Notification.h"
+#include "V8NotificationCenter.h"
+#endif
+
 #if ENABLE(SHARED_WORKERS)
 #include "V8SharedWorker.h"
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.cpp
 #if ENABLE(GEOLOCATION)
 #include "V8Coordinates.h"
 #include "V8Geolocation.h"
@@ -413,6 +428,25 @@
 
 #if ENABLE(XSLT)
 #include "V8XSLTProcessor.h"
+=======
+#if ENABLE(3D_CANVAS)
+#include "V8CanvasRenderingContext3D.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArray.h"
+#include "V8CanvasByteArray.h"
+#include "V8CanvasBuffer.h"
+#include "V8CanvasFloatArray.h"
+#include "V8CanvasFramebuffer.h"
+#include "V8CanvasIntArray.h"
+#include "V8CanvasProgram.h"
+#include "V8CanvasRenderbuffer.h"
+#include "V8CanvasShader.h"
+#include "V8CanvasShortArray.h"
+#include "V8CanvasTexture.h"
+#include "V8CanvasUnsignedByteArray.h"
+#include "V8CanvasUnsignedIntArray.h"
+#include "V8CanvasUnsignedShortArray.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.cpp
 #endif
 
 namespace WebCore {
diff --git a/WebCore/bindings/v8/V8Index.h b/WebCore/bindings/v8/V8Index.h
index d6db4c6..b73100c 100644
--- a/WebCore/bindings/v8/V8Index.h
+++ b/WebCore/bindings/v8/V8Index.h
@@ -54,6 +54,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(VIDEO)
 #define VIDEO_HTMLELEMENT_TYPES(V)                                      \
+    V(AUDIO, HTMLAudioElementConstructor)                               \
     V(HTMLAUDIOELEMENT, HTMLAudioElement)                               \
     V(HTMLMEDIAELEMENT, HTMLMediaElement)                               \
     V(HTMLSOURCEELEMENT, HTMLSourceElement)                             \
@@ -88,6 +89,14 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define APPLICATIONCACHE_NONNODE_WRAPPER_TYPES(V)
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+#define NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)                          \
+    V(NOTIFICATION, Notification)                                       \
+    V(NOTIFICATIONCENTER, NotificationCenter)
+#else
+#define NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)
+#endif
+
 #if ENABLE(SHARED_WORKERS)
 #define SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                    \
     V(SHAREDWORKER, SharedWorker)
@@ -109,7 +118,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(ENTITY, Entity)                                                   \
     V(ENTITYREFERENCE, EntityReference)                                 \
     V(HTMLDOCUMENT, HTMLDocument)                                       \
+    V(IMAGE, HTMLImageElementConstructor)                               \
     V(NODE, Node)                                                       \
+    V(OPTION, HTMLOptionElementConstructor)                             \
     V(NOTATION, Notation)                                               \
     V(PROCESSINGINSTRUCTION, ProcessingInstruction)                     \
     V(TEXT, Text)                                                       \
@@ -216,7 +227,6 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 
 #if ENABLE(SVG_FONTS)
 #define SVG_FONTS_ELEMENT_TYPES(V)                                      \
-    V(SVGDEFINITIONSRCELEMENT, SVGDefinitionSrcElement)                 \
     V(SVGFONTFACEELEMENT, SVGFontFaceElement)                           \
     V(SVGFONTFACEFORMATELEMENT, SVGFontFaceFormatElement)               \
     V(SVGFONTFACENAMEELEMENT, SVGFontFaceNameElement)                   \
@@ -289,13 +299,21 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #endif  // SVG
 
 
+#if ENABLE(WEB_SOCKETS)
+#define WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)                        \
+    V(WEBSOCKET, WebSocket)
+#else
+#define WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)
+#endif
+
 // ACTIVE_DOM_OBJECT_TYPES are DOM_OBJECT_TYPES that need special treatement
 // during GC.
 #define ACTIVE_DOM_OBJECT_TYPES(V)                                      \
     V(MESSAGEPORT, MessagePort)                                         \
     V(XMLHTTPREQUEST, XMLHttpRequest)                                   \
     WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                               \
-    SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)
+    SHARED_WORKER_ACTIVE_OBJECT_WRAPPER_TYPES(V)                        \
+    WEBSOCKET_ACTIVE_OBJECT_WRAPPER_TYPES(V)
 
 // NOTE: DOM_OBJECT_TYPES is split into two halves because
 //       Visual Studio's Intellinonsense crashes when macros get
@@ -303,8 +321,10 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 // DOM_OBJECT_TYPES are non-node DOM types.
 #define DOM_OBJECT_TYPES_1(V)                                           \
     V(BARINFO, BarInfo)                                                 \
+    V(BEFORELOADEVENT, BeforeLoadEvent)                                 \
     V(CANVASGRADIENT, CanvasGradient)                                   \
     V(CANVASPATTERN, CanvasPattern)                                     \
+    V(CANVASRENDERINGCONTEXT, CanvasRenderingContext)                   \
     V(CANVASRENDERINGCONTEXT2D, CanvasRenderingContext2D)               \
     V(CLIENTRECT, ClientRect)                                           \
     V(CLIENTRECTLIST, ClientRectList)                                   \
@@ -359,6 +379,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     V(NODEITERATOR, NodeIterator)                                       \
     V(NODELIST, NodeList)                                               \
     V(OVERFLOWEVENT, OverflowEvent)                                     \
+    V(PAGETRANSITIONEVENT, PageTransitionEvent)                         \
     V(PLUGIN, Plugin)                                                   \
     V(PLUGINARRAY, PluginArray)                                         \
     V(PROGRESSEVENT, ProgressEvent)                                     \
@@ -391,6 +412,7 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     APPLICATIONCACHE_NONNODE_WRAPPER_TYPES(V)                           \
     DATAGRID_NONNODE_TYPES(V)                                           \
     VIDEO_NONNODE_TYPES(V)                                              \
+    NOTIFICATIONS_NONNODE_WRAPPER_TYPES(V)                              \
     SHARED_WORKER_NONNODE_WRAPPER_TYPES(V)                              \
     WORKER_NONNODE_WRAPPER_TYPES(V)
 
@@ -438,16 +460,42 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #define DOM_OBJECT_WORKERS_TYPES(V)
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if ENABLE(GEOLOCATION)
 #define DOM_OBJECT_GEOLOCATION_TYPES(V)                                 \
     V(COORDINATES, Coordinates)                                         \
     V(GEOLOCATION, Geolocation)                                         \
     V(GEOPOSITION, Geoposition)                                         \
     V(POSITIONERROR, PositionError)
+=======
+#if ENABLE(3D_CANVAS)
+#define DOM_OBJECT_3D_CANVAS_TYPES(V)                                   \
+    V(CANVASARRAY, CanvasArray)                                         \
+    V(CANVASARRAYBUFFER, CanvasArrayBuffer)                             \
+    V(CANVASBUFFER, CanvasBuffer)                                       \
+    V(CANVASBYTEARRAY, CanvasByteArray)                                 \
+    V(CANVASFLOATARRAY, CanvasFloatArray)                               \
+    V(CANVASFRAMEBUFFER, CanvasFramebuffer)                             \
+    V(CANVASINTARRAY, CanvasIntArray)                                   \
+    V(CANVASPROGRAM, CanvasProgram)                                     \
+    V(CANVASRENDERBUFFER, CanvasRenderbuffer)                           \
+    V(CANVASRENDERINGCONTEXT3D, CanvasRenderingContext3D)               \
+    V(CANVASSHADER, CanvasShader)                                       \
+    V(CANVASSHORTARRAY, CanvasShortArray)                               \
+    V(CANVASTEXTURE, CanvasTexture)                                     \
+    V(CANVASUNSIGNEDBYTEARRAY, CanvasUnsignedByteArray)                 \
+    V(CANVASUNSIGNEDINTARRAY, CanvasUnsignedIntArray)                   \
+    V(CANVASUNSIGNEDSHORTARRAY, CanvasUnsignedShortArray)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #else
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_GEOLOCATION_TYPES(V)
+=======
+#define DOM_OBJECT_3D_CANVAS_TYPES(V)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
 #if ENABLE(TOUCH_EVENTS)
 #define DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                 \
     V(TOUCHLIST, TouchList)                                             \
@@ -458,12 +506,15 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
 #endif
 
 #if PLATFORM(CHROMIUM)
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 #define DOM_OBJECT_TYPES(V)                                             \
     DOM_OBJECT_TYPES_1(V)                                               \
     DOM_OBJECT_TYPES_2(V)                                               \
     DOM_OBJECT_DATABASE_TYPES(V)                                        \
     DOM_OBJECT_STORAGE_TYPES(V)                                         \
     DOM_OBJECT_WORKERS_TYPES(V)                                         \
+<<<<<<< HEAD:WebCore/bindings/v8/V8Index.h
     DOM_OBJECT_XPATH_TYPES(V)                                           \
     DOM_OBJECT_XSLT_TYPES(V)                                            \
     V(INSPECTORBACKEND, InspectorBackend)
@@ -477,6 +528,9 @@ typedef v8::Persistent<v8::FunctionTemplate> (*FunctionTemplateFactory)();
     DOM_OBJECT_TOUCH_EVENT_TYPES(V)                                     \
     DOM_OBJECT_WORKERS_TYPES(V)
 #endif
+=======
+    DOM_OBJECT_3D_CANVAS_TYPES(V)
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Index.h
 
 #if ENABLE(SVG)
 // SVG_OBJECT_TYPES are svg non-node, non-pod types.
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.cpp b/WebCore/bindings/v8/V8IsolatedWorld.cpp
index 1457545..d4e4f52 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.cpp
+++ b/WebCore/bindings/v8/V8IsolatedWorld.cpp
@@ -43,34 +43,29 @@
 
 namespace WebCore {
 
-static int isolatedWorldCount = 0;
+int V8IsolatedWorld::isolatedWorldCount = 0;
 
-static void contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world)
+void V8IsolatedWorld::contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world)
 {
     // Our context is going away.  Time to clean up the world.
     V8IsolatedWorld* world = static_cast<V8IsolatedWorld*>(isolated_world);
     delete world;
 }
 
-void V8IsolatedWorld::evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy* proxy, int extensionGroup)
+V8IsolatedWorld::V8IsolatedWorld(V8Proxy* proxy, int extensionGroup)
 {
+    ++isolatedWorldCount;
+
     v8::HandleScope scope;
-    v8::Persistent<v8::Context> context = proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup);
+    m_context = SharedPersistent<v8::Context>::create(proxy->createNewContext(v8::Handle<v8::Object>(), extensionGroup));
 
     // Run code in the new context.
-    v8::Context::Scope context_scope(context);
-
-    // The lifetime of this object is controlled by the V8 GC.
-    // We need to create the world before touching DOM wrappers.
-    V8IsolatedWorld* world = new V8IsolatedWorld(context);
+    v8::Context::Scope context_scope(m_context->get());
 
-    V8Proxy::installHiddenObjectPrototype(context);
-    proxy->installDOMWindow(context, proxy->frame()->domWindow());
-
-    proxy->frame()->loader()->client()->didCreateIsolatedScriptContext();
+    m_context->get()->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
 
-    for (size_t i = 0; i < sources.size(); ++i)
-        proxy->evaluate(sources[i], 0);
+    V8Proxy::installHiddenObjectPrototype(m_context->get());
+    proxy->installDOMWindow(m_context->get(), proxy->frame()->domWindow());
 
     // Using the default security token means that the canAccess is always
     // called, which is slow.
@@ -78,40 +73,24 @@ void V8IsolatedWorld::evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy*
     //        created contexts so that they can all be updated when the
     //        document domain
     //        changes.
-    // FIXME: Move this statement above proxy->evaluate?  It seems like we
-    //        should set up the token before running the script.
-    context->UseDefaultSecurityToken();
+    m_context->get()->UseDefaultSecurityToken();
 
-    context.Dispose();
-    // WARNING!  This might well delete |world|.
+    proxy->frame()->loader()->client()->didCreateIsolatedScriptContext();
 }
 
-V8IsolatedWorld::V8IsolatedWorld(v8::Handle<v8::Context> context)
-    : m_context(v8::Persistent<v8::Context>::New(context))
+void V8IsolatedWorld::destroy()
 {
-    ++isolatedWorldCount;
-    m_context.MakeWeak(this, &contextWeakReferenceCallback);
-    m_context->Global()->SetHiddenValue(V8HiddenPropertyName::isolatedWorld(), v8::External::Wrap(this));
+    m_context->get().MakeWeak(this, &contextWeakReferenceCallback);
 }
 
 V8IsolatedWorld::~V8IsolatedWorld()
 {
     --isolatedWorldCount;
-    m_context.Dispose();
-    m_context.Clear();
+    m_context->disposeHandle();
 }
 
-V8IsolatedWorld* V8IsolatedWorld::getEntered()
+V8IsolatedWorld* V8IsolatedWorld::getEnteredImpl()
 {
-    if (isolatedWorldCount == 0) {
-        // This is a temporary performance optimization.   Essentially,
-        // GetHiddenValue is too slow for this code path.  We need to get the
-        // V8 team to add a real property to v8::Context for isolated worlds.
-        // Until then, we optimize the common case of not having any isolated
-        // worlds at all.
-        return 0;
-    }
-
     if (!v8::Context::InContext())
         return 0;
     v8::HandleScope scope;
diff --git a/WebCore/bindings/v8/V8IsolatedWorld.h b/WebCore/bindings/v8/V8IsolatedWorld.h
index 2036e65..15d8711 100644
--- a/WebCore/bindings/v8/V8IsolatedWorld.h
+++ b/WebCore/bindings/v8/V8IsolatedWorld.h
@@ -35,6 +35,7 @@
 
 #include "V8DOMMap.h"
 #include "V8Index.h"
+#include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "ScriptSourceCode.h"  // for WebCore::ScriptSourceCode
 
@@ -57,11 +58,14 @@ namespace WebCore {
     //
     class V8IsolatedWorld {
     public:
-        ~V8IsolatedWorld();
+        // Creates an isolated world. To destroy it, call destroy().
+        // This will delete the isolated world when the context it owns is GC'd.
+        V8IsolatedWorld(V8Proxy* proxy, int extensionGroup);
 
-        // Evaluate JavaScript in a new isolated world.  The script has access
-        // to the DOM of the document associated with |proxy|.
-        static void evaluate(const Vector<ScriptSourceCode>& sources, V8Proxy* proxy, int extensionGroup);
+        // Call this to destroy the isolated world. It will be deleted sometime
+        // after this call, once all script references to the world's context
+        // have been dropped.
+        void destroy();
 
         // Returns the isolated world associated with
         // v8::Context::GetEntered().  Because worlds are isolated, the entire
@@ -71,26 +75,42 @@ namespace WebCore {
         // FIXME: Consider edge cases with DOM mutation events that might
         // violate this invariant.
         //
-        static V8IsolatedWorld* getEntered();
+        static V8IsolatedWorld* getEntered()
+        {
+            // This is a temporary performance optimization.   Essentially,
+            // GetHiddenValue is too slow for this code path.  We need to get the
+            // V8 team to add a real property to v8::Context for isolated worlds.
+            // Until then, we optimize the common case of not having any isolated
+            // worlds at all.
+            if (!isolatedWorldCount)
+                return 0;
+            return getEnteredImpl();
+        }
 
-        v8::Handle<v8::Context> context() { return m_context; }
+        v8::Handle<v8::Context> context() { return m_context->get(); }
+        PassRefPtr<SharedPersistent<v8::Context> > shared_context() { return m_context; }
 
         DOMDataStore* getDOMDataStore() const { return m_domDataStore.getStore(); }
 
     private:
-        // The lifetime of an isolated world is managed by the V8 garbage
-        // collector.  In particular, the object created by this constructor is
-        // freed when |context| is garbage collected.
-        explicit V8IsolatedWorld(v8::Handle<v8::Context> context);
+        ~V8IsolatedWorld();
+
+        static V8IsolatedWorld* getEnteredImpl();
+
+        // Called by the garbage collector when our JavaScript context is about
+        // to be destroyed.
+        static void contextWeakReferenceCallback(v8::Persistent<v8::Value> object, void* isolated_world);
 
         // The v8::Context for the isolated world.  This object is keep on the
         // heap as long as |m_context| has not been garbage collected.
-        v8::Persistent<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
 
         // The backing store for the isolated world's DOM wrappers.  This class
         // doesn't have visibility into the wrappers.  This handle simply helps
         // manage their lifetime.
         DOMDataStoreHandle m_domDataStore;
+
+        static int isolatedWorldCount;
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8LazyEventListener.cpp b/WebCore/bindings/v8/V8LazyEventListener.cpp
index 59fa7be..9b58571 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -33,199 +33,115 @@
 
 #include "Frame.h"
 #include "V8Binding.h"
+#include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
 
+#include <wtf/StdLibExtras.h>
+
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(Frame *frame, const String& code, const String& functionName, bool isSVGEvent)
-    : V8AbstractEventListener(frame, true)
+V8LazyEventListener::V8LazyEventListener(Frame* frame, const String& code, const String& functionName, bool isSVGEvent)
+    : V8AbstractEventListener(frame, 0, true)
     , m_code(code)
     , m_functionName(functionName)
     , m_isSVGEvent(isSVGEvent)
-    , m_compiled(false)
-    , m_wrappedFunctionCompiled(false)
-{
-}
-
-V8LazyEventListener::~V8LazyEventListener()
 {
-    disposeListenerObject();
-
-    // Dispose wrapped function
-    if (!m_wrappedFunction.IsEmpty()) {
-#ifndef NDEBUG
-        V8GCController::unregisterGlobalHandle(this, m_wrappedFunction);
-#endif
-        m_wrappedFunction.Dispose();
-        m_wrappedFunction.Clear();
-    }
 }
 
-v8::Local<v8::Function> V8LazyEventListener::getListenerFunction()
+v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
-    if (m_compiled) {
-        ASSERT(m_listener.IsEmpty() || m_listener->IsFunction());
-        return m_listener.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
-    }
-
-    m_compiled = true;
-
-    ASSERT(m_frame);
-
-    {
-        // Switch to the context of m_frame.
-        v8::HandleScope handleScope;
-
-        // Use the outer scope to hold context.
-        v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);
-        // Bail out if we could not get the context.
-        if (v8Context.IsEmpty())
-            return v8::Local<v8::Function>();
-
-        v8::Context::Scope scope(v8Context);
-
-        // Wrap function around the event code.  The parenthesis around the function are needed so that evaluating the code yields
-        // the function value.  Without the parenthesis the function value is thrown away.
-
-        // Make it an anonymous function to avoid name conflict for cases like
-        // <body onload='onload()'>
-        // <script> function onload() { alert('hi'); } </script>.
-        // Set function name to function object instead.
-        // See issue 944690.
-        //
-        // The ECMAScript spec says (very obliquely) that the parameter to an event handler is named "evt".
-        //
-        // Don't use new lines so that lines in the modified handler
-        // have the same numbers as in the original code.
-        String code = "(function (evt) {";
-        code.append(m_code);
-        code.append("\n})");
-
-        v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-        v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_frame->document()->url(), m_lineNumber - 1);
-        if (!script.IsEmpty()) {
-            V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-            ASSERT(proxy);
-            v8::Local<v8::Value> value = proxy->runScript(script, false);
-            if (!value.IsEmpty()) {
-                ASSERT(value->IsFunction());
-                v8::Local<v8::Function> listenerFunction = v8::Local<v8::Function>::Cast(value);
-                listenerFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
-
-                m_listener = v8::Persistent<v8::Function>::New(listenerFunction);
-#ifndef NDEBUG
-                V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
-#endif
-            }
-        }
-    }
-
-    ASSERT(m_listener.IsEmpty() || m_listener->IsFunction());
-    return m_listener.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
-}
-
-v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
-{
-    v8::Local<v8::Function> handlerFunction = getWrappedListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(getListenerObject());
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(m_frame);
+    V8Proxy* proxy = V8Proxy::retrieve(frame());
     return proxy->callFunction(handlerFunction, receiver, 1, parameters);
 }
 
-
 static v8::Handle<v8::Value> V8LazyEventListenerToString(const v8::Arguments& args)
 {
-    return args.Callee()->GetHiddenValue(v8::String::New("toStringString"));
+    return args.Holder()->GetHiddenValue(V8HiddenPropertyName::toStringString());
 }
 
-
-v8::Local<v8::Function> V8LazyEventListener::getWrappedListenerFunction()
+void V8LazyEventListener::prepareListenerObject()
 {
-    if (m_wrappedFunctionCompiled) {
-        ASSERT(m_wrappedFunction.IsEmpty() || m_wrappedFunction->IsFunction());
-        return m_wrappedFunction.IsEmpty() ? v8::Local<v8::Function>() : v8::Local<v8::Function>::New(m_wrappedFunction);
-    }
-
-    m_wrappedFunctionCompiled = true;
-
-    {
-        // Switch to the context of m_frame.
-        v8::HandleScope handleScope;
-
-        // Use the outer scope to hold context.
-        v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(m_frame);
-        // Bail out if we cannot get the context.
-        if (v8Context.IsEmpty())
-            return v8::Local<v8::Function>();
-
-        v8::Context::Scope scope(v8Context);
-
-        // FIXME: cache the wrapper function.
-
-        // Nodes other than the document object, when executing inline event handlers push document, form, and the target node on the scope chain.
-        // We do this by using 'with' statement.
-        // See chrome/fast/forms/form-action.html
-        //     chrome/fast/forms/selected-index-value.html
-        //     base/fast/overflow/onscroll-layer-self-destruct.html
-        //
-        // Don't use new lines so that lines in the modified handler
-        // have the same numbers as in the original code.
-        String code = "(function (evt) {" \
-                      "with (this.ownerDocument ? this.ownerDocument : {}) {" \
-                      "with (this.form ? this.form : {}) {" \
-                      "with (this) {" \
-                      "return (function(evt){";
-        code.append(m_code);
-        // Insert '\n' otherwise //-style comments could break the handler.
-        code.append(  "\n}).call(this, evt);}}}})");
-        v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
-        v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_frame->document()->url(), m_lineNumber);
-        if (!script.IsEmpty()) {
-            V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-            ASSERT(proxy);
-            v8::Local<v8::Value> value = proxy->runScript(script, false);
-            if (!value.IsEmpty()) {
-                ASSERT(value->IsFunction());
-
-                m_wrappedFunction = v8::Persistent<v8::Function>::New(v8::Local<v8::Function>::Cast(value));
-
-                // Change the toString function on the wrapper function to avoid it returning the source for the actual wrapper function. Instead
-                // it returns source for a clean wrapper function with the event argument wrapping the event source code. The reason for this
-                // is that some web sites uses toString on event functions and the evals the source returned (some times a RegExp is applied as
-                // well) for some other use. That fails miserably if the actual wrapper source is returned.
-                v8::Local<v8::FunctionTemplate> toStringTemplate = v8::FunctionTemplate::New(V8LazyEventListenerToString);
-                v8::Local<v8::Function> toStringFunction;
-                if (!toStringTemplate.IsEmpty())
-                    toStringFunction = toStringTemplate->GetFunction();
-                if (!toStringFunction.IsEmpty()) {
-                    String toStringResult = "function ";
-                    toStringResult.append(m_functionName);
-                    toStringResult.append("(");
-                    if (m_isSVGEvent)
-                        toStringResult.append("evt");
-                    else
-                        toStringResult.append("event");
-                    toStringResult.append(") {\n  ");
-                    toStringResult.append(m_code);
-                    toStringResult.append("\n}");
-                    toStringFunction->SetHiddenValue(v8::String::New("toStringString"), v8ExternalString(toStringResult));
-                    m_wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
-                }
-
-#ifndef NDEBUG
-                V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_wrappedFunction);
-#endif
-                m_wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+    if (hasExistingListenerObject())
+        return;
+
+    // Switch to the context of m_frame.
+    v8::HandleScope handleScope;
+
+    // Use the outer scope to hold context.
+    v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(frame());
+    // Bail out if we cannot get the context.
+    if (v8Context.IsEmpty())
+        return;
+
+    v8::Context::Scope scope(v8Context);
+
+    // FIXME: cache the wrapper function.
+
+    // Nodes other than the document object, when executing inline event handlers push document, form, and the target node on the scope chain.
+    // We do this by using 'with' statement.
+    // See chrome/fast/forms/form-action.html
+    //     chrome/fast/forms/selected-index-value.html
+    //     base/fast/overflow/onscroll-layer-self-destruct.html
+    //
+    // Don't use new lines so that lines in the modified handler
+    // have the same numbers as in the original code.
+    String code = "(function (evt) {" \
+            "with (this.ownerDocument ? this.ownerDocument : {}) {" \
+            "with (this.form ? this.form : {}) {" \
+            "with (this) {" \
+            "return (function(evt){";
+    code.append(m_code);
+    // Insert '\n' otherwise //-style comments could break the handler.
+    code.append(  "\n}).call(this, evt);}}}})");
+    v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
+    v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, frame()->document()->url(), lineNumber());
+    if (!script.IsEmpty()) {
+        V8Proxy* proxy = V8Proxy::retrieve(frame());
+        ASSERT(proxy);
+        v8::Local<v8::Value> value = proxy->runScript(script, false);
+        if (!value.IsEmpty()) {
+            ASSERT(value->IsFunction());
+
+            v8::Local<v8::Function> wrappedFunction = v8::Local<v8::Function>::Cast(value);
+
+            // Change the toString function on the wrapper function to avoid it
+            // returning the source for the actual wrapper function. Instead it
+            // returns source for a clean wrapper function with the event
+            // argument wrapping the event source code. The reason for this is
+            // that some web sites use toString on event functions and eval the
+            // source returned (sometimes a RegExp is applied as well) for some
+            // other use. That fails miserably if the actual wrapper source is
+            // returned.
+            DEFINE_STATIC_LOCAL(v8::Persistent<v8::FunctionTemplate>, toStringTemplate, ());
+            if (toStringTemplate.IsEmpty())
+                toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
+            v8::Local<v8::Function> toStringFunction;
+            if (!toStringTemplate.IsEmpty())
+                toStringFunction = toStringTemplate->GetFunction();
+            if (!toStringFunction.IsEmpty()) {
+                String toStringResult = "function ";
+                toStringResult.append(m_functionName);
+                toStringResult.append("(");
+                toStringResult.append(m_isSVGEvent ? "evt" : "event");
+                toStringResult.append(") {\n  ");
+                toStringResult.append(m_code);
+                toStringResult.append("\n}");
+                wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
+                wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
             }
+
+            wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+
+            setListenerObject(wrappedFunction);
         }
     }
-
-    return v8::Local<v8::Function>::New(m_wrappedFunction);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8LazyEventListener.h b/WebCore/bindings/v8/V8LazyEventListener.h
index 62d9342..ba460e6 100644
--- a/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/WebCore/bindings/v8/V8LazyEventListener.h
@@ -50,30 +50,19 @@ namespace WebCore {
             return adoptRef(new V8LazyEventListener(frame, code, functionName, isSVGEvent));
         }
 
-        // For lazy event listener, the listener object is the same as its listener
-        // function without additional scope chains.
-        virtual v8::Local<v8::Object> getListenerObject() { return getWrappedListenerFunction(); }
+        virtual bool isLazy() const { return true; }
+
+    protected:
+        virtual void prepareListenerObject();
 
     private:
         V8LazyEventListener(Frame*, const String& code, const String& functionName, bool isSVGEvent);
-        virtual ~V8LazyEventListener();
 
-        virtual bool virtualisAttribute() const { return true; }
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
 
         String m_code;
         String m_functionName;
         bool m_isSVGEvent;
-        bool m_compiled;
-
-        // If the event listener is on a non-document dom node, we compile the function with some implicit scope chains before it.
-        bool m_wrappedFunctionCompiled;
-        v8::Persistent<v8::Function> m_wrappedFunction;
-
-        v8::Local<v8::Function> getWrappedListenerFunction();
-
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-
-        v8::Local<v8::Function> getListenerFunction();
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8ObjectEventListener.cpp b/WebCore/bindings/v8/V8ObjectEventListener.cpp
deleted file mode 100644
index f10766c..0000000
--- a/WebCore/bindings/v8/V8ObjectEventListener.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "V8ObjectEventListener.h"
-
-#include "Frame.h"
-#include "V8Proxy.h"
-
-namespace WebCore {
-
-static void weakObjectEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
-{
-    V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(parameter);
-
-    // Remove the wrapper
-    Frame* frame = listener->frame();
-    if (frame) {
-        V8Proxy* proxy = V8Proxy::retrieve(frame);
-        if (proxy)
-            proxy->objectListeners()->remove(listener);
-
-        // Because the listener is no longer in the list, it must be disconnected from the frame to avoid dangling frame pointer
-        // in the destructor.
-        listener->disconnectFrame();
-    }
-    listener->disposeListenerObject();
-}
-
-// An object event listener wrapper only holds a weak reference to the
-// JS function. A strong reference can create a cycle.
-//
-// The lifetime of these objects is bounded by the life time of the JS
-// wrapper of XHR or Node. So we can create a hidden reference from
-// the JS wrapper to to its JS function.
-//
-//                          (map)
-//          XHR or Node  <----------  JS_wrapper
-//               |             (hidden) :  ^
-//               V                      V  : (may be reachable by closure)
-//           V8_listener  --------> JS_function
-//                         (weak)  <-- may create a cycle if it is strong
-//
-// The persistent reference is made weak in the constructor of
-// V8ObjectEventListener.
-
-V8ObjectEventListener::V8ObjectEventListener(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(frame, listener, isInline)
-{
-    m_listener.MakeWeak(this, weakObjectEventListenerCallback);
-}
-
-V8ObjectEventListener::~V8ObjectEventListener()
-{
-    if (m_frame) {
-        ASSERT(!m_listener.IsEmpty());
-        V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-        if (proxy)
-            proxy->objectListeners()->remove(this);
-    }
-
-    disposeListenerObject();
-}
-
-} // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index 1cfafb8..5e0c8b6 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -32,11 +32,18 @@
 #include "V8Proxy.h"
 
 #include "CSSMutableStyleDeclaration.h"
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #include "CString.h"
+=======
+#include "DateExtension.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
 #include "DOMObjectsInclude.h"
 #include "DocumentLoader.h"
 #include "FrameLoaderClient.h"
+#include "Page.h"
+#include "PageGroup.h"
 #include "ScriptController.h"
+#include "StorageNamespace.h"
 #include "V8Binding.h"
 #include "V8Collection.h"
 #include "V8ConsoleMessage.h"
@@ -67,7 +74,7 @@ namespace WebCore {
 v8::Persistent<v8::Context> V8Proxy::m_utilityContext;
 
 // Static list of registered extensions
-V8ExtensionList V8Proxy::m_extensions;
+V8Extensions V8Proxy::m_extensions;
 
 const char* V8Proxy::kContextDebugDataType = "type";
 const char* V8Proxy::kContextDebugDataValue = "value";
@@ -213,6 +220,14 @@ static void reportFatalErrorInV8(const char* location, const char* message)
     handleFatalErrorInV8();
 }
 
+V8Proxy::V8Proxy(Frame* frame)
+    : m_frame(frame),
+      m_context(SharedPersistent<v8::Context>::create()),
+      m_listenerGuard(V8ListenerGuard::create()),
+      m_inlineCode(false),
+      m_timerCallback(false),
+      m_recursion(0) { }
+
 V8Proxy::~V8Proxy()
 {
     clearForClose();
@@ -230,22 +245,6 @@ void V8Proxy::destroyGlobal()
     }
 }
 
-static void disconnectEventListenersInList(V8EventListenerList& list)
-{
-    V8EventListenerList::iterator it = list.begin();
-    while (it != list.end()) {
-        (*it)->disconnectFrame();
-        ++it;
-    }
-    list.clear();
-}
-
-void V8Proxy::disconnectEventListeners()
-{
-    disconnectEventListenersInList(m_eventListeners);
-    disconnectEventListenersInList(m_objectListeners);
-}
-
 v8::Handle<v8::Script> V8Proxy::compileScript(v8::Handle<v8::String> code, const String& fileName, int baseLine)
 #ifdef ANDROID_INSTRUMENT
 {
@@ -296,10 +295,32 @@ bool V8Proxy::handleOutOfMemory()
     return true;
 }
 
-void V8Proxy::evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup)
+void V8Proxy::evaluateInIsolatedWorld(int worldID, const Vector<ScriptSourceCode>& sources, int extensionGroup)
 {
     initContextIfNeeded();
-    V8IsolatedWorld::evaluate(sources, this, extensionGroup);
+
+    v8::HandleScope handleScope;
+    V8IsolatedWorld* world = 0;
+
+    if (worldID > 0) {
+        IsolatedWorldMap::iterator iter = m_isolatedWorlds.find(worldID);
+        if (iter != m_isolatedWorlds.end()) {
+            world = iter->second;
+        } else {
+            world = new V8IsolatedWorld(this, extensionGroup);
+            m_isolatedWorlds.set(worldID, world);
+        }
+    } else {
+        world = new V8IsolatedWorld(this, extensionGroup);
+    }
+
+    v8::Local<v8::Context> context = v8::Local<v8::Context>::New(world->context());
+    v8::Context::Scope context_scope(context);
+    for (size_t i = 0; i < sources.size(); ++i)
+      evaluate(sources[i], 0);
+
+    if (worldID == 0)
+      world->destroy();
 }
 
 void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int extensionGroup)
@@ -309,7 +330,7 @@ void V8Proxy::evaluateInNewContext(const Vector<ScriptSourceCode>& sources, int
     v8::HandleScope handleScope;
 
     // Set up the DOM window as the prototype of the new global object.
-    v8::Handle<v8::Context> windowContext = m_context;
+    v8::Handle<v8::Context> windowContext = context();
     v8::Handle<v8::Object> windowGlobal = windowContext->Global();
     v8::Handle<v8::Object> windowWrapper = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, windowGlobal);
 
@@ -357,6 +378,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
     ASSERT(v8::Context::InContext());
     LOCK_V8;
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     // Compile the script.
     v8::Local<v8::String> code = v8ExternalString(source.source());
 #if PLATFORM(CHROMIUM)
@@ -372,14 +394,27 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
     ChromiumBridge::traceEventEnd("v8.compile", node, "");
     ChromiumBridge::traceEventBegin("v8.run", node, "");
 #endif
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
-        // Isolate exceptions that occur when executing the code. These
-        // exceptions should not interfere with javascript code we might
-        // evaluate from C++ when returning from here.
+        // Isolate exceptions that occur when compiling and executing
+        // the code. These exceptions should not interfere with
+        // javascript code we might evaluate from C++ when returning
+        // from here.
         v8::TryCatch tryCatch;
         tryCatch.SetVerbose(true);
 
+        // Compile the script.
+        v8::Local<v8::String> code = v8ExternalString(source.source());
+        ChromiumBridge::traceEventBegin("v8.compile", node, "");
+
+        // NOTE: For compatibility with WebCore, ScriptSourceCode's line starts at
+        // 1, whereas v8 starts at 0.
+        v8::Handle<v8::Script> script = compileScript(code, source.url(), source.startLine() - 1);
+        ChromiumBridge::traceEventEnd("v8.compile", node, "");
+
+        ChromiumBridge::traceEventBegin("v8.run", node, "");
         // Set inlineCode to true for <a href="javascript:doSomething()">
         // and false for <script>doSomething</script>. We make a rough guess at
         // this based on whether the script source has a URL.
@@ -431,15 +466,18 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
-        m_recursion++;
 
         // See comment in V8Proxy::callFunction.
         m_frame->keepAlive();
 
+        m_recursion++;
         result = script->Run();
         m_recursion--;
     }
 
+    // Release the storage mutex if applicable.
+    releaseStorageMutex();
+
     if (handleOutOfMemory())
         ASSERT(result.IsEmpty());
 
@@ -458,6 +496,7 @@ v8::Local<v8::Value> V8Proxy::runScriptInternal(v8::Handle<v8::Script> script, b
 
 v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8::Handle<v8::Object> receiver, int argc, v8::Handle<v8::Value> args[])
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::JavaScriptExecuteTimeCounter);
 #endif
@@ -465,10 +504,23 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
     // For now, we don't put any artificial limitations on the depth
     // of recursion that stems from calling functions. This is in
     // contrast to the script evaluations.
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
     v8::Local<v8::Value> result;
     {
         V8ConsoleMessage::Scope scope;
 
+        if (m_recursion >= kMaxRecursionDepth) {
+            v8::Local<v8::String> code = v8::String::New("throw new RangeError('Maximum call stack size exceeded.')");
+            if (code.IsEmpty())
+                return result;
+            v8::Local<v8::Script> script = v8::Script::Compile(code);
+            if (script.IsEmpty())
+                return result;
+            script->Run();
+            return result;
+        }
+
         // Evaluating the JavaScript could cause the frame to be deallocated,
         // so we start the keep alive timer here.
         // Frame::keepAlive method adds the ref count of the frame and sets a
@@ -476,9 +528,14 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
         // execution finishs before firing the timer.
         m_frame->keepAlive();
 
+        m_recursion++;
         result = function->Call(receiver, argc, args);
+        m_recursion--;
     }
 
+    // Release the storage mutex if applicable.
+    releaseStorageMutex();
+
     if (v8::V8::IsDead())
         handleFatalErrorInV8();
 
@@ -508,17 +565,13 @@ v8::Local<v8::Value> V8Proxy::newInstance(v8::Handle<v8::Function> constructor,
     return result;
 }
 
-v8::Local<v8::Object> V8Proxy::createWrapperFromCache(V8ClassIndex::V8WrapperType type)
+v8::Local<v8::Object> V8Proxy::createWrapperFromCacheSlowCase(V8ClassIndex::V8WrapperType type)
 {
-    int classIndex = V8ClassIndex::ToInt(type);
-    v8::Local<v8::Object> clone(m_wrapperBoilerplates->CloneElementAt(classIndex));
-    if (!clone.IsEmpty())
-        return clone;
-
     // Not in cache.
+    int classIndex = V8ClassIndex::ToInt(type);
     initContextIfNeeded();
-    v8::Context::Scope scope(m_context);
-    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(m_context));
+    v8::Context::Scope scope(context());
+    v8::Local<v8::Function> function = V8DOMWrapper::getConstructor(type, getHiddenObjectPrototype(context()));
     v8::Local<v8::Object> instance = SafeAllocation::newInstance(function);
     if (!instance.IsEmpty()) {
         m_wrapperBoilerplates->Set(v8::Integer::New(classIndex), instance);
@@ -531,9 +584,9 @@ bool V8Proxy::isContextInitialized()
 {
     // m_context, m_global, and m_wrapperBoilerplates should
     // all be non-empty if if m_context is non-empty.
-    ASSERT(m_context.IsEmpty() || !m_global.IsEmpty());
-    ASSERT(m_context.IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
-    return !m_context.IsEmpty();
+    ASSERT(context().IsEmpty() || !m_global.IsEmpty());
+    ASSERT(context().IsEmpty() || !m_wrapperBoilerplates.IsEmpty());
+    return !context().IsEmpty();
 }
 
 DOMWindow* V8Proxy::retrieveWindow(v8::Handle<v8::Context> context)
@@ -547,7 +600,14 @@ DOMWindow* V8Proxy::retrieveWindow(v8::Handle<v8::Context> context)
 
 Frame* V8Proxy::retrieveFrame(v8::Handle<v8::Context> context)
 {
-    return retrieveWindow(context)->frame();
+    DOMWindow* window = retrieveWindow(context);
+    Frame* frame = window->frame();
+    if (frame && frame->domWindow() == window)
+        return frame;
+    // We return 0 here because |context| is detached from the Frame.  If we
+    // did return |frame| we could get in trouble because the frame could be
+    // navigated to another security origin.
+    return 0;
 }
 
 Frame* V8Proxy::retrieveFrameForEnteredContext()
@@ -701,21 +761,20 @@ void V8Proxy::updateDocumentWrapperCache()
         clearDocumentWrapperCache();
         return;
     }
-    m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
+    context()->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
 }
 
 void V8Proxy::clearDocumentWrapperCache()
 {
-    ASSERT(!m_context.IsEmpty());
-    m_context->Global()->ForceDelete(v8::String::New("document"));
+    ASSERT(!context().IsEmpty());
+    context()->Global()->ForceDelete(v8::String::New("document"));
 }
 
 void V8Proxy::disposeContextHandles()
 {
-    if (!m_context.IsEmpty()) {
+    if (!context().IsEmpty()) {
         m_frame->loader()->client()->didDestroyScriptContextForFrame();
-        m_context.Dispose();
-        m_context.Clear();
+        shared_context()->disposeHandle();
     }
 
     if (!m_wrapperBoilerplates.IsEmpty()) {
@@ -727,10 +786,45 @@ void V8Proxy::disposeContextHandles()
     }
 }
 
+void V8Proxy::releaseStorageMutex()
+{
+    // If we've just left a top level script context and local storage has been
+    // instantiated, we must ensure that any storage locks have been freed.
+    // Per http://dev.w3.org/html5/spec/Overview.html#storage-mutex
+    if (m_recursion != 0)
+        return;
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+    if (page->group().hasLocalStorage())
+        page->group().localStorage()->unlock();
+}
+
+void V8Proxy::disconnectEventListeners()
+{
+    m_listenerGuard->disconnectListeners();
+    m_listenerGuard = V8ListenerGuard::create();
+}
+    
+void V8Proxy::resetIsolatedWorlds()
+{
+    for (IsolatedWorldMap::iterator iter = m_isolatedWorlds.begin();
+         iter != m_isolatedWorlds.end(); ++iter) {
+        iter->second->destroy();
+    }
+    m_isolatedWorlds.clear();
+}
+
 void V8Proxy::clearForClose()
 {
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!m_context.IsEmpty()) {
         LOCK_V8;
+=======
+    resetIsolatedWorlds();
+
+    if (!context().IsEmpty()) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handleScope;
 
         clearDocumentWrapper();
@@ -741,13 +835,18 @@ void V8Proxy::clearForClose()
 void V8Proxy::clearForNavigation()
 {
     disconnectEventListeners();
+    resetIsolatedWorlds();
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.cpp
     if (!m_context.IsEmpty()) {
         LOCK_V8;
+=======
+    if (!context().IsEmpty()) {
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.cpp
         v8::HandleScope handle;
         clearDocumentWrapper();
 
-        v8::Context::Scope contextScope(m_context);
+        v8::Context::Scope contextScope(context());
 
         // Clear the document wrapper cache before turning on access checks on
         // the old DOMWindow wrapper. This way, access to the document wrapper
@@ -760,7 +859,7 @@ void V8Proxy::clearForNavigation()
         wrapper->TurnOnAccessCheck();
 
         // Separate the context from its global object.
-        m_context->DetachGlobal();
+        context()->DetachGlobal();
 
         disposeContextHandles();
     }
@@ -771,7 +870,7 @@ void V8Proxy::setSecurityToken()
     Document* document = m_frame->document();
     // Setup security origin and security token.
     if (!document) {
-        m_context->UseDefaultSecurityToken();
+        context()->UseDefaultSecurityToken();
         return;
     }
 
@@ -791,14 +890,14 @@ void V8Proxy::setSecurityToken()
     // case, we use the global object as the security token to avoid
     // calling canAccess when a script accesses its own objects.
     if (token.isEmpty() || token == "null") {
-        m_context->UseDefaultSecurityToken();
+        context()->UseDefaultSecurityToken();
         return;
     }
 
     CString utf8Token = token.utf8();
     // NOTE: V8 does identity comparison in fast path, must use a symbol
     // as the security token.
-    m_context->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
+    context()->SetSecurityToken(v8::String::NewSymbol(utf8Token.data(), utf8Token.length()));
 }
 
 void V8Proxy::updateDocument()
@@ -816,6 +915,10 @@ void V8Proxy::updateDocument()
     // global object wrapper succeed.
     initContextIfNeeded();
 
+    // Bail out if context initialization failed.
+    if (context().IsEmpty())
+        return;
+
     // We have a new document and we need to update the cache.
     updateDocumentWrapperCache();
 
@@ -930,21 +1033,26 @@ v8::Persistent<v8::Context> V8Proxy::createNewContext(v8::Handle<v8::Object> glo
 
     // Install a security handler with V8.
     globalTemplate->SetAccessCheckCallbacks(V8Custom::v8DOMWindowNamedSecurityCheck, V8Custom::v8DOMWindowIndexedSecurityCheck, v8::Integer::New(V8ClassIndex::DOMWINDOW));
+    globalTemplate->SetInternalFieldCount(V8Custom::kDOMWindowInternalFieldCount);
+
+    // Used to avoid sleep calls in unload handlers.
+    if (!registeredExtensionWithV8(DateExtension::get()))
+        registerExtension(DateExtension::get(), String());
 
     // Dynamically tell v8 about our extensions now.
     OwnArrayPtr<const char*> extensionNames(new const char*[m_extensions.size()]);
     int index = 0;
-    for (V8ExtensionList::iterator it = m_extensions.begin(); it != m_extensions.end(); ++it) {
-        if (it->group && it->group != extensionGroup)
+    for (size_t i = 0; i < m_extensions.size(); ++i) {
+        if (m_extensions[i].group && m_extensions[i].group != extensionGroup)
             continue;
 
         // Note: we check the loader URL here instead of the document URL
         // because we might be currently loading an URL into a blank page.
         // See http://code.google.com/p/chromium/issues/detail?id=10924
-        if (it->scheme.length() > 0 && (it->scheme != m_frame->loader()->activeDocumentLoader()->url().protocol() || it->scheme != m_frame->page()->mainFrame()->loader()->activeDocumentLoader()->url().protocol()))
+        if (m_extensions[i].scheme.length() > 0 && (m_extensions[i].scheme != m_frame->loader()->activeDocumentLoader()->url().protocol() || m_extensions[i].scheme != m_frame->page()->mainFrame()->loader()->activeDocumentLoader()->url().protocol()))
             continue;
 
-        extensionNames[index++] = it->extension->name();
+        extensionNames[index++] = m_extensions[i].extension->name();
     }
     v8::ExtensionConfiguration extensions(index, extensionNames.get());
     result = v8::Context::New(&extensions, globalTemplate, global);
@@ -967,12 +1075,14 @@ bool V8Proxy::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* windo
 
     // Wrap the window.
     V8DOMWrapper::setDOMWrapper(jsWindow, V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
+    V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(jsWindow->GetPrototype()), V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
 
     window->ref();
     V8DOMWrapper::setJSWrapperForDOMObject(window, v8::Persistent<v8::Object>::New(jsWindow));
 
     // Insert the window instance as the prototype of the shadow object.
     v8::Handle<v8::Object> v8Global = context->Global();
+    V8DOMWrapper::setDOMWrapper(v8::Handle<v8::Object>::Cast(v8Global->GetPrototype()), V8ClassIndex::ToInt(V8ClassIndex::DOMWINDOW), window);
     v8Global->Set(implicitProtoString, jsWindow);
     return true;
 }
@@ -1015,7 +1125,7 @@ bool V8Proxy::installDOMWindow(v8::Handle<v8::Context> context, DOMWindow* windo
 void V8Proxy::initContextIfNeeded()
 {
     // Bail out if the context has already been initialized.
-    if (!m_context.IsEmpty())
+    if (!context().IsEmpty())
         return;
 
 #ifdef ANDROID_INSTRUMENT
@@ -1044,17 +1154,18 @@ void V8Proxy::initContextIfNeeded()
         isV8Initialized = true;
     }
 
-    m_context = createNewContext(m_global, 0);
-    if (m_context.IsEmpty())
+
+    v8::Persistent<v8::Context> context = createNewContext(m_global, 0);
+    if (context.IsEmpty())
         return;
+    m_context->set(context);
+
 
-    // Starting from now, use local context only.
-    v8::Local<v8::Context> v8Context = context();
-    v8::Context::Scope contextScope(v8Context);
+    v8::Context::Scope contextScope(context);
 
     // Store the first global object created so we can reuse it.
     if (m_global.IsEmpty()) {
-        m_global = v8::Persistent<v8::Object>::New(v8Context->Global());
+        m_global = v8::Persistent<v8::Object>::New(context->Global());
         // Bail out if allocation of the first global objects fails.
         if (m_global.IsEmpty()) {
             disposeContextHandles();
@@ -1065,7 +1176,7 @@ void V8Proxy::initContextIfNeeded()
 #endif
     }
 
-    installHiddenObjectPrototype(m_context);
+    installHiddenObjectPrototype(context);
     m_wrapperBoilerplates = v8::Persistent<v8::Array>::New(v8::Array::New(V8ClassIndex::WRAPPER_TYPE_COUNT));
     // Bail out if allocation failed.
     if (m_wrapperBoilerplates.IsEmpty()) {
@@ -1076,7 +1187,7 @@ void V8Proxy::initContextIfNeeded()
     V8GCController::registerGlobalHandle(PROXY, this, m_wrapperBoilerplates);
 #endif
 
-    if (!installDOMWindow(v8Context, m_frame->domWindow()))
+    if (!installDOMWindow(context, m_frame->domWindow()))
         disposeContextHandles();
 
     updateDocument();
@@ -1162,6 +1273,23 @@ v8::Local<v8::Context> V8Proxy::context(Frame* frame)
     return context;
 }
 
+PassRefPtr<SharedPersistent<v8::Context> > V8Proxy::shared_context(Frame* frame)
+{
+    V8Proxy *proxy = V8Proxy::retrieve(frame);
+    if (!proxy)
+        return 0;
+
+    proxy->initContextIfNeeded();
+    RefPtr<SharedPersistent<v8::Context> > context = proxy->shared_context();
+    if (V8IsolatedWorld* world = V8IsolatedWorld::getEntered()) {
+        context = world->shared_context();
+        if (frame != V8Proxy::retrieveFrame(context->get()))
+            return 0;
+    }
+
+    return context;
+}
+
 v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
 {
     V8Proxy* proxy = retrieve(frame);
@@ -1169,7 +1297,7 @@ v8::Local<v8::Context> V8Proxy::mainWorldContext(Frame* frame)
         return v8::Local<v8::Context>();
 
     proxy->initContextIfNeeded();
-    return proxy->context();
+    return v8::Local<v8::Context>::New(proxy->context());
 }
 
 v8::Local<v8::Context> V8Proxy::currentContext()
@@ -1279,14 +1407,21 @@ String V8Proxy::sourceName()
 #endif
 }
 
-void V8Proxy::registerExtensionWithV8(v8::Extension* extension) {
+void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
+{
     // If the extension exists in our list, it was already registered with V8.
-    for (V8ExtensionList::iterator it = m_extensions.begin(); it != m_extensions.end(); ++it) {
-        if (it->extension == extension)
-            return;
+    if (!registeredExtensionWithV8(extension))
+        v8::RegisterExtension(extension);
+}
+
+bool V8Proxy::registeredExtensionWithV8(v8::Extension* extension)
+{
+    for (size_t i = 0; i < m_extensions.size(); ++i) {
+        if (m_extensions[i].extension == extension)
+            return true;
     }
 
-    v8::RegisterExtension(extension);
+    return false;
 }
 
 void V8Proxy::registerExtension(v8::Extension* extension, const String& schemeRestriction)
@@ -1306,17 +1441,17 @@ void V8Proxy::registerExtension(v8::Extension* extension, int extensionGroup)
 bool V8Proxy::setContextDebugId(int debugId)
 {
     ASSERT(debugId > 0);
-    if (m_context.IsEmpty())
+    if (context().IsEmpty())
         return false;
     v8::HandleScope scope;
-    if (!m_context->GetData()->IsUndefined())
+    if (!context()->GetData()->IsUndefined())
         return false;
 
-    v8::Context::Scope contextScope(m_context);
+    v8::Context::Scope contextScope(context());
     v8::Handle<v8::Object> contextData = v8::Object::New();
     contextData->Set(v8::String::New(kContextDebugDataType), v8::String::New("page"));
     contextData->Set(v8::String::New(kContextDebugDataValue), v8::Integer::New(debugId));
-    m_context->SetData(contextData);
+    context()->SetData(contextData);
     return true;
 }
 
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index d8f546c..c68f6b7 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -31,25 +31,30 @@
 #ifndef V8Proxy_h
 #define V8Proxy_h
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
 #include "Node.h"
 #include "NodeFilter.h"
 #include "PlatformString.h" // for WebCore::String
+=======
+#include "ChromiumBridge.h"
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 #include "ScriptSourceCode.h" // for WebCore::ScriptSourceCode
 #include "SecurityOrigin.h" // for WebCore::SecurityOrigin
-#include "V8CustomBinding.h"
-#include "V8DOMMap.h"
+#include "SharedPersistent.h"
+#include "V8AbstractEventListener.h"
 #include "V8DOMWrapper.h"
-#include "V8EventListenerList.h"
 #include "V8GCController.h"
 #include "V8Index.h"
-#include "V8Utilities.h"
 #include <v8.h>
-#include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h> // so generated bindings don't have to
 #include <wtf/Vector.h>
 
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
 #if defined(ENABLE_DOM_STATS_COUNTERS) && PLATFORM(CHROMIUM)
 #include "ChromiumBridge.h"
+=======
+#ifdef ENABLE_DOM_STATS_COUNTERS
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 #define INC_STATS(name) ChromiumBridge::incrementStatsCounter(name)
 #else
 #define INC_STATS(name)
@@ -57,49 +62,14 @@
 
 namespace WebCore {
 
-    class CSSRule;
-    class CSSRuleList;
-    class CSSStyleDeclaration;
-    class CSSValue;
-    class CSSValueList;
-    class ClientRectList;
-    class DOMImplementation;
     class DOMWindow;
-    class Document;
-    class Element;
-    class Event;
-    class EventListener;
-    class EventTarget;
     class Frame;
-    class HTMLCollection;
-    class HTMLDocument;
-    class HTMLElement;
-    class HTMLOptionsCollection;
-    class MediaList;
-    class MimeType;
-    class MimeTypeArray;
-    class NamedNodeMap;
-    class Navigator;
     class Node;
-    class NodeFilter;
-    class NodeList;
-    class Plugin;
-    class PluginArray;
     class SVGElement;
-#if ENABLE(SVG)
-    class SVGElementInstance;
-#endif
-    class Screen;
     class ScriptExecutionContext;
-#if ENABLE(DOM_STORAGE)
-    class Storage;
-    class StorageEvent;
-#endif
     class String;
-    class StyleSheet;
-    class StyleSheetList;
     class V8EventListener;
-    class V8ObjectEventListener;
+    class V8IsolatedWorld;
 
     // FIXME: use standard logging facilities in WebCore.
     void logInfo(Frame*, const String& message, const String& url);
@@ -145,7 +115,11 @@ namespace WebCore {
         int group;
         v8::Extension* extension;
     };
+<<<<<<< HEAD:WebCore/bindings/v8/V8Proxy.h
     typedef WTF::Vector<V8ExtensionInfo> V8ExtensionList;
+=======
+    typedef WTF::Vector<V8ExtensionInfo> V8Extensions;
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/V8Proxy.h
 
     class V8Proxy {
     public:
@@ -158,7 +132,7 @@ namespace WebCore {
             GeneralError
         };
 
-        explicit V8Proxy(Frame* frame) : m_frame(frame), m_inlineCode(false), m_timerCallback(false), m_recursion(0) { }
+        explicit V8Proxy(Frame*);
 
         ~V8Proxy();
 
@@ -196,9 +170,6 @@ namespace WebCore {
 
         bool isEnabled();
 
-        V8EventListenerList* eventListeners() { return &m_eventListeners; }
-        V8EventListenerList* objectListeners() { return &m_objectListeners; }
-
 #if ENABLE(SVG)
         static void setSVGContext(void*, SVGElement*);
         static SVGElement* svgContext(void*);
@@ -211,7 +182,7 @@ namespace WebCore {
         // global scope, its own prototypes for intrinsic JavaScript objects (String,
         // Array, and so-on), and its own wrappers for all DOM nodes and DOM
         // constructors.
-        void evaluateInNewWorld(const Vector<ScriptSourceCode>& sources, int extensionGroup);
+        void evaluateInIsolatedWorld(int worldId, const Vector<ScriptSourceCode>& sources, int extensionGroup);
 
         // Evaluate JavaScript in a new context. The script gets its own global scope
         // and its own prototypes for intrinsic JavaScript objects (String, Array,
@@ -239,7 +210,12 @@ namespace WebCore {
         // To create JS Wrapper objects, we create a cache of a 'boiler plate'
         // object, and then simply Clone that object each time we need a new one.
         // This is faster than going through the full object creation process.
-        v8::Local<v8::Object> createWrapperFromCache(V8ClassIndex::V8WrapperType);
+        v8::Local<v8::Object> createWrapperFromCache(V8ClassIndex::V8WrapperType type)
+        {
+            int classIndex = V8ClassIndex::ToInt(type);
+            v8::Local<v8::Object> clone(m_wrapperBoilerplates->CloneElementAt(classIndex));
+            return clone.IsEmpty() ? createWrapperFromCacheSlowCase(type) : clone;
+        }
 
         // Returns the window object associated with a context.
         static DOMWindow* retrieveWindow(v8::Handle<v8::Context>);
@@ -290,6 +266,7 @@ namespace WebCore {
         // Returns V8 Context of a frame. If none exists, creates
         // a new context. It is potentially slow and consumes memory.
         static v8::Local<v8::Context> context(Frame*);
+        static PassRefPtr<SharedPersistent<v8::Context> > shared_context(Frame*);
         static v8::Local<v8::Context> mainWorldContext(Frame*);
         static v8::Local<v8::Context> currentContext();
 
@@ -334,10 +311,19 @@ namespace WebCore {
         static int sourceLineNumber();
         static String sourceName();
 
-        // Returns a local handle of the context.
-        v8::Local<v8::Context> context()
+        v8::Handle<v8::Context> context()
+        {
+            return m_context->get();
+        }
+
+        PassRefPtr<SharedPersistent<v8::Context> > shared_context()
+        {
+            return m_context;
+        }
+
+        PassRefPtr<V8ListenerGuard> listenerGuard()
         {
-            return v8::Local<v8::Context>::New(m_context);
+            return m_listenerGuard;
         }
 
         bool setContextDebugId(int id);
@@ -368,7 +354,6 @@ namespace WebCore {
         static const char* kContextDebugDataType;
         static const char* kContextDebugDataValue;
 
-        void disconnectEventListeners();
         void setSecurityToken();
         void clearDocumentWrapper();
 
@@ -382,6 +367,14 @@ namespace WebCore {
         // Dispose global handles of m_contexts and friends.
         void disposeContextHandles();
 
+        // If m_recursionCount is 0, let LocalStorage know so we can release
+        // the storage mutex.
+        void releaseStorageMutex();
+
+        void disconnectEventListeners();
+        
+        void resetIsolatedWorlds();
+
         static bool canAccessPrivate(DOMWindow*);
 
         static const char* rangeExceptionName(int exceptionCode);
@@ -407,11 +400,17 @@ namespace WebCore {
             return v8::Local<v8::Context>::New(m_utilityContext);
         }
 
+        v8::Local<v8::Object> createWrapperFromCacheSlowCase(V8ClassIndex::V8WrapperType);
+
         static void registerExtensionWithV8(v8::Extension*);
+        static bool registeredExtensionWithV8(v8::Extension*);
 
         Frame* m_frame;
 
-        v8::Persistent<v8::Context> m_context;
+        RefPtr<SharedPersistent<v8::Context> > m_context;
+
+        RefPtr<V8ListenerGuard> m_listenerGuard;
+
         // For each possible type of wrapper, we keep a boilerplate object.
         // The boilerplate is used to create additional wrappers of the same
         // type.  We keep a single persistent handle to an array of the
@@ -426,14 +425,6 @@ namespace WebCore {
 
         int m_handlerLineNumber;
 
-        // A list of event listeners created for this frame,
-        // the list gets cleared when removing all timeouts.
-        V8EventListenerList m_eventListeners;
-
-        // A list of event listeners create for XMLHttpRequest object for this frame,
-        // the list gets cleared when removing all timeouts.
-        V8EventListenerList m_objectListeners;
-
         // True for <a href="javascript:foo()"> and false for <script>foo()</script>.
         // Only valid during execution.
         bool m_inlineCode;
@@ -447,8 +438,18 @@ namespace WebCore {
         // excessive recursion in the binding layer.
         int m_recursion;
 
-        // List of extensions registered with the context.
-        static V8ExtensionList m_extensions;
+        // All of the extensions registered with the context.
+        static V8Extensions m_extensions;
+
+        // The isolated worlds we are tracking for this frame. We hold them alive
+        // here so that they can be used again by future calls to
+        // evaluateInIsolatedWorld().
+        //
+        // Note: although the pointer is raw, the instance is kept alive by a strong
+        // reference to the v8 context it contains, which is not made weak until we
+        // call world->destroy().
+        typedef HashMap<int, V8IsolatedWorld*> IsolatedWorldMap;
+        IsolatedWorldMap m_isolatedWorlds;
     };
 
     template <int tag, typename T>
diff --git a/WebCore/bindings/v8/V8Utilities.cpp b/WebCore/bindings/v8/V8Utilities.cpp
index c1ac6d4..a66f435 100644
--- a/WebCore/bindings/v8/V8Utilities.cpp
+++ b/WebCore/bindings/v8/V8Utilities.cpp
@@ -33,8 +33,15 @@
 
 #include <v8.h>
 
+#include "Document.h"
+#include "Frame.h"
+#include "ScriptExecutionContext.h"
+#include "ScriptState.h"
 #include "V8CustomBinding.h"
+#include "V8Binding.h"
 #include "V8Proxy.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
 
 #include <wtf/Assertions.h>
 #include "Frame.h"
@@ -43,7 +50,7 @@ namespace WebCore {
 
 // Use an array to hold dependents. It works like a ref-counted scheme.
 // A value can be added more than once to the DOM object.
-void createHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
+void createHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
     v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     if (cache->IsNull() || cache->IsUndefined()) {
@@ -55,7 +62,7 @@ void createHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> v
     cacheArray->Set(v8::Integer::New(cacheArray->Length()), value);
 }
 
-void removeHiddenDependency(v8::Local<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
+void removeHiddenDependency(v8::Handle<v8::Object> object, v8::Local<v8::Value> value, int cacheIndex)
 {
     v8::Local<v8::Value> cache = object->GetInternalField(cacheIndex);
     if (!cache->IsArray())
@@ -98,7 +105,46 @@ void navigateIfAllowed(Frame* frame, const KURL& url, bool lockHistory, bool loc
         return;
 
     if (!protocolIsJavaScript(url) || ScriptController::isSafeScript(frame))
-        frame->loader()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), callingFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture());
+}
+
+ScriptExecutionContext* getScriptExecutionContext(ScriptState* scriptState)
+{
+#if ENABLE(WORKERS)
+    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
+    if (proxy)
+        return proxy->workerContext()->scriptExecutionContext();
+#endif
+
+    if (scriptState)
+        return scriptState->frame()->document()->scriptExecutionContext();
+    else {
+        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+        if (frame)
+            return frame->document()->scriptExecutionContext();
+    }
+
+    return 0;
+}
+
+void reportException(ScriptState* scriptState, v8::TryCatch& exceptionCatcher)
+{
+    String errorMessage;
+    int lineNumber = 0;
+    String sourceURL;
+
+    // There can be a situation that an exception is thrown without setting a message.
+    v8::Local<v8::Message> message = exceptionCatcher.Message();
+    if (message.IsEmpty())
+        errorMessage = toWebCoreString(exceptionCatcher.Exception()->ToString());
+    else {
+        errorMessage = toWebCoreString(message->Get());
+        lineNumber = message->GetLineNumber();
+        sourceURL = toWebCoreString(message->GetScriptResourceName());
+    }
+
+    getScriptExecutionContext(scriptState)->reportException(errorMessage, lineNumber, sourceURL);
+    exceptionCatcher.Reset();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8Utilities.h b/WebCore/bindings/v8/V8Utilities.h
index 3e59d34..1a713c9 100644
--- a/WebCore/bindings/v8/V8Utilities.h
+++ b/WebCore/bindings/v8/V8Utilities.h
@@ -44,17 +44,26 @@ namespace WebCore {
 
     class Frame;
     class KURL;
+    class ScriptExecutionContext;
+    class ScriptState;
     class String;
 
     // Use an array to hold dependents. It works like a ref-counted scheme. A value can be added more than once to the DOM object.
-    void createHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
-    void removeHiddenDependency(v8::Local<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+    void createHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
+    void removeHiddenDependency(v8::Handle<v8::Object>, v8::Local<v8::Value>, int cacheIndex);
 
     bool processingUserGesture();
     bool shouldAllowNavigation(Frame*);
     KURL completeURL(const String& relativeURL);
     void navigateIfAllowed(Frame*, const KURL&, bool lockHistory, bool lockBackForwardList);
 
+    ScriptExecutionContext* getScriptExecutionContext(ScriptState*);
+    inline ScriptExecutionContext* getScriptExecutionContext() {
+        return getScriptExecutionContext(0);
+    }
+
+    void reportException(ScriptState*, v8::TryCatch&);
+
     class AllowAllocation {
     public:
         inline AllowAllocation()
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 862cd2d..24e493c 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -41,20 +41,13 @@
 
 namespace WebCore {
 
-V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-    : V8EventListener(0, listener, isInline)
+V8WorkerContextEventListener::V8WorkerContextEventListener(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
+    : V8EventListener(0, guard, listener, isInline)
     , m_proxy(proxy)
 {
 }
 
-V8WorkerContextEventListener::~V8WorkerContextEventListener()
-{
-    if (m_proxy)
-        m_proxy->removeEventListener(this);
-    disposeListenerObject();
-}
-
-void V8WorkerContextEventListener::handleEvent(Event* event, bool isWindowEvent)
+void V8WorkerContextEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     // Is the EventListener disconnected?
     if (disconnected())
@@ -77,7 +70,7 @@ void V8WorkerContextEventListener::handleEvent(Event* event, bool isWindowEvent)
     // Get the V8 wrapper for the event object.
     v8::Handle<v8::Value> jsEvent = WorkerContextExecutionProxy::convertEventToV8Object(event);
 
-    invokeEventHandler(context, event, jsEvent, isWindowEvent);
+    invokeEventHandler(context, event, jsEvent);
 }
 
 bool V8WorkerContextEventListener::reportError(const String& message, const String& url, int lineNumber)
@@ -98,6 +91,7 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
     // Enter the V8 context in which to perform the event handling.
     v8::Context::Scope scope(context);
 
+    v8::Local<v8::Object> listener = getListenerObject();
     v8::Local<v8::Value> returnValue;
     {
         // Catch exceptions thrown in calling the function so they do not propagate to javascript code that caused the event to fire.
@@ -105,8 +99,8 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
         tryCatch.SetVerbose(true);
 
         // Call the function.
-        if (!m_listener.IsEmpty() && m_listener->IsFunction()) {
-            v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
+        if (!listener.IsEmpty() && listener->IsFunction()) {
+            v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
             v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
 
             v8::Handle<v8::Value> parameters[3] = { v8String(message), v8String(url), v8::Integer::New(lineNumber) };
@@ -126,10 +120,10 @@ bool V8WorkerContextEventListener::reportError(const String& message, const Stri
     return errorHandled;
 }
 
-v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
+v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
     v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
@@ -141,13 +135,12 @@ v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(v8::Hand
     return result;
 }
 
-v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(Event* event, bool isWindowEvent)
+v8::Local<v8::Object> V8WorkerContextEventListener::getReceiverObject(Event* event)
 {
-    if (!m_listener.IsEmpty() && !m_listener->IsFunction())
-        return v8::Local<v8::Object>::New(m_listener);
+    v8::Local<v8::Object> listener = getListenerObject();
 
-    if (isWindowEvent)
-        return v8::Context::GetCurrent()->Global();
+    if (!listener.IsEmpty() && !listener->IsFunction())
+        return listener;
 
     EventTarget* target = event->currentTarget();
     v8::Handle<v8::Value> value = WorkerContextExecutionProxy::convertEventTargetToV8Object(target);
diff --git a/WebCore/bindings/v8/V8WorkerContextEventListener.h b/WebCore/bindings/v8/V8WorkerContextEventListener.h
index c901c51..3752533 100644
--- a/WebCore/bindings/v8/V8WorkerContextEventListener.h
+++ b/WebCore/bindings/v8/V8WorkerContextEventListener.h
@@ -44,23 +44,21 @@ namespace WebCore {
 
     class V8WorkerContextEventListener : public V8EventListener {
     public:
-        static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
+        static PassRefPtr<V8WorkerContextEventListener> create(WorkerContextExecutionProxy* proxy, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isInline)
         {
-            return adoptRef(new V8WorkerContextEventListener(proxy, listener, isInline));
+            return adoptRef(new V8WorkerContextEventListener(proxy, guard, listener, isInline));
         }
-        V8WorkerContextEventListener(WorkerContextExecutionProxy*, v8::Local<v8::Object> listener, bool isInline);
 
-        virtual ~V8WorkerContextEventListener();
-        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
         virtual bool reportError(const String& message, const String& url, int lineNumber);
-        virtual bool disconnected() const { return !m_proxy; }
 
         WorkerContextExecutionProxy* proxy() const { return m_proxy; }
-        void disconnect() { m_proxy = 0; }
 
     private:
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-        v8::Local<v8::Object> getReceiverObject(Event*, bool isWindowEvent);
+        V8WorkerContextEventListener(WorkerContextExecutionProxy*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isInline);
+
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+        v8::Local<v8::Object> getReceiverObject(Event*);
         WorkerContextExecutionProxy* m_proxy;
     };
 
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index ba858cf..8ef65b3 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -38,6 +38,8 @@
 #include "DOMCoreException.h"
 #include "DedicatedWorkerContext.h"
 #include "Event.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
 #include "EventException.h"
 #include "MessagePort.h"
 #include "RangeException.h"
@@ -46,7 +48,9 @@
 #include "V8Index.h"
 #include "V8Proxy.h"
 #include "V8WorkerContextEventListener.h"
-#include "V8WorkerContextObjectEventListener.h"
+#if ENABLE(WEB_SOCKETS)
+#include "WebSocket.h"
+#endif
 #include "Worker.h"
 #include "WorkerContext.h"
 #include "WorkerLocation.h"
@@ -66,6 +70,7 @@ static void reportFatalErrorInV8(const char* location, const char* message)
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_recursion(0)
+    , m_listenerGuard(V8ListenerGuard::create())
 {
     initV8IfNeeded();
 }
@@ -77,13 +82,7 @@ WorkerContextExecutionProxy::~WorkerContextExecutionProxy()
 
 void WorkerContextExecutionProxy::dispose()
 {
-    // Disconnect all event listeners.
-    if (m_listeners.get()) {
-        for (V8EventListenerList::iterator iterator(m_listeners->begin()); iterator != m_listeners->end(); ++iterator)
-           static_cast<V8WorkerContextEventListener*>(*iterator)->disconnect();
-
-        m_listeners->clear();
-    }
+    m_listenerGuard->disconnectListeners();
 
     // Detach all events from their JS wrappers.
     for (size_t eventIndex = 0; eventIndex < m_events.size(); ++eventIndex) {
@@ -169,8 +168,6 @@ void WorkerContextExecutionProxy::initContextIfNeeded()
     // Insert the object instance as the prototype of the shadow object.
     v8::Handle<v8::Object> globalObject = m_context->Global();
     globalObject->Set(implicitProtoString, jsWorkerContext);
-
-    m_listeners.set(new V8EventListenerList());
 }
 
 v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::V8WrapperType type, void* impl)
@@ -224,6 +221,14 @@ v8::Handle<v8::Value> WorkerContextExecutionProxy::convertToV8Object(V8ClassInde
             case V8ClassIndex::WORKERNAVIGATOR:
                 static_cast<WorkerNavigator*>(impl)->ref();
                 break;
+#if ENABLE(NOTIFICATIONS)
+            case V8ClassIndex::NOTIFICATIONCENTER:
+                static_cast<NotificationCenter*>(impl)->ref();
+                break;
+            case V8ClassIndex::NOTIFICATION:
+                static_cast<Notification*>(impl)->ref();
+                break;
+#endif
             case V8ClassIndex::DOMCOREEXCEPTION:
                 static_cast<DOMCoreException*>(impl)->ref();
                 break;
@@ -398,6 +403,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
     return result;
 }
 
+<<<<<<< HEAD:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener)
 {
     if (!object->IsObject())
@@ -419,19 +425,11 @@ PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListen
     return newListener.release();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
 PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
 {
-    return findOrCreateEventListenerHelper(object, isInline, findOnly, false);
-}
-
-PassRefPtr<V8EventListener> WorkerContextExecutionProxy::findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly)
-{
-    return findOrCreateEventListenerHelper(object, isInline, findOnly, true);
-}
-
-void WorkerContextExecutionProxy::removeEventListener(V8EventListener* listener)
-{
-    m_listeners->remove(listener);
+    return findOnly ? V8EventListenerList::findWrapper(object, isInline) : V8EventListenerList::findOrCreateWrapper<V8WorkerContextEventListener>(this, m_listenerGuard, object, isInline);
 }
 
 void WorkerContextExecutionProxy::trackEvent(Event* event)
diff --git a/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 75024df..a08395c 100644
--- a/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -64,12 +64,8 @@ namespace WebCore {
         WorkerContextExecutionProxy(WorkerContext*);
         ~WorkerContextExecutionProxy();
 
-        void removeEventListener(V8EventListener*);
-
         // Finds/creates event listener wrappers.
         PassRefPtr<V8EventListener> findOrCreateEventListener(v8::Local<v8::Value> listener, bool isInline, bool findOnly);
-        PassRefPtr<V8EventListener> findOrCreateObjectEventListener(v8::Local<v8::Value> object, bool isInline, bool findOnly);
-        PassRefPtr<V8EventListener> findOrCreateEventListenerHelper(v8::Local<v8::Value> object, bool isInline, bool findOnly, bool createObjectEventListener);
 
         // Track the event so that we can detach it from the JS wrapper when a worker
         // terminates. This is needed because we need to be able to dispose these
@@ -114,8 +110,8 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
         int m_recursion;
+        RefPtr<V8ListenerGuard> m_listenerGuard;
 
-        OwnPtr<V8EventListenerList> m_listeners;
         Vector<Event*> m_events;
     };
 
diff --git a/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp b/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
index ce759eb..0240895 100644
--- a/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8AbstractWorkerCustom.cpp
@@ -38,75 +38,18 @@
 #include "ScriptExecutionContext.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
-PassRefPtr<EventListener> getEventListener(AbstractWorker* worker, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    if (worker->scriptExecutionContext()->isWorkerContext()) {
-        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-        ASSERT(workerContextProxy);
-        return workerContextProxy->findOrCreateObjectEventListener(value, isAttribute, findOnly);
-    }
-
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_GETTER(AbstractWorkerOnerror)
-{
-    INC_STATS(L"DOM.AbstractWorker.onerror._get");
-    AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, info.Holder());
-    if (worker->onerror()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(AbstractWorkerOnerror)
-{
-    INC_STATS(L"DOM.AbstractWorker.onerror._set");
-    AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, info.Holder());
-    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onerror());
-    if (value->IsNull()) {
-        if (oldListener) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kAbstractWorkerRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        worker->setOnerror(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(worker, value, true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kAbstractWorkerRequestCacheIndex);
-            }
-
-            worker->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kAbstractWorkerRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(AbstractWorkerAddEventListener)
 {
     INC_STATS(L"DOM.AbstractWorker.addEventListener()");
     AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(worker, args[1], false, false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(worker, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -122,7 +65,7 @@ CALLBACK_FUNC_DECL(AbstractWorkerRemoveEventListener)
     INC_STATS(L"DOM.AbstractWorker.removeEventListener()");
     AbstractWorker* worker = V8DOMWrapper::convertToNativeObject<AbstractWorker>(V8ClassIndex::ABSTRACTWORKER, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(worker, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(worker, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
new file mode 100644
index 0000000..4a85e82
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasArrayBufferCustom.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasArrayBufferConstructor)
+{
+    INC_STATS("DOM.CanvasArrayBuffer.Contructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.");
+
+    int argLen = args.Length();
+    // Supported constructors:
+    // CanvasArrayBuffer(n) where n is an integer:
+    //   -- create an empty buffer of n bytes
+
+    if (argLen != 1)
+        return throwError("Wrong number of arguments specified to constructor (requires 1)");
+
+    int len = 0;
+    if (!args[0]->IsInt32())
+        return throwError("Argument to CanvasArrayBuffer constructor was not an integer");
+    len = toInt32(args[0]);
+    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(len);
+    // Transform the holder into a wrapper object for the array.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::CANVASARRAYBUFFER), buffer.get());
+    return toV8(buffer.release(), args.Holder());
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
new file mode 100644
index 0000000..311b838
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasArrayCustom.h
@@ -0,0 +1,136 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+    // Template function used by the CanvasArray*Constructor callbacks.
+    template<class ArrayClass>
+    v8::Handle<v8::Value> constructCanvasArray(const v8::Arguments& args,
+                                               int classIndex)
+    {
+        if (!args.IsConstructCall())
+            return throwError("DOM object constructor cannot be called as a function.");
+
+        int argLen = args.Length();
+        // Supported constructors:
+        // Canvas<T>Array(n) where n is an integer:
+        //   -- create an empty array of n elements
+        // Canvas<T>Array(arr) where arr is an array:
+        //   -- create a Canvas<T>Array containing the contents of "arr"
+        // Canvas<T>Array(buf, offset, length)
+        //   -- create a Canvas<T>Array pointing to the CanvasArrayBuffer
+        //      "buf", starting at the specified offset, for the given
+        //      length
+
+        if (argLen == 0)
+            return throwError("No arguments specified to constructor");
+
+        // See whether the first argument is a CanvasArrayBuffer.
+        if (V8CanvasArrayBuffer::HasInstance(args[0])) {
+            if (argLen > 3)
+                return throwError("Wrong number of arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
+
+            CanvasArrayBuffer* buf =
+                V8DOMWrapper::convertToNativeObject<CanvasArrayBuffer>(V8ClassIndex::CANVASARRAYBUFFER,
+                                                                       args[0]->ToObject());
+            if (buf == NULL)
+                return throwError("Could not convert argument 0 to a CanvasArrayBuffer");
+            bool ok;
+            int offset = 0;
+            if (argLen > 1) {
+                offset = toInt32(args[1], ok);
+                if (!ok)
+                    return throwError("Could not convert argument 1 to an integer");
+            }
+            int length = buf->byteLength() - offset;
+            if (argLen > 2) {
+                length = toInt32(args[2], ok);
+                if (!ok)
+                    return throwError("Could not convert argument 2 to an integer");
+            }
+            if (length < 0)
+                return throwError("Length / offset out of range");
+
+            RefPtr<ArrayClass> array = ArrayClass::create(buf, offset, length);
+            if (array == NULL)
+                return throwError("Invalid arguments to new Canvas<T>Array(CanvasArrayBuffer, int, int)");
+            // Transform the holder into a wrapper object for the array.
+            V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+            return toV8(array.release(), args.Holder());
+        }
+
+        int len = 0;
+        v8::Handle<v8::Array> srcArray;
+        if (argLen != 1)
+            return throwError("Wrong number of arguments to new Canvas<T>Array(int / array)");
+
+        if (args[0]->IsInt32()) {
+            len = toInt32(args[0]);
+        } else if (args[0]->IsArray()) {
+            srcArray = v8::Local<v8::Array>::Cast(args[0]);
+            if (srcArray.IsEmpty())
+                return throwError("Could not convert argument 0 to an array");
+            len = srcArray->Length();
+        } else
+            return throwError("Could not convert argument 0 to either an int32 or an array");
+
+        RefPtr<ArrayClass> array = ArrayClass::create(len);
+        if (!srcArray.IsEmpty()) {
+            // Need to copy the incoming array into the newly created CanvasArray.
+            for (int i = 0; i < len; i++) {
+                v8::Local<v8::Value> val = srcArray->Get(v8::Integer::New(i));
+                if (!val->IsNumber()) {
+                    char buf[256];
+                    sprintf(buf, "Could not convert array element %d to a number", i);
+                    return throwError(buf);
+                }
+                array->set(i, val->NumberValue());
+            }
+        }
+
+        // Transform the holder into a wrapper object for the array.
+        V8DOMWrapper::setDOMWrapper(args.Holder(), classIndex, array.get());
+        return toV8(array.release(), args.Holder());
+    }
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
new file mode 100644
index 0000000..503e5e8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasByteArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasByteArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasByteArrayConstructor)
+{
+    INC_STATS("DOM.CanvasByteArray.Contructor");
+
+    return constructCanvasArray<CanvasByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASBYTEARRAY));
+}
+
+// Get the specified value from the byte buffer and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid byte buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasByteArray)
+{
+    INC_STATS("DOM.CanvasByteArray.IndexedPropertyGetter");
+    CanvasByteArray* byteBuffer = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+
+    if ((index < 0) || (index >= byteBuffer->length()))
+        return v8::Undefined();
+    signed char result;
+    if (!byteBuffer->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the byte buffer. Accesses outside the valid byte buffer range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasByteArray)
+{
+    INC_STATS("DOM.CanvasByteArray.IndexedPropertySetter");
+    CanvasByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasByteArray>(V8ClassIndex::CANVASBYTEARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
new file mode 100644
index 0000000..b3c1d62
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasFloatArrayCustom.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasFloatArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasFloatArrayConstructor)
+{
+    INC_STATS("DOM.CanvasFloatArray.Contructor");
+
+    return constructCanvasArray<CanvasFloatArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASFLOATARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasFloatArray)
+{
+    INC_STATS("DOM.CanvasFloatArray.IndexedPropertyGetter");
+    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    float result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasFloatArray)
+{
+    INC_STATS("DOM.CanvasFloatArray.IndexedPropertySetter");
+    CanvasFloatArray* array = V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length()))
+        array->set(index, value->NumberValue());
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
new file mode 100644
index 0000000..6f35db8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasIntArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasIntArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasIntArrayConstructor)
+{
+    INC_STATS("DOM.CanvasIntArray.Contructor");
+
+    return constructCanvasArray<CanvasIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASINTARRAY));
+}
+
+// Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasIntArray)
+{
+    INC_STATS("DOM.CanvasIntArray.IndexedPropertyGetter");
+    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    int result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasIntArray)
+{
+    INC_STATS("DOM.CanvasIntArray.IndexedPropertySetter");
+    CanvasIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
new file mode 100644
index 0000000..c109bb8
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasRenderingContext3DCustom.cpp
@@ -0,0 +1,597 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderingContext3D.h"
+
+#include "ExceptionCode.h"
+
+#include "NotImplemented.h"
+
+#include <wtf/FastMalloc.h>
+
+#include "V8Binding.h"
+#include "V8CanvasArray.h"
+#include "V8CanvasByteArray.h"
+#include "V8CanvasFloatArray.h"
+#include "V8CanvasIntArray.h"
+#include "V8CanvasShortArray.h"
+#include "V8CanvasUnsignedByteArray.h"
+#include "V8CanvasUnsignedIntArray.h"
+#include "V8CanvasUnsignedShortArray.h"
+#include "V8HTMLImageElement.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static float* jsArrayToFloatArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    float* data;
+    if (!tryFastMalloc(len * sizeof(float)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        if (!val->IsNumber()) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = toFloat(val);
+    }
+    return data;
+}
+
+// Allocates new storage via tryFastMalloc.
+// Returns NULL if array failed to convert for any reason.
+static int* jsArrayToIntArray(v8::Handle<v8::Array> array, uint32_t len)
+{
+    // Convert the data element-by-element.
+    int* data;
+    if (!tryFastMalloc(len * sizeof(int)).getValue(data))
+        return 0;
+    for (uint32_t i = 0; i < len; i++) {
+        v8::Local<v8::Value> val = array->Get(v8::Integer::New(i));
+        bool ok;
+        int ival = toInt32(val, ok);
+        if (!ok) {
+            fastFree(data);
+            return 0;
+        }
+        data[i] = ival;
+    }
+    return data;
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferData)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.bufferData()");
+
+    // Forms:
+    // * bufferData(GLenum target, CanvasArray data, GLenum usage);
+    //   - Sets the buffer's data from the given CanvasArray
+    // * bufferData(GLenum target, GLsizeiptr size, GLenum usage);
+    //   - Sets the size of the buffer to the given size in bytes
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int usage = toInt32(args[2], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (args[1]->IsInt32()) {
+        int size = toInt32(args[1]);
+        context->bufferData(target, size, usage);
+    } else if (V8CanvasArray::HasInstance(args[1])) {
+        CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[1]->ToObject());
+        context->bufferData(target, array, usage);
+    } else {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DBufferSubData)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.bufferSubData()");
+
+    // Forms:
+    // * bufferSubData(GLenum target, GLintptr offset, CanvasArray data);
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int offset = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (!V8CanvasArray::HasInstance(args[2])) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, args[2]->ToObject());
+    context->bufferSubData(target, offset, array);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexImage2D)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.texImage2D()");
+
+    // Currently supported forms:
+    // * void texImage2D(in GLenum target, in GLint level,
+    //                   in GLint internalformat,
+    //                   in GLsizei width, in GLsizei height, in GLint border,
+    //                   in GLenum format, in GLenum type, in CanvasArray pixels);
+    // * void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+    //                   [Optional] in GLboolean flipY, [Optional] in GLboolean premultiplyAlpha);
+    if (args.Length() != 3 &&
+        args.Length() != 4 &&
+        args.Length() != 5 &&
+        args.Length() != 9) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int target = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    int level = toInt32(args[1], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    if (args.Length() == 3 ||
+        args.Length() == 4 ||
+        args.Length() == 5) {
+        v8::Handle<v8::Value> arg = args[2];
+        if (V8HTMLImageElement::HasInstance(arg)) {
+            HTMLImageElement* image_element = V8DOMWrapper::convertDOMWrapperToNode<HTMLImageElement>(v8::Handle<v8::Object>::Cast(arg));
+            bool flipY = false;
+            bool premultiplyAlpha = false;
+            if (args.Length() >= 4)
+                flipY = args[3]->BooleanValue();
+            if (args.Length() >= 5)
+                premultiplyAlpha = args[4]->BooleanValue();
+            context->texImage2D(target, level, image_element, flipY, premultiplyAlpha, ec);
+        } else {
+            // FIXME: consider different / better exception type.
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        // Fall through
+    } else if (args.Length() == 9) {
+        int internalformat = toInt32(args[2], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int width = toInt32(args[3], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int height = toInt32(args[4], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int border = toInt32(args[5], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int format = toInt32(args[6], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        int type = toInt32(args[7], ok);
+        if (!ok) {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+        v8::Handle<v8::Value> arg = args[8];
+        if (V8CanvasArray::HasInstance(arg)) {
+            CanvasArray* array = V8DOMWrapper::convertToNativeObject<CanvasArray>(V8ClassIndex::CANVASARRAY, arg->ToObject());
+            // FIXME: must do validation similar to JOGL's to ensure that
+            // the incoming array is of the appropriate length and type
+            context->texImage2D(target,
+                                level,
+                                internalformat,
+                                width,
+                                height,
+                                border,
+                                format,
+                                type,
+                                array,
+                                ec);
+            // Fall through
+        } else {
+            V8Proxy::setDOMException(SYNTAX_ERR);
+            return notHandledByInterceptor();
+        }
+    } else {
+        ASSERT_NOT_REACHED();
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DTexSubImage2D)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.texSubImage2D()");
+
+    // FIXME: implement
+    notImplemented();
+
+    return v8::Undefined();
+}
+
+enum FunctionToCall {
+    kUniform1v, kUniform2v, kUniform3v, kUniform4v,
+    kVertexAttrib1v, kVertexAttrib2v, kVertexAttrib3v, kVertexAttrib4v
+};
+
+static v8::Handle<v8::Value> vertexAttribAndUniformHelperf(const v8::Arguments& args,
+                                                           FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1fv(GLint location, Array data);
+    // * glUniform1fv(GLint location, CanvasFloatArray data);
+    // * glUniform2fv(GLint location, Array data);
+    // * glUniform2fv(GLint location, CanvasFloatArray data);
+    // * glUniform3fv(GLint location, Array data);
+    // * glUniform3fv(GLint location, CanvasFloatArray data);
+    // * glUniform4fv(GLint location, Array data);
+    // * glUniform4fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib1fv(GLint location, Array data);
+    // * glVertexAttrib1fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib2fv(GLint location, Array data);
+    // * glVertexAttrib2fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib3fv(GLint location, Array data);
+    // * glVertexAttrib3fv(GLint location, CanvasFloatArray data);
+    // * glVertexAttrib4fv(GLint location, Array data);
+    // * glVertexAttrib4fv(GLint location, CanvasFloatArray data);
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8CanvasFloatArray::HasInstance(args[1])) {
+        CanvasFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1fv(location, array); break;
+            case kUniform2v: context->uniform2fv(location, array); break;
+            case kUniform3v: context->uniform3fv(location, array); break;
+            case kUniform4v: context->uniform4fv(location, array); break;
+            case kVertexAttrib1v: context->vertexAttrib1fv(location, array); break;
+            case kVertexAttrib2v: context->vertexAttrib2fv(location, array); break;
+            case kVertexAttrib3v: context->vertexAttrib3fv(location, array); break;
+            case kVertexAttrib4v: context->vertexAttrib4fv(location, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1fv(location, data, len); break;
+        case kUniform2v: context->uniform2fv(location, data, len); break;
+        case kUniform3v: context->uniform3fv(location, data, len); break;
+        case kUniform4v: context->uniform4fv(location, data, len); break;
+        case kVertexAttrib1v: context->vertexAttrib1fv(location, data, len); break;
+        case kVertexAttrib2v: context->vertexAttrib2fv(location, data, len); break;
+        case kVertexAttrib3v: context->vertexAttrib3fv(location, data, len); break;
+        case kVertexAttrib4v: context->vertexAttrib4fv(location, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+static v8::Handle<v8::Value> uniformHelperi(const v8::Arguments& args,
+                                            FunctionToCall functionToCall) {
+    // Forms:
+    // * glUniform1iv(GLint location, Array data);
+    // * glUniform1iv(GLint location, CanvasIntArray data);
+    // * glUniform2iv(GLint location, Array data);
+    // * glUniform2iv(GLint location, CanvasIntArray data);
+    // * glUniform3iv(GLint location, Array data);
+    // * glUniform3iv(GLint location, CanvasIntArray data);
+    // * glUniform4iv(GLint location, Array data);
+    // * glUniform4iv(GLint location, CanvasIntArray data);
+
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    if (V8CanvasIntArray::HasInstance(args[1])) {
+        CanvasIntArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasIntArray>(V8ClassIndex::CANVASINTARRAY, args[1]->ToObject());
+        ASSERT(array != NULL);
+        switch (functionToCall) {
+            case kUniform1v: context->uniform1iv(location, array); break;
+            case kUniform2v: context->uniform2iv(location, array); break;
+            case kUniform3v: context->uniform3iv(location, array); break;
+            case kUniform4v: context->uniform4iv(location, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[1]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    int* data = jsArrayToIntArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (functionToCall) {
+        case kUniform1v: context->uniform1iv(location, data, len); break;
+        case kUniform2v: context->uniform2iv(location, data, len); break;
+        case kUniform3v: context->uniform3iv(location, data, len); break;
+        case kUniform4v: context->uniform4iv(location, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform1fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform1iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform1iv()");
+    return uniformHelperi(args, kUniform1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform2fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform2iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform2iv()");
+    return uniformHelperi(args, kUniform2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform3fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform3iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform3iv()");
+    return uniformHelperi(args, kUniform3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform4fv()");
+    return vertexAttribAndUniformHelperf(args, kUniform4v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniform4iv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniform4iv()");
+    return uniformHelperi(args, kUniform4v);
+}
+
+static v8::Handle<v8::Value> uniformMatrixHelper(const v8::Arguments& args,
+                                                 int matrixSize)
+{
+    // Forms:
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix2fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix3fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, Array data);
+    // * glUniformMatrix4fv(GLint location, GLboolean transpose, CanvasFloatArray data);
+    //
+    // FIXME: need to change to accept CanvasFloatArray as well.
+    if (args.Length() != 3) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    CanvasRenderingContext3D* context =
+        V8DOMWrapper::convertDOMWrapperToNative<CanvasRenderingContext3D>(args.Holder());
+    bool ok;
+    int location = toInt32(args[0], ok);
+    if (!ok) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    bool transpose = args[1]->BooleanValue();
+    if (V8CanvasFloatArray::HasInstance(args[2])) {
+        CanvasFloatArray* array = 
+            V8DOMWrapper::convertToNativeObject<CanvasFloatArray>(V8ClassIndex::CANVASFLOATARRAY, args[2]->ToObject());
+        ASSERT(array != NULL);
+        switch (matrixSize) {
+            case 2: context->uniformMatrix2fv(location, transpose, array); break;
+            case 3: context->uniformMatrix3fv(location, transpose, array); break;
+            case 4: context->uniformMatrix4fv(location, transpose, array); break;
+            default: ASSERT_NOT_REACHED(); break;
+        }
+        return v8::Undefined();
+    }
+
+    v8::Handle<v8::Array> array =
+      v8::Local<v8::Array>::Cast(args[2]);
+    if (array.IsEmpty()) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    uint32_t len = array->Length();
+    float* data = jsArrayToFloatArray(array, len);
+    if (!data) {
+        // FIXME: consider different / better exception type.
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+    switch (matrixSize) {
+        case 2: context->uniformMatrix2fv(location, transpose, data, len); break;
+        case 3: context->uniformMatrix3fv(location, transpose, data, len); break;
+        case 4: context->uniformMatrix4fv(location, transpose, data, len); break;
+        default: ASSERT_NOT_REACHED(); break;
+    }
+    fastFree(data);
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix2fv()");
+    return uniformMatrixHelper(args, 2);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix3fv()");
+    return uniformMatrixHelper(args, 3);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DUniformMatrix4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.uniformMatrix4fv()");
+    return uniformMatrixHelper(args, 4);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib1fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib1fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib1v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib2fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib2fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib2v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib3fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib3fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib3v);
+}
+
+CALLBACK_FUNC_DECL(CanvasRenderingContext3DVertexAttrib4fv)
+{
+    INC_STATS("DOM.CanvasRenderingContext3D.vertexAttrib4fv()");
+    return vertexAttribAndUniformHelperf(args, kVertexAttrib4v);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
new file mode 100644
index 0000000..8b83022
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasShortArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasShortArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasShortArrayConstructor)
+{
+    INC_STATS("DOM.CanvasShortArray.Contructor");
+
+    return constructCanvasArray<CanvasShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASSHORTARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasShortArray)
+{
+    INC_STATS("DOM.CanvasShortArray.IndexedPropertyGetter");
+    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    short result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasShortArray)
+{
+    INC_STATS("DOM.CanvasShortArray.IndexedPropertySetter");
+    CanvasShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasShortArray>(V8ClassIndex::CANVASSHORTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
new file mode 100644
index 0000000..62ab880
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedByteArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedByteArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedByteArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedByteArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertyGetter");
+    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned char result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray)
+{
+    INC_STATS("DOM.CanvasUnsignedByteArray.IndexedPropertySetter");
+    CanvasUnsignedByteArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedByteArray>(V8ClassIndex::CANVASUNSIGNEDBYTEARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
new file mode 100644
index 0000000..94ec7d0
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedIntArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedIntArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedIntArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedIntArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDINTARRAY));
+}
+
+// Get the specified value from the integer array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid pixel buffer range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertyGetter");
+    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned int result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the integer array. Accesses outside the valid integer array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray)
+{
+    INC_STATS("DOM.CanvasUnsignedIntArray.IndexedPropertySetter");
+    CanvasUnsignedIntArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedIntArray>(V8ClassIndex::CANVASUNSIGNEDINTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp b/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
new file mode 100644
index 0000000..eeef82c
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8CanvasUnsignedShortArrayCustom.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedShortArray.h"
+
+#include "V8Binding.h"
+#include "V8CanvasArrayBuffer.h"
+#include "V8CanvasArrayCustom.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(CanvasUnsignedShortArrayConstructor)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.Contructor");
+
+    return constructCanvasArray<CanvasUnsignedShortArray>(args, V8ClassIndex::ToInt(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY));
+}
+
+// Get the specified value from the array and return it wrapped as a JavaScript Number object to V8. Accesses outside the valid array range return "undefined".
+INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertyGetter");
+    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+
+    if ((index < 0) || (index >= array->length()))
+        return v8::Undefined();
+    unsigned short result;
+    if (!array->get(index, result))
+        return v8::Undefined();
+    return v8::Number::New(result);
+}
+
+// Set the specified value in the array. Accesses outside the valid array range are silently ignored.
+INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray)
+{
+    INC_STATS("DOM.CanvasUnsignedShortArray.IndexedPropertySetter");
+    CanvasUnsignedShortArray* array = V8DOMWrapper::convertToNativeObject<CanvasUnsignedShortArray>(V8ClassIndex::CANVASUNSIGNEDSHORTARRAY, info.Holder());
+
+    if ((index >= 0) && (index < array->length())) {
+        if (!value->IsNumber())
+            return throwError("Could not convert value argument to a number");
+        array->set(index, value->NumberValue());
+    }
+    return value;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/bindings/v8/custom/V8CustomBinding.h b/WebCore/bindings/v8/custom/V8CustomBinding.h
index 22b4a94..3f381be 100644
--- a/WebCore/bindings/v8/custom/V8CustomBinding.h
+++ b/WebCore/bindings/v8/custom/V8CustomBinding.h
@@ -135,6 +135,16 @@ namespace WebCore {
         static const int kAbstractWorkerInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        static const int kNotificationRequestCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kNotificationInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
+#if ENABLE(SVG)
+        static const int kSVGElementInstanceEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kSVGElementInstanceInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
         static const int kDOMWindowConsoleIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kDOMWindowHistoryIndex = kDefaultWrapperInternalFieldCount + 1;
         static const int kDOMWindowLocationbarIndex = kDefaultWrapperInternalFieldCount + 2;
@@ -148,7 +158,8 @@ namespace WebCore {
         static const int kDOMWindowToolbarIndex = kDefaultWrapperInternalFieldCount + 10;
         static const int kDOMWindowLocationIndex = kDefaultWrapperInternalFieldCount + 11;
         static const int kDOMWindowDOMSelectionIndex = kDefaultWrapperInternalFieldCount + 12;
-        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 13;
+        static const int kDOMWindowEventListenerCacheIndex = kDefaultWrapperInternalFieldCount + 13;
+        static const int kDOMWindowInternalFieldCount = kDefaultWrapperInternalFieldCount + 14;
 
         static const int kStyleSheetOwnerNodeIndex = kDefaultWrapperInternalFieldCount + 0;
         static const int kStyleSheetInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
@@ -158,6 +169,11 @@ namespace WebCore {
         static const int kDOMApplicationCacheFieldCount = kDefaultWrapperInternalFieldCount + 1;
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+        static const int kWebSocketCacheIndex = kDefaultWrapperInternalFieldCount + 0;
+        static const int kWebSocketInternalFieldCount = kDefaultWrapperInternalFieldCount + 1;
+#endif
+
 #define DECLARE_PROPERTY_ACCESSOR_GETTER(NAME) \
     static v8::Handle<v8::Value> v8##NAME##AccessorGetter( \
         v8::Local<v8::String> name, const v8::AccessorInfo& info)
@@ -218,11 +234,18 @@ namespace WebCore {
 
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DStrokeStyle);
         DECLARE_PROPERTY_ACCESSOR(CanvasRenderingContext2DFillStyle);
-        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowEvent);
+        DECLARE_PROPERTY_ACCESSOR(DOMWindowEvent);
         DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowCrypto);
         DECLARE_PROPERTY_ACCESSOR_SETTER(DOMWindowLocation);
         DECLARE_PROPERTY_ACCESSOR_SETTER(DOMWindowOpener);
 
+#if ENABLE(VIDEO)
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowAudio);
+#endif
+
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowImage);
+        DECLARE_PROPERTY_ACCESSOR_GETTER(DOMWindowOption);
+
         DECLARE_PROPERTY_ACCESSOR(DocumentLocation);
         DECLARE_PROPERTY_ACCESSOR(DocumentImplementation);
         DECLARE_PROPERTY_ACCESSOR_GETTER(EventSrcElement);
@@ -231,7 +254,6 @@ namespace WebCore {
         DECLARE_PROPERTY_ACCESSOR_GETTER(EventClipboardData);
 
         DECLARE_PROPERTY_ACCESSOR(DOMWindowEventHandler);
-        DECLARE_PROPERTY_ACCESSOR(NodeEventHandler);
 
         DECLARE_CALLBACK(HTMLCanvasElementGetContext);
 
@@ -319,6 +341,38 @@ namespace WebCore {
         DECLARE_CALLBACK(CanvasRenderingContext2DStrokeText);
         DECLARE_CALLBACK(CanvasRenderingContext2DPutImageData);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_CALLBACK(CanvasRenderingContext3DBufferData);
+        DECLARE_CALLBACK(CanvasRenderingContext3DBufferSubData);
+        DECLARE_CALLBACK(CanvasRenderingContext3DSizeof);
+        DECLARE_CALLBACK(CanvasRenderingContext3DTexImage2D);
+        DECLARE_CALLBACK(CanvasRenderingContext3DTexSubImage2D);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform1iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform2iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform3iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniform4iv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DUniformMatrix4fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib1fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib2fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib3fv);
+        DECLARE_CALLBACK(CanvasRenderingContext3DVertexAttrib4fv);
+
+        DECLARE_CALLBACK(CanvasArrayBufferConstructor);
+        DECLARE_CALLBACK(CanvasByteArrayConstructor);
+        DECLARE_CALLBACK(CanvasFloatArrayConstructor);
+        DECLARE_CALLBACK(CanvasIntArrayConstructor);
+        DECLARE_CALLBACK(CanvasShortArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedByteArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedIntArrayConstructor);
+        DECLARE_CALLBACK(CanvasUnsignedShortArrayConstructor);
+#endif
+
         DECLARE_PROPERTY_ACCESSOR_GETTER(ClipboardTypes);
         DECLARE_CALLBACK(ClipboardClearData);
         DECLARE_CALLBACK(ClipboardGetData);
@@ -400,14 +454,22 @@ namespace WebCore {
         DECLARE_CALLBACK(InspectorBackendAddSourceToFrame);
         DECLARE_CALLBACK(InspectorBackendSearch);
         DECLARE_CALLBACK(InspectorBackendSetting);
+        DECLARE_CALLBACK(InspectorBackendDatabaseForId);
         DECLARE_CALLBACK(InspectorBackendInspectedWindow);
         DECLARE_CALLBACK(InspectorBackendSetSetting);
         DECLARE_CALLBACK(InspectorBackendCurrentCallFrame);
         DECLARE_CALLBACK(InspectorBackendDebuggerEnabled);
         DECLARE_CALLBACK(InspectorBackendPauseOnExceptions);
         DECLARE_CALLBACK(InspectorBackendProfilerEnabled);
+        DECLARE_CALLBACK(InspectorBackendNodeForId);
+        DECLARE_CALLBACK(InspectorBackendWrapObject);
+        DECLARE_CALLBACK(InspectorBackendUnwrapObject);
+        DECLARE_CALLBACK(InspectorBackendPushNodePathToFrontend);
 #if ENABLE(DATABASE)
-        DECLARE_CALLBACK(InspectorBackendDatabaseTableNames);
+        DECLARE_CALLBACK(InspectorBackendSelectDatabase);
+#endif
+#if ENABLE(DOM_STORAGE)
+        DECLARE_CALLBACK(InspectorBackendSelectDOMStorage);
 #endif
         DECLARE_CALLBACK(InspectorBackendWrapCallback);
 
@@ -445,21 +507,52 @@ namespace WebCore {
         DECLARE_INDEXED_PROPERTY_SETTER(HTMLSelectElementCollection);
         DECLARE_NAMED_PROPERTY_GETTER(HTMLCollection);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasByteArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasFloatArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasFloatArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasIntArray);
+#endif
+
         DECLARE_INDEXED_PROPERTY_GETTER(CanvasPixelArray);
         DECLARE_INDEXED_PROPERTY_SETTER(CanvasPixelArray);
 
+#if ENABLE(3D_CANVAS)
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasShortArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedByteArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedByteArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedIntArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedIntArray);
+
+        DECLARE_INDEXED_PROPERTY_GETTER(CanvasUnsignedShortArray);
+        DECLARE_INDEXED_PROPERTY_SETTER(CanvasUnsignedShortArray);
+#endif
+
+        DECLARE_PROPERTY_ACCESSOR_GETTER(MessageEventPorts);
+        DECLARE_CALLBACK(MessageEventInitMessageEvent);
+
         DECLARE_PROPERTY_ACCESSOR(MessagePortOnmessage);
         DECLARE_PROPERTY_ACCESSOR(MessagePortOnclose);
-        DECLARE_CALLBACK(MessagePortStartConversation);
         DECLARE_CALLBACK(MessagePortAddEventListener);
+        DECLARE_CALLBACK(MessagePortPostMessage);
         DECLARE_CALLBACK(MessagePortRemoveEventListener);
+        DECLARE_CALLBACK(MessagePortStartConversation);
 
         DECLARE_CALLBACK(DatabaseChangeVersion);
         DECLARE_CALLBACK(DatabaseTransaction);
+        DECLARE_CALLBACK(DatabaseReadTransaction);
         DECLARE_CALLBACK(SQLTransactionExecuteSql);
         DECLARE_CALLBACK(SQLResultSetRowListItem);
 
         DECLARE_INDEXED_PROPERTY_GETTER(ClientRectList);
+        DECLARE_INDEXED_PROPERTY_GETTER(FileList);
   
 #if ENABLE(DATAGRID)
         DECLARE_PROPERTY_ACCESSOR(HTMLDataGridElementDataSource);
@@ -496,8 +589,10 @@ namespace WebCore {
         DECLARE_CALLBACK(AbstractWorkerRemoveEventListener);
 
         DECLARE_PROPERTY_ACCESSOR(DedicatedWorkerContextOnmessage);
+        DECLARE_CALLBACK(DedicatedWorkerContextPostMessage);
 
         DECLARE_PROPERTY_ACCESSOR(WorkerOnmessage);
+        DECLARE_CALLBACK(WorkerPostMessage);
         DECLARE_CALLBACK(WorkerConstructor);
 
         DECLARE_PROPERTY_ACCESSOR_GETTER(WorkerContextSelf);
@@ -509,7 +604,17 @@ namespace WebCore {
         DECLARE_CALLBACK(WorkerContextClearInterval);
         DECLARE_CALLBACK(WorkerContextAddEventListener);
         DECLARE_CALLBACK(WorkerContextRemoveEventListener);
-#endif
+#endif // ENABLE(WORKERS)
+
+#if ENABLE(NOTIFICATIONS)
+        DECLARE_CALLBACK(NotificationCenterRequestPermission);
+        DECLARE_CALLBACK(NotificationCenterCreateNotification);
+        DECLARE_CALLBACK(NotificationCenterCreateHTMLNotification);
+
+        DECLARE_CALLBACK(NotificationAddEventListener);
+        DECLARE_CALLBACK(NotificationRemoveEventListener);
+        DECLARE_PROPERTY_ACCESSOR(NotificationEventHandler);
+#endif // ENABLE(NOTIFICATIONS)
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         DECLARE_PROPERTY_ACCESSOR(DOMApplicationCacheEventHandler);
@@ -521,12 +626,23 @@ namespace WebCore {
         DECLARE_CALLBACK(SharedWorkerConstructor);
 #endif
 
+<<<<<<< HEAD:WebCore/bindings/v8/custom/V8CustomBinding.h
         DECLARE_CALLBACK(GeolocationGetCurrentPosition);
         DECLARE_CALLBACK(GeolocationWatchPosition);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesAltitude);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesAltitudeAccuracy);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesHeading);
         DECLARE_PROPERTY_ACCESSOR_GETTER(CoordinatesSpeed);
+=======
+#if ENABLE(WEB_SOCKETS)
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnopen);
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnmessage);
+        DECLARE_PROPERTY_ACCESSOR(WebSocketOnclose);
+        DECLARE_CALLBACK(WebSocketConstructor);
+        DECLARE_CALLBACK(WebSocketSend);
+        DECLARE_CALLBACK(WebSocketClose);
+#endif
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/custom/V8CustomBinding.h
 
 #undef DECLARE_INDEXED_ACCESS_CHECK
 #undef DECLARE_NAMED_ACCESS_CHECK
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
index 305da8d..91abecd 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.cpp
@@ -35,37 +35,25 @@
 
 namespace WebCore {
 
-V8EventListener::V8EventListener(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
-    : V8AbstractEventListener(frame, isAttribute)
+V8EventListener::V8EventListener(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
+    : V8AbstractEventListener(frame, guard, isAttribute)
 {
-    m_listener = v8::Persistent<v8::Object>::New(listener);
-#ifndef NDEBUG
-    V8GCController::registerGlobalHandle(EVENT_LISTENER, this, m_listener);
-#endif
-}
-
-V8EventListener::~V8EventListener()
-{
-    if (m_frame) {
-        V8Proxy* proxy = V8Proxy::retrieve(m_frame);
-        if (proxy)
-            proxy->eventListeners()->remove(this);
-    }
-
-    disposeListenerObject();
+    setListenerObject(listener);
 }
 
 v8::Local<v8::Function> V8EventListener::getListenerFunction()
 {
+    v8::Local<v8::Object> listener = getListenerObject();
+
     // Has the listener been disposed?
-    if (m_listener.IsEmpty())
+    if (listener.IsEmpty())
         return v8::Local<v8::Function>();
 
-    if (m_listener->IsFunction())
-        return v8::Local<v8::Function>::New(v8::Persistent<v8::Function>::Cast(m_listener));
+    if (listener->IsFunction())
+        return v8::Local<v8::Function>::Cast(listener);
 
-    if (m_listener->IsObject()) {
-        v8::Local<v8::Value> property = m_listener->Get(v8::String::NewSymbol("handleEvent"));
+    if (listener->IsObject()) {
+        v8::Local<v8::Value> property = listener->Get(v8::String::NewSymbol("handleEvent"));
         if (property->IsFunction())
             return v8::Local<v8::Function>::Cast(property);
     }
@@ -73,16 +61,16 @@ v8::Local<v8::Function> V8EventListener::getListenerFunction()
     return v8::Local<v8::Function>();
 }
 
-v8::Local<v8::Value> V8EventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event, bool isWindowEvent)
+v8::Local<v8::Value> V8EventListener::callListenerFunction(v8::Handle<v8::Value> jsEvent, Event* event)
 {
     v8::Local<v8::Function> handlerFunction = getListenerFunction();
-    v8::Local<v8::Object> receiver = getReceiverObject(event, isWindowEvent);
+    v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
 
-    V8Proxy* proxy = V8Proxy::retrieve(m_frame);
+    V8Proxy* proxy = V8Proxy::retrieve(frame());
     if (!proxy)
         return v8::Local<v8::Value>();
     return proxy->callFunction(handlerFunction, receiver, 1, parameters);
diff --git a/WebCore/bindings/v8/custom/V8CustomEventListener.h b/WebCore/bindings/v8/custom/V8CustomEventListener.h
index 20adf99..e34f24f 100644
--- a/WebCore/bindings/v8/custom/V8CustomEventListener.h
+++ b/WebCore/bindings/v8/custom/V8CustomEventListener.h
@@ -44,23 +44,19 @@ namespace WebCore {
     // that can handle the event.
     class V8EventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8EventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isAttribute)
+        static PassRefPtr<V8EventListener> create(Frame* frame, PassRefPtr<V8ListenerGuard> guard, v8::Local<v8::Object> listener, bool isAttribute)
         {
-            return adoptRef(new V8EventListener(frame, listener, isAttribute));
+            return adoptRef(new V8EventListener(frame, guard, listener, isAttribute));
         }
 
-        // Detach the listener from its owner frame.
-        void disconnectFrame() { m_frame = 0; }
-
     protected:
-        V8EventListener(Frame*, v8::Local<v8::Object> listener, bool isAttribute);
-        virtual ~V8EventListener();
+        V8EventListener(Frame*, PassRefPtr<V8ListenerGuard>, v8::Local<v8::Object> listener, bool isAttribute);
+
         v8::Local<v8::Function> getListenerFunction();
 
     private:
-        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*, bool isWindowEvent);
-        virtual bool virtualisAttribute() const { return m_isAttribute; }
-    };
+        virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsEvent, Event*);
+     };
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp b/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
index 7a3bfe6..1b81257 100644
--- a/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
@@ -37,13 +37,13 @@
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Document.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
 static const bool kFindOnly = true;
 static const bool kFindOrCreate = false;
 
@@ -101,13 +101,15 @@ ACCESSOR_SETTER(DOMApplicationCacheEventHandler)
     }
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/bindings/v8/custom/V8DOMApplicationCacheCustom.cpp
 // Handles appcache.addEventListner(name, func, capture) method calls
 CALLBACK_FUNC_DECL(DOMApplicationCacheAddEventListener)
 {
     INC_STATS("DOMApplicationCache.addEventListener()");
     DOMApplicationCache* appcache = V8DOMWrapper::convertToNativeObject<DOMApplicationCache>(V8ClassIndex::DOMAPPLICATIONCACHE, args.Holder());
 
-    RefPtr<EventListener> listener = argumentToEventListener(appcache, args[1], kFindOrCreate);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(appcache, args[1], false, ListenerFindOrCreate);
     if (listener) {
         createHiddenDependency(args.Holder(), args[1], V8Custom::kDOMApplicationCacheCacheIndex);
         String eventType = toWebCoreString(args[0]);
@@ -123,7 +125,7 @@ CALLBACK_FUNC_DECL(DOMApplicationCacheRemoveEventListener)
     INC_STATS("DOMApplicationCache.removeEventListener()");
     DOMApplicationCache* appcache = V8DOMWrapper::convertToNativeObject<DOMApplicationCache>(V8ClassIndex::DOMAPPLICATIONCACHE, args.Holder());
 
-    RefPtr<EventListener> listener = argumentToEventListener(appcache, args[1], kFindOnly);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(appcache, args[1], false, ListenerFindOnly);
     if (listener) {
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kDOMApplicationCacheCacheIndex);
         String eventType = toWebCoreString(args[0]);
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 7d0b9e6..0dc5a96 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -34,6 +34,7 @@
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 
@@ -48,6 +49,7 @@
 #include "PlatformScreen.h"
 #include "ScheduledAction.h"
 #include "ScriptSourceCode.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
 #include "WindowFeatures.h"
 
@@ -64,32 +66,44 @@ v8::Handle<v8::Value> V8Custom::WindowSetTimeoutImpl(const v8::Arguments& args,
     if (argumentCount < 1)
         return v8::Undefined();
 
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
-
-    if (!imp->frame())
-        return v8::Undefined();
-
-    if (!V8Proxy::canAccessFrame(imp->frame(), true))
-        return v8::Undefined();
+    v8::Handle<v8::Value> function = args[0];
 
-    ScriptExecutionContext* scriptContext = static_cast<ScriptExecutionContext*>(imp->frame()->document());
+    WebCore::String functionString;
+    if (!function->IsFunction()) {
+        if (function->IsString())
+            functionString = toWebCoreString(function);
+        else {
+            v8::Handle<v8::Value> v8String = function->ToString();
 
-    v8::Handle<v8::Value> function = args[0];
+            // Bail out if string conversion failed. 
+            if (v8String.IsEmpty()) 
+                return v8::Undefined(); 
 
-    int32_t timeout = 0;
-    if (argumentCount >= 2) 
-        timeout = args[1]->Int32Value();
+            functionString = toWebCoreString(v8String);
+        }
 
-    int id;
-    if (function->IsString()) {
         // Don't allow setting timeouts to run empty functions!
         // (Bug 1009597)
-        WebCore::String functionString = toWebCoreString(function);
         if (functionString.length() == 0)
             return v8::Undefined();
+    }
+
+    int32_t timeout = 0;
+    if (argumentCount >= 2)
+        timeout = args[1]->Int32Value();
+
+    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
+
+    if (!V8Proxy::canAccessFrame(imp->frame(), true))
+        return v8::Undefined();
 
-        id = DOMTimer::install(scriptContext, new ScheduledAction(functionString), timeout, singleShot);
-    } else if (function->IsFunction()) {
+    ScriptExecutionContext* scriptContext = static_cast<ScriptExecutionContext*>(imp->document());
+
+    if (!scriptContext)
+        return v8::Undefined();
+
+    int id;
+    if (function->IsFunction()) {
         int paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
         v8::Local<v8::Value>* params = 0;
         if (paramCount > 0) {
@@ -100,14 +114,14 @@ v8::Handle<v8::Value> V8Custom::WindowSetTimeoutImpl(const v8::Arguments& args,
         }
 
         // params is passed to action, and released in action's destructor
-        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+        ScheduledAction* action = new ScheduledAction(V8Proxy::context(imp->frame()), v8::Handle<v8::Function>::Cast(function), paramCount, params);
 
         delete[] params;
 
         id = DOMTimer::install(scriptContext, action, timeout, singleShot);
-    } else
-        // FIXME(fqian): what's the right return value if failed.
-        return v8::Undefined();
+    } else {
+        id = DOMTimer::install(scriptContext, new ScheduledAction(V8Proxy::context(imp->frame()), functionString), timeout, singleShot);
+    }
 
     return v8::Integer::New(id);
 }
@@ -145,14 +159,37 @@ static v8::Handle<v8::Value> convertBase64(const String& str, bool encode)
 
 ACCESSOR_GETTER(DOMWindowEvent)
 {
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return v8::Undefined();
+
+    Frame* frame = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder)->frame();
+    if (!V8Proxy::canAccessFrame(frame, true))
+        return v8::Undefined();
+
+    v8::Local<v8::Context> context = V8Proxy::context(frame);
     v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
-    v8::Local<v8::Context> context = v8::Context::GetCurrent();
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
     if (jsEvent.IsEmpty())
         return v8::Undefined();
     return jsEvent;
 }
 
+ACCESSOR_SETTER(DOMWindowEvent)
+{
+    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
+    if (holder.IsEmpty())
+        return;
+
+    Frame* frame = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder)->frame();
+    if (!V8Proxy::canAccessFrame(frame, true))
+        return;
+
+    v8::Local<v8::Context> context = V8Proxy::context(frame);
+    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    context->Global()->SetHiddenValue(eventSymbol, value);
+}
+
 ACCESSOR_GETTER(DOMWindowCrypto)
 {
     // FIXME: Implement me.
@@ -161,11 +198,7 @@ ACCESSOR_GETTER(DOMWindowCrypto)
 
 ACCESSOR_SETTER(DOMWindowLocation)
 {
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return;
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     WindowSetLocation(imp, toWebCoreString(value));
 }
 
@@ -194,18 +227,42 @@ ACCESSOR_SETTER(DOMWindowOpener)
     info.This()->Set(name, value);
 }
 
+#if ENABLE(VIDEO)
+
+ACCESSOR_GETTER(DOMWindowAudio)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::AUDIO, window);
+}
+
+#endif
+
+ACCESSOR_GETTER(DOMWindowImage)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::IMAGE, window);
+}
+
+ACCESSOR_GETTER(DOMWindowOption)
+{
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    return V8DOMWrapper::getConstructor(V8ClassIndex::OPTION, window);
+}
+
 CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
 {
     INC_STATS("DOM.DOMWindow.addEventListener()");
+
+    String eventType = toWebCoreString(args[0]);
+    bool useCapture = args[2]->BooleanValue();
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return v8::Undefined();
 
-    if (!imp->frame())
-        return v8::Undefined();  // DOMWindow could be disconnected from the frame
-  
-    Document* doc = imp->frame()->document();
+    Document* doc = imp->document();
+
     if (!doc)
         return v8::Undefined();
 
@@ -214,12 +271,11 @@ CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
     if (!proxy)
         return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(proxy, args[1], false, ListenerFindOrCreate);
 
     if (listener) {
-        String eventType = toWebCoreString(args[0]);
-        bool useCapture = args[2]->BooleanValue();
         imp->addEventListener(eventType, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kDOMWindowEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -229,15 +285,17 @@ CALLBACK_FUNC_DECL(DOMWindowAddEventListener)
 CALLBACK_FUNC_DECL(DOMWindowRemoveEventListener)
 {
     INC_STATS("DOM.DOMWindow.removeEventListener()");
+
+    String eventType = toWebCoreString(args[0]);
+    bool useCapture = args[2]->BooleanValue();
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return v8::Undefined();
 
-    if (!imp->frame())
-        return v8::Undefined();
+    Document* doc = imp->document();
 
-    Document* doc = imp->frame()->document();
     if (!doc)
         return v8::Undefined();
 
@@ -245,12 +303,11 @@ CALLBACK_FUNC_DECL(DOMWindowRemoveEventListener)
     if (!proxy)
         return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->eventListeners()->findWrapper(args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(proxy, args[1], false, ListenerFindOnly);
 
     if (listener) {
-        String eventType = toWebCoreString(args[0]);
-        bool useCapture = args[2]->BooleanValue();
         imp->removeEventListener(eventType, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kDOMWindowEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -265,8 +322,8 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
     ASSERT(source->frame());
 
     v8::TryCatch tryCatch;
-    String message = toWebCoreString(args[0]);
-    MessagePort* port = 0;
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
     String targetOrigin;
 
     // This function has variable arguments and can either be:
@@ -274,8 +331,8 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
     // or
     //   postMessage(message, targetOrigin);
     if (args.Length() > 2) {
-        if (V8DOMWrapper::isWrapperOfType(args[1], V8ClassIndex::MESSAGEPORT))
-            port = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, v8::Handle<v8::Object>::Cast(args[1]));
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
         targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
     } else {
         targetOrigin = toWebCoreStringWithNullOrUndefinedCheck(args[1]);
@@ -285,16 +342,18 @@ CALLBACK_FUNC_DECL(DOMWindowPostMessage)
         return v8::Undefined();
 
     ExceptionCode ec = 0;
-    window->postMessage(message, port, targetOrigin, source, ec);
-    if (ec)
-        V8Proxy::setDOMException(ec);
-
-    return v8::Undefined();
+    window->postMessage(message.release(), &portArray, targetOrigin, source, ec);
+    return throwError(ec);
 }
 
 CALLBACK_FUNC_DECL(DOMWindowAtob)
 {
     INC_STATS("DOM.DOMWindow.atob()");
+
+    if (args[0]->IsNull())
+        return v8String("");
+    String str = toWebCoreString(args[0]);
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
@@ -303,16 +362,17 @@ CALLBACK_FUNC_DECL(DOMWindowAtob)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
-    if (args[0]->IsNull())
-        return v8String("");
-
-    String str = toWebCoreString(args[0]);
     return convertBase64(str, false);
 }
 
 CALLBACK_FUNC_DECL(DOMWindowBtoa)
 {
     INC_STATS("DOM.DOMWindow.btoa()");
+
+    if (args[0]->IsNull())
+        return v8String("");
+    String str = toWebCoreString(args[0]);
+
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
 
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
@@ -321,10 +381,6 @@ CALLBACK_FUNC_DECL(DOMWindowBtoa)
     if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
-    if (args[0]->IsNull())
-        return v8String("");
-
-    String str = toWebCoreString(args[0]);
     return convertBase64(str, true);
 }
 
@@ -335,7 +391,10 @@ CALLBACK_FUNC_DECL(DOMWindowBtoa)
 CALLBACK_FUNC_DECL(DOMWindowToString)
 {
     INC_STATS("DOM.DOMWindow.toString()");
-    return args.This()->ObjectProtoToString();
+    v8::Handle<v8::Object> domWrapper = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, args.This());
+    if (domWrapper.IsEmpty())
+        return args.This()->ObjectProtoToString();
+    return domWrapper->ObjectProtoToString();
 }
 
 CALLBACK_FUNC_DECL(DOMWindowNOP)
@@ -344,84 +403,6 @@ CALLBACK_FUNC_DECL(DOMWindowNOP)
     return v8::Undefined();
 }
 
-static String eventNameFromAttributeName(const String& name)
-{
-    ASSERT(name.startsWith("on"));
-    String eventType = name.substring(2);
-
-    if (eventType.startsWith("w")) {
-        switch(eventType[eventType.length() - 1]) {
-        case 't':
-            eventType = "webkitAnimationStart";
-            break;
-        case 'n':
-            eventType = "webkitAnimationIteration";
-            break;
-        case 'd':
-            ASSERT(eventType.length() > 7);
-            if (eventType[7] == 'a')
-                eventType = "webkitAnimationEnd";
-            else
-                eventType = "webkitTransitionEnd";
-            break;
-        }
-    }
-
-    return eventType;
-}
-
-ACCESSOR_SETTER(DOMWindowEventHandler)
-{
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return;
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
-    if (!imp->frame())
-        return;
-
-    Document* doc = imp->frame()->document();
-    if (!doc)
-        return;
-
-    String key = toWebCoreString(name);
-    String eventType = eventNameFromAttributeName(key);
-
-    if (value->IsNull()) {
-        // Clear the event listener
-        imp->clearAttributeEventListener(eventType);
-    } else {
-        V8Proxy* proxy = V8Proxy::retrieve(imp->frame());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), value, true);
-        if (listener)
-            imp->setAttributeEventListener(eventType, listener);
-    }
-}
-
-ACCESSOR_GETTER(DOMWindowEventHandler)
-{
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return v8::Undefined();
-
-    DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
-    if (!imp->frame())
-        return v8::Undefined();
-
-    Document* doc = imp->frame()->document();
-    if (!doc)
-        return v8::Undefined();
-
-    String key = toWebCoreString(name);
-    String eventType = eventNameFromAttributeName(key);
-
-    EventListener* listener = imp->getAttributeEventListener(eventType);
-    return V8DOMWrapper::convertEventListenerToV8Object(listener);
-}
-
 static bool canShowModalDialogNow(const Frame* frame)
 {
     // A frame can out live its page. See bug 1219613.
@@ -512,7 +493,7 @@ static Frame* createWindow(Frame* callingFrame,
         return 0;
 
     newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
+    newFrame->page()->setOpenedByDOM();
 
     // Set dialog arguments on the global object of the new frame.
     if (!dialogArgs.IsEmpty()) {
@@ -525,13 +506,13 @@ static Frame* createWindow(Frame* callingFrame,
 
     if (protocolIsJavaScript(url) || ScriptController::isSafeScript(newFrame)) {
         KURL completedUrl =
-            url.isEmpty() ? KURL("") : completeURL(url);
+            url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(url);
         bool userGesture = processingUserGesture();
 
         if (created)
             newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
         else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
+            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, userGesture);
     }
 
     return newFrame;
@@ -542,11 +523,16 @@ static Frame* createWindow(Frame* callingFrame,
 CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
 {
     INC_STATS("DOM.DOMWindow.showModalDialog()");
+
+    String url = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
+    v8::Local<v8::Value> dialogArgs = args[1];
+    String featureArgs = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
+
     DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(
         V8ClassIndex::DOMWINDOW, args.Holder());
     Frame* frame = window->frame();
 
-    if (!frame || !V8Proxy::canAccessFrame(frame, true)) 
+    if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
     Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
@@ -560,10 +546,6 @@ CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
     if (!canShowModalDialogNow(frame) || !allowPopUp())
         return v8::Undefined();
 
-    String url = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
-    v8::Local<v8::Value> dialogArgs = args[1];
-    String featureArgs = toWebCoreStringWithNullOrUndefinedCheck(args[2]);
-
     const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
 
     const bool trusted = false;
@@ -631,10 +613,14 @@ CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)
 CALLBACK_FUNC_DECL(DOMWindowOpen)
 {
     INC_STATS("DOM.DOMWindow.open()");
+
+    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
+    AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
+
     DOMWindow* parent = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, args.Holder());
     Frame* frame = parent->frame();
 
-    if (!frame || !V8Proxy::canAccessFrame(frame, true))
+    if (!V8Proxy::canAccessFrame(frame, true))
         return v8::Undefined();
 
     Frame* callingFrame = V8Proxy::retrieveFrameForCallingContext();
@@ -649,9 +635,6 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
     if (!page)
         return v8::Undefined();
 
-    String urlString = toWebCoreStringWithNullOrUndefinedCheck(args[0]);
-    AtomicString frameName = (args[1]->IsUndefined() || args[1]->IsNull()) ? "_blank" : AtomicString(toWebCoreString(args[1]));
-
     // Because FrameTree::find() returns true for empty strings, we must check
     // for empty framenames. Otherwise, illegitimate window.open() calls with
     // no name will pass right through the popup blocker.
@@ -687,7 +670,7 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
             // the outgoingReferrer.  We replicate that behavior here.
             String referrer = enteredFrame->loader()->outgoingReferrer();
 
-            frame->loader()->scheduleLocationChange(completedUrl, referrer, false, userGesture);
+            frame->redirectScheduler()->scheduleLocationChange(completedUrl, referrer, false, userGesture);
         }
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, frame->domWindow());
     }
@@ -756,11 +739,8 @@ CALLBACK_FUNC_DECL(DOMWindowOpen)
 INDEXED_PROPERTY_GETTER(DOMWindow)
 {
     INC_STATS("DOM.DOMWindow.IndexedPropertyGetter");
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return notHandledByInterceptor();
 
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     if (!window)
         return notHandledByInterceptor();
 
@@ -780,11 +760,8 @@ NAMED_PROPERTY_GETTER(DOMWindow)
 {
     INC_STATS("DOM.DOMWindow.NamedPropertyGetter");
 
-    v8::Handle<v8::Object> holder = V8DOMWrapper::lookupDOMWrapper(V8ClassIndex::DOMWINDOW, info.This());
-    if (holder.IsEmpty())
-        return notHandledByInterceptor();
-
-    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
+    // TODO(antonm): investigate what convertToNativeObject does for the case of DOMWINDOW.
+    DOMWindow* window = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
     if (!window)
         return notHandledByInterceptor();
 
@@ -800,12 +777,13 @@ NAMED_PROPERTY_GETTER(DOMWindow)
         return V8DOMWrapper::convertToV8Object(V8ClassIndex::DOMWINDOW, child->domWindow());
 
     // Search IDL functions defined in the prototype
-    v8::Handle<v8::Value> result = holder->GetRealNamedPropertyInPrototypeChain(name);
+    v8::Handle<v8::Value> result = info.Holder()->GetRealNamedProperty(name);
     if (!result.IsEmpty())
         return result;
 
     // Search named items in the document.
     Document* doc = frame->document();
+
     if (doc) {
         RefPtr<HTMLCollection> items = doc->windowNamedItems(propName);
         if (items->length() >= 1) {
@@ -826,13 +804,13 @@ void V8Custom::WindowSetLocation(DOMWindow* window, const String& relativeURL)
     if (!frame)
         return;
 
-    if (!shouldAllowNavigation(frame))
-        return;
-
     KURL url = completeURL(relativeURL);
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(frame))
+        return;
+
     navigateIfAllowed(frame, url, false, false);
 }
 
@@ -853,12 +831,15 @@ CALLBACK_FUNC_DECL(DOMWindowSetInterval)
 
 void V8Custom::ClearTimeoutImpl(const v8::Arguments& args)
 {
+    int handle = toInt32(args[0]);
+
     v8::Handle<v8::Object> holder = args.Holder();
     DOMWindow* imp = V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, holder);
     if (!V8Proxy::canAccessFrame(imp->frame(), true))
         return;
-    ScriptExecutionContext* context = static_cast<ScriptExecutionContext*>(imp->frame()->document());
-    int handle = toInt32(args[0]);
+    ScriptExecutionContext* context = static_cast<ScriptExecutionContext*>(imp->document());
+    if (!context)
+        return;
     DOMTimer::removeById(context, handle);
 }
 
diff --git a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
index cdcef31..9ddd620 100644
--- a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
@@ -87,10 +87,8 @@ CALLBACK_FUNC_DECL(DatabaseChangeVersion)
     return v8::Undefined();
 }
 
-CALLBACK_FUNC_DECL(DatabaseTransaction)
+static v8::Handle<v8::Value> createTransaction(const v8::Arguments& args, bool readOnly)
 {
-    INC_STATS("DOM.Database.transaction()");
-
     if (!args.Length())
         return throwError("Transaction callback is required.", V8Proxy::SyntaxError);
 
@@ -121,12 +119,22 @@ CALLBACK_FUNC_DECL(DatabaseTransaction)
         successCallback = V8CustomVoidCallback::create(args[2], frame);
     }
 
-    database->transaction(callback.release(), errorCallback.release(), successCallback.release());
-
+    database->transaction(callback.release(), errorCallback.release(), successCallback.release(), readOnly);
     return v8::Undefined();
 }
 
+CALLBACK_FUNC_DECL(DatabaseTransaction)
+{
+    INC_STATS("DOM.Database.transaction()");
+    return createTransaction(args, false);
+}
+
+CALLBACK_FUNC_DECL(DatabaseReadTransaction)
+{
+    INC_STATS("DOM.Database.readTransaction()");
+    return createTransaction(args, true);
+}
+
 } // namespace WebCore
 
 #endif
-
diff --git a/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
index f13e45e..263c005 100644
--- a/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp
@@ -35,48 +35,26 @@
 #include "WorkerContextExecutionProxy.h"
 
 #include "DedicatedWorkerContext.h"
+#include "V8Binding.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8WorkerContextEventListener.h"
 
 namespace WebCore {
 
-ACCESSOR_GETTER(DedicatedWorkerContextOnmessage)
+CALLBACK_FUNC_DECL(DedicatedWorkerContextPostMessage)
 {
-    INC_STATS(L"DOM.DedicatedWorkerContext.onmessage._get");
-    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, info.Holder());
-    if (workerContext->onmessage()) {
-        V8WorkerContextEventListener* listener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(DedicatedWorkerContextOnmessage)
-{
-    INC_STATS(L"DOM.DedicatedWorkerContext.onmessage._set");
-    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, info.Holder());
-    V8WorkerContextEventListener* oldListener = static_cast<V8WorkerContextEventListener*>(workerContext->onmessage());
-    if (value->IsNull()) {
-        if (workerContext->onmessage()) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        workerContext->setOnmessage(0);
-    } else {
-        RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(value), false, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-            }
-
-            workerContext->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kDedicatedWorkerContextRequestCacheIndex);
-        }
+    INC_STATS(L"DOM.DedicatedWorkerContext.postMessage");
+    DedicatedWorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<DedicatedWorkerContext>(V8ClassIndex::DEDICATEDWORKERCONTEXT, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(v8ValueToWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
     }
+    ExceptionCode ec = 0;
+    workerContext->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
index 80d204b..8b77a3a 100644
--- a/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DocumentCustom.cpp
@@ -31,10 +31,12 @@
 #include "config.h"
 #include "Document.h"
 
+#include "CanvasRenderingContext.h"
 #include "ExceptionCode.h"
 #include "Node.h"
 #include "XPathNSResolver.h"
 #include "XPathResult.h"
+#include "CanvasRenderingContext.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -62,12 +64,8 @@ CALLBACK_FUNC_DECL(DocumentEvaluate)
     if (V8Node::HasInstance(args[1]))
         contextNode = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[1]));
 
-    RefPtr<XPathNSResolver> resolver;
-    if (V8XPathNSResolver::HasInstance(args[2]))
-        resolver = V8DOMWrapper::convertToNativeObject<XPathNSResolver>(V8ClassIndex::XPATHNSRESOLVER, v8::Handle<v8::Object>::Cast(args[2]));
-    else if (args[2]->IsObject())
-        resolver = V8CustomXPathNSResolver::create(args[2]->ToObject());
-    else if (!args[2]->IsNull() && !args[2]->IsUndefined())
+    RefPtr<XPathNSResolver> resolver = V8DOMWrapper::getXPathNSResolver(args[2]);
+    if (!resolver && !args[2]->IsNull() && !args[2]->IsUndefined())
         return throwError(TYPE_MISMATCH_ERR);
 
     int type = toInt32(args[3]);
@@ -99,8 +97,17 @@ CALLBACK_FUNC_DECL(DocumentGetCSSCanvasContext)
     String name = toWebCoreString(args[1]);
     int width = toInt32(args[2]);
     int height = toInt32(args[3]);
-    CanvasRenderingContext2D* result = imp->getCSSCanvasContext(contextId, name, width, height);
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+    CanvasRenderingContext* result = imp->getCSSCanvasContext(contextId, name, width, height);
+    if (!result)
+        return v8::Undefined();
+    if (result->is2d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+#if ENABLE(3D_CANVAS)
+    else if (result->is3d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+#endif // ENABLE(3D_CANVAS)
+    ASSERT_NOT_REACHED();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8FileListCustom.cpp b/WebCore/bindings/v8/custom/V8FileListCustom.cpp
new file mode 100644
index 0000000..bc533cf
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8FileListCustom.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileList.h"
+
+#include "File.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8Proxy.h"
+
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+INDEXED_PROPERTY_GETTER(FileList)
+{
+    INC_STATS("DOM.FileList.IndexedPropertyGetter");
+    FileList* fileList = V8DOMWrapper::convertToNativeObject<FileList>(V8ClassIndex::FILELIST, info.Holder());
+    RefPtr<File> file = fileList->item(index);
+    if (!file)
+        return notHandledByInterceptor();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::FILE, file.release());
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
index 6f9b761..c735c49 100644
--- a/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLAudioElement.h"
+#include "V8HTMLAudioElementConstructor.h"
 
+#include "HTMLAudioElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -42,6 +43,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLAudioElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLAudioElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLAudioElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLAUDIOELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLAudioElementConstructor)
 {
     INC_STATS("DOM.HTMLAudioElement.Contructor");
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.h
index 35a40f5..ac4b46d 100644..100755
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumMac.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLAudioElementConstructor.h
@@ -28,15 +28,20 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SQLiteFileSystem.h"
+#ifndef V8HTMLAudioElementConstructor_h
+#define V8HTMLAudioElementConstructor_h
+
+#include <v8.h>
 
 namespace WebCore {
 
-void SQLiteFileSystem::registerSQLiteVFS()
-{
-    // stub for registering Chromium's SQLite VFS for Mac
-    ASSERT_NOT_REACHED();
+class V8HTMLAudioElementConstructor {
+private:
+    static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+
+    friend class V8ClassIndex;
+};
+
 }
 
-} // namespace WebCore
+#endif // V8HTMLAudioElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
index 6ba9367..4116673 100644
--- a/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLCanvasElementCustom.cpp
@@ -30,7 +30,9 @@
 
 #include "config.h"
 #include "HTMLCanvasElement.h"
+#include "CanvasRenderingContext.h"
 
+#include "CanvasRenderingContext.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
 #include "V8Node.h"
@@ -44,8 +46,17 @@ CALLBACK_FUNC_DECL(HTMLCanvasElementGetContext)
     v8::Handle<v8::Object> holder = args.Holder();
     HTMLCanvasElement* imp = V8DOMWrapper::convertDOMWrapperToNode<HTMLCanvasElement>(holder);
     String contextId = toWebCoreString(args[0]);
-    CanvasRenderingContext2D* result = imp->getContext(contextId);
-    return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+    CanvasRenderingContext* result = imp->getContext(contextId);
+    if (!result)
+        return v8::Undefined();
+    if (result->is2d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT2D, result);
+#if ENABLE(3D_CANVAS)
+    else if (result->is3d())
+        return V8DOMWrapper::convertToV8Object(V8ClassIndex::CANVASRENDERINGCONTEXT3D, result);
+#endif
+    ASSERT_NOT_REACHED();
+    return v8::Undefined();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index 4f865dd..2f55758 100644
--- a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "HTMLFrameElement.h"
+#include "HTMLNames.h"
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -37,6 +38,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames; 
+
 ACCESSOR_SETTER(HTMLFrameElementSrc)
 {
     HTMLFrameElement* frame = V8DOMWrapper::convertDOMWrapperToNode<HTMLFrameElement>(info.Holder());
@@ -45,7 +48,7 @@ ACCESSOR_SETTER(HTMLFrameElementSrc)
     if (!allowSettingFrameSrcToJavascriptUrl(frame, srcValue))
         return;
 
-    frame->setSrc(srcValue);
+    frame->setAttribute(srcAttr, srcValue); 
 }
 
 ACCESSOR_SETTER(HTMLFrameElementLocation)
diff --git a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
index ce2c29a..a4863e8 100644
--- a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "HTMLIFrameElement.h"
+#include "HTMLNames.h" 
 
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
@@ -37,6 +38,8 @@
 
 namespace WebCore {
 
+using namespace HTMLNames; 
+
 ACCESSOR_SETTER(HTMLIFrameElementSrc)
 {
     HTMLIFrameElement* iframe = V8DOMWrapper::convertDOMWrapperToNode<HTMLIFrameElement>(info.Holder());
@@ -45,7 +48,7 @@ ACCESSOR_SETTER(HTMLIFrameElementSrc)
     if (!allowSettingFrameSrcToJavascriptUrl(iframe, v))
         return;
 
-    iframe->setSrc(v);
+    iframe->setAttribute(srcAttr, v); 
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
index 91ebd5f..71c99cf 100644
--- a/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLImageElement.h"
+#include "V8HTMLImageElementConstructor.h"
 
+#include "HTMLImageElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -42,6 +43,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLImageElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLImageElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLImageElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLIMAGEELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLImageElementConstructor)
 {
     INC_STATS("DOM.HTMLImageElement.Contructor");
diff --git a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.h
index dca3536..cdce0e0 100644..100755
--- a/WebCore/bindings/js/JSSharedWorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLImageElementConstructor.h
@@ -28,23 +28,20 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
+#ifndef V8HTMLImageElementConstructor_h
+#define V8HTMLImageElementConstructor_h
 
-#if ENABLE(SHARED_WORKERS)
-
-#include "JSSharedWorkerContext.h"
-
-using namespace JSC;
+#include <v8.h>
 
 namespace WebCore {
 
-void JSSharedWorkerContext::markChildren(MarkStack& markStack)
-{
-    Base::markChildren(markStack);
+    class V8HTMLImageElementConstructor {
+    private:
+        static v8::Persistent<v8::FunctionTemplate> GetTemplate();
 
-    markIfNotNull(markStack, impl()->onconnect());
-}
+        friend class V8ClassIndex;
+    };
 
-} // namespace WebCore
+}
 
-#endif // ENABLE(SHARED_WORKERS)
+#endif // V8HTMLImageElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
index c22d127..f9c9cb4 100644
--- a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.cpp
@@ -29,8 +29,9 @@
  */
 
 #include "config.h"
-#include "HTMLOptionElement.h"
+#include "V8HTMLOptionElementConstructor.h"
 
+#include "HTMLOptionElement.h"
 #include "Document.h"
 #include "Frame.h"
 #include "HTMLNames.h"
@@ -43,6 +44,24 @@
 
 namespace WebCore {
 
+v8::Persistent<v8::FunctionTemplate> V8HTMLOptionElementConstructor::GetTemplate()
+{
+    static v8::Persistent<v8::FunctionTemplate> cachedTemplate;
+    if (!cachedTemplate.IsEmpty())
+        return cachedTemplate;
+
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(USE_CALLBACK(HTMLOptionElementConstructor));
+
+    v8::Local<v8::ObjectTemplate> instance = result->InstanceTemplate();
+    instance->SetInternalFieldCount(V8Custom::kNodeMinimumInternalFieldCount);
+    result->SetClassName(v8::String::New("HTMLOptionElement"));
+    result->Inherit(V8DOMWrapper::getTemplate(V8ClassIndex::HTMLOPTIONELEMENT));
+
+    cachedTemplate = v8::Persistent<v8::FunctionTemplate>::New(result);
+    return cachedTemplate;
+}
+
 CALLBACK_FUNC_DECL(HTMLOptionElementConstructor)
 {
     INC_STATS("DOM.HTMLOptionElement.Contructor");
diff --git a/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h
new file mode 100755
index 0000000..70076a5
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8HTMLOptionElementConstructor.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8HTMLOptionElementConstructor_h
+#define V8HTMLOptionElementConstructor_h
+
+#include <v8.h>
+
+namespace WebCore {
+
+    class V8HTMLOptionElementConstructor {
+    private:
+        static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+
+        friend class V8ClassIndex;
+    };
+
+}
+
+#endif // V8HTMLOptionElementConstructor_h
diff --git a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
index 2571df4..ec9b034 100644
--- a/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8InspectorBackendCustom.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "InspectorBackend.h"
 
+#include "Database.h"
 #include "DOMWindow.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -57,13 +58,8 @@ CALLBACK_FUNC_DECL(InspectorBackendHighlightDOMNode)
     if (args.Length() < 1)
         return v8::Undefined();
 
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
-    if (!node)
-        return v8::Undefined();
-
     InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
-    inspectorBackend->highlight(node);
-
+    inspectorBackend->highlight(args[0]->ToInt32()->Value());
     return v8::Undefined();
 }
 
@@ -107,11 +103,17 @@ CALLBACK_FUNC_DECL(InspectorBackendSearch)
 }
 
 #if ENABLE(DATABASE)
-CALLBACK_FUNC_DECL(InspectorBackendDatabaseTableNames)
+CALLBACK_FUNC_DECL(InspectorBackendDatabaseForId)
 {
-    INC_STATS("InspectorBackend.databaseTableNames()");
-    v8::Local<v8::Array> result = v8::Array::New(0);
-    return result;
+    INC_STATS("InspectorBackend.databaseForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Database* database = inspectorBackend->databaseForId(args[0]->ToInt32()->Value());
+    if (!database)
+        return v8::Undefined();
+    return V8DOMWrapper::convertToV8Object<Database>(V8ClassIndex::DATABASE, database);
 }
 #endif
 
@@ -215,4 +217,90 @@ CALLBACK_FUNC_DECL(InspectorBackendWrapCallback)
     return args[0];
 }
 
+CALLBACK_FUNC_DECL(InspectorBackendNodeForId)
+{
+    INC_STATS("InspectorBackend.nodeForId()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    
+    Node* node = inspectorBackend->nodeForId(args[0]->ToInt32()->Value());
+    if (!node)
+        return v8::Undefined();
+
+    InspectorController* ic = inspectorBackend->inspectorController();
+    if (!ic)
+        return v8::Undefined();
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NODE, node);
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendWrapObject)
+{
+    INC_STATS("InspectorBackend.wrapObject()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    return inspectorBackend->wrapObject(ScriptValue(args[0]), toWebCoreStringWithNullCheck(args[1])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendUnwrapObject)
+{
+    INC_STATS("InspectorBackend.unwrapObject()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    return inspectorBackend->unwrapObject(toWebCoreStringWithNullCheck(args[0])).v8Value();
+}
+
+CALLBACK_FUNC_DECL(InspectorBackendPushNodePathToFrontend)
+{
+    INC_STATS("InspectorBackend.pushNodePathToFrontend()");
+    if (args.Length() < 2)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(v8::Handle<v8::Object>::Cast(args[0]));
+    bool selectInUI = args[1]->ToBoolean()->Value();
+    if (node)
+        return v8::Number::New(inspectorBackend->pushNodePathToFrontend(node, selectInUI));
+
+    return v8::Undefined();
+}
+
+#if ENABLE(DATABASE)
+CALLBACK_FUNC_DECL(InspectorBackendSelectDatabase)
+{
+    INC_STATS("InspectorBackend.selectDatabase()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Database* database = V8DOMWrapper::convertToNativeObject<Database>(V8ClassIndex::DATABASE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (database)
+        inspectorBackend->selectDatabase(database);
+
+    return v8::Undefined();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+CALLBACK_FUNC_DECL(InspectorBackendSelectDOMStorage)
+{
+    INC_STATS("InspectorBackend.selectDOMStorage()");
+    if (args.Length() < 1)
+        return v8::Undefined();
+
+    InspectorBackend* inspectorBackend = V8DOMWrapper::convertToNativeObject<InspectorBackend>(V8ClassIndex::INSPECTORBACKEND, args.Holder());
+    Storage* storage = V8DOMWrapper::convertToNativeObject<Storage>(V8ClassIndex::STORAGE, v8::Handle<v8::Object>::Cast(args[0]));
+    if (storage)
+        inspectorBackend->selectDOMStorage(storage);
+
+    return v8::Undefined();
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index 3f3ff6b..1ed4c51 100644
--- a/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -128,13 +128,13 @@ ACCESSOR_SETTER(LocationHref)
     if (!frame)
         return;
 
-    if (!shouldAllowNavigation(frame))
-        return;
-
     KURL url = completeURL(toWebCoreString(value));
     if (url.isNull())
         return;
 
+    if (!shouldAllowNavigation(frame))
+        return;
+
     navigateIfAllowed(frame, url, false, false);
 }
 
@@ -274,7 +274,7 @@ CALLBACK_FUNC_DECL(LocationReload)
         return v8::Undefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->loader()->scheduleRefresh(processingUserGesture());
+        frame->redirectScheduler()->scheduleRefresh(processingUserGesture());
     return v8::Undefined();
 }
 
@@ -288,13 +288,13 @@ CALLBACK_FUNC_DECL(LocationReplace)
     if (!frame)
         return v8::Undefined();
 
-    if (!shouldAllowNavigation(frame))
-        return v8::Undefined();
-
     KURL url = completeURL(toWebCoreString(args[0]));
     if (url.isNull())
         return v8::Undefined();
 
+    if (!shouldAllowNavigation(frame))
+        return v8::Undefined();
+
     navigateIfAllowed(frame, url, true, true);
     return v8::Undefined();
 }
@@ -309,13 +309,13 @@ CALLBACK_FUNC_DECL(LocationAssign)
     if (!frame)
         return v8::Undefined();
 
-    if (!shouldAllowNavigation(frame))
-        return v8::Undefined();
-
     KURL url = completeURL(toWebCoreString(args[0]));
     if (url.isNull())
         return v8::Undefined();
 
+    if (!shouldAllowNavigation(frame))
+        return v8::Undefined();
+
     navigateIfAllowed(frame, url, false, false);
     return v8::Undefined();
 }
diff --git a/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp b/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
index f45aecf..ca02b16 100644
--- a/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8MessageChannelConstructor.cpp
@@ -36,6 +36,7 @@
 
 #include "Document.h"
 #include "Frame.h"
+#include "V8Utilities.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 
@@ -52,16 +53,9 @@ CALLBACK_FUNC_DECL(MessageChannelConstructor)
         return throwError("DOM object constructor cannot be called as a function.");
 
     // Get the ScriptExecutionContext (WorkerContext or Document)
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Note: it's OK to let this RefPtr go out of scope because we also call
     // SetDOMWrapper(), which effectively holds a reference to obj.
diff --git a/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp b/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
new file mode 100644
index 0000000..c5af635
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MessageEvent.h"
+#include "SerializedScriptValue.h"
+
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8DOMWindow.h"
+#include "V8MessagePortCustom.h"
+#include "V8Proxy.h"
+
+namespace WebCore {
+
+ACCESSOR_GETTER(MessageEventPorts)
+{
+    INC_STATS("DOM.MessageEvent.ports");
+    MessageEvent* event = V8DOMWrapper::convertToNativeObject<MessageEvent>(V8ClassIndex::MESSAGEEVENT, info.Holder());
+
+    MessagePortArray* ports = event->ports();
+    if (!ports || ports->isEmpty())
+        return v8::Null();
+
+    v8::Local<v8::Array> portArray = v8::Array::New(ports->size());
+    for (size_t i = 0; i < ports->size(); ++i)
+        portArray->Set(v8::Integer::New(i), V8DOMWrapper::convertToV8Object(V8ClassIndex::MESSAGEPORT, (*ports)[i].get()));
+
+    return portArray;
+}
+
+CALLBACK_FUNC_DECL(MessageEventInitMessageEvent)
+{
+    INC_STATS("DOM.MessageEvent.initMessageEvent");
+    MessageEvent* event = V8DOMWrapper::convertToNativeObject<MessageEvent>(V8ClassIndex::MESSAGEEVENT, args.Holder());
+    String typeArg = v8ValueToWebCoreString(args[0]);
+    bool canBubbleArg = args[1]->BooleanValue();
+    bool cancelableArg = args[2]->BooleanValue();
+    RefPtr<SerializedScriptValue> dataArg = SerializedScriptValue::create(v8ValueToWebCoreString(args[3]));
+    String originArg = v8ValueToWebCoreString(args[4]);
+    String lastEventIdArg = v8ValueToWebCoreString(args[5]);
+    DOMWindow* sourceArg = V8DOMWindow::HasInstance(args[6]) ? V8DOMWrapper::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, v8::Handle<v8::Object>::Cast(args[6])) : 0;
+    OwnPtr<MessagePortArray> portArray;
+
+    if (!isUndefinedOrNull(args[7])) {
+        portArray = new MessagePortArray();
+        if (!getMessagePortArray(args[7], *portArray))
+            return v8::Undefined();
+    }
+    event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg.release(), originArg, lastEventIdArg, sourceArg, portArray.release());
+    return v8::Undefined();
+  }
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
index 95d248c..0d8631f 100644
--- a/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8MessagePortCustom.cpp
@@ -32,66 +32,22 @@
 
 #include "ExceptionCode.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
+#include "V8MessagePortCustom.h"
+#include "V8MessagePort.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContextExecutionProxy.h"
 
 namespace WebCore {
 
-PassRefPtr<EventListener> getEventListener(MessagePort* messagePort, v8::Local<v8::Value> value, bool findOnly, bool createObjectEventListener)
-{
-    V8Proxy* proxy = V8Proxy::retrieve(messagePort->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, false) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-    }
-
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy)
-        return workerContextProxy->findOrCreateEventListenerHelper(value, false, findOnly, createObjectEventListener);
-#endif
-
-    return PassRefPtr<EventListener>();
-}
-
-ACCESSOR_GETTER(MessagePortOnmessage)
-{
-    INC_STATS("DOM.MessagePort.onmessage._get");
-    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
-    return V8DOMWrapper::convertEventListenerToV8Object(messagePort->onmessage());
-}
-
-ACCESSOR_SETTER(MessagePortOnmessage)
-{
-    INC_STATS("DOM.MessagePort.onmessage._set");
-    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, info.Holder());
-    if (value->IsNull()) {
-        if (messagePort->onmessage()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(messagePort->onmessage());
-            removeHiddenDependency(info.Holder(), listener->getListenerObject(), V8Custom::kMessagePortRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        messagePort->setOnmessage(0);
-
-    } else {
-        RefPtr<EventListener> listener = getEventListener(messagePort, value, false, false);
-        if (listener) {
-            messagePort->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kMessagePortRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(MessagePortAddEventListener)
 {
     INC_STATS("DOM.MessagePort.addEventListener()");
     MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
-    RefPtr<EventListener> listener = getEventListener(messagePort, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(messagePort, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -106,7 +62,7 @@ CALLBACK_FUNC_DECL(MessagePortRemoveEventListener)
 {
     INC_STATS("DOM.MessagePort.removeEventListener()");
     MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
-    RefPtr<EventListener> listener = getEventListener(messagePort, args[1], true, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(messagePort, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -118,4 +74,64 @@ CALLBACK_FUNC_DECL(MessagePortRemoveEventListener)
     return v8::Undefined();
 }
 
+CALLBACK_FUNC_DECL(MessagePortPostMessage)
+{
+    INC_STATS("DOM.MessagePort.postMessage");
+    MessagePort* messagePort = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
+    }
+    ExceptionCode ec = 0;
+    messagePort->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
+}
+
+bool getMessagePortArray(v8::Local<v8::Value> value, MessagePortArray& portArray)
+{
+    if (isUndefinedOrNull(value)) {
+        portArray.resize(0);
+        return true;
+    }
+
+    if (!value->IsObject()) {
+        throwError("MessagePortArray argument must be an object");
+        return false;
+    }
+    uint32_t length = 0;
+    v8::Local<v8::Object> ports = v8::Local<v8::Object>::Cast(value);
+
+    if (value->IsArray()) {
+        v8::Local<v8::Array> array = v8::Local<v8::Array>::Cast(value);
+        length = array->Length();
+    } else {
+        // Sequence-type object - get the length attribute
+        v8::Local<v8::Value> sequenceLength = ports->Get(v8::String::New("length"));
+        if (!sequenceLength->IsNumber()) {
+            throwError("MessagePortArray argument has no length attribute");
+            return false;
+        }
+        length = sequenceLength->Uint32Value();
+    }
+    portArray.resize(length);
+
+    for (unsigned int i = 0; i < length; ++i) {
+        v8::Local<v8::Value> port = ports->Get(v8::Integer::New(i));
+        // Validation of non-null objects, per HTML5 spec 8.3.3.
+        if (isUndefinedOrNull(port)) {
+            throwError(INVALID_STATE_ERR);
+            return false;
+        }
+        // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
+        if (!V8MessagePort::HasInstance(port)) {
+            throwError("MessagePortArray argument must contain only MessagePorts");
+            return false;
+        }
+        portArray[i] = V8DOMWrapper::convertToNativeObject<MessagePort>(V8ClassIndex::MESSAGEPORT, v8::Handle<v8::Object>::Cast(port));
+    }
+    return true;
+}
+
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8MessagePortCustom.h b/WebCore/bindings/v8/custom/V8MessagePortCustom.h
new file mode 100644
index 0000000..7ab502b
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8MessagePortCustom.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2008, 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef V8MessagePortCustom_h
+#define V8MessagePortCustom_h
+
+#include <v8.h>
+
+#include "MessagePort.h"
+
+namespace WebCore {
+
+    // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
+    // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec and generates exceptions as appropriate.
+    // Returns true if the array was filled, or false if the passed value was not of an appropriate type.
+    bool getMessagePortArray(v8::Local<v8::Value>, MessagePortArray&);
+
+} // namespace WebCore
+
+#endif // V8MessagePortCustom_h
diff --git a/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 6b0d740..9b4b9aa 100644
--- a/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -39,76 +39,18 @@
 #include "V8CustomBinding.h"
 #include "V8CustomEventListener.h"
 #include "V8Node.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-static inline String toEventType(v8::Local<v8::String> value)
-{
-    String key = toWebCoreString(value);
-    ASSERT(key.startsWith("on"));
-    return key.substring(2);
-}
-
-static PassRefPtr<EventListener> getEventListener(Node* node, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    V8Proxy* proxy = V8Proxy::retrieve(node->scriptExecutionContext());
-    // The document might be created using createDocument, which does
-    // not have a frame, use the active frame.
-    if (!proxy)
-        proxy = V8Proxy::retrieve(V8Proxy::retrieveFrameForEnteredContext());
-
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_SETTER(NodeEventHandler)
-{
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
-    String eventType = toEventType(name);
-
-    // Remove hidden dependency on the old event handler.
-    if (EventListener* listener = node->getAttributeEventListener(eventType)) {
-        if (static_cast<V8AbstractEventListener*>(listener)->isObjectListener()) {
-            v8::Local<v8::Object> v8Listener = static_cast<V8ObjectEventListener*>(listener)->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kNodeEventListenerCacheIndex);
-        }
-    }
-
-    // Set handler if the value is a function.
-    if (value->IsFunction()) {
-        RefPtr<EventListener> listener = getEventListener(node, value, true, false);
-        if (listener) {
-            node->setAttributeEventListener(eventType, listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kNodeEventListenerCacheIndex);
-        }
-    } else {
-        // Otherwise, clear the handler.
-        node->clearAttributeEventListener(eventType);
-    }
-}
-
-ACCESSOR_GETTER(NodeEventHandler)
-{
-    Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(info.Holder());
-
-    EventListener* listener = node->getAttributeEventListener(toEventType(name));
-    return V8DOMWrapper::convertEventListenerToV8Object(listener);
-}
-
 CALLBACK_FUNC_DECL(NodeAddEventListener)
 {
     INC_STATS("DOM.Node.addEventListener()");
     Node* node = V8DOMWrapper::convertDOMWrapperToNode<Node>(args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(node, args[1], false, false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(node, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -126,9 +68,9 @@ CALLBACK_FUNC_DECL(NodeRemoveEventListener)
     // It is possbile that the owner document of the node is detached
     // from the frame.
     // See issue http://b/878909
-    RefPtr<EventListener> listener = getEventListener(node, args[1], false, true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(node, args[1], false, ListenerFindOnly);
     if (listener) {
-        String type = toWebCoreString(args[0]);
+        AtomicString type = v8ValueToAtomicWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         node->removeEventListener(type, listener.get(), useCapture);
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
diff --git a/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
new file mode 100644
index 0000000..bd5fb4a
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8NotificationCenterCustom.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "NotImplemented.h"
+#include "Notification.h"
+#include "NotificationCenter.h"
+#include "V8Binding.h"
+#include "V8CustomBinding.h"
+#include "V8CustomEventListener.h"
+#include "V8CustomVoidCallback.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+CALLBACK_FUNC_DECL(NotificationAddEventListener)
+{
+    INC_STATS("DOM.Notification.addEventListener()");
+    Notification* notification = V8DOMWrapper::convertToNativeObject<Notification>(V8ClassIndex::NOTIFICATION, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(notification, args[1], false, ListenerFindOrCreate);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        notification->addEventListener(type, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kNotificationRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(NotificationRemoveEventListener)
+{
+    INC_STATS("DOM.Notification.removeEventListener()");
+    Notification* notification = V8DOMWrapper::convertToNativeObject<Notification>(V8ClassIndex::NOTIFICATION, args.Holder());
+
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(notification, args[1], false, ListenerFindOnly);
+    if (listener) {
+        String type = toWebCoreString(args[0]);
+        bool useCapture = args[2]->BooleanValue();
+        notification->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kNotificationRequestCacheIndex);
+    }
+
+    return v8::Undefined();
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterCreateHTMLNotification)
+{
+    INC_STATS(L"DOM.NotificationCenter.CreateHTMLNotification()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    ScriptExecutionContext* context = notificationCenter->context();
+    ExceptionCode ec = 0;
+    String url = toWebCoreString(args[0]);
+    RefPtr<Notification> notification = Notification::create(url, context, ec, notificationCenter->presenter());
+
+    if (ec)
+        return throwError(ec);
+
+    if (context->isWorkerContext())
+        return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterCreateNotification)
+{
+    INC_STATS(L"DOM.NotificationCenter.CreateNotification()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    NotificationContents contents(toWebCoreString(args[0]), toWebCoreString(args[1]), toWebCoreString(args[2]));
+
+    ScriptExecutionContext* context = notificationCenter->context();
+    ExceptionCode ec = 0;
+    RefPtr<Notification> notification = Notification::create(contents, context, ec, notificationCenter->presenter());
+
+    if (ec)
+        return throwError(ec);
+
+    if (context->isWorkerContext())
+        return WorkerContextExecutionProxy::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+
+    return V8DOMWrapper::convertToV8Object(V8ClassIndex::NOTIFICATION, notification.get());
+}
+
+CALLBACK_FUNC_DECL(NotificationCenterRequestPermission)
+{
+    INC_STATS(L"DOM.NotificationCenter.RequestPermission()");
+    NotificationCenter* notificationCenter = V8DOMWrapper::convertToNativeObject<NotificationCenter>(V8ClassIndex::NOTIFICATIONCENTER, args.Holder());
+    ScriptExecutionContext* context = notificationCenter->context();
+
+    // Requesting permission is only valid from a page context.
+    if (context->isWorkerContext())
+        return throwError(NOT_SUPPORTED_ERR);
+
+    RefPtr<V8CustomVoidCallback> callback;
+    if (args.Length() > 0) {
+        if (!args[0]->IsObject())
+            return throwError("Callback must be of valid type.", V8Proxy::TypeError);
+ 
+        callback = V8CustomVoidCallback::create(args[0], V8Proxy::retrieveFrameForCurrentContext());
+    }
+
+    notificationCenter->requestPermission(callback.release());
+    return v8::Undefined();
+}
+
+
+}  // namespace WebCore
+
+#endif  // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp b/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
index ce9c345..dff4ff4 100644
--- a/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SVGElementInstanceCustom.cpp
@@ -49,15 +49,12 @@ CALLBACK_FUNC_DECL(SVGElementInstanceAddEventListener)
     INC_STATS("DOM.SVGElementInstance.AddEventListener()");
     SVGElementInstance* instance = V8DOMWrapper::convertDOMWrapperToNative<SVGElementInstance>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(instance->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findOrCreateWrapper<V8EventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(instance, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         instance->addEventListener(type, listener, useCapture);
+        createHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
 
     return v8::Undefined();
@@ -68,15 +65,12 @@ CALLBACK_FUNC_DECL(SVGElementInstanceRemoveEventListener)
     INC_STATS("DOM.SVGElementInstance.RemoveEventListener()");
     SVGElementInstance* instance = V8DOMWrapper::convertDOMWrapperToNative<SVGElementInstance>(args.Holder());
 
-    V8Proxy* proxy = V8Proxy::retrieve(instance->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
-
-    RefPtr<EventListener> listener = proxy->eventListeners()->findWrapper(args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(instance, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
         instance->removeEventListener(type, listener.get(), useCapture);
+        removeHiddenDependency(args.Holder(), args[1], V8Custom::kNodeEventListenerCacheIndex);
     }
 
     return v8::Undefined();
diff --git a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
index 3ab2f8e..e470bc8 100644
--- a/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SharedWorkerCustom.cpp
@@ -53,12 +53,15 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
     if (!args.IsConstructCall())
         return throwError("DOM object constructor cannot be called as a function.");
 
-    if (args.Length() < 2)
+    if (args.Length() < 1)
         return throwError("Not enough arguments", V8Proxy::SyntaxError);
 
     v8::TryCatch tryCatch;
     v8::Handle<v8::String> scriptUrl = args[0]->ToString();
-    v8::Handle<v8::String> name = args[1]->ToString();
+    String name;
+    if (args.Length() > 1)
+        name = toWebCoreString(args[1]->ToString());
+
     if (tryCatch.HasCaught())
         return throwError(tryCatch.Exception());
 
@@ -66,21 +69,14 @@ CALLBACK_FUNC_DECL(SharedWorkerConstructor)
         return v8::Undefined();
 
     // Get the script execution context.
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrame();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Create the worker object.
     // Note: it's OK to let this RefPtr go out of scope because we also call SetDOMWrapper(), which effectively holds a reference to obj.
     ExceptionCode ec = 0;
-    RefPtr<SharedWorker> obj = SharedWorker::create(toWebCoreString(scriptUrl), toWebCoreString(name), context, ec);
+    RefPtr<SharedWorker> obj = SharedWorker::create(toWebCoreString(scriptUrl), name, context, ec);
 
     // Setup the standard wrapper object internal fields.
     v8::Handle<v8::Object> wrapperObject = args.Holder();
diff --git a/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp b/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
index dd19a88..b2a807d 100755
--- a/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8WebKitPointConstructor.cpp
@@ -30,17 +30,38 @@
 
 #include "config.h"
 
+#include "V8Binding.h"
 #include "V8CustomBinding.h"
+#include "V8DOMWrapper.h"
 #include "V8Index.h"
 #include "V8Proxy.h"
 #include "WebKitPoint.h"
 
+#include <wtf/MathExtras.h>
+
 namespace WebCore {
 
 CALLBACK_FUNC_DECL(WebKitPointConstructor)
 {
     INC_STATS("DOM.WebKitPoint.Constructor");
-    return V8Proxy::constructDOMObject<V8ClassIndex::WEBKITPOINT, WebKitPoint>(args);
+    float x = 0;
+    float y = 0;
+    if (args.Length() > 1) {
+        if (!args[0]->IsUndefined()) {
+            x = toFloat(args[0]);
+            if (isnan(x))
+                x = 0;
+        }
+        if (!args[1]->IsUndefined()) {
+            y = toFloat(args[1]);
+            if (isnan(y))
+                y = 0;
+        }
+    }
+    PassRefPtr<WebKitPoint> point = WebKitPoint::create(x, y);
+    point->ref();
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::WEBKITPOINT, point.get());
+    return args.Holder();
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
new file mode 100644
index 0000000..f498e4f
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8WebSocketCustom.cpp
@@ -0,0 +1,131 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocket.h"
+
+#include "Frame.h"
+#include "Settings.h"
+#include "V8Binding.h"
+#include "V8Proxy.h"
+#include "V8Utilities.h"
+#include "WorkerContext.h"
+#include "WorkerContextExecutionProxy.h"
+
+namespace WebCore {
+
+// ??? AddEventListener, RemoveEventListener
+
+CALLBACK_FUNC_DECL(WebSocketConstructor)
+{
+    INC_STATS("DOM.WebSocket.Constructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object custructor cannot be called as a function.");
+    if (args.Length() == 0)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+
+    v8::TryCatch tryCatch;
+    v8::Handle<v8::String> urlstring = args[0]->ToString();
+    if (tryCatch.HasCaught())
+        return throwError(tryCatch.Exception());
+    if (urlstring.IsEmpty())
+        return throwError("Empty URL", V8Proxy::SyntaxError);
+
+    // Get the script execution context.
+    ScriptExecutionContext* context = 0;
+    // TODO: Workers
+    if (!context) {
+        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
+        if (!frame)
+            return throwError("WebSocket constructor's associated frame is not available", V8Proxy::ReferenceError);
+        context = frame->document();
+    }
+
+    const KURL& url = context->completeURL(toWebCoreString(urlstring));
+
+    RefPtr<WebSocket> webSocket = WebSocket::create(context);
+    ExceptionCode ec = 0;
+
+    if (args.Length() < 2)
+        webSocket->connect(url, ec);
+    else {
+        v8::TryCatch tryCatchProtocol;
+        v8::Handle<v8::String> protocol = args[1]->ToString();
+        if (tryCatchProtocol.HasCaught())
+            return throwError(tryCatchProtocol.Exception());
+        webSocket->connect(url, toWebCoreString(protocol), ec);
+    }
+    if (ec)
+        return throwError(ec);
+
+    // Setup the standard wrapper object internal fields.
+    V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::WEBSOCKET), webSocket.get());
+
+    // Add object to the wrapper map.
+    webSocket->ref();
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(webSocket.get(), v8::Persistent<v8::Object>::New(args.Holder()));
+
+    return args.Holder();
+}
+
+CALLBACK_FUNC_DECL(WebSocketSend)
+{
+    INC_STATS("DOM.WebSocket.send()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    ExceptionCode ec = 0;
+    bool ret = false;
+    if (args.Length() < 1)
+        return throwError("Not enough arguments", V8Proxy::SyntaxError);
+    else {
+        String msg = toWebCoreString(args[0]);
+        ret = webSocket->send(msg, ec);
+    }
+    if (ec)
+        return throwError(ec);
+    return v8Boolean(ret);
+}
+
+CALLBACK_FUNC_DECL(WebSocketClose)
+{
+    INC_STATS("DOM.WebSocket.close()");
+    WebSocket* webSocket = V8DOMWrapper::convertToNativeObject<WebSocket>(V8ClassIndex::WEBSOCKET, args.Holder());
+
+    webSocket->close();
+    return v8::Undefined();
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index b526040..21b3c30 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -52,45 +52,6 @@ ACCESSOR_GETTER(WorkerContextSelf)
     return WorkerContextExecutionProxy::convertWorkerContextToV8Object(workerContext);
 }
 
-ACCESSOR_GETTER(WorkerContextOnerror)
-{
-    INC_STATS(L"DOM.WorkerContext.onerror._get");
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    if (workerContext->onerror()) {
-        V8WorkerContextEventListener* listener = static_cast<V8WorkerContextEventListener*>(workerContext->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(WorkerContextOnerror)
-{
-    INC_STATS(L"DOM.WorkerContext.onerror._set");
-    WorkerContext* workerContext = V8DOMWrapper::convertToNativeObject<WorkerContext>(V8ClassIndex::WORKERCONTEXT, info.Holder());
-    V8WorkerContextEventListener* oldListener = static_cast<V8WorkerContextEventListener*>(workerContext->onerror());
-    if (value->IsNull()) {
-        if (workerContext->onerror()) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        workerContext->setOnerror(0);
-    } else {
-        RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(value), true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerContextRequestCacheIndex);
-            }
-
-            workerContext->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerContextRequestCacheIndex);
-        }
-    }
-}
-
 v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singleShot)
 {
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
@@ -103,9 +64,10 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
     int32_t timeout = argumentCount >= 2 ? args[1]->Int32Value() : 0;
     int timerId;
 
+    v8::Handle<v8::Context> v8Context = workerContext->script()->proxy()->context();
     if (function->IsString()) {
         WebCore::String stringFunction = toWebCoreString(function);
-        timerId = DOMTimer::install(workerContext, new ScheduledAction(stringFunction, workerContext->url()), timeout, singleShot);
+        timerId = DOMTimer::install(workerContext, new ScheduledAction(v8Context, stringFunction, workerContext->url()), timeout, singleShot);
     } else if (function->IsFunction()) {
         size_t paramCount = argumentCount >= 2 ? argumentCount - 2 : 0;
         v8::Local<v8::Value>* params = 0;
@@ -115,7 +77,7 @@ v8::Handle<v8::Value> SetTimeoutOrInterval(const v8::Arguments& args, bool singl
                 params[i] = args[i+2];
         }
         // ScheduledAction takes ownership of actual params and releases them in its destructor.
-        ScheduledAction* action = new ScheduledAction(v8::Handle<v8::Function>::Cast(function), paramCount, params);
+        ScheduledAction* action = new ScheduledAction(v8Context, v8::Handle<v8::Function>::Cast(function), paramCount, params);
         delete [] params;
         timerId = DOMTimer::install(workerContext, action, timeout, singleShot);
     } else
@@ -170,8 +132,7 @@ CALLBACK_FUNC_DECL(WorkerContextAddEventListener)
     INC_STATS(L"DOM.WorkerContext.addEventListener()");
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
 
-    RefPtr<V8EventListener> listener = workerContext->script()->proxy()->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, false);
-
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(workerContext, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -186,10 +147,8 @@ CALLBACK_FUNC_DECL(WorkerContextRemoveEventListener)
 {
     INC_STATS(L"DOM.WorkerContext.removeEventListener()");
     WorkerContext* workerContext = V8DOMWrapper::convertDOMWrapperToNative<WorkerContext>(args.Holder());
-    WorkerContextExecutionProxy* proxy = workerContext->script()->proxy();
-
-    RefPtr<V8EventListener> listener = proxy->findOrCreateEventListener(v8::Local<v8::Object>::Cast(args[1]), false, true);
 
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(workerContext, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -197,7 +156,6 @@ CALLBACK_FUNC_DECL(WorkerContextRemoveEventListener)
 
         removeHiddenDependency(args.Holder(), args[1], V8Custom::kWorkerContextRequestCacheIndex);
     }
-
     return v8::Undefined();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8WorkerCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
index 32450b8..454e41f 100755
--- a/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerCustom.cpp
@@ -36,9 +36,10 @@
 
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "SerializedScriptValue.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
+#include "V8MessagePortCustom.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -65,16 +66,9 @@ CALLBACK_FUNC_DECL(WorkerConstructor)
         return v8::Undefined();
 
     // Get the script execution context.
-    ScriptExecutionContext* context = 0;
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return v8::Undefined();
-        context = frame->document();
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     // Create the worker object.
     // Note: it's OK to let this RefPtr go out of scope because we also call setDOMWrapper(), which effectively holds a reference to obj.
@@ -93,60 +87,19 @@ CALLBACK_FUNC_DECL(WorkerConstructor)
     return wrapperObject;
 }
 
-PassRefPtr<EventListener> getEventListener(Worker* worker, v8::Local<v8::Value> value, bool isAttribute, bool findOnly)
-{
-    if (worker->scriptExecutionContext()->isWorkerContext()) {
-        WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-        ASSERT(workerContextProxy);
-        return workerContextProxy->findOrCreateObjectEventListener(value, isAttribute, findOnly);
-    }
-
-    V8Proxy* proxy = V8Proxy::retrieve(worker->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, isAttribute) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, isAttribute);
-    }
-
-    return 0;
-}
-
-ACCESSOR_GETTER(WorkerOnmessage)
-{
-    INC_STATS(L"DOM.Worker.onmessage._get");
-    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
-    if (worker->onmessage()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(worker->onmessage());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Undefined();
-}
-
-ACCESSOR_SETTER(WorkerOnmessage)
+CALLBACK_FUNC_DECL(WorkerPostMessage)
 {
-    INC_STATS(L"DOM.Worker.onmessage._set");
-    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, info.Holder());
-    V8ObjectEventListener* oldListener = static_cast<V8ObjectEventListener*>(worker->onmessage());
-    if (value->IsNull()) {
-        if (oldListener) {
-            v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-            removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        worker->setOnmessage(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(worker, value, true, false);
-        if (listener) {
-            if (oldListener) {
-                v8::Local<v8::Object> oldV8Listener = oldListener->getListenerObject();
-                removeHiddenDependency(info.Holder(), oldV8Listener, V8Custom::kWorkerRequestCacheIndex);
-            }
-
-            worker->setOnmessage(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kWorkerRequestCacheIndex);
-        }
+    INC_STATS("DOM.Worker.postMessage");
+    Worker* worker = V8DOMWrapper::convertToNativeObject<Worker>(V8ClassIndex::WORKER, args.Holder());
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(toWebCoreString(args[0]));
+    MessagePortArray portArray;
+    if (args.Length() > 1) {
+        if (!getMessagePortArray(args[1], portArray))
+            return v8::Undefined();
     }
+    ExceptionCode ec = 0;
+    worker->postMessage(message.release(), &portArray, ec);
+    return throwError(ec);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
index 02ce8e2..af647cd 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestConstructor.cpp
@@ -33,8 +33,8 @@
 #include "Frame.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
+#include "V8Utilities.h"
 #include "XMLHttpRequest.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
@@ -50,20 +50,9 @@ CALLBACK_FUNC_DECL(XMLHttpRequestConstructor)
 
     // Expect no parameters.
     // Allocate a XMLHttpRequest object as its internal field.
-    ScriptExecutionContext* context = 0;
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* proxy = WorkerContextExecutionProxy::retrieve();
-    if (proxy)
-        context = proxy->workerContext();
-    else {
-#endif
-        Frame* frame = V8Proxy::retrieveFrameForCurrentContext();
-        if (!frame)
-            return throwError("XMLHttpRequest constructor's associated frame is not available", V8Proxy::ReferenceError);
-        context = frame->document();
-#if ENABLE(WORKERS)
-    }
-#endif
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return throwError("XMLHttpRequest constructor's associated context is not available", V8Proxy::ReferenceError);
     RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     V8DOMWrapper::setDOMWrapper(args.Holder(), V8ClassIndex::ToInt(V8ClassIndex::XMLHTTPREQUEST), xmlHttpRequest.get());
 
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 7204a61..39105de 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -33,10 +33,10 @@
 
 #include "Frame.h"
 #include "V8Binding.h"
-#include "V8Document.h"
 #include "V8CustomBinding.h"
+#include "V8Document.h"
+#include "V8File.h"
 #include "V8HTMLDocument.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -44,227 +44,6 @@
 
 namespace WebCore {
 
-static PassRefPtr<EventListener> getEventListener(XMLHttpRequest* xmlHttpRequest, v8::Local<v8::Value> value, bool findOnly)
-{
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy)
-        return workerContextProxy->findOrCreateObjectEventListener(value, false, findOnly);
-#endif
-
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (proxy) {
-        V8EventListenerList* list = proxy->objectListeners();
-        return findOnly ? list->findWrapper(value, false) : list->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-    }
-
-    return PassRefPtr<EventListener>();
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequest.onabort._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onabort()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onabort());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequest.onabort._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onabort()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onabort());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnabort(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnabort(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequest.onerror._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onerror()) {
-        RefPtr<V8ObjectEventListener> listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequest.onerror._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onerror()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onerror());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnerror(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnload)
-{
-    INC_STATS("DOM.XMLHttpRequest.onload._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onload()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onload());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnload)
-{
-    INC_STATS("DOM.XMLHttpRequest.onload._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onload()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onload());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        xmlHttpRequest->setOnload(0);
-
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnload(listener.get());
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequest.onloadstart._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onloadstart()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onloadstart());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequest.onloadstart._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onloadstart()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onloadstart());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnloadstart(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnloadstart(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequest.onprogress._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onprogress()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onprogress());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequest.onprogress._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onprogress()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onprogress());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnprogress(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnprogress(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestOnreadystatechange)
-{
-    INC_STATS("DOM.XMLHttpRequest.onreadystatechange._get");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (xmlHttpRequest->onreadystatechange()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onreadystatechange());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestOnreadystatechange)
-{
-    INC_STATS("DOM.XMLHttpRequest.onreadystatechange._set");
-    XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequest->onreadystatechange()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequest->onreadystatechange());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequest->setOnreadystatechange(0);
-    } else {
-        RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, value, false);
-        if (listener) {
-            xmlHttpRequest->setOnreadystatechange(listener.get());
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
 ACCESSOR_GETTER(XMLHttpRequestResponseText)
 {
     // FIXME: This is only needed because webkit set this getter as custom.
@@ -279,7 +58,7 @@ CALLBACK_FUNC_DECL(XMLHttpRequestAddEventListener)
     INC_STATS("DOM.XMLHttpRequest.addEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -295,7 +74,7 @@ CALLBACK_FUNC_DECL(XMLHttpRequestRemoveEventListener)
     INC_STATS("DOM.XMLHttpRequest.removeEventListener()");
     XMLHttpRequest* xmlHttpRequest = V8DOMWrapper::convertToNativeObject<XMLHttpRequest>(V8ClassIndex::XMLHTTPREQUEST, args.Holder());
 
-    RefPtr<EventListener> listener = getEventListener(xmlHttpRequest, args[1], true);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -323,22 +102,9 @@ CALLBACK_FUNC_DECL(XMLHttpRequestOpen)
 
     String method = toWebCoreString(args[0]);
     String urlstring = toWebCoreString(args[1]);
-    ScriptExecutionContext* context = 0;
-#if ENABLE(WORKERS)
-    WorkerContextExecutionProxy* workerContextProxy = WorkerContextExecutionProxy::retrieve();
-    if (workerContextProxy) {
-        context = workerContextProxy->workerContext();
-        ASSERT(context);
-    }
-#endif
-
-    if (!context) {
-        V8Proxy* proxy = V8Proxy::retrieve();
-        if (!proxy)
-            return v8::Undefined();
-        context = proxy->frame()->document();
-        ASSERT(context);
-    }
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return v8::Undefined();
 
     KURL url = context->completeURL(urlstring);
 
@@ -379,12 +145,16 @@ CALLBACK_FUNC_DECL(XMLHttpRequestSend)
         xmlHttpRequest->send(ec);
     else {
         v8::Handle<v8::Value> arg = args[0];
-        // FIXME: upstream handles "File" objects too.
         if (IsDocumentType(arg)) {
             v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
             Document* document = V8DOMWrapper::convertDOMWrapperToNode<Document>(object);
             ASSERT(document);
             xmlHttpRequest->send(document, ec);
+        } else if (V8File::HasInstance(arg)) {
+            v8::Handle<v8::Object> object = v8::Handle<v8::Object>::Cast(arg);
+            File* file = V8DOMWrapper::convertDOMWrapperToNative<File>(object);
+            ASSERT(file);
+            xmlHttpRequest->send(file, ec);
         } else
             xmlHttpRequest->send(toWebCoreStringWithNullCheck(arg), ec);
     }
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
index bbc69dd..9323f71 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp
@@ -34,7 +34,6 @@
 #include "ExceptionCode.h"
 #include "V8Binding.h"
 #include "V8CustomBinding.h"
-#include "V8ObjectEventListener.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "XMLHttpRequest.h"
@@ -43,212 +42,14 @@
 
 namespace WebCore {
 
-ACCESSOR_GETTER(XMLHttpRequestUploadOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onabort._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onabort()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onabort());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnabort)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onabort._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onabort()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onabort());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnabort(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnabort(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onerror._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onerror()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onerror());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnerror)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onerror._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onerror()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onerror());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnerror(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnerror(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnload)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onload._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onload()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onload());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnload)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onload._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onload()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onload());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnload(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnload(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onloadstart._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onloadstart()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onloadstart());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnloadstart)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onloadstart._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onloadstart()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onloadstart());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnloadstart(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnloadstart(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
-ACCESSOR_GETTER(XMLHttpRequestUploadOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onprogress._get");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (xmlHttpRequestUpload->onprogress()) {
-        V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onprogress());
-        v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-        return v8Listener;
-    }
-    return v8::Null();
-}
-
-ACCESSOR_SETTER(XMLHttpRequestUploadOnprogress)
-{
-    INC_STATS("DOM.XMLHttpRequestUpload.onprogress._set");
-    XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, info.Holder());
-    if (value->IsNull()) {
-        if (xmlHttpRequestUpload->onprogress()) {
-            V8ObjectEventListener* listener = static_cast<V8ObjectEventListener*>(xmlHttpRequestUpload->onprogress());
-            v8::Local<v8::Object> v8Listener = listener->getListenerObject();
-            removeHiddenDependency(info.Holder(), v8Listener, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-
-        // Clear the listener.
-        xmlHttpRequestUpload->setOnprogress(0);
-    } else {
-        XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-        V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-        if (!proxy)
-            return;
-
-        RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), value, false);
-        if (listener) {
-            xmlHttpRequestUpload->setOnprogress(listener);
-            createHiddenDependency(info.Holder(), value, V8Custom::kXMLHttpRequestCacheIndex);
-        }
-    }
-}
-
 CALLBACK_FUNC_DECL(XMLHttpRequestUploadAddEventListener)
 {
     INC_STATS("DOM.XMLHttpRequestUpload.addEventListener()");
     XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, args.Holder());
 
     XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined();
 
-    RefPtr<EventListener> listener = proxy->objectListeners()->findOrCreateWrapper<V8ObjectEventListener>(proxy->frame(), args[1], false);
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOrCreate);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
@@ -265,12 +66,8 @@ CALLBACK_FUNC_DECL(XMLHttpRequestUploadRemoveEventListener)
     XMLHttpRequestUpload* xmlHttpRequestUpload = V8DOMWrapper::convertToNativeObject<XMLHttpRequestUpload>(V8ClassIndex::XMLHTTPREQUESTUPLOAD, args.Holder());
 
     XMLHttpRequest* xmlHttpRequest = xmlHttpRequestUpload->associatedXMLHttpRequest();
-    V8Proxy* proxy = V8Proxy::retrieve(xmlHttpRequest->scriptExecutionContext());
-    if (!proxy)
-        return v8::Undefined(); // Probably leaked.
-
-    RefPtr<EventListener> listener = proxy->objectListeners()->findWrapper(args[1], false);
 
+    RefPtr<EventListener> listener = V8DOMWrapper::getEventListener(xmlHttpRequest, args[1], false, ListenerFindOnly);
     if (listener) {
         String type = toWebCoreString(args[0]);
         bool useCapture = args[2]->BooleanValue();
diff --git a/WebCore/bindings/v8/npruntime.cpp b/WebCore/bindings/v8/npruntime.cpp
index 64a1927..3ae2e70 100644
--- a/WebCore/bindings/v8/npruntime.cpp
+++ b/WebCore/bindings/v8/npruntime.cpp
@@ -39,7 +39,7 @@
 // The static initializer here should work okay, but we want to avoid
 // static initialization in general.
 
-namespace {
+namespace npruntime {
 
 // We use StringKey here as the key-type to avoid a string copy to
 // construct the map key and for faster comparisons than strcmp.
@@ -112,7 +112,10 @@ struct StringKeyHash {
     static const bool safeToCompareToEmptyOrDeleted = true;
 };
 
-}  // namespace
+}  // namespace npruntime
+
+using npruntime::StringKey;
+using npruntime::StringKeyHash;
 
 // Implement HashTraits<StringKey>
 struct StringKeyHashTraits : WTF::GenericHashTraits<StringKey> {
diff --git a/WebCore/bridge/IdentifierRep.h b/WebCore/bridge/IdentifierRep.h
index 8e0e0d9..8128bf8 100644
--- a/WebCore/bridge/IdentifierRep.h
+++ b/WebCore/bridge/IdentifierRep.h
@@ -27,11 +27,12 @@
 #define IdentifierRep_h
 
 #include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <string.h>
 
 namespace WebCore {
     
-class IdentifierRep {
+class IdentifierRep : public FastAllocBase {
 public:
     static IdentifierRep* get(int);
     static IdentifierRep* get(const char*);
diff --git a/WebCore/bridge/jni/jni_jsobject.mm b/WebCore/bridge/jni/jni_jsobject.mm
index c9af8b0..eb4a6bd 100644
--- a/WebCore/bridge/jni/jni_jsobject.mm
+++ b/WebCore/bridge/jni/jni_jsobject.mm
@@ -29,19 +29,18 @@
 #if ENABLE(MAC_JAVA_BRIDGE)
 
 #include "Frame.h"
+#include "ScriptController.h"
+#include "StringSourceProvider.h"
 #include "WebCoreFrameView.h"
 #include "jni_runtime.h"
 #include "jni_utility.h"
-#include "ScriptController.h"
 #include "runtime_object.h"
 #include "runtime_root.h"
 #include <interpreter/CallFrame.h>
+#include <runtime/Completion.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/JSLock.h>
-#include <runtime/Completion.h>
-#include <runtime/Completion.h>
 #include <wtf/Assertions.h>
-#include <parser/SourceProvider.h>
 
 using WebCore::Frame;
 
diff --git a/WebCore/bridge/npapi.h b/WebCore/bridge/npapi.h
index 126d513..ca70dcf 100644
--- a/WebCore/bridge/npapi.h
+++ b/WebCore/bridge/npapi.h
@@ -71,6 +71,13 @@
 #    endif /* XP_PC */
 #endif /* __MWERKS__ */
 
+#ifdef __SYMBIAN32__
+#   ifndef XP_SYMBIAN
+#       define XP_SYMBIAN 1
+#       undef XP_WIN
+#   endif
+#endif  /* __SYMBIAN32__ */
+
 #if defined(__APPLE_CC__) && !defined(__MACOS_CLASSIC__) && !defined(XP_UNIX)
 #   define XP_MACOSX
 #endif
@@ -114,6 +121,14 @@
 /*             Definition of Basic Types                                */
 /*----------------------------------------------------------------------*/
 
+/* QNX sets the _INT16 and friends defines, but does not typedef the types */
+#ifdef __QNXNTO__
+#undef _UINT16
+#undef _INT16
+#undef _UINT32
+#undef _INT32
+#endif
+
 #ifndef _UINT16
 #define _UINT16
 typedef unsigned short uint16;
diff --git a/WebCore/bridge/objc/objc_instance.h b/WebCore/bridge/objc/objc_instance.h
index 6f1eb0d..64cd491 100644
--- a/WebCore/bridge/objc/objc_instance.h
+++ b/WebCore/bridge/objc/objc_instance.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,16 +37,12 @@ class ObjcClass;
 
 class ObjcInstance : public Instance {
 public:
-    static PassRefPtr<ObjcInstance> create(ObjectStructPtr instance, PassRefPtr<RootObject> rootObject)
-    {
-        return adoptRef(new ObjcInstance(instance, rootObject));
-    }
-
+    static PassRefPtr<ObjcInstance> create(ObjectStructPtr, PassRefPtr<RootObject>);
+    virtual ~ObjcInstance();
+    
     static void setGlobalException(NSString*, JSGlobalObject* exceptionEnvironment = 0); // A null exceptionEnvironment means the exception should propogate to any execution environment.
 
-    ~ObjcInstance();
-    
-    virtual Class *getClass() const;
+    virtual Class* getClass() const;
         
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
@@ -71,7 +67,7 @@ protected:
 private:
     static void moveGlobalExceptionToExecState(ExecState*);
 
-    ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject>);
+    ObjcInstance(ObjectStructPtr, PassRefPtr<RootObject>);
     
     RetainPtr<ObjectStructPtr> _instance;
     mutable ObjcClass *_class;
diff --git a/WebCore/bridge/objc/objc_instance.mm b/WebCore/bridge/objc/objc_instance.mm
index b84f7bb..f7550e4 100644
--- a/WebCore/bridge/objc/objc_instance.mm
+++ b/WebCore/bridge/objc/objc_instance.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,8 +44,21 @@
 using namespace JSC::Bindings;
 using namespace JSC;
 
-static NSString* s_exception;
+static NSString *s_exception;
 static JSGlobalObject* s_exceptionEnvironment; // No need to protect this value, since we just use it for a pointer comparison.
+static NSMapTable *s_instanceWrapperCache;
+
+static NSMapTable *createInstanceWrapperCache()
+{
+#ifdef BUILDING_ON_TIGER
+    return NSCreateMapTable(NSNonRetainedObjectMapKeyCallBacks, NSNonOwnedPointerMapValueCallBacks, 0);
+#else
+    // NSMapTable with zeroing weak pointers is the recommended way to build caches like this under garbage collection.
+    NSPointerFunctionsOptions keyOptions = NSPointerFunctionsZeroingWeakMemory | NSPointerFunctionsObjectPersonality;
+    NSPointerFunctionsOptions valueOptions = NSPointerFunctionsOpaqueMemory | NSPointerFunctionsOpaquePersonality;
+    return [[NSMapTable alloc] initWithKeyOptions:keyOptions valueOptions:valueOptions capacity:0];
+#endif
+}
 
 void ObjcInstance::setGlobalException(NSString* exception, JSGlobalObject* exceptionEnvironment)
 {
@@ -74,7 +87,7 @@ void ObjcInstance::moveGlobalExceptionToExecState(ExecState* exec)
     s_exceptionEnvironment = 0;
 }
 
-ObjcInstance::ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject> rootObject) 
+ObjcInstance::ObjcInstance(id instance, PassRefPtr<RootObject> rootObject) 
     : Instance(rootObject)
     , _instance(instance)
     , _class(0)
@@ -83,13 +96,30 @@ ObjcInstance::ObjcInstance(ObjectStructPtr instance, PassRefPtr<RootObject> root
 {
 }
 
+PassRefPtr<ObjcInstance> ObjcInstance::create(id instance, PassRefPtr<RootObject> rootObject)
+{
+    if (!s_instanceWrapperCache)
+        s_instanceWrapperCache = createInstanceWrapperCache();
+    if (void* existingWrapper = NSMapGet(s_instanceWrapperCache, instance))
+        return static_cast<ObjcInstance*>(existingWrapper);
+    RefPtr<ObjcInstance> wrapper = adoptRef(new ObjcInstance(instance, rootObject));
+    NSMapInsert(s_instanceWrapperCache, instance, wrapper.get());
+    return wrapper.release();
+}
+
 ObjcInstance::~ObjcInstance() 
 {
-    // -finalizeForWebScript and -dealloc/-finalize may require autorelease pools.
+    // Both -finalizeForWebScript and -dealloc/-finalize of _instance may require autorelease pools.
     NSAutoreleasePool* pool = [[NSAutoreleasePool alloc] init];
+
+    ASSERT(s_instanceWrapperCache);
+    ASSERT(_instance);
+    NSMapRemove(s_instanceWrapperCache, _instance.get());
+
     if ([_instance.get() respondsToSelector:@selector(finalizeForWebScript)])
         [_instance.get() performSelector:@selector(finalizeForWebScript)];
     _instance = 0;
+
     [pool drain];
 }
 
diff --git a/WebCore/bridge/objc/objc_runtime.h b/WebCore/bridge/objc/objc_runtime.h
index 82d563b..7c772a6 100644
--- a/WebCore/bridge/objc/objc_runtime.h
+++ b/WebCore/bridge/objc/objc_runtime.h
@@ -109,6 +109,7 @@ public:
 
 private:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual CallType getCallData(CallData&);
     virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
diff --git a/WebCore/bridge/objc/objc_runtime.mm b/WebCore/bridge/objc/objc_runtime.mm
index 2d69c1c..5efc865 100644
--- a/WebCore/bridge/objc/objc_runtime.mm
+++ b/WebCore/bridge/objc/objc_runtime.mm
@@ -203,13 +203,20 @@ bool ObjcFallbackObjectImp::getOwnPropertySlot(ExecState*, const Identifier&, Pr
     return true;
 }
 
+bool ObjcFallbackObjectImp::getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor& descriptor)
+{
+    // keep the prototype from getting called instead of just returning false
+    descriptor.setUndefined();
+    return true;
+}
+
 void ObjcFallbackObjectImp::put(ExecState*, const Identifier&, JSValue, PutPropertySlot&)
 {
 }
 
 static JSValue JSC_HOST_CALL callObjCFallbackObject(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue.isObject(&RuntimeObjectImp::s_info))
+    if (!thisValue.inherits(&RuntimeObjectImp::s_info))
         return throwError(exec, TypeError);
 
     JSValue result = jsUndefined();
diff --git a/WebCore/bridge/qt/qt_class.h b/WebCore/bridge/qt/qt_class.h
index 19d4207..dc6b130 100644
--- a/WebCore/bridge/qt/qt_class.h
+++ b/WebCore/bridge/qt/qt_class.h
@@ -26,7 +26,7 @@
 
 QT_BEGIN_NAMESPACE
 class QObject;
-class QMetaObject;
+struct QMetaObject;
 QT_END_NAMESPACE
 
 namespace JSC {
diff --git a/WebCore/bridge/qt/qt_instance.cpp b/WebCore/bridge/qt/qt_instance.cpp
index 506697a..0546014 100644
--- a/WebCore/bridge/qt/qt_instance.cpp
+++ b/WebCore/bridge/qt/qt_instance.cpp
@@ -43,30 +43,21 @@ namespace Bindings {
 typedef QMultiHash<void*, QtInstance*> QObjectInstanceMap;
 static QObjectInstanceMap cachedInstances;
 
-// Cache JSObjects
-typedef QHash<QtInstance*, JSObject*> InstanceJSObjectMap;
-static InstanceJSObjectMap cachedObjects;
-
 // Derived RuntimeObject
 class QtRuntimeObjectImp : public RuntimeObjectImp {
 public:
     QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
-    ~QtRuntimeObjectImp();
-    virtual void invalidate();
 
     static const ClassInfo s_info;
 
-    virtual void mark()
+    virtual void markChildren(MarkStack& markStack)
     {
+        RuntimeObjectImp::markChildren(markStack);
         QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
         if (instance)
-            instance->mark();
-        RuntimeObjectImp::mark();
+            instance->markAggregate(markStack);
     }
 
-protected:
-    void removeFromCache();
-        
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
 };
@@ -78,25 +69,6 @@ QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> ins
 {
 }
 
-QtRuntimeObjectImp::~QtRuntimeObjectImp()
-{
-    removeFromCache();
-}
-
-void QtRuntimeObjectImp::invalidate()
-{
-    removeFromCache();
-    RuntimeObjectImp::invalidate();
-}
-
-void QtRuntimeObjectImp::removeFromCache()
-{
-    JSLock lock(SilenceAssertionsOnly);
-    QtInstance* key = cachedObjects.key(this);
-    if (key)
-        cachedObjects.remove(key);
-}
-
 // QtInstance
 QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject, QScriptEngine::ValueOwnership ownership)
     : Instance(rootObject)
@@ -112,7 +84,6 @@ QtInstance::~QtInstance()
 {
     JSLock lock(SilenceAssertionsOnly);
 
-    cachedObjects.remove(this);
     cachedInstances.remove(m_hashkey);
 
     // clean up (unprotect from gc) the JSValues we've created
@@ -190,25 +161,19 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
-RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
+RuntimeObjectImp* QtInstance::newRuntimeObject(ExecState* exec)
 {
     JSLock lock(SilenceAssertionsOnly);
-    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    if (!ret) {
-        ret = new (exec) QtRuntimeObjectImp(exec, this);
-        cachedObjects.insert(this, ret);
-        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
-    }
-    return ret;
+    return new (exec) QtRuntimeObjectImp(exec, this);
 }
 
-void QtInstance::mark()
+void QtInstance::markAggregate(MarkStack& markStack)
 {
-    if (m_defaultMethod && !m_defaultMethod->marked())
-        m_defaultMethod->mark();
+    if (m_defaultMethod)
+        markStack.append(m_defaultMethod);
     foreach(JSObject* val, m_methods.values()) {
-        if (val && !val->marked())
-            val->mark();
+        if (val)
+            markStack.append(val);
     }
 }
 
diff --git a/WebCore/bridge/qt/qt_instance.h b/WebCore/bridge/qt/qt_instance.h
index 23766b1..00aaa5b 100644
--- a/WebCore/bridge/qt/qt_instance.h
+++ b/WebCore/bridge/qt/qt_instance.h
@@ -40,7 +40,7 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
@@ -48,7 +48,7 @@ public:
     virtual JSValue valueOf(ExecState*) const;
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual void mark(); // This isn't inherited
+    void markAggregate(MarkStack&);
 
     virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
diff --git a/WebCore/bridge/qt/qt_runtime.cpp b/WebCore/bridge/qt/qt_runtime.cpp
index 6be119c..3cb2156 100644
--- a/WebCore/bridge/qt/qt_runtime.cpp
+++ b/WebCore/bridge/qt/qt_runtime.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "qt_runtime.h"
 
+#include "BooleanObject.h"
 #include "DateInstance.h"
 #include "DateMath.h"
 #include "DatePrototype.h"
@@ -46,9 +47,9 @@
 #include <JSFunction.h>
 #include <limits.h>
 #include <runtime.h>
+#include <runtime/Error.h>
 #include <runtime_array.h>
 #include <runtime_object.h>
-#include "BooleanObject.h"
 
 // QtScript has these
 Q_DECLARE_METATYPE(QObjectList);
@@ -1162,7 +1163,7 @@ static int findMethodIndex(ExecState* exec,
         }
 
         // If the native method requires more arguments than what was passed from JavaScript
-        if (jsArgs.size() < (types.count() - 1)) {
+        if (jsArgs.size() + 1 < static_cast<unsigned>(types.count())) {
             qMatchDebug() << "Match:too few args for" << method.signature();
             tooFewArgs.append(index);
             continue;
@@ -1185,7 +1186,7 @@ static int findMethodIndex(ExecState* exec,
 
         bool converted = true;
         int matchDistance = 0;
-        for (int i = 0; converted && i < types.count() - 1; ++i) {
+        for (unsigned i = 0; converted && i + 1 < static_cast<unsigned>(types.count()); ++i) {
             JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
@@ -1202,7 +1203,7 @@ static int findMethodIndex(ExecState* exec,
         qMatchDebug() << "Match: " << method.signature() << (converted ? "converted":"failed to convert") << "distance " << matchDistance;
 
         if (converted) {
-            if ((jsArgs.size() == types.count() - 1)
+            if ((jsArgs.size() + 1 == static_cast<unsigned>(types.count()))
                 && (matchDistance == 0)) {
                 // perfect match, use this one
                 chosenIndex = index;
@@ -1328,17 +1329,17 @@ QtRuntimeMetaMethod::QtRuntimeMetaMethod(ExecState* exec, const Identifier& iden
     d->m_allowPrivate = allowPrivate;
 }
 
-void QtRuntimeMetaMethod::mark()
+void QtRuntimeMetaMethod::markChildren(MarkStack& markStack)
 {
-    QtRuntimeMethod::mark();
+    QtRuntimeMethod::markChildren(markStack);
     QW_D(QtRuntimeMetaMethod);
     if (d->m_connect)
-        d->m_connect->mark();
+        markStack.append(d->m_connect);
     if (d->m_disconnect)
-        d->m_disconnect->mark();
+        markStack.append(d->m_disconnect);
 }
 
-JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
+JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1436,7 +1437,7 @@ QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, const Iden
     d->m_isConnect = isConnect;
 }
 
-JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
+JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
diff --git a/WebCore/bridge/qt/qt_runtime.h b/WebCore/bridge/qt/qt_runtime.h
index 72d93eb..edb577c 100644
--- a/WebCore/bridge/qt/qt_runtime.h
+++ b/WebCore/bridge/qt/qt_runtime.h
@@ -167,7 +167,7 @@ public:
 
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
 
-    virtual void mark();
+    virtual void markChildren(MarkStack& markStack);
 
 protected:
     QtRuntimeMetaMethodData* d_func() const {return reinterpret_cast<QtRuntimeMetaMethodData*>(d_ptr);}
diff --git a/WebCore/bridge/runtime.cpp b/WebCore/bridge/runtime.cpp
index 6934406..eac8586 100644
--- a/WebCore/bridge/runtime.cpp
+++ b/WebCore/bridge/runtime.cpp
@@ -48,12 +48,14 @@ Array::~Array()
 
 Instance::Instance(PassRefPtr<RootObject> rootObject)
     : _rootObject(rootObject)
+    , m_runtimeObject(0)
 {
     ASSERT(_rootObject);
 }
 
 Instance::~Instance()
 {
+    ASSERT(!m_runtimeObject);
 }
 
 static KJSDidExecuteFunctionPtr s_didExecuteFunction;
@@ -80,11 +82,37 @@ void Instance::end()
 
 RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
 {
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    if (m_runtimeObject)
+        return m_runtimeObject;
+    JSLock lock(SilenceAssertionsOnly);
+    m_runtimeObject = newRuntimeObject(exec);
+    _rootObject->addRuntimeObject(m_runtimeObject);
+    return m_runtimeObject;
+}
+
+RuntimeObjectImp* Instance::newRuntimeObject(ExecState* exec)
+{
     JSLock lock(SilenceAssertionsOnly);
-    
     return new (exec) RuntimeObjectImp(exec, this);
 }
 
+void Instance::willDestroyRuntimeObject()
+{
+    ASSERT(_rootObject);
+    ASSERT(_rootObject->isValid());
+    ASSERT(m_runtimeObject);
+    _rootObject->removeRuntimeObject(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
+void Instance::willInvalidateRuntimeObject()
+{
+    ASSERT(m_runtimeObject);
+    m_runtimeObject = 0;
+}
+
 RootObject* Instance::rootObject() const 
 { 
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
diff --git a/WebCore/bridge/runtime.h b/WebCore/bridge/runtime.h
index 2f74a4e..6682a97 100644
--- a/WebCore/bridge/runtime.h
+++ b/WebCore/bridge/runtime.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -86,8 +86,10 @@ public:
     void begin();
     void end();
     
-    virtual Class *getClass() const = 0;
-    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
+    virtual Class* getClass() const = 0;
+    RuntimeObjectImp* createRuntimeObject(ExecState*);
+    void willInvalidateRuntimeObject();
+    void willDestroyRuntimeObject();
     
     // Returns false if the value was not set successfully.
     virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
@@ -111,13 +113,18 @@ public:
     virtual ~Instance();
 
     virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&) { return false; }
     virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
     virtual void virtualEnd() { }
+    virtual RuntimeObjectImp* newRuntimeObject(ExecState*);
 
     RefPtr<RootObject> _rootObject;
+
+private:
+    RuntimeObjectImp* m_runtimeObject;
 };
 
 class Array : public Noncopyable {
diff --git a/WebCore/bridge/runtime_array.cpp b/WebCore/bridge/runtime_array.cpp
index 2849822..feadb07 100644
--- a/WebCore/bridge/runtime_array.cpp
+++ b/WebCore/bridge/runtime_array.cpp
@@ -75,6 +75,29 @@ bool RuntimeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeArray::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    bool ok;
+    unsigned index = propertyName.toArrayIndex(&ok);
+    if (ok) {
+        if (index < getLength()) {
+            PropertySlot slot;
+            slot.setCustomIndex(this, index, indexGetter);
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | DontEnum);
+            return true;
+        }
+    }
+    
+    return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 bool RuntimeArray::getOwnPropertySlot(ExecState *exec, unsigned index, PropertySlot& slot)
 {
     if (index < getLength()) {
diff --git a/WebCore/bridge/runtime_array.h b/WebCore/bridge/runtime_array.h
index 5a86e9d..f614f7f 100644
--- a/WebCore/bridge/runtime_array.h
+++ b/WebCore/bridge/runtime_array.h
@@ -37,6 +37,7 @@ public:
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState *, const Identifier&, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual void put(ExecState*, unsigned propertyName, JSValue);
     
diff --git a/WebCore/bridge/runtime_method.cpp b/WebCore/bridge/runtime_method.cpp
index 0af0af5..ffe4c0a 100644
--- a/WebCore/bridge/runtime_method.cpp
+++ b/WebCore/bridge/runtime_method.cpp
@@ -73,6 +73,18 @@ bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
+bool RuntimeMethod::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor &descriptor)
+{
+    if (propertyName == exec->propertyNames().length) {
+        PropertySlot slot;
+        slot.setCustom(this, lengthGetter);
+        descriptor.setDescriptor(slot.getValue(exec, propertyName), ReadOnly | DontDelete | DontEnum);
+        return true;
+    }
+    
+    return InternalFunction::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
@@ -82,13 +94,13 @@ static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* functi
     
     RuntimeObjectImp* imp;
 
-    if (thisValue.isObject(&RuntimeObjectImp::s_info)) {
+    if (thisValue.inherits(&RuntimeObjectImp::s_info)) {
         imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
         JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value.isObject(&RuntimeObjectImp::s_info))    
+        if (value.inherits(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
             return throwError(exec, TypeError);
diff --git a/WebCore/bridge/runtime_method.h b/WebCore/bridge/runtime_method.h
index 5333c14..3233ffa 100644
--- a/WebCore/bridge/runtime_method.h
+++ b/WebCore/bridge/runtime_method.h
@@ -53,6 +53,7 @@ public:
 private:
     static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
     virtual CallType getCallData(CallData&);
 
     OwnPtr<Bindings::MethodList> _methodList;
diff --git a/WebCore/bridge/runtime_object.cpp b/WebCore/bridge/runtime_object.cpp
index 385f914..9583fb2 100644
--- a/WebCore/bridge/runtime_object.cpp
+++ b/WebCore/bridge/runtime_object.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,6 @@
 
 #include "JSDOMBinding.h"
 #include "runtime_method.h"
-#include "runtime_root.h"
 #include <runtime/Error.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -40,38 +39,38 @@ using namespace Bindings;
 
 const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
 
-RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> i)
+RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
     // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
     // We need to pass in the right global object for "i".
     : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
-    
-RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> i)
+
+RuntimeObjectImp::RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
     : JSObject(structure)
-    , instance(i)
+    , m_instance(instance)
 {
-    instance->rootObject()->addRuntimeObject(this);
 }
 
 RuntimeObjectImp::~RuntimeObjectImp()
 {
-    if (instance)
-        instance->rootObject()->removeRuntimeObject(this);
+    if (m_instance)
+        m_instance->willDestroyRuntimeObject();
 }
 
 void RuntimeObjectImp::invalidate()
 {
-    ASSERT(instance);
-    instance = 0;
+    ASSERT(m_instance);
+    if (m_instance)
+        m_instance->willInvalidateRuntimeObject();
+    m_instance = 0;
 }
 
 JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -89,7 +88,7 @@ JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier
 JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -108,7 +107,7 @@ JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propert
 JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
-    RefPtr<Instance> instance = thisObj->instance;
+    RefPtr<Instance> instance = thisObj->m_instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -126,11 +125,13 @@ JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& proper
 
 bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return false;
     }
     
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     
     Class *aClass = instance->getClass();
@@ -167,14 +168,63 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
+bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (!m_instance) {
+        throwInvalidAccessError(exec);
+        return false;
+    }
+    
+    RefPtr<Instance> instance = m_instance;
+    instance->begin();
+    
+    Class *aClass = instance->getClass();
+    
+    if (aClass) {
+        // See if the instance has a field with the specified name.
+        Field *aField = aClass->fieldNamed(propertyName, instance.get());
+        if (aField) {
+            PropertySlot slot;
+            slot.setCustom(this, fieldGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete);
+            return true;
+        } else {
+            // Now check if a method with specified name exists, if so return a function object for
+            // that method.
+            MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
+            if (methodList.size() > 0) {
+                PropertySlot slot;
+                slot.setCustom(this, methodGetter);
+                instance->end();
+                descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly);
+                return true;
+            }
+        }
+        
+        // Try a fallback object.
+        if (!aClass->fallbackObject(exec, instance.get(), propertyName).isUndefined()) {
+            PropertySlot slot;
+            slot.setCustom(this, fallbackObjectGetter);
+            instance->end();
+            descriptor.setDescriptor(slot.getValue(exec, propertyName), DontDelete | ReadOnly | DontEnum);
+            return true;
+        }
+    }
+    
+    instance->end();
+    
+    return instance->getOwnPropertyDescriptor(this, exec, propertyName, descriptor);
+}
+
 void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
     instance->begin();
 
     // Set the value of the property.
@@ -195,10 +245,11 @@ bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
 
 JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
-    if (!instance)
+    if (!m_instance)
         return throwInvalidAccessError(exec);
     
-    RefPtr<Instance> protector(instance);
+    RefPtr<Instance> instance = m_instance;
+
     instance->begin();
     JSValue result = instance->defaultValue(exec, hint);
     instance->end();
@@ -216,8 +267,13 @@ static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* functi
 
 CallType RuntimeObjectImp::getCallData(CallData& callData)
 {
-    if (!instance || !instance->supportsInvokeDefaultMethod())
+    if (!m_instance)
         return CallTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsInvokeDefaultMethod())
+        return CallTypeNone;
+    
     callData.native.function = callRuntimeObject;
     return CallTypeHost;
 }
@@ -235,24 +291,36 @@ static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor,
 
 ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
 {
-    if (!instance || !instance->supportsConstruct())
+    if (!m_instance)
         return ConstructTypeNone;
+    
+    RefPtr<Instance> instance = m_instance;
+    if (!instance->supportsConstruct())
+        return ConstructTypeNone;
+    
     constructData.native.function = callRuntimeConstructor;
     return ConstructTypeHost;
 }
 
 void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
-    if (!instance) {
+    if (!m_instance) {
         throwInvalidAccessError(exec);
         return;
     }
+
+    RefPtr<Instance> instance = m_instance;
     
     instance->begin();
     instance->getPropertyNames(exec, propertyNames);
     instance->end();
 }
 
+void RuntimeObjectImp::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    getOwnPropertyNames(exec, propertyNames);
+}
+
 JSObject* RuntimeObjectImp::throwInvalidAccessError(ExecState* exec)
 {
     return throwError(exec, ReferenceError, "Trying to access object from destroyed plug-in.");
diff --git a/WebCore/bridge/runtime_object.h b/WebCore/bridge/runtime_object.h
index f01fe1e..f16778e 100644
--- a/WebCore/bridge/runtime_object.h
+++ b/WebCore/bridge/runtime_object.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,20 +34,22 @@ namespace JSC {
 class RuntimeObjectImp : public JSObject {
 public:
     RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+    virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
     virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
+    virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
     virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
-    
+
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+    virtual void getOwnPropertyNames(ExecState*, PropertyNameArray&);
+
+    void invalidate();
 
-    virtual void invalidate();
-    Bindings::Instance* getInternalInstance() const { return instance.get(); }
+    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
 
     static JSObject* throwInvalidAccessError(ExecState*);
 
@@ -64,7 +66,7 @@ public:
     }
 
 protected:
-    RuntimeObjectImp(ExecState*, PassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
+    RuntimeObjectImp(ExecState*, NonNullPassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
     virtual const ClassInfo* classInfo() const { return &s_info; }
@@ -73,7 +75,7 @@ private:
     static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
     static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
-    RefPtr<Bindings::Instance> instance;
+    RefPtr<Bindings::Instance> m_instance;
 };
     
 } // namespace
diff --git a/WebCore/config.h b/WebCore/config.h
index 21442bf..7460946 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2005, 2006 Apple Inc.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ -74,6 +75,7 @@
 
 #endif /* PLATFORM(WIN_OS) */
 
+<<<<<<< HEAD:WebCore/config.h
 // On MSW, wx headers need to be included before windows.h is.
 // The only way we can always ensure this is if we include wx here.
 #if PLATFORM(WX)
@@ -138,6 +140,8 @@
 #define ENABLE_GEOLOCATION 1
 #endif  // PLATFORM(ANDROID)
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/config.h
 #ifdef __cplusplus
 
 // These undefs match up with defines in WebCorePrefix.h for Mac OS X.
@@ -148,10 +152,19 @@
 
 #endif
 
+// On MSW, wx headers need to be included before windows.h is.
+// The only way we can always ensure this is if we include wx here.
+#if PLATFORM(WX)
+// The defines in KeyboardCodes.h conflict with Windows as well, and the only way I've found
+// to address the problem is include KeyboarddCodes.h before windows.h, so do it here.
+#include "KeyboardCodes.h"
+#include <wx/defs.h>
+#endif
+
 // this breaks compilation of <QFontDatabase>, at least, so turn it off for now
 // Also generates errors on wx on Windows, presumably because these functions
 // are used from wx headers.
-#if !PLATFORM(QT) && !PLATFORM(WX)
+#if !PLATFORM(QT) && !PLATFORM(WX) && !PLATFORM(CHROMIUM)
 #include <wtf/DisallowCType.h>
 #endif
 
@@ -211,13 +224,30 @@
 #include <wtf/MathExtras.h>
 #endif
 
-#if !defined(WTF_USE_V8)
-/* Currently Chromium is the only platform which uses V8 by default */
 #if PLATFORM(CHROMIUM)
+
+#if !PLATFORM(DARWIN)
+// Define SKIA on non-Mac.
+#define WTF_PLATFORM_SKIA 1
+#endif /* !PLATFORM(DARWIN) */
+
+// Chromium uses this file instead of JavaScriptCore/config.h to compile
+// JavaScriptCore/wtf (chromium doesn't compile the rest of JSC). Therefore,
+// this define is required.
+#define WTF_CHANGES 1
+
+#define WTF_USE_GOOGLEURL 1
+
+#if !defined(WTF_USE_V8)
 #define WTF_USE_V8 1
-#else
-#define WTF_USE_V8 0
+#endif
+
+#undef WTF_USE_CFNETWORK
+
 #endif /* PLATFORM(CHROMIUM) */
+
+#if !defined(WTF_USE_V8)
+#define WTF_USE_V8 0
 #endif /* !defined(WTF_USE_V8) */
 
 /* Using V8 implies not using JSC and vice versa */
diff --git a/WebCore/css/CSSCanvasValue.cpp b/WebCore/css/CSSCanvasValue.cpp
index cf8cb42..0c1c3f9 100644
--- a/WebCore/css/CSSCanvasValue.cpp
+++ b/WebCore/css/CSSCanvasValue.cpp
@@ -47,15 +47,15 @@ String CSSCanvasValue::cssText() const
 void CSSCanvasValue::canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect)
 {
     IntRect imageChangeRect = enclosingIntRect(changedRect);
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this), &imageChangeRect);
 }
 
 void CSSCanvasValue::canvasResized(HTMLCanvasElement*)
 {
-    HashMap<RenderObject*, IntSize>::const_iterator end = m_clients.end();
-    for (HashMap<RenderObject*, IntSize>::const_iterator curr = m_clients.begin(); curr != end; ++curr)
+    RenderObjectSizeCountMap::const_iterator end = m_clients.end();
+    for (RenderObjectSizeCountMap::const_iterator curr = m_clients.begin(); curr != end; ++curr)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 8a91140..34b93c1 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -62,6 +62,7 @@ static const int computedProperties[] = {
     CSSPropertyBackgroundOrigin,
     CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
+    CSSPropertyBackgroundSize,
     CSSPropertyBorderBottomColor,
     CSSPropertyBorderBottomLeftRadius,
     CSSPropertyBorderBottomRightRadius,
@@ -80,7 +81,6 @@ static const int computedProperties[] = {
     CSSPropertyBorderTopStyle,
     CSSPropertyBorderTopWidth,
     CSSPropertyBottom,
-    CSSPropertyBoxShadow,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
     CSSPropertyClip,
@@ -132,6 +132,7 @@ static const int computedProperties[] = {
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
     CSSPropertyTextIndent,
+    CSSPropertyTextRendering,
     CSSPropertyTextShadow,
     CSSPropertyTextOverflow,
     CSSPropertyTextTransform,
@@ -160,7 +161,6 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
-    CSSPropertyWebkitBackgroundSize,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -174,6 +174,7 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBoxOrient,
     CSSPropertyWebkitBoxPack,
     CSSPropertyWebkitBoxReflect,
+    CSSPropertyWebkitBoxShadow,
     CSSPropertyWebkitBoxSizing,
     CSSPropertyWebkitColumnBreakAfter,
     CSSPropertyWebkitColumnBreakBefore,
@@ -187,6 +188,7 @@ static const int computedProperties[] = {
 #if ENABLE(DASHBOARD_SUPPORT)
     CSSPropertyWebkitDashboardRegion,
 #endif
+    CSSPropertyWebkitFontSmoothing,
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -255,7 +257,6 @@ static const int computedProperties[] = {
     CSSPropertyStrokeMiterlimit,
     CSSPropertyStrokeOpacity,
     CSSPropertyStrokeWidth,
-    CSSPropertyTextRendering,
     CSSPropertyAlignmentBaseline,
     CSSPropertyBaselineShift,
     CSSPropertyDominantBaseline,
@@ -627,6 +628,32 @@ static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecorati
     return list;
 }
 
+static PassRefPtr<CSSValue> fillRepeatToCSSValue(EFillRepeat xRepeat, EFillRepeat yRepeat)
+{
+    // For backwards compatibility, if both values are equal, just return one of them. And
+    // if the two values are equivalent to repeat-x or repeat-y, just return the shorthand.
+    if (xRepeat == yRepeat)
+        return CSSPrimitiveValue::create(xRepeat);
+    if (xRepeat == CSSValueRepeat && yRepeat == CSSValueNoRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatX);
+    if (xRepeat == CSSValueNoRepeat && yRepeat == CSSValueRepeat)
+        return CSSPrimitiveValue::createIdentifier(CSSValueRepeatY);
+
+    RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+    list->append(CSSPrimitiveValue::create(xRepeat));
+    list->append(CSSPrimitiveValue::create(yRepeat));
+    return list.release();
+}
+
+static void logUnimplementedPropertyID(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(HashSet<int>, propertyIDSet, ());
+    if (!propertyIDSet.add(propertyID).second)
+        return;
+
+    LOG_ERROR("WebKit does not yet implement getComputedStyle for '%s'.", getPropertyName(static_cast<CSSPropertyID>(propertyID)));
+} 
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -661,14 +688,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (style->backgroundImage())
                 return style->backgroundImage()->cssValue();
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
-        case CSSPropertyWebkitBackgroundSize: {
+        case CSSPropertyBackgroundSize: {
+            EFillSizeType size = style->backgroundSizeType();
+            if (size == Contain)
+                return CSSPrimitiveValue::createIdentifier(CSSValueContain);
+            if (size == Cover)
+                return CSSPrimitiveValue::createIdentifier(CSSValueCover);
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().width()));
-            list->append(CSSPrimitiveValue::create(style->backgroundSize().height()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().width()));
+            list->append(CSSPrimitiveValue::create(style->backgroundSizeLength().height()));
             return list.release();
         }  
         case CSSPropertyBackgroundRepeat:
-            return CSSPrimitiveValue::create(style->backgroundRepeat());
+            return fillRepeatToCSSValue(style->backgroundRepeatX(), style->backgroundRepeatY());
         case CSSPropertyWebkitBackgroundComposite:
             return CSSPrimitiveValue::create(style->backgroundComposite());
         case CSSPropertyBackgroundAttachment:
@@ -756,7 +788,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         }
         case CSSPropertyWebkitBoxReflect:
             return valueForReflection(style->boxReflect());
-        case CSSPropertyBoxShadow:
+        case CSSPropertyWebkitBoxShadow:
             return valueForShadow(style->boxShadow(), static_cast<CSSPropertyID>(propertyID));
         case CSSPropertyCaptionSide:
             return CSSPrimitiveValue::create(style->captionSide());
@@ -942,7 +974,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return list.release();
         }  
         case CSSPropertyWebkitMaskRepeat:
-            return CSSPrimitiveValue::create(style->maskRepeat());
+            return fillRepeatToCSSValue(style->maskRepeatX(), style->maskRepeatY());
         case CSSPropertyWebkitMaskAttachment:
             return CSSPrimitiveValue::create(style->maskAttachment());
         case CSSPropertyWebkitMaskComposite:
@@ -1053,6 +1085,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
             return valueForShadow(style->textShadow(), static_cast<CSSPropertyID>(propertyID));
+        case CSSPropertyTextRendering:
+            return CSSPrimitiveValue::create(style->fontDescription().textRenderingMode());
         case CSSPropertyTextOverflow:
             if (style->textOverflow())
                 return CSSPrimitiveValue::createIdentifier(CSSValueEllipsis);
@@ -1141,6 +1175,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->matchNearestMailBlockquoteColor());
         case CSSPropertyResize:
             return CSSPrimitiveValue::create(style->resize());
+        case CSSPropertyWebkitFontSmoothing:
+            return CSSPrimitiveValue::create(style->fontDescription().fontSmoothing());
         case CSSPropertyZIndex:
             if (style->hasAutoZIndex())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
@@ -1435,7 +1471,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 #endif
     }
 
-    LOG_ERROR("unimplemented propertyID: %d", propertyID);
+    logUnimplementedPropertyID(propertyID);
     return 0;
 }
 
diff --git a/WebCore/css/CSSCursorImageValue.cpp b/WebCore/css/CSSCursorImageValue.cpp
index 13c55a8..c1a517c 100644
--- a/WebCore/css/CSSCursorImageValue.cpp
+++ b/WebCore/css/CSSCursorImageValue.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 #if ENABLE(SVG)
 static inline bool isSVGCursorIdentifier(const String& url)
 {
-    KURL kurl(url);
+    KURL kurl(ParsedURLString, url);
     return kurl.hasFragmentIdentifier();
 }
 
diff --git a/WebCore/css/CSSImageGeneratorValue.cpp b/WebCore/css/CSSImageGeneratorValue.cpp
index 6e23d95..4cf0873 100644
--- a/WebCore/css/CSSImageGeneratorValue.cpp
+++ b/WebCore/css/CSSImageGeneratorValue.cpp
@@ -49,24 +49,42 @@ void CSSImageGeneratorValue::addClient(RenderObject* renderer, const IntSize& si
     ref();
     if (!size.isEmpty())
         m_sizes.add(size);
-    m_clients.add(renderer, size);
+    
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    if (it == m_clients.end())
+        m_clients.add(renderer, SizeCountPair(size, 1));
+    else {
+        SizeCountPair& sizeCount = it->second;
+        ++sizeCount.second;
+    }
 }
 
 void CSSImageGeneratorValue::removeClient(RenderObject* renderer)
 {
-    IntSize size = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize size = sizeCount.first;
     if (!size.isEmpty()) {
         m_sizes.remove(size);
         if (!m_sizes.contains(size))
             m_images.remove(size);
     }
-    m_clients.remove(renderer);
+    
+    if (!--sizeCount.second)
+        m_clients.remove(renderer);
+
     deref();
 }
 
 Image* CSSImageGeneratorValue::getImage(RenderObject* renderer, const IntSize& size)
 {
-    IntSize oldSize = m_clients.get(renderer);
+    RenderObjectSizeCountMap::iterator it = m_clients.find(renderer);
+    ASSERT(it != m_clients.end());
+
+    SizeCountPair& sizeCount = it->second;
+    IntSize oldSize = sizeCount.first;
     if (oldSize != size) {
         removeClient(renderer);
         addClient(renderer, size);
diff --git a/WebCore/css/CSSImageGeneratorValue.h b/WebCore/css/CSSImageGeneratorValue.h
index 661fd37..c053bfe 100644
--- a/WebCore/css/CSSImageGeneratorValue.h
+++ b/WebCore/css/CSSImageGeneratorValue.h
@@ -57,8 +57,11 @@ protected:
     Image* getImage(RenderObject*, const IntSize&);
     void putImage(const IntSize&, PassRefPtr<Image>);
 
+    typedef pair<IntSize, int> SizeCountPair;
+    typedef HashMap<RenderObject*, SizeCountPair> RenderObjectSizeCountMap;
+
     HashCountedSet<IntSize> m_sizes; // A count of how many times a given image size is in use.
-    HashMap<RenderObject*, IntSize> m_clients; // A map from RenderObjects to image sizes.
+    RenderObjectSizeCountMap m_clients; // A map from RenderObjects (with entry count) to image sizes.
     HashMap<IntSize, RefPtr<Image> > m_images; // A cache of Image objects by image size.
     
     RefPtr<StyleGeneratedImage> m_image;
diff --git a/WebCore/css/CSSImageValue.cpp b/WebCore/css/CSSImageValue.cpp
index 7fc99bb..3432a4e 100644
--- a/WebCore/css/CSSImageValue.cpp
+++ b/WebCore/css/CSSImageValue.cpp
@@ -63,7 +63,7 @@ StyleCachedImage* CSSImageValue::cachedImage(DocLoader* loader, const String& ur
             cachedImage = loader->requestImage(url);
         else {
             // FIXME: Should find a way to make these images sit in their own memory partition, since they are user agent images.
-            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(url), String()));
+            cachedImage = static_cast<CachedImage*>(cache()->requestResource(0, CachedResource::ImageResource, KURL(ParsedURLString, url), String()));
         }
 
         if (cachedImage) {
diff --git a/WebCore/css/CSSImportRule.cpp b/WebCore/css/CSSImportRule.cpp
index 50e60f4..6e62f6d 100644
--- a/WebCore/css/CSSImportRule.cpp
+++ b/WebCore/css/CSSImportRule.cpp
@@ -1,7 +1,7 @@
 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2002, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2002, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,6 +26,8 @@
 #include "DocLoader.h"
 #include "Document.h"
 #include "MediaList.h"
+#include "Settings.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -60,7 +62,20 @@ void CSSImportRule::setCSSStyleSheet(const String& url, const String& charset, c
 
     CSSStyleSheet* parent = parentStyleSheet();
     bool strict = !parent || parent->useStrictParsing();
-    m_styleSheet->parseString(sheet->sheetText(strict), strict);
+    String sheetText = sheet->sheetText(strict);
+    m_styleSheet->parseString(sheetText, strict);
+
+    if (strict && parent && parent->doc() && parent->doc()->settings() && parent->doc()->settings()->needsSiteSpecificQuirks()) {
+        // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+        DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+        DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
+        if (url.endsWith(slashKHTMLFixesDotCss) && sheetText == mediaWikiKHTMLFixesStyleSheet) {
+            ASSERT(m_styleSheet->length() == 1);
+            ExceptionCode ec;
+            m_styleSheet->deleteRule(0, ec);
+        }
+    }
+
     m_loading = false;
 
     if (parent)
@@ -85,7 +100,7 @@ void CSSImportRule::insertedIntoParent()
     String absHref = m_strHref;
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
 
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
@@ -96,7 +111,10 @@ void CSSImportRule::insertedIntoParent()
         root = curr;
     }
 
-    m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
+    if (parentSheet->isUserStyleSheet())
+        m_cachedSheet = docLoader->requestUserCSSStyleSheet(absHref, parentSheet->charset());
+    else
+        m_cachedSheet = docLoader->requestCSSStyleSheet(absHref, parentSheet->charset());
     if (m_cachedSheet) {
         // if the import rule is issued dynamically, the sheet may be
         // removed from the pending sheet count, so let the doc know
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index 8ff5300..2dd2f5d 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -28,6 +28,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
+#include "CSSValueKeywords.h"
 #include "CSSValueList.h"
 #include "Document.h"
 #include "ExceptionCode.h"
@@ -110,15 +111,24 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
     switch (propertyID) {
         case CSSPropertyBackgroundPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyBackgroundPositionX,
-                                        CSSPropertyBackgroundPositionY };
+            const int properties[2] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyBackgroundRepeat: {
+            const int properties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyBackground: {
-            const int properties[7] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
-                                        CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundClip,
-                                        CSSPropertyBackgroundOrigin, CSSPropertyBackgroundColor };
-            return getLayeredShorthandValue(properties, 7);
+            const int properties[9] = { CSSPropertyBackgroundColor,
+                                        CSSPropertyBackgroundImage, 
+                                        CSSPropertyBackgroundRepeatX, 
+                                        CSSPropertyBackgroundRepeatY, 
+                                        CSSPropertyBackgroundAttachment, 
+                                        CSSPropertyBackgroundPositionX, 
+                                        CSSPropertyBackgroundPositionY, 
+                                        CSSPropertyBackgroundClip,
+                                        CSSPropertyBackgroundOrigin }; 
+            return getLayeredShorthandValue(properties, 9);
         }
         case CSSPropertyBorder: {
             const int properties[3][4] = {{ CSSPropertyBorderTopWidth,
@@ -206,8 +216,11 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
         }
         case CSSPropertyWebkitMaskPosition: {
             // FIXME: Is this correct? The code in cssparser.cpp is confusing
-            const int properties[2] = { CSSPropertyWebkitMaskPositionX,
-                                        CSSPropertyWebkitMaskPositionY };
+            const int properties[2] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
+            return getLayeredShorthandValue(properties, 2);
+        }
+        case CSSPropertyWebkitMaskRepeat: {
+            const int properties[2] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
             return getLayeredShorthandValue(properties, 2);
         }
         case CSSPropertyWebkitMask: {
@@ -286,6 +299,9 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
     // can safely be omitted.
     for (size_t i = 0; i < numLayers; i++) {
         String layerRes;
+        bool useRepeatXShorthand = false;
+        bool useRepeatYShorthand = false;
+        bool useSingleWordShorthand = false;
         for (size_t j = 0; j < number; j++) {
             RefPtr<CSSValue> value;
             if (values[j]) {
@@ -302,11 +318,50 @@ String CSSMutableStyleDeclaration::getLayeredShorthandValue(const int* propertie
                         value = 0;
                 }
             }
+
+            // We need to report background-repeat as it was written in the CSS. If the property is implicit,
+            // then it was written with only one value. Here we figure out which value that was so we can
+            // report back correctly. 
+            if (properties[j] == CSSPropertyBackgroundRepeatX && isPropertyImplicit(properties[j])) {
+                if (j < number - 1 && properties[j + 1] == CSSPropertyBackgroundRepeatY) {
+                    RefPtr<CSSValue> yValue;
+                    RefPtr<CSSValue> nextValue = values[j + 1];
+                    if (nextValue->isValueList())
+                        yValue = static_cast<CSSValueList*>(nextValue.get())->itemWithoutBoundsCheck(i);
+                    else
+                        yValue = nextValue;
+                        
+                    int xId = static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+                    int yId = static_cast<CSSPrimitiveValue*>(yValue.get())->getIdent();
+                    if (xId != yId) {
+                        if (xId == CSSValueRepeat && yId == CSSValueNoRepeat) {
+                            useRepeatXShorthand = true;
+                            ++j;
+                        } else if (xId == CSSValueNoRepeat && yId == CSSValueRepeat) {
+                            useRepeatYShorthand = true;
+                            continue;
+                        }
+                    } else {
+                        useSingleWordShorthand = true;
+                        ++j;
+                    }
+                }
+            }
             
             if (value && !value->isImplicitInitialValue()) {
                 if (!layerRes.isNull())
                     layerRes += " ";
-                layerRes += value->cssText();
+                if (useRepeatXShorthand) {
+                    useRepeatXShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatX);
+                } else if (useRepeatYShorthand) {
+                    useRepeatYShorthand = false;
+                    layerRes += getValueName(CSSValueRepeatY);
+                } else if (useSingleWordShorthand) {
+                    useSingleWordShorthand = false;
+                    layerRes += value->cssText();
+                } else
+                    layerRes += value->cssText();
             }
         }
         
@@ -583,6 +638,8 @@ String CSSMutableStyleDeclaration::cssText() const
     
     const CSSProperty* positionXProp = 0;
     const CSSProperty* positionYProp = 0;
+    const CSSProperty* repeatXProp = 0;
+    const CSSProperty* repeatYProp = 0;
     
     unsigned size = m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
@@ -591,6 +648,10 @@ String CSSMutableStyleDeclaration::cssText() const
             positionXProp = &prop;
         else if (prop.id() == CSSPropertyBackgroundPositionY)
             positionYProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatX)
+            repeatXProp = &prop;
+        else if (prop.id() == CSSPropertyBackgroundRepeatY)
+            repeatYProp = &prop;
         else
             result += prop.cssText();
     }
@@ -614,6 +675,22 @@ String CSSMutableStyleDeclaration::cssText() const
             result += positionYProp->cssText();
     }
 
+    // FIXME: We need to do the same for background-repeat.
+    if (repeatXProp && repeatYProp && repeatXProp->isImportant() == repeatYProp->isImportant()) {
+        String repeatValue;
+        const int repeatProperties[2] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+        if (repeatXProp->value()->isValueList() || repeatYProp->value()->isValueList()) 
+            repeatValue = getLayeredShorthandValue(repeatProperties, 2);
+        else
+            repeatValue = repeatXProp->value()->cssText() + " " + repeatYProp->value()->cssText();
+        result += "background-repeat: " + repeatValue + (repeatXProp->isImportant() ? " !important" : "") + "; ";
+    } else {
+        if (repeatXProp) 
+            result += repeatXProp->cssText();
+        if (repeatYProp)
+            result += repeatYProp->cssText();
+    }
+
     return result;
 }
 
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index b79992f..b7155b3 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -4,6 +4,7 @@
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -171,7 +172,7 @@ CSSParser::~CSSParser()
     }
     delete m_floatingMediaQueryExp;
     delete m_floatingMediaQuery;
-    deleteAllValues(m_floatingSelectors);
+    fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingValueLists);
     deleteAllValues(m_floatingFunctions);
     deleteAllValues(m_reusableSelectorVector);
@@ -747,7 +748,11 @@ bool CSSParser::parseValue(int propId, bool important)
         // inline | block | list-item | run-in | inline-block | table |
         // inline-table | table-row-group | table-header-group | table-footer-group | table-row |
         // table-column-group | table-column | table-cell | table-caption | box | inline-box | none | inherit
+#if ENABLE(WCSS)
+        if ((id >= CSSValueInline && id <= CSSValueWapMarquee) || id == CSSValueNone)
+#else
         if ((id >= CSSValueInline && id <= CSSValueWebkitInlineBox) || id == CSSValueNone)
+#endif
             valid_primitive = true;
         break;
 
@@ -920,8 +925,10 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackgroundPosition:
     case CSSPropertyBackgroundPositionX:
     case CSSPropertyBackgroundPositionY:
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
     case CSSPropertyBackgroundRepeat:
+    case CSSPropertyBackgroundRepeatX:
+    case CSSPropertyBackgroundRepeatY:
     case CSSPropertyWebkitMaskAttachment:
     case CSSPropertyWebkitMaskClip:
     case CSSPropertyWebkitMaskComposite:
@@ -931,17 +938,21 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitMaskPositionX:
     case CSSPropertyWebkitMaskPositionY:
     case CSSPropertyWebkitMaskSize:
-    case CSSPropertyWebkitMaskRepeat: {
+    case CSSPropertyWebkitMaskRepeat:
+    case CSSPropertyWebkitMaskRepeatX:
+    case CSSPropertyWebkitMaskRepeatY: {
         RefPtr<CSSValue> val1;
         RefPtr<CSSValue> val2;
         int propId1, propId2;
+        bool result = false;
         if (parseFillProperty(propId, propId1, propId2, val1, val2)) {
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
-            return true;
+            result = true;
         }
-        return false;
+        m_implicitShorthand = false;
+        return result;
     }
     case CSSPropertyListStyleImage:     // <uri> | none | inherit
         if (id == CSSValueNone) {
@@ -1231,7 +1242,7 @@ bool CSSParser::parseValue(int propId, bool important)
         valid_primitive = validUnit(value, FLength, m_strict);
         break;
     case CSSPropertyTextShadow: // CSS2 property, dropped in CSS2.1, back in CSS3, so treat as CSS3
-    case CSSPropertyBoxShadow:
+    case CSSPropertyWebkitBoxShadow:
         if (id == CSSValueNone)
             valid_primitive = true;
         else
@@ -1313,6 +1324,28 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             valid_primitive = validUnit(value, FTime|FInteger|FNonNeg, m_strict);
         break;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        if (id == CSSValueLtr || id == CSSValueRtl)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeStyle:
+        if (id == CSSValueNone || id == CSSValueSlide || id == CSSValueScroll || id == CSSValueAlternate)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWapMarqueeLoop:
+        if (id == CSSValueInfinite)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FInteger | FNonNeg, m_strict);
+        break;
+    case CSSPropertyWapMarqueeSpeed:
+        if (id == CSSValueNormal || id == CSSValueSlow || id == CSSValueFast)
+            valid_primitive = true;
+        else
+            valid_primitive = validUnit(value, FTime | FInteger | FNonNeg, m_strict);
+        break;
+#endif
     case CSSPropertyWebkitUserDrag: // auto | none | element
         if (id == CSSValueAuto || id == CSSValueNone || id == CSSValueElement)
             valid_primitive = true;
@@ -1452,6 +1485,11 @@ bool CSSParser::parseValue(int propId, bool important)
             id == CSSValueWave)
             valid_primitive = true;
         break;
+    case CSSPropertyTextRendering: // auto | optimizeSpeed | optimizeLegibility | geometricPrecision
+        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility
+            || id == CSSValueGeometricprecision)
+            valid_primitive = true;
+        break;
     case CSSPropertyTextLineThroughWidth:
     case CSSPropertyTextOverlineWidth:
     case CSSPropertyTextUnderlineWidth:
@@ -1542,6 +1580,12 @@ bool CSSParser::parseValue(int propId, bool important)
             valid_primitive = true;
         break;
 
+    case CSSPropertyWebkitFontSmoothing:
+        if (id == CSSValueAuto || id == CSSValueNone 
+            || id == CSSValueAntialiased || id == CSSValueSubpixelAntialiased)
+            valid_primitive = true;
+        break;
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion:                 // <dashboard-region> | <dashboard-region> 
         if (value->unit == CSSParserValue::Function || id == CSSValueNone)
@@ -1554,7 +1598,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyBackground: {
         // Position must come before color in this array because a plain old "0" is a legal color
         // in quirks mode but it's usually the X coordinate of a position.
-        // FIXME: Add CSSPropertyWebkitBackgroundSize to the shorthand.
+        // FIXME: Add CSSPropertyBackgroundSize to the shorthand.
         const int properties[] = { CSSPropertyBackgroundImage, CSSPropertyBackgroundRepeat, 
                                    CSSPropertyBackgroundAttachment, CSSPropertyBackgroundPosition, CSSPropertyBackgroundOrigin, 
                                    CSSPropertyBackgroundColor };
@@ -1736,7 +1780,7 @@ void CSSParser::addFillValue(RefPtr<CSSValue>& lval, PassRefPtr<CSSValue> rval)
         lval = rval;
 }
 
-const int cMaxFillProperties = 7;
+const int cMaxFillProperties = 9;
 
 bool CSSParser::parseFillShorthand(int propId, const int* properties, int numProperties, bool important)
 {
@@ -1750,6 +1794,7 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
     RefPtr<CSSValue> values[cMaxFillProperties];
     RefPtr<CSSValue> clipValue;
     RefPtr<CSSValue> positionYValue;
+    RefPtr<CSSValue> repeatYValue;
     int i;
 
     while (m_valueList->current()) {
@@ -1767,6 +1812,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], CSSInitialValue::createImplicit());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, CSSInitialValue::createImplicit());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, CSSInitialValue::createImplicit());
                     if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                         // If background-origin wasn't present, then reset background-clip also.
                         addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1789,6 +1836,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
                     addFillValue(values[i], val1.release());
                     if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                         addFillValue(positionYValue, val2.release());
+                    if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                        addFillValue(repeatYValue, val2.release());
                     if (properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) {
                         // Reparse the value as a clip, and see if we succeed.
                         if (parseFillProperty(CSSPropertyBackgroundClip, propId1, propId2, val1, val2))
@@ -1812,6 +1861,8 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addFillValue(values[i], CSSInitialValue::createImplicit());
             if (properties[i] == CSSPropertyBackgroundPosition || properties[i] == CSSPropertyWebkitMaskPosition)
                 addFillValue(positionYValue, CSSInitialValue::createImplicit());
+            if (properties[i] == CSSPropertyBackgroundRepeat || properties[i] == CSSPropertyWebkitMaskRepeat)
+                addFillValue(repeatYValue, CSSInitialValue::createImplicit());
             if ((properties[i] == CSSPropertyBackgroundOrigin || properties[i] == CSSPropertyWebkitMaskOrigin) && !parsedProperty[i]) {
                 // If background-origin wasn't present, then reset background-clip also.
                 addFillValue(clipValue, CSSInitialValue::createImplicit());
@@ -1829,6 +1880,14 @@ bool CSSParser::parseFillShorthand(int propId, const int* properties, int numPro
             addProperty(CSSPropertyWebkitMaskPositionX, values[i].release(), important);
             // it's OK to call positionYValue.release() since we only see CSSPropertyWebkitMaskPosition once
             addProperty(CSSPropertyWebkitMaskPositionY, positionYValue.release(), important);
+        } else if (properties[i] == CSSPropertyBackgroundRepeat) {
+            addProperty(CSSPropertyBackgroundRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyBackgroundRepeatY, repeatYValue.release(), important);
+        } else if (properties[i] == CSSPropertyWebkitMaskRepeat) {
+            addProperty(CSSPropertyWebkitMaskRepeatX, values[i].release(), important);
+            // it's OK to call repeatYValue.release() since we only see CSSPropertyBackgroundPosition once
+            addProperty(CSSPropertyWebkitMaskRepeatY, repeatYValue.release(), important);
         } else
             addProperty(properties[i], values[i].release(), important);
             
@@ -2156,7 +2215,7 @@ PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
     if (attrName[0] == '-')
         return 0;
 
-    if (document()->isHTMLDocument())
+    if (document() && document()->isHTMLDocument())
         attrName = attrName.lower();
     
     return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
@@ -2269,9 +2328,59 @@ void CSSParser::parseFillPosition(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& va
         value1.swap(value2);
 }
 
-PassRefPtr<CSSValue> CSSParser::parseFillSize()
+void CSSParser::parseFillRepeat(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& value2)
+{
+    CSSParserValue* value = m_valueList->current();
+
+    int id = m_valueList->current()->id;
+    if (id == CSSValueRepeatX) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        m_valueList->next();
+        return;
+    } 
+    if (id == CSSValueRepeatY) {
+        m_implicitShorthand = true;
+        value1 = CSSPrimitiveValue::createIdentifier(CSSValueNoRepeat);
+        value2 = CSSPrimitiveValue::createIdentifier(CSSValueRepeat);
+        m_valueList->next();
+        return;    
+    }
+    if (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)
+        value1 = CSSPrimitiveValue::createIdentifier(id);
+    else {
+        value1 = 0;
+        return;
+    }
+
+    value = m_valueList->next();
+
+    // First check for the comma.  If so, we are finished parsing this value or value pair.
+    if (value && value->unit == CSSParserValue::Operator && value->iValue == ',')
+        value = 0;
+
+    if (value)
+        id = m_valueList->current()->id;
+    
+    if (value && (id == CSSValueRepeat || id == CSSValueNoRepeat || id == CSSValueRound || id == CSSValueSpace)) {
+        value2 = CSSPrimitiveValue::createIdentifier(id);
+        m_valueList->next();
+    } else { 
+        // If only one value was specified, value2 is the same as value1.
+        m_implicitShorthand = true;
+        value2 = CSSPrimitiveValue::createIdentifier(static_cast<CSSPrimitiveValue*>(value1.get())->getIdent());
+    }
+}
+
+PassRefPtr<CSSValue> CSSParser::parseFillSize(bool& allowComma)
 {
+    allowComma = true;
     CSSParserValue* value = m_valueList->current();
+
+    if (value->id == CSSValueContain || value->id == CSSValueCover)
+        return CSSPrimitiveValue::createIdentifier(value->id);
+
     RefPtr<CSSPrimitiveValue> parsedValue1;
     
     if (value->id == CSSValueAuto)
@@ -2286,6 +2395,8 @@ PassRefPtr<CSSValue> CSSParser::parseFillSize()
     if ((value = m_valueList->next())) {
         if (value->id == CSSValueAuto)
             parsedValue2 = CSSPrimitiveValue::create(0, CSSPrimitiveValue::CSS_UNKNOWN);
+        else if (value->unit == CSSParserValue::Operator && value->iValue == ',')
+            allowComma = false;
         else {
             if (!validUnit(value, FLength|FPercent, m_strict))
                 return 0;
@@ -2316,6 +2427,12 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
     } else if (propId == CSSPropertyWebkitMaskPosition) {
         propId1 = CSSPropertyWebkitMaskPositionX;
         propId2 = CSSPropertyWebkitMaskPositionY;
+    } else if (propId == CSSPropertyBackgroundRepeat) {
+        propId1 = CSSPropertyBackgroundRepeatX;
+        propId2 = CSSPropertyBackgroundRepeatY;
+    } else if (propId == CSSPropertyWebkitMaskRepeat) {
+        propId1 = CSSPropertyWebkitMaskRepeatX;
+        propId2 = CSSPropertyWebkitMaskRepeatY;
     }
 
     while ((val = m_valueList->current())) {
@@ -2328,6 +2445,7 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
             m_valueList->next();
             allowComma = false;
         } else {
+            allowComma = true;
             switch (propId) {
                 case CSSPropertyBackgroundColor:
                     currValue = parseBackgroundColor();
@@ -2402,17 +2520,16 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                     break;
                 case CSSPropertyBackgroundRepeat:
                 case CSSPropertyWebkitMaskRepeat:
-                    if (val->id >= CSSValueRepeat && val->id <= CSSValueNoRepeat) {
-                        currValue = CSSPrimitiveValue::createIdentifier(val->id);
-                        m_valueList->next();
-                    }
+                    parseFillRepeat(currValue, currValue2);
+                    // parseFillRepeat advances the m_valueList pointer
                     break;
-                case CSSPropertyWebkitBackgroundSize:
-                case CSSPropertyWebkitMaskSize:
-                    currValue = parseFillSize();
+                case CSSPropertyBackgroundSize:
+                case CSSPropertyWebkitMaskSize: {
+                    currValue = parseFillSize(allowComma);
                     if (currValue)
                         m_valueList->next();
                     break;
+                }
             }
             if (!currValue)
                 return false;
@@ -2437,7 +2554,6 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 else
                     value2 = currValue2.release();
             }
-            allowComma = true;
         }
         
         // When parsing any fill shorthand property, we let it handle building up the lists for all
@@ -3554,7 +3670,7 @@ struct ShadowParseContext {
         , allowBlur(false)
         , allowSpread(false)
         , allowColor(true)
-        , allowStyle(prop == CSSPropertyBoxShadow)
+        , allowStyle(prop == CSSPropertyWebkitBoxShadow)
         , allowBreak(true)
     {
     }
@@ -3586,7 +3702,7 @@ struct ShadowParseContext {
         allowY = false;
         allowBlur = false;
         allowSpread = false;
-        allowStyle = property == CSSPropertyBoxShadow;
+        allowStyle = property == CSSPropertyWebkitBoxShadow;
     }
 
     void commitLength(CSSParserValue* v)
@@ -3605,12 +3721,12 @@ struct ShadowParseContext {
             allowY = false;
             allowBlur = true;
             allowColor = true;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
             allowBreak = true;
         } else if (allowBlur) {
             blur = val.release();
             allowBlur = false;
-            allowSpread = property == CSSPropertyBoxShadow;
+            allowSpread = property == CSSPropertyWebkitBoxShadow;
         } else if (allowSpread) {
             spread = val.release();
             allowSpread = false;
@@ -3627,7 +3743,7 @@ struct ShadowParseContext {
         } else {
             allowBlur = false;
             allowSpread = false;
-            allowStyle = property == CSSPropertyBoxShadow;
+            allowStyle = property == CSSPropertyWebkitBoxShadow;
         }
     }
 
@@ -4730,7 +4846,7 @@ UChar* CSSParser::text(int *length)
 
 CSSSelector* CSSParser::createFloatingSelector()
 {
-    CSSSelector* selector = new CSSSelector;
+    CSSSelector* selector = fastNew<CSSSelector>();
     m_floatingSelectors.add(selector);
     return selector;
 }
@@ -5126,11 +5242,11 @@ static int cssPropertyID(const UChar* propertyName, unsigned length)
                 const char* const opacity = "opacity";
                 name = opacity;
                 length = strlen(opacity);
-            } else if (strcmp(buffer, "-webkit-box-shadow") == 0) {
-                // CSS Backgrounds/Borders.  -webkit-box-shadow worked in Safari 4 and earlier.
-                const char* const boxShadow = "box-shadow";
-                name = boxShadow;
-                length = strlen(boxShadow);
+            } else if (strcmp(buffer, "-webkit-background-size") == 0) {
+                // CSS Backgrounds/Borders.  -webkit-background-size worked in Safari 4 and earlier.
+                const char* const backgroundSize = "background-size";
+                name = backgroundSize;
+                length = strlen(backgroundSize);
             } else if (hasPrefix(buffer + 7, length - 7, "-border-")) {
                 // -webkit-border-*-*-radius worked in Safari 4 and earlier. -webkit-border-radius syntax
                 // differs from border-radius, so it is remains as a distinct property.
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index 5a2b283..1a156da 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -82,7 +82,8 @@ namespace WebCore {
         bool parseFillImage(RefPtr<CSSValue>&);
         PassRefPtr<CSSValue> parseFillPositionXY(bool& xFound, bool& yFound);
         void parseFillPosition(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-        PassRefPtr<CSSValue> parseFillSize();
+        void parseFillRepeat(RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        PassRefPtr<CSSValue> parseFillSize(bool &allowComma);
         
         bool parseFillProperty(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseFillShorthand(int propId, const int* properties, int numProperties, bool important);
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 6343dac..1f2c9ca 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -643,7 +643,7 @@ Rect* CSSPrimitiveValue::getRectValue(ExceptionCode& ec) const
     return m_value.rect;
 }
 
-RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
+PassRefPtr<RGBColor> CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
 {
     ec = 0;
     if (m_type != CSS_RGBCOLOR) {
@@ -652,7 +652,7 @@ RGBColor* CSSPrimitiveValue::getRGBColorValue(ExceptionCode& ec) const
     }
 
     // FIMXE: This should not return a new object for each invocation.
-    return RGBColor::create(m_value.rgbcolor).releaseRef();
+    return RGBColor::create(m_value.rgbcolor);
 }
 
 Pair* CSSPrimitiveValue::getPairValue(ExceptionCode& ec) const
diff --git a/WebCore/css/CSSPrimitiveValue.h b/WebCore/css/CSSPrimitiveValue.h
index 85a0ba3..d417619 100644
--- a/WebCore/css/CSSPrimitiveValue.h
+++ b/WebCore/css/CSSPrimitiveValue.h
@@ -152,7 +152,7 @@ public:
     Rect* getRectValue(ExceptionCode&) const;
     Rect* getRectValue() const { return m_type != CSS_RECT ? 0 : m_value.rect; }
 
-    RGBColor* getRGBColorValue(ExceptionCode&) const;
+    PassRefPtr<RGBColor> getRGBColorValue(ExceptionCode&) const;
     RGBA32 getRGBA32Value() const { return m_type != CSS_RGBCOLOR ? 0 : m_value.rgbcolor; }
 
     Pair* getPairValue(ExceptionCode&) const;
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 69cfbb1..3616aa5 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2007 Alexey Proskuryakov <ap@nypop.com>.
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,11 +30,13 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
+#include "FontSmoothingMode.h"
 #include "GraphicsTypes.h"
 #include "Path.h"
 #include "RenderStyleConstants.h"
 #include "SVGRenderStyleDefs.h"
 #include "TextDirection.h"
+#include "TextRenderingMode.h"
 #include "ThemeTypes.h"
 
 namespace WebCore {
@@ -197,6 +200,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case ListboxPart:
             m_value.ident = CSSValueListbox;
             break;
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            m_value.ident = CSSValueListButton;
+            break;
+#endif
         case ListItemPart:
             m_value.ident = CSSValueListitem;
             break;
@@ -227,6 +235,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaSliderThumbPart:
             m_value.ident = CSSValueMediaSliderthumb;
             break;
+        case MediaVolumeSliderContainerPart:
+            m_value.ident = CSSValueMediaVolumeSliderContainer;
+            break;
+        case MediaVolumeSliderPart:
+            m_value.ident = CSSValueMediaVolumeSlider;
+            break;
+        case MediaVolumeSliderThumbPart:
+            m_value.ident = CSSValueMediaVolumeSliderthumb;
+            break;
         case MediaControlsBackgroundPart:
             m_value.ident = CSSValueMediaControlsBackground;
             break;
@@ -375,15 +392,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFillRepeat e)
         case RepeatFill:
             m_value.ident = CSSValueRepeat;
             break;
-        case RepeatXFill:
-            m_value.ident = CSSValueRepeatX;
-            break;
-        case RepeatYFill:
-            m_value.ident = CSSValueRepeatY;
-            break;
         case NoRepeatFill:
             m_value.ident = CSSValueNoRepeat;
             break;
+        case RoundFill:
+            m_value.ident = CSSValueRound;
+            break;
+        case SpaceFill:
+            m_value.ident = CSSValueSpace;
+            break;
     }
 }
 
@@ -392,12 +409,12 @@ template<> inline CSSPrimitiveValue::operator EFillRepeat() const
     switch (m_value.ident) {
         case CSSValueRepeat:
             return RepeatFill;
-        case CSSValueRepeatX:
-            return RepeatXFill;
-        case CSSValueRepeatY:
-            return RepeatYFill;
         case CSSValueNoRepeat:
             return NoRepeatFill;
+        case CSSValueRound:
+            return RoundFill;
+        case CSSValueSpace:
+            return SpaceFill;
         default:
             ASSERT_NOT_REACHED();
             return RepeatFill;
@@ -522,6 +539,7 @@ template<> inline CSSPrimitiveValue::operator EBoxOrient() const
         case CSSValueInlineAxis:
             return HORIZONTAL;
         case CSSValueVertical:
+        case CSSValueBlockAxis:
             return VERTICAL;
         default:
             ASSERT_NOT_REACHED();
@@ -777,6 +795,11 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EDisplay e)
         case TABLE_CAPTION:
             m_value.ident = CSSValueTableCaption;
             break;
+#if ENABLE(WCSS)
+        case WAP_MARQUEE:
+            m_value.ident = CSSValueWapMarquee;
+            break;
+#endif
         case BOX:
             m_value.ident = CSSValueWebkitBox;
             break;
@@ -1782,6 +1805,81 @@ template<> inline CSSPrimitiveValue::operator EPointerEvents() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(FontSmoothingMode smoothing)
+    : m_type(CSS_IDENT)
+{
+    switch (smoothing) {
+    case AutoSmoothing:
+        m_value.ident = CSSValueAuto;
+        return;
+    case NoSmoothing:
+        m_value.ident = CSSValueNone;
+        return;
+    case Antialiased:
+        m_value.ident = CSSValueAntialiased;
+        return;
+    case SubpixelAntialiased:
+        m_value.ident = CSSValueSubpixelAntialiased;
+        return;
+    }
+    
+    ASSERT_NOT_REACHED();
+    m_value.ident = CSSValueAuto;
+}
+
+template<> inline CSSPrimitiveValue::operator FontSmoothingMode() const
+{
+    switch (m_value.ident) {
+    case CSSValueAuto:
+        return AutoSmoothing;
+    case CSSValueNone:
+        return NoSmoothing;
+    case CSSValueAntialiased:
+        return Antialiased;
+    case CSSValueSubpixelAntialiased:
+        return SubpixelAntialiased;
+    }
+    
+    ASSERT_NOT_REACHED();
+    return AutoSmoothing;
+}
+
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(TextRenderingMode e)
+    : m_type(CSS_IDENT)
+{
+    switch (e) {
+        case AutoTextRendering:
+            m_value.ident = CSSValueAuto;
+            break;
+        case OptimizeSpeed:
+            m_value.ident = CSSValueOptimizespeed;
+            break;
+        case OptimizeLegibility:
+            m_value.ident = CSSValueOptimizelegibility;
+            break;
+        case GeometricPrecision:
+            m_value.ident = CSSValueGeometricprecision;
+            break;
+    }
+}
+
+template<> inline CSSPrimitiveValue::operator TextRenderingMode() const
+{
+    switch (m_value.ident) {
+        case CSSValueAuto:
+            return AutoTextRendering;
+        case CSSValueOptimizespeed:
+            return OptimizeSpeed;
+        case CSSValueOptimizelegibility:
+            return OptimizeLegibility;
+        case CSSValueGeometricprecision:
+            return GeometricPrecision;
+        default:
+            ASSERT_NOT_REACHED();
+            return AutoTextRendering;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2185,42 +2283,6 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ETextRendering e)
-    : m_type(CSS_IDENT)
-{
-    switch (e) {
-        case TR_AUTO:
-            m_value.ident = CSSValueAuto;
-            break;
-        case TR_OPTIMIZESPEED:
-            m_value.ident = CSSValueOptimizespeed;
-            break;
-        case TR_OPTIMIZELEGIBILITY:
-            m_value.ident = CSSValueOptimizelegibility;
-            break;
-        case TR_GEOMETRICPRECISION:
-            m_value.ident = CSSValueGeometricprecision;
-            break;
-    }
-}
-
-template<> inline CSSPrimitiveValue::operator ETextRendering() const
-{
-    switch (m_value.ident) {
-        case CSSValueAuto:
-            return TR_AUTO;
-        case CSSValueOptimizespeed:
-            return TR_OPTIMIZESPEED;
-        case CSSValueOptimizelegibility:
-            return TR_OPTIMIZELEGIBILITY;
-        case CSSValueGeometricprecision:
-            return TR_GEOMETRICPRECISION;
-        default:
-            ASSERT_NOT_REACHED();
-            return TR_AUTO;
-    }
-}
-
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     : m_type(CSS_IDENT)
 {
diff --git a/WebCore/css/CSSPropertyLonghand.cpp b/WebCore/css/CSSPropertyLonghand.cpp
index b15f31e..b45fa0d 100644
--- a/WebCore/css/CSSPropertyLonghand.cpp
+++ b/WebCore/css/CSSPropertyLonghand.cpp
@@ -77,6 +77,9 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
 
+    static const int backgroundRepeatProperties[] = { CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundRepeat, backgroundRepeatProperties);
+
     static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
 
@@ -134,7 +137,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyBackgroundOrigin,
         CSSPropertyBackgroundPositionX,
         CSSPropertyBackgroundPositionY,
-        CSSPropertyBackgroundRepeat,
+        CSSPropertyBackgroundRepeatX,
+        CSSPropertyBackgroundRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
 
@@ -163,6 +167,9 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
     static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
 
+    static const int maskRepeatProperties[] = { CSSPropertyWebkitMaskRepeatX, CSSPropertyWebkitMaskRepeatY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskRepeat, maskRepeatProperties);
+
     static const int maskProperties[] = {
         CSSPropertyWebkitMaskAttachment,
         CSSPropertyWebkitMaskClip,
@@ -170,7 +177,8 @@ static void initShorthandMap(ShorthandMap& shorthandMap)
         CSSPropertyWebkitMaskOrigin,
         CSSPropertyWebkitMaskPositionX,
         CSSPropertyWebkitMaskPositionY,
-        CSSPropertyWebkitMaskRepeat,
+        CSSPropertyWebkitMaskRepeatX,
+        CSSPropertyWebkitMaskRepeatY
     };
     SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
 
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index 40e456f..7bed755 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -18,6 +18,9 @@ background-position
 background-position-x
 background-position-y
 background-repeat
+background-repeat-x
+background-repeat-y
+background-size
 border
 border-bottom
 border-bottom-color
@@ -46,7 +49,6 @@ border-top-style
 border-top-width
 border-width
 bottom
-box-shadow
 caption-side
 clear
 clip
@@ -124,6 +126,7 @@ text-overline-color
 text-overline-mode
 text-overline-style
 text-overline-width
+text-rendering
 text-shadow
 text-transform
 text-underline
@@ -157,7 +160,6 @@ zoom
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
--webkit-background-size
 -webkit-binding
 -webkit-border-fit
 -webkit-border-horizontal-spacing
@@ -177,6 +179,7 @@ zoom
 -webkit-box-orient
 -webkit-box-pack
 -webkit-box-reflect
+-webkit-box-shadow
 -webkit-box-sizing
 -webkit-column-break-after
 -webkit-column-break-before
@@ -190,6 +193,7 @@ zoom
 -webkit-column-width
 -webkit-columns
 -webkit-font-size-delta
+-webkit-font-smoothing
 -webkit-highlight
 -webkit-line-break
 -webkit-line-clamp
@@ -214,6 +218,8 @@ zoom
 -webkit-mask-position-x
 -webkit-mask-position-y
 -webkit-mask-repeat
+-webkit-mask-repeat-x
+-webkit-mask-repeat-y
 -webkit-mask-size
 -webkit-match-nearest-mail-blockquote-color
 -webkit-nbsp-mode
diff --git a/WebCore/css/CSSRuleList.idl b/WebCore/css/CSSRuleList.idl
index 224d6a1..9add078 100644
--- a/WebCore/css/CSSRuleList.idl
+++ b/WebCore/css/CSSRuleList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         InterfaceUUID=64c346a0-1e34-49d3-9472-57ec8e0fdccb,
diff --git a/WebCore/css/CSSSelector.cpp b/WebCore/css/CSSSelector.cpp
index 80910a7..313528f 100644
--- a/WebCore/css/CSSSelector.cpp
+++ b/WebCore/css/CSSSelector.cpp
@@ -77,9 +77,12 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, before, ("before"));
     DEFINE_STATIC_LOCAL(AtomicString, checked, ("checked"));
     DEFINE_STATIC_LOCAL(AtomicString, fileUploadButton, ("-webkit-file-upload-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, defaultString, ("default"));
     DEFINE_STATIC_LOCAL(AtomicString, disabled, ("disabled"));
     DEFINE_STATIC_LOCAL(AtomicString, readOnly, ("read-only"));
     DEFINE_STATIC_LOCAL(AtomicString, readWrite, ("read-write"));
+    DEFINE_STATIC_LOCAL(AtomicString, valid, ("valid"));
+    DEFINE_STATIC_LOCAL(AtomicString, invalid, ("invalid"));
     DEFINE_STATIC_LOCAL(AtomicString, drag, ("-webkit-drag"));
     DEFINE_STATIC_LOCAL(AtomicString, dragAlias, ("-khtml-drag")); // was documented with this name in Apple documentation, so keep an alia
     DEFINE_STATIC_LOCAL(AtomicString, empty, ("empty"));
@@ -96,6 +99,9 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, focus, ("focus"));
     DEFINE_STATIC_LOCAL(AtomicString, hover, ("hover"));
     DEFINE_STATIC_LOCAL(AtomicString, indeterminate, ("indeterminate"));
+#if ENABLE(DATALIST)
+    DEFINE_STATIC_LOCAL(AtomicString, inputListButton, ("-webkit-input-list-button"));
+#endif
     DEFINE_STATIC_LOCAL(AtomicString, inputPlaceholder, ("-webkit-input-placeholder"));
     DEFINE_STATIC_LOCAL(AtomicString, lastChild, ("last-child"));
     DEFINE_STATIC_LOCAL(AtomicString, lastOfType, ("last-of-type"));
@@ -105,6 +111,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSlider, ("-webkit-media-controls-volume-slider"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsRewindButton, ("-webkit-media-controls-rewind-button"));
@@ -112,6 +119,7 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsStatusDisplay, ("-webkit-media-controls-status-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsVolumeSliderContainer, ("-webkit-media-controls-volume-slider-container"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
@@ -170,12 +178,18 @@ void CSSSelector::extractPseudoType() const
     else if (m_value == fileUploadButton) {
         m_pseudoType = PseudoFileUploadButton;
         element = true;
-    } else if (m_value == disabled)
+    } else if (m_value == defaultString)
+        m_pseudoType = PseudoDefault;
+    else if (m_value == disabled)
         m_pseudoType = PseudoDisabled;
     else if (m_value == readOnly)
         m_pseudoType = PseudoReadOnly;
     else if (m_value == readWrite)
         m_pseudoType = PseudoReadWrite;
+    else if (m_value == valid)
+        m_pseudoType = PseudoValid;
+    else if (m_value == invalid)
+        m_pseudoType = PseudoInvalid;
     else if (m_value == drag || m_value == dragAlias)
         m_pseudoType = PseudoDrag;
     else if (m_value == enabled)
@@ -186,7 +200,14 @@ void CSSSelector::extractPseudoType() const
         m_pseudoType = PseudoFirstChild;
     else if (m_value == fullPageMedia)
         m_pseudoType = PseudoFullPageMedia;
-    else if (m_value == inputPlaceholder) {
+    else
+#if ENABLE(DATALIST)
+    if (m_value == inputListButton) {
+        m_pseudoType = PseudoInputListButton;
+        element = true;
+    } else
+#endif
+    if (m_value == inputPlaceholder) {
         m_pseudoType = PseudoInputPlaceholder;
         element = true;
     } else if (m_value == lastChild)
@@ -235,6 +256,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimeline) {
         m_pseudoType = PseudoMediaControlsTimeline;
         element = true;
+    } else if (m_value == mediaControlsVolumeSlider) {
+        m_pseudoType = PseudoMediaControlsVolumeSlider;
+        element = true;
     } else if (m_value == mediaControlsSeekBackButton) {
         m_pseudoType = PseudoMediaControlsSeekBackButton;
         element = true;
@@ -256,6 +280,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsTimelineContainer) {
         m_pseudoType = PseudoMediaControlsTimelineContainer;
         element = true;
+    } else if (m_value == mediaControlsVolumeSliderContainer) {
+        m_pseudoType = PseudoMediaControlsVolumeSliderContainer;
+        element = true;
     } else if (m_value == notStr)
         m_pseudoType = PseudoNot;
     else if (m_value == nthChild)
diff --git a/WebCore/css/CSSSelector.h b/WebCore/css/CSSSelector.h
index 18251fd..0c3b677 100644
--- a/WebCore/css/CSSSelector.h
+++ b/WebCore/css/CSSSelector.h
@@ -126,12 +126,15 @@ namespace WebCore {
             PseudoChecked,
             PseudoEnabled,
             PseudoFullPageMedia,
+            PseudoDefault,
             PseudoDisabled,
             PseudoInputPlaceholder,
             PseudoOptional,
             PseudoRequired,
             PseudoReadOnly,
             PseudoReadWrite,
+            PseudoValid,
+            PseudoInvalid,
             PseudoIndeterminate,
             PseudoTarget,
             PseudoBefore,
@@ -170,15 +173,18 @@ namespace WebCore {
             PseudoMediaControlsMuteButton,
             PseudoMediaControlsPlayButton,
             PseudoMediaControlsTimelineContainer,
+            PseudoMediaControlsVolumeSliderContainer,
             PseudoMediaControlsCurrentTimeDisplay,
             PseudoMediaControlsTimeRemainingDisplay,
             PseudoMediaControlsTimeline,
+            PseudoMediaControlsVolumeSlider,
             PseudoMediaControlsSeekBackButton,
             PseudoMediaControlsSeekForwardButton,
             PseudoMediaControlsRewindButton,
             PseudoMediaControlsReturnToRealtimeButton,
             PseudoMediaControlsStatusDisplay,
-            PseudoMediaControlsFullscreenButton
+            PseudoMediaControlsFullscreenButton,
+            PseudoInputListButton
         };
 
         PseudoType pseudoType() const
diff --git a/WebCore/css/CSSSelectorList.cpp b/WebCore/css/CSSSelectorList.cpp
index 5ad3809..7f82ca4 100644
--- a/WebCore/css/CSSSelectorList.cpp
+++ b/WebCore/css/CSSSelectorList.cpp
@@ -55,11 +55,9 @@ void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
     for (size_t i = 0; i < size; ++i) {
         memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        // We want to free the memory (which was allocated with new), but we
-        // don't want the destructor to run since it will affect the copy
-        // we've just made. In theory this is undefined, but operator delete
-        // is only defined taking a void*, so in practice it should be ok.
-        delete reinterpret_cast<char*>(selectorVector[i]);
+        // We want to free the memory (which was allocated with fastNew), but we
+        // don't want the destructor to run since it will affect the copy we've just made.
+        fastDeleteSkippingDestructor(selectorVector[i]);
         ASSERT(!m_selectorArray[i].isLastInSelectorList());
     }
     m_selectorArray[size - 1].setLastInSelectorList();
@@ -91,4 +89,51 @@ void CSSSelectorList::deleteSelectors()
     }
 }
 
+
+template <typename Functor>
+static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
+{
+    ASSERT(selector);
+
+    do {
+        if (functor(selector))
+            return true;
+        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
+            if (forEachTagSelector(functor, simpleSelector))
+                return true;
+        }
+    } while ((selector = selector->tagHistory()));
+
+    return false;
+}
+
+template <typename Functor>
+static bool forEachSelector(Functor& functor, const CSSSelectorList* selectorList)
+{
+    for (CSSSelector* selector = selectorList->first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (forEachTagSelector(functor, selector))
+            return true;
+    }
+
+    return false;
+}
+
+class SelectorNeedsNamespaceResolutionFunctor {
+public:
+    bool operator()(CSSSelector* selector)
+    {
+        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
+            return true;
+        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
+            return true;
+        return false;
+    }
+};
+
+bool CSSSelectorList::selectorsNeedNamespaceResolution()
+{
+    SelectorNeedsNamespaceResolutionFunctor functor;
+    return forEachSelector(functor, this);
 }
+
+} // namespace WebCore
diff --git a/WebCore/css/CSSSelectorList.h b/WebCore/css/CSSSelectorList.h
index 3518139..9e40ef8 100644
--- a/WebCore/css/CSSSelectorList.h
+++ b/WebCore/css/CSSSelectorList.h
@@ -31,25 +31,27 @@
 
 namespace WebCore {
     
-    class CSSSelectorList : public Noncopyable {
-    public:
-        CSSSelectorList() : m_selectorArray(0) { }
-        ~CSSSelectorList();
-
-        void adopt(CSSSelectorList& list);
-        void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
-        
-        CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
-        static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
-        bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
-        
-    private:
-        void deleteSelectors();
-
-        // End of the array is indicated by m_isLastInSelectorList bit in the last item.
-        CSSSelector* m_selectorArray;
-    };
-
-}
-
-#endif
+class CSSSelectorList : public Noncopyable {
+public:
+    CSSSelectorList() : m_selectorArray(0) { }
+    ~CSSSelectorList();
+
+    void adopt(CSSSelectorList& list);
+    void adoptSelectorVector(Vector<CSSSelector*>& selectorVector);
+    
+    CSSSelector* first() const { return m_selectorArray ? m_selectorArray : 0; }
+    static CSSSelector* next(CSSSelector* previous) { return previous->isLastInSelectorList() ? 0 : previous + 1; }
+    bool hasOneSelector() const { return m_selectorArray ? m_selectorArray->isLastInSelectorList() : false; }
+
+    bool selectorsNeedNamespaceResolution();
+
+private:
+    void deleteSelectors();
+
+    // End of the array is indicated by m_isLastInSelectorList bit in the last item.
+    CSSSelector* m_selectorArray;
+};
+
+} // namespace WebCore
+
+#endif // CSSSelectorList_h
diff --git a/WebCore/css/CSSStyleDeclaration.idl b/WebCore/css/CSSStyleDeclaration.idl
index f7ce37f..3e37418 100644
--- a/WebCore/css/CSSStyleDeclaration.idl
+++ b/WebCore/css/CSSStyleDeclaration.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module css {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         DelegatingPutFunction,
         HasNameGetter,
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 9074476..69c5598 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -408,7 +408,9 @@ static const MediaQueryEvaluator& printEval()
     return staticPrintEval;
 }
 
-CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet, bool strictParsing, bool matchAuthorAndUserStyles)
+CSSStyleSelector::CSSStyleSelector(Document* doc, StyleSheetList* styleSheets, CSSStyleSheet* mappedElementSheet,
+                                   CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                                   bool strictParsing, bool matchAuthorAndUserStyles)
     : m_backgroundData(BackgroundFillLayer)
     , m_checker(doc, strictParsing)
     , m_fontSelector(CSSFontSelector::create(doc))
@@ -449,12 +451,15 @@ CSSStyleSelector::CSSStyleSelector(Document* doc, const String& userStyleSheet,
     }
 
     // FIXME: This sucks! The user sheet is reparsed every time!
-    if (!userStyleSheet.isEmpty()) {
-        m_userSheet = CSSStyleSheet::create(doc);
-        m_userSheet->parseString(userStyleSheet, strictParsing);
-
+    if (pageUserSheet || pageGroupUserSheets) {
         m_userStyle = new CSSRuleSet();
-        m_userStyle->addRulesFromSheet(m_userSheet.get(), *m_medium, this);
+        if (pageUserSheet)
+            m_userStyle->addRulesFromSheet(pageUserSheet, *m_medium, this);
+        if (pageGroupUserSheets) {
+            unsigned length = pageGroupUserSheets->size();
+            for (unsigned i = 0; i < length; i++)
+                m_userStyle->addRulesFromSheet(pageGroupUserSheets->at(i).get(), *m_medium, this);
+        }
     }
 
     // add stylesheets from document
@@ -995,6 +1000,13 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
 
                 if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
                     return false;
+
+                if (s->isDefaultButtonForForm() != m_element->isDefaultButtonForForm())
+                    return false;
+
+                if ((s->willValidate() && s->isValidFormControlElement()) !=
+                    (m_element->willValidate() && m_element->isValidFormControlElement()))
+                    return false;
             }
 
             if (style->transitions() || style->animations())
@@ -1127,6 +1139,17 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     }
 #endif
 
+#if ENABLE(MATHML)
+    static bool loadedMathMLUserAgentSheet;
+    if (e->isMathMLElement() && !loadedMathMLUserAgentSheet) {
+        // MathML rules.
+        loadedMathMLUserAgentSheet = true;
+        CSSStyleSheet* mathMLSheet = parseUASheet(mathmlUserAgentStyleSheet, sizeof(mathmlUserAgentStyleSheet));
+        defaultStyle->addRulesFromSheet(mathMLSheet, screenEval());
+        defaultPrintStyle->addRulesFromSheet(mathMLSheet, printEval());
+    }
+#endif
+
 #if ENABLE(WML)
     static bool loadedWMLUserAgentSheet;
     if (e->isWMLElement() && !loadedWMLUserAgentSheet) {
@@ -2358,6 +2381,8 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
                 break;
+            case CSSSelector::PseudoDefault:
+                return e && e->isDefaultButtonForForm();
             case CSSSelector::PseudoDisabled:
                 if (e && e->isFormControlElement()) {
                     InputElement* inputElement = toInputElement(e);
@@ -2384,6 +2409,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return e && e->isOptionalFormControl();
             case CSSSelector::PseudoRequired:
                 return e && e->isRequiredFormControl();
+            case CSSSelector::PseudoValid:
+                return e && e->willValidate() && e->isValidFormControlElement();
+            case CSSSelector::PseudoInvalid:
+                return e && e->willValidate() && !e->isValidFormControlElement();
             case CSSSelector::PseudoChecked: {
                 if (!e || !e->isFormControlElement())
                     break;
@@ -2465,6 +2494,11 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoFileUploadButton:
                 dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
+#if ENABLE(DATALIST)
+            case CSSSelector::PseudoInputListButton:
+                dynamicPseudo = INPUT_LIST_BUTTON;
+                return true;
+#endif
             case CSSSelector::PseudoInputPlaceholder:
                 dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
@@ -2494,7 +2528,10 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 return true;
             case CSSSelector::PseudoMediaControlsTimelineContainer:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE_CONTAINER;
-                 return true;
+                return true;
+            case CSSSelector::PseudoMediaControlsVolumeSliderContainer:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER;
+                return true;
             case CSSSelector::PseudoMediaControlsCurrentTimeDisplay:
                 dynamicPseudo = MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
                 return true;
@@ -2504,6 +2541,9 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             case CSSSelector::PseudoMediaControlsTimeline:
                 dynamicPseudo = MEDIA_CONTROLS_TIMELINE;
                 return true;
+            case CSSSelector::PseudoMediaControlsVolumeSlider:
+                dynamicPseudo = MEDIA_CONTROLS_VOLUME_SLIDER;
+                return true;
             case CSSSelector::PseudoMediaControlsSeekBackButton:
                 dynamicPseudo = MEDIA_CONTROLS_SEEK_BACK_BUTTON;
                 return true;
@@ -2920,10 +2960,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBackgroundOrigin:
         HANDLE_BACKGROUND_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyBackgroundRepeat:
-        HANDLE_BACKGROUND_VALUE(repeat, Repeat, value)
-        return;
-    case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyBackgroundSize:
         HANDLE_BACKGROUND_VALUE(size, Size, value)
         return;
     case CSSPropertyWebkitMaskAttachment:
@@ -2938,9 +2975,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitMaskOrigin:
         HANDLE_MASK_VALUE(origin, Origin, value)
         return;
-    case CSSPropertyWebkitMaskRepeat:
-        HANDLE_MASK_VALUE(repeat, Repeat, value)
-        return;
     case CSSPropertyWebkitMaskSize:
         HANDLE_MASK_VALUE(size, Size, value)
         return;
@@ -2991,6 +3025,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyDisplay:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
+#if ENABLE(WCSS)
+        if (primitiveValue) {
+            if (primitiveValue->getIdent() == CSSValueWapMarquee) {
+                // Initialize Wap Marquee style
+                m_style->setOverflowX(OMARQUEE);
+                m_style->setOverflowY(OMARQUEE);
+                m_style->setWhiteSpace(NOWRAP);
+                m_style->setMarqueeDirection(MLEFT);
+                m_style->setMarqueeSpeed(85); // Normal speed
+                m_style->setMarqueeLoopCount(1);
+                m_style->setMarqueeBehavior(MSCROLL);
+
+                if (m_parentStyle)
+                    m_style->setDisplay(m_parentStyle->display());
+                else
+                    m_style->setDisplay(*primitiveValue);
+            } else
+                m_style->setDisplay(*primitiveValue);
+        }
+#endif
         return;
     case CSSPropertyEmptyCells:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
@@ -3207,6 +3261,26 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_MASK_VALUE(yPosition, YPosition, value)
         return;
     }
+    case CSSPropertyBackgroundRepeat:
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_BACKGROUND_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyBackgroundRepeatX:
+        HANDLE_BACKGROUND_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyBackgroundRepeatY:
+        HANDLE_BACKGROUND_VALUE(repeatY, RepeatY, value)
+        return;
+    case CSSPropertyWebkitMaskRepeat:
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatX, RepeatX);
+        HANDLE_MASK_INHERIT_AND_INITIAL(repeatY, RepeatY);
+        return;
+    case CSSPropertyWebkitMaskRepeatX:
+        HANDLE_MASK_VALUE(repeatX, RepeatX, value)
+        return;
+    case CSSPropertyWebkitMaskRepeatY:
+        HANDLE_MASK_VALUE(repeatY, RepeatY, value)
+        return;
     case CSSPropertyBorderSpacing: {
         if (isInherit) {
             m_style->setHorizontalBorderSpacing(m_parentStyle->horizontalBorderSpacing());
@@ -3437,6 +3511,41 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
+    case CSSPropertyWebkitFontSmoothing: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setFontSmoothing(m_parentStyle->fontDescription().fontSmoothing());
+        else if (isInitial)
+            fontDescription.setFontSmoothing(AutoSmoothing);
+        else {
+            if (!primitiveValue)
+                return;
+            int id = primitiveValue->getIdent();
+            FontSmoothingMode smoothing;
+            switch (id) {
+                case CSSValueAuto:
+                    smoothing = AutoSmoothing;
+                    break;
+                case CSSValueNone:
+                    smoothing = NoSmoothing;
+                    break;
+                case CSSValueAntialiased:
+                    smoothing = Antialiased;
+                    break;
+                case CSSValueSubpixelAntialiased:
+                    smoothing = SubpixelAntialiased;
+                    break;
+                default:
+                    ASSERT_NOT_REACHED();
+                    smoothing = AutoSmoothing;
+            }
+            fontDescription.setFontSmoothing(smoothing);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
+
     case CSSPropertyLetterSpacing:
     case CSSPropertyWordSpacing:
     {
@@ -3754,7 +3863,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     {
         FontDescription fontDescription = m_style->fontDescription();
         fontDescription.setKeywordSize(0);
-        bool familyIsFixed = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
         float oldSize = 0;
         float size = 0;
         
@@ -3769,7 +3877,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_parentNode)
                 fontDescription.setKeywordSize(m_parentStyle->fontDescription().keywordSize());
         } else if (isInitial) {
-            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), familyIsFixed);
+            size = fontSizeForKeyword(CSSValueMedium, m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
             fontDescription.setKeywordSize(CSSValueMedium - CSSValueXxSmall + 1);
         } else if (primitiveValue->getIdent()) {
             // Keywords are being used.
@@ -3782,7 +3890,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 case CSSValueXLarge:
                 case CSSValueXxLarge:
                 case CSSValueWebkitXxxLarge:
-                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), familyIsFixed);
+                    size = fontSizeForKeyword(primitiveValue->getIdent(), m_style->htmlHacks(), fontDescription.useFixedDefaultSize());
                     fontDescription.setKeywordSize(primitiveValue->getIdent() - CSSValueXxSmall + 1);
                     break;
                 case CSSValueLarger:
@@ -4025,13 +4133,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             if (m_style->setFontDescription(fontDescription))
                 m_fontDirty = true;
             return;
-        }
-        else if (isInitial) {
+        } else if (isInitial) {
             FontDescription initialDesc = FontDescription();
             FontDescription fontDescription = m_style->fontDescription();
             // We need to adjust the size to account for the generic family change from monospace
             // to non-monospace.
-            if (fontDescription.keywordSize() && fontDescription.genericFamily() == FontDescription::MonospaceFamily)
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize())
                 setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), false));
             fontDescription.setGenericFamily(initialDesc.genericFamily());
             if (!initialDesc.firstFamily().familyIsEmpty())
@@ -4041,21 +4148,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         }
         
-        if (!value->isValueList()) return;
+        if (!value->isValueList())
+            return;
         FontDescription fontDescription = m_style->fontDescription();
-        CSSValueList *list = static_cast<CSSValueList*>(value);
+        CSSValueList* list = static_cast<CSSValueList*>(value);
         int len = list->length();
         FontFamily& firstFamily = fontDescription.firstFamily();
-        FontFamily *currFamily = 0;
+        FontFamily* currFamily = 0;
         
         // Before mapping in a new font-family property, we should reset the generic family.
-        bool oldFamilyIsMonospace = fontDescription.genericFamily() == FontDescription::MonospaceFamily;
+        bool oldFamilyUsedFixedDefaultSize = fontDescription.useFixedDefaultSize();
         fontDescription.setGenericFamily(FontDescription::NoFamily);
 
         for (int i = 0; i < len; i++) {
-            CSSValue *item = list->itemWithoutBoundsCheck(i);
-            if (!item->isPrimitiveValue()) continue;
-            CSSPrimitiveValue *val = static_cast<CSSPrimitiveValue*>(item);
+            CSSValue* item = list->itemWithoutBoundsCheck(i);
+            if (!item->isPrimitiveValue())
+                continue;
+            CSSPrimitiveValue* val = static_cast<CSSPrimitiveValue*>(item);
             AtomicString face;
             Settings* settings = m_checker.m_document->settings();
             if (val->primitiveType() == CSSPrimitiveValue::CSS_STRING)
@@ -4087,28 +4196,32 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                         break;
                 }
             }
-    
+
             if (!face.isEmpty()) {
                 if (!currFamily) {
                     // Filling in the first family.
                     firstFamily.setFamily(face);
+                    firstFamily.appendFamily(0); // Remove any inherited family-fallback list.
                     currFamily = &firstFamily;
-                }
-                else {
+                } else {
                     RefPtr<SharedFontFamily> newFamily = SharedFontFamily::create();
                     newFamily->setFamily(face);
                     currFamily->appendFamily(newFamily);
                     currFamily = newFamily.get();
                 }
-    
-                if (fontDescription.keywordSize() && (fontDescription.genericFamily() == FontDescription::MonospaceFamily) != oldFamilyIsMonospace)
-                    setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyIsMonospace));
-            
-                if (m_style->setFontDescription(fontDescription))
-                    m_fontDirty = true;
             }
         }
-      return;
+
+        // We can't call useFixedDefaultSize() until all new font families have been added
+        // If currFamily is non-zero then we set at least one family on this description.
+        if (currFamily) {
+            if (fontDescription.keywordSize() && fontDescription.useFixedDefaultSize() != oldFamilyUsedFixedDefaultSize)
+                setFontSize(fontDescription, fontSizeForKeyword(CSSValueXxSmall + fontDescription.keywordSize() - 1, m_style->htmlHacks(), !oldFamilyUsedFixedDefaultSize));
+
+            if (m_style->setFontDescription(fontDescription))
+                m_fontDirty = true;
+        }
+        return;
     }
     case CSSPropertyTextDecoration: {
         // list of ident
@@ -4526,9 +4639,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(outlineOffset, OutlineOffset)
         m_style->setOutlineOffset(primitiveValue->computeLengthInt(style(), m_rootElementStyle, zoomFactor));
         return;
-
+    case CSSPropertyTextRendering: {
+        FontDescription fontDescription = m_style->fontDescription();
+        if (isInherit) 
+            fontDescription.setTextRenderingMode(m_parentStyle->fontDescription().textRenderingMode());
+        else if (isInitial)
+            fontDescription.setTextRenderingMode(AutoTextRendering);
+        else {
+            if (!primitiveValue)
+                return;
+            fontDescription.setTextRenderingMode(*primitiveValue);
+        }
+        if (m_style->setFontDescription(fontDescription))
+            m_fontDirty = true;
+        return;
+    }
     case CSSPropertyTextShadow:
-    case CSSPropertyBoxShadow: {
+    case CSSPropertyWebkitBoxShadow: {
         if (isInherit) {
             if (id == CSSPropertyTextShadow)
                 return m_style->setTextShadow(m_parentStyle->textShadow() ? new ShadowData(*m_parentStyle->textShadow()) : 0);
@@ -4742,6 +4869,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setMarqueeLoopCount(m_parentStyle->marqueeLoopCount());
         m_style->setMarqueeBehavior(m_parentStyle->marqueeBehavior());
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeLoop:
+#endif
     case CSSPropertyWebkitMarqueeRepetition: {
         HANDLE_INHERIT_AND_INITIAL(marqueeLoopCount, MarqueeLoopCount)
         if (!primitiveValue)
@@ -4752,6 +4882,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setMarqueeLoopCount(primitiveValue->getIntValue());
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeSpeed:
+#endif
     case CSSPropertyWebkitMarqueeSpeed: {
         HANDLE_INHERIT_AND_INITIAL(marqueeSpeed, MarqueeSpeed)      
         if (!primitiveValue)
@@ -4802,9 +4935,30 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeStyle:
+#endif
     case CSSPropertyWebkitMarqueeStyle:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
+#if ENABLE(WCSS)
+    case CSSPropertyWapMarqueeDir:
+        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
+        if (primitiveValue && primitiveValue->getIdent()) {
+            switch (primitiveValue->getIdent()) {
+            case CSSValueLtr:
+                m_style->setMarqueeDirection(MRIGHT);
+                break;
+            case CSSValueRtl:
+                m_style->setMarqueeDirection(MLEFT);
+                break;
+            default:
+                m_style->setMarqueeDirection(*primitiveValue);
+                break;
+            }
+        }
+        return;
+#endif
     case CSSPropertyWebkitMarqueeDirection:
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
@@ -5246,10 +5400,10 @@ void CSSStyleSelector::mapFillImage(FillLayer* layer, CSSValue* value)
     layer->setImage(styleImage(value));
 }
 
-void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatX(FillLayer* layer, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setRepeat(FillLayer::initialFillRepeat(layer->type()));
+        layer->setRepeatX(FillLayer::initialFillRepeatX(layer->type()));
         return;
     }
     
@@ -5257,22 +5411,46 @@ void CSSStyleSelector::mapFillRepeat(FillLayer* layer, CSSValue* value)
         return;
 
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setRepeat(*primitiveValue);
+    layer->setRepeatX(*primitiveValue);
 }
 
-void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+void CSSStyleSelector::mapFillRepeatY(FillLayer* layer, CSSValue* value)
 {
-    LengthSize b = FillLayer::initialFillSize(layer->type());
-    
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setSize(b);
+        layer->setRepeatY(FillLayer::initialFillRepeatY(layer->type()));
         return;
     }
     
     if (!value->isPrimitiveValue())
         return;
-        
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    layer->setRepeatY(*primitiveValue);
+}
+
+void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
+{
+    if (!value->isPrimitiveValue()) {
+        layer->setSizeType(SizeNone);
+        return;
+    }
+
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->getIdent() == CSSValueContain)
+        layer->setSizeType(Contain);
+    else if (primitiveValue->getIdent() == CSSValueCover)
+        layer->setSizeType(Cover);
+    else
+        layer->setSizeType(SizeLength);
+    
+    LengthSize b = FillLayer::initialFillSizeLength(layer->type());
+    
+    if (value->cssValueType() == CSSValue::CSS_INITIAL || primitiveValue->getIdent() == CSSValueContain
+        || primitiveValue->getIdent() == CSSValueCover) {
+        layer->setSizeLength(b);
+        return;
+    }
+
     Pair* pair = primitiveValue->getPairValue();
     if (!pair)
         return;
@@ -5309,7 +5487,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
     
     b.setWidth(firstLength);
     b.setHeight(secondLength);
-    layer->setSize(b);
+    layer->setSizeLength(b);
 }
 
 void CSSStyleSelector::mapFillXPosition(FillLayer* layer, CSSValue* value)
@@ -5587,8 +5765,7 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
         return;
 
     const FontDescription& parentFont = parentStyle->fontDescription();
-
-    if (childFont.genericFamily() == parentFont.genericFamily())
+    if (childFont.useFixedDefaultSize() == parentFont.useFixedDefaultSize())
         return;
 
     // For now, lump all families but monospace together.
@@ -5601,17 +5778,16 @@ void CSSStyleSelector::checkForGenericFamilyChange(RenderStyle* style, RenderSty
     // If the font uses a keyword size, then we refetch from the table rather than
     // multiplying by our scale factor.
     float size;
-    if (childFont.keywordSize()) {
-        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(),
-                                  childFont.genericFamily() == FontDescription::MonospaceFamily);
-    } else {
+    if (childFont.keywordSize())
+        size = fontSizeForKeyword(CSSValueXxSmall + childFont.keywordSize() - 1, style->htmlHacks(), childFont.useFixedDefaultSize());
+    else {
         Settings* settings = m_checker.m_document->settings();
         float fixedScaleFactor = settings
             ? static_cast<float>(settings->defaultFixedFontSize()) / settings->defaultFontSize()
             : 1;
-        size = (parentFont.genericFamily() == FontDescription::MonospaceFamily) ? 
-                childFont.specifiedSize()/fixedScaleFactor :
-                childFont.specifiedSize()*fixedScaleFactor;
+        size = parentFont.useFixedDefaultSize() ?
+                childFont.specifiedSize() / fixedScaleFactor :
+                childFont.specifiedSize() * fixedScaleFactor;
     }
 
     FontDescription newFontDescription(childFont);
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 668c6c3..6e0663f 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -80,7 +80,9 @@ public:
     // This class selects a RenderStyle for a given element based on a collection of stylesheets.
     class CSSStyleSelector : public Noncopyable {
     public:
-        CSSStyleSelector(Document*, const String& userStyleSheet, StyleSheetList*, CSSStyleSheet*, bool strictParsing, bool matchAuthorAndUserStyles);
+        CSSStyleSelector(Document*, StyleSheetList* authorSheets, CSSStyleSheet* mappedElementSheet,
+                         CSSStyleSheet* pageUserSheet, const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets,
+                         bool strictParsing, bool matchAuthorAndUserStyles);
         ~CSSStyleSelector();
 
         void initElementAndPseudoState(Element*);
@@ -175,7 +177,6 @@ public:
         
         CSSRuleSet* m_authorStyle;
         CSSRuleSet* m_userStyle;
-        RefPtr<CSSStyleSheet> m_userSheet;
 
         bool m_hasUAAppearance;
         BorderData m_borderData;
@@ -223,7 +224,8 @@ public:
         void mapFillComposite(FillLayer*, CSSValue*);
         void mapFillOrigin(FillLayer*, CSSValue*);
         void mapFillImage(FillLayer*, CSSValue*);
-        void mapFillRepeat(FillLayer*, CSSValue*);
+        void mapFillRepeatX(FillLayer*, CSSValue*);
+        void mapFillRepeatY(FillLayer*, CSSValue*);
         void mapFillSize(FillLayer*, CSSValue*);
         void mapFillXPosition(FillLayer*, CSSValue*);
         void mapFillYPosition(FillLayer*, CSSValue*);
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index ce50af6..1579999 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -40,20 +40,22 @@ CSSStyleSheet::CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, con
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(!parentSheet || parentSheet->useStrictParsing())
+    , m_isUserStyleSheet(parentSheet ? parentSheet->isUserStyleSheet() : false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(Node *parentNode, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const String& charset)
     : StyleSheet(parentNode, href)
     , m_doc(parentNode->document())
     , m_namespaces(0)
     , m_charset(charset)
     , m_loadCompleted(false)
     , m_strictParsing(false)
+    , m_isUserStyleSheet(false)
 {
 }
 
-CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const String& charset)
+CSSStyleSheet::CSSStyleSheet(CSSRule* ownerRule, const String& href, const String& charset)
     : StyleSheet(ownerRule, href)
     , m_namespaces(0)
     , m_charset(charset)
@@ -62,6 +64,7 @@ CSSStyleSheet::CSSStyleSheet(CSSRule *ownerRule, const String& href, const Strin
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_doc = parentSheet ? parentSheet->doc() : 0;
+    m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
 }
 
 CSSStyleSheet::~CSSStyleSheet()
diff --git a/WebCore/css/CSSStyleSheet.h b/WebCore/css/CSSStyleSheet.h
index 8646ee9..f534104 100644
--- a/WebCore/css/CSSStyleSheet.h
+++ b/WebCore/css/CSSStyleSheet.h
@@ -93,6 +93,9 @@ public:
     void setStrictParsing(bool b) { m_strictParsing = b; }
     bool useStrictParsing() const { return m_strictParsing; }
 
+    void setIsUserStyleSheet(bool b) { m_isUserStyleSheet = b; }
+    bool isUserStyleSheet() const { return m_isUserStyleSheet; }
+
 private:
     CSSStyleSheet(Node* ownerNode, const String& href, const String& charset);
     CSSStyleSheet(CSSStyleSheet* parentSheet, const String& href, const String& charset);
@@ -106,6 +109,7 @@ private:
     String m_charset;
     bool m_loadCompleted : 1;
     bool m_strictParsing : 1;
+    bool m_isUserStyleSheet : 1;
 };
 
 } // namespace
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index c0b52f2..1b7b1d8 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -169,6 +169,8 @@ repeat
 repeat-x
 repeat-y
 no-repeat
+# round
+# space
 #
 # CSS_PROP__WEBKIT_BACKGROUND_COMPOSITE:
 #
@@ -260,6 +262,7 @@ table-cell
 table-caption
 -webkit-box
 -webkit-inline-box
+-wap-marquee
 #none
 #
 # CSS_PROP_CURSOR:
@@ -498,6 +501,7 @@ square-button
 button
 button-bevel
 default-button
+list-button
 listbox
 listitem
 media-fullscreen-button
@@ -509,6 +513,9 @@ media-rewind-button
 media-return-to-realtime-button
 media-slider
 media-sliderthumb
+media-volume-slider-container
+media-volume-slider
+media-volume-sliderthumb
 media-controls-background
 media-current-time-display
 media-time-remaining-display
@@ -551,6 +558,12 @@ padding
 padding-box
 
 #
+# background-size
+#
+contain
+cover
+
+#
 # CSS_PROP__KHTML_RTL_ORDERING
 #
 logical
@@ -611,3 +624,17 @@ fill
 stroke
 #all
 #none
+
+#
+# -webkit-font-smoothing
+#
+# auto
+# none
+antialiased
+subpixel-antialiased
+
+# text-rendering
+#auto
+optimizeSpeed
+optimizeLegibility
+geometricPrecision
diff --git a/WebCore/css/CSSValueList.cpp b/WebCore/css/CSSValueList.cpp
index 4928026..9633f7c 100644
--- a/WebCore/css/CSSValueList.cpp
+++ b/WebCore/css/CSSValueList.cpp
@@ -96,6 +96,14 @@ bool CSSValueList::hasValue(CSSValue* val)
     return false;
 }
 
+PassRefPtr<CSSValueList> CSSValueList::copy()
+{
+    PassRefPtr<CSSValueList> newList = m_isSpaceSeparated ? createSpaceSeparated() : createCommaSeparated();
+    for (size_t index = 0; index < m_values.size(); index++)
+        newList->append(item(index));
+    return newList;
+}
+
 String CSSValueList::cssText() const
 {
     String result = "";
diff --git a/WebCore/css/CSSValueList.h b/WebCore/css/CSSValueList.h
index 0d531de..b835345 100644
--- a/WebCore/css/CSSValueList.h
+++ b/WebCore/css/CSSValueList.h
@@ -54,6 +54,7 @@ public:
     void prepend(PassRefPtr<CSSValue>);
     bool removeAll(CSSValue*);
     bool hasValue(CSSValue*);
+    PassRefPtr<CSSValueList> copy();
 
     virtual String cssText() const;
 
diff --git a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 2cd90a9d..e8492d4 100644
--- a/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -93,8 +93,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getSVGPropertyCSSValue(int pro
             return CSSPrimitiveValue::create(svgStyle->strokeMiterLimit(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyStrokeOpacity:
             return CSSPrimitiveValue::create(svgStyle->strokeOpacity(), CSSPrimitiveValue::CSS_NUMBER);
-        case CSSPropertyTextRendering:
-            return CSSPrimitiveValue::create(svgStyle->textRendering());
         case CSSPropertyAlignmentBaseline:
             return CSSPrimitiveValue::create(svgStyle->alignmentBaseline());
         case CSSPropertyDominantBaseline:
diff --git a/WebCore/css/SVGCSSParser.cpp b/WebCore/css/SVGCSSParser.cpp
index 04ba185..0ae9fbc 100644
--- a/WebCore/css/SVGCSSParser.cpp
+++ b/WebCore/css/SVGCSSParser.cpp
@@ -132,12 +132,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             valid_primitive = true;
         break;
 
-    case CSSPropertyTextRendering:   // auto | optimizeSpeed | optimizeLegibility | geometricPrecision | inherit
-        if (id == CSSValueAuto || id == CSSValueOptimizespeed || id == CSSValueOptimizelegibility ||
-       id == CSSValueGeometricprecision)
-            valid_primitive = true;
-        break;
-
     case CSSPropertyImageRendering:  // auto | optimizeSpeed |
     case CSSPropertyColorRendering:  // optimizeQuality | inherit
         if (id == CSSValueAuto || id == CSSValueOptimizespeed ||
diff --git a/WebCore/css/SVGCSSPropertyNames.in b/WebCore/css/SVGCSSPropertyNames.in
index 965fbbf..e400ffe 100644
--- a/WebCore/css/SVGCSSPropertyNames.in
+++ b/WebCore/css/SVGCSSPropertyNames.in
@@ -37,7 +37,7 @@ stroke-linejoin
 stroke-miterlimit
 stroke-opacity
 stroke-width
-text-rendering
+# text-rendering
 alignment-baseline
 baseline-shift
 dominant-baseline
diff --git a/WebCore/css/SVGCSSStyleSelector.cpp b/WebCore/css/SVGCSSStyleSelector.cpp
index d326dde..b81b4f2 100644
--- a/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/WebCore/css/SVGCSSStyleSelector.cpp
@@ -229,13 +229,6 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
                 svgstyle->setShapeRendering(*primitiveValue);
             break;
         }
-        case CSSPropertyTextRendering:
-        {
-            HANDLE_INHERIT_AND_INITIAL(textRendering, TextRendering)
-            if (primitiveValue)
-                svgstyle->setTextRendering(*primitiveValue);
-            break;
-        }
         // end of ident only properties
         case CSSPropertyFill:
         {
diff --git a/WebCore/css/SVGCSSValueKeywords.in b/WebCore/css/SVGCSSValueKeywords.in
index c866a17..152a68f 100644
--- a/WebCore/css/SVGCSSValueKeywords.in
+++ b/WebCore/css/SVGCSSValueKeywords.in
@@ -196,7 +196,7 @@ linearRGB
 
 # CSS_PROP_COLOR_RENDERING
 #auto
-optimizeSpeed
+#optimizeSpeed
 optimizeQuality
 
 ## CSS_PROP_FILL
@@ -220,7 +220,7 @@ optimizeQuality
 #auto
 #optimizeSpeed
 crispEdges
-geometricPrecision
+#geometricPrecision
 
 # CSS_PROP_STROKE
 # CSS_PROP_STROKE_DASHARRAY
@@ -238,11 +238,6 @@ bevel
 # CSS_PROP_STROKE_MITERLIMIT
 # CSS_PROP_STROKE_OPACITY
 # CSS_PROP_STROKE_WIDTH
-# CSS_PROP_TEXT_RENDERING
-#auto
-#optimizeSpeed
-optimizeLegibility
-#geometricPrecision
 
 # CSS_PROP_ALIGNMENT_BASELINE
 #auto
diff --git a/WebCore/css/StyleBase.cpp b/WebCore/css/StyleBase.cpp
index 4d5c9c8..aaa7626 100644
--- a/WebCore/css/StyleBase.cpp
+++ b/WebCore/css/StyleBase.cpp
@@ -57,7 +57,7 @@ KURL StyleBase::baseURL() const
     if (!sheet)
         return KURL();
     if (!sheet->href().isNull())
-        return KURL(sheet->href());
+        return KURL(ParsedURLString, sheet->href());
     if (sheet->parent()) 
         return sheet->parent()->baseURL();
     if (!sheet->ownerNode()) 
diff --git a/WebCore/css/StyleSheetList.idl b/WebCore/css/StyleSheetList.idl
index 2abd22f..574d749 100644
--- a/WebCore/css/StyleSheetList.idl
+++ b/WebCore/css/StyleSheetList.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,6 +22,7 @@ module stylesheets {
 
     // Introduced in DOM Level 2:
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/WebCore/css/WCSSPropertyNames.in b/WebCore/css/WCSSPropertyNames.in
new file mode 100644
index 0000000..704209f
--- /dev/null
+++ b/WebCore/css/WCSSPropertyNames.in
@@ -0,0 +1,4 @@
+-wap-marquee-dir
+-wap-marquee-loop
+-wap-marquee-speed
+-wap-marquee-style
diff --git a/WebCore/css/WCSSValueKeywords.in b/WebCore/css/WCSSValueKeywords.in
new file mode 100644
index 0000000..00657ba
--- /dev/null
+++ b/WebCore/css/WCSSValueKeywords.in
@@ -0,0 +1 @@
+# place holder for all WCSS specific CSS value keywords
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 6b03390..095fab3 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -72,6 +72,10 @@ layer {
     display: block
 }
 
+nav {
+    display: block
+}
+
 marquee {
     display: inline-block;
     overflow: -webkit-marquee
@@ -350,6 +354,11 @@ input[type="search"]::-webkit-search-results-button {
     display: inline-block;
 }
 
+input::-webkit-input-list-button {
+    -webkit-appearance: list-button;
+    display: inline-block;
+}
+
 textarea {
     -webkit-appearance: textarea;
     background-color: white;
@@ -364,7 +373,7 @@ textarea {
     word-wrap: break-word;
 }
 
-input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder, textarea::-webkit-input-placeholder {
     color: darkGray;
 }
 
@@ -483,6 +492,10 @@ select[size="1"] {
     white-space: pre;
 }
 
+datalist {
+    display: none;
+}
+
 optgroup {
     font-weight: bolder;
 }
diff --git a/WebCore/css/mathml.css b/WebCore/css/mathml.css
new file mode 100644
index 0000000..e725d8c
--- /dev/null
+++ b/WebCore/css/mathml.css
@@ -0,0 +1,170 @@
+@namespace "http://www.w3.org/1998/Math/MathML";
+
+/* approved */
+math {
+    font-family: Symbol, STIXGeneral, "Times New Roman";
+    display: inline-block;
+    padding: 0px;
+    margin: 0px;
+    text-indent: 0;
+    font-size: 1.1em;
+    vertical-align: baseline;
+}
+math[display="block"] {
+    font-family: "New Times Roman"
+    display: block;
+    text-align: center;
+    page-break-inside: avoid;
+}
+
+mfrac {
+    vertical-align: middle;
+}
+
+msub, msup {
+   display: inline-block;
+}
+
+msub > * + * {
+   vertical-align: sub;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msup > * + * {
+   vertical-align: super;
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+msubsup > * {
+    margin: 0px;
+    padding: 0px;
+    vertical-align: middle;
+}
+
+msubsup > * + * {
+   font-size: 0.75em;
+   line-height: 0.75em;
+}
+
+munderover {
+    vertical-align: middle;
+}
+
+munderover > * + *, mover > * + *, munder > * + * {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mrow {
+    line-height: 1em;
+    white-space: nowrap;
+    vertical-align: middle;
+}
+
+mfenced > * {
+    vertical-align: middle;
+}
+
+mo, mn, mi {
+   line-height: 0.75em;
+   padding: 0px;
+   margin: 0px;
+}
+
+mo[mathsize="small"], mn[mathsize="small"], mi[mathsize="small"] {
+   font-size: 0.75em;
+   line-height: 0.5625em;
+}
+
+mo[mathsize="normal"],mn[mathsize="normal"],mi[mathsize="normal"] {
+   font-size: 1em;
+   line-height: 0.75em;
+}
+
+mo[mathsize="big"], mn[mathsize="big"], mi[mathsize="big"] {
+   line-height: 1.2em;
+   font-size: 1.5em;
+}
+ 
+annotation, annotation-xml {
+    display:none;
+}
+
+mphantom {
+    visibility: hidden;
+}
+merror {
+    outline: solid thin red;
+}
+
+msqrt {
+    padding-top: 0.2em;
+    padding-left: 0.75em;
+}
+
+mroot {
+    padding-top: 0.2em;
+    padding-left: 0.2em;
+}
+
+mroot > * + * {
+    font-size: 0.75em;
+    line-height: 0.75em;
+    vertical-align: top;
+    padding-right: 0.3em;
+}
+
+mtable {
+    display: inline-table;
+    line-height: 1.5em;
+    text-align: center;
+    vertical-align: middle;
+}
+mtr {
+    display: table-row;
+}
+mtd {
+    display: table-cell;
+    padding: 0 0.5ex;
+}
+
+mtable[columnalign="left"], mtr[columnalign="left"], mtd[columnalign="left"] {
+    text-align: left;
+}
+
+mtable[columnalign="right"], mtr[columnalign="right"], mtd[columnalign="right"] {
+    text-align: right;
+}
+mtable[rowalign="top"] mtd, mtable mtr[rowalign="top"] mtd, mtable mtr mtd[rowalign="top"] {
+    vertical-align: top;
+}
+mtable[rowalign="bottom"] mtd, mtable mtr[rowalign="bottom"] mtd, mtable mtr mtd[rowalign="bottom"] {
+    vertical-align: bottom;
+}
+mtable[rowalign="center"] mtd, mtable mtr[rowalign="center"] mtd, mtable mtr mtd[rowalign="center"] {
+    vertical-align: middle;
+}
+mtable[frame="solid"] {
+    border: solid thin;
+}
+mtable[frame="dashed"] {
+    border: dashed thin;
+}
+mtable[rowlines="solid"], mtable[rowlines="dashed"], mtable[columnlines="solid"], mtable[columnlines="dashed"] {
+    border-collapse: collapse;
+}
+mtable[rowlines="solid"] > mtr + mtr {
+    border-top: solid thin;
+}
+mtable[rowlines="dashed"] > mtr + mtr {
+    border-top: dashed thin;
+}
+mtable[columnlines="solid"] > mtr > mtd + mtd {
+    border-left: solid thin;
+}
+mtable[columnlines="dashed"] > mtr > mtd + mtd {
+    border-left: dashed thin;
+}
+
diff --git a/WebCore/css/mediaControls.css b/WebCore/css/mediaControls.css
index f9694f8..d0ec90d 100644
--- a/WebCore/css/mediaControls.css
+++ b/WebCore/css/mediaControls.css
@@ -88,6 +88,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     padding: 0px 2px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
     display: -webkit-box;
diff --git a/WebCore/css/mediaControlsChromium.css b/WebCore/css/mediaControlsChromium.css
index 6fda61c..0f667bd 100644
--- a/WebCore/css/mediaControlsChromium.css
+++ b/WebCore/css/mediaControlsChromium.css
@@ -33,6 +33,7 @@ audio {
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-user-select: none;
     position: absolute;
+    overflow: visible;
     bottom: 0;
     width: 100%;
     height: 32px;
@@ -46,7 +47,6 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-
     position: absolute;
     top: auto;
     bottom: 0;
@@ -83,8 +83,8 @@ audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-
     width: auto;
     height: 32px;
 
-    border-left-color: rgba(255, 255, 255, 0.2);
-    border-right-color: rgba(255, 255, 255, 0.2);
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
 }
 
 audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
@@ -141,12 +141,13 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
     position: absolute;
     top: auto;
-    bottom: 8px;
+    bottom: 7px;
     left: 6px;
     right: 65px;
     height: 16px;
 
     border-color: rgba(255, 255, 255, 0.2);
+    border-style: solid;
     border-width: 1px;
     border-radius: 2px;
     background-color: rgba(255, 255, 255, 0.08);
@@ -167,3 +168,25 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     -webkit-appearance: media-fullscreen-button;
     display: none;
 }
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    -webkit-appearance: media-volume-slider-container;
+    position: absolute;
+
+    width: 34px;
+    height: 100px;
+
+    background-color: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    -webkit-appearance: media-volume-slider;
+    display: inline;
+    position: absolute;
+
+    top: 10px;
+    left: 12px;
+
+    width: 10px;
+    height: 80px;
+}
diff --git a/WebCore/css/qt/mediaControls-extras.css b/WebCore/css/mediaControlsQt.css
index d85deae..a9c3609 100644
--- a/WebCore/css/qt/mediaControls-extras.css
+++ b/WebCore/css/mediaControlsQt.css
@@ -25,18 +25,38 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+ /* QtWebKit media controls. Extends mediaControls.css */
+
 audio {
     height: 34px;
     width: 400px;
 }
 
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: end;
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    z-index: 0;
+    overflow: hidden;
+    height: 100%;
+    text-align: right;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+	display: none;
+}
+
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     left: auto;
     right: 5px;
     width: 12px;
     height: 12px;
     padding: 6px;
-    margin: 5px 0px;
+    margin: 5px 5px 5px 3px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
@@ -44,17 +64,18 @@ audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-bu
     width: 9px;
     height: 12px;
     padding: 6px 12px 6px 11px;
-    margin: 5px 0px;
+    margin: 5px 3px 5px 5px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
-    /* Since MediaControlElements are always created with a renderer we have to hide
-       the controls we don't use, so they don't mess up activation and event handling */
-    left: 0px;
-    top: 0px;
-    width: 0px;
-    height: 0px;
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 34px;
+}
 
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
@@ -66,6 +87,14 @@ audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     margin: 5px 0px;
 }
 
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
+
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     /* Since MediaControlElements are always created with a renderer we have to hide
        the controls we don't use, so they don't mess up activation and event handling */
@@ -99,3 +128,11 @@ audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-f
     display: none;
 }
 
+audio::-webkit-media-controls-rewind-button, video::-webkit-media-controls-rewind-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-return-to-realtime-button, video::-webkit-media-controls-return-to-realtime-button {
+    display: none;
+}
+
diff --git a/WebCore/css/mediaControlsQT.css b/WebCore/css/mediaControlsQuickTime.css
index 5cf48ae..5cf48ae 100644
--- a/WebCore/css/mediaControlsQT.css
+++ b/WebCore/css/mediaControlsQuickTime.css
diff --git a/WebCore/dom/ActiveDOMObject.h b/WebCore/dom/ActiveDOMObject.h
index e58d3f9..73b52d5 100644
--- a/WebCore/dom/ActiveDOMObject.h
+++ b/WebCore/dom/ActiveDOMObject.h
@@ -53,9 +53,6 @@ namespace WebCore {
         virtual void resume();
         virtual void stop();
 
-    protected:
-        virtual ~ActiveDOMObject();
-
         template<class T> void setPendingActivity(T* thisObject)
         {
             ASSERT(thisObject == this);
@@ -70,6 +67,9 @@ namespace WebCore {
             thisObject->deref();
         }
 
+    protected:
+        virtual ~ActiveDOMObject();
+
     private:
         ScriptExecutionContext* m_scriptExecutionContext;
         unsigned m_pendingActivityCount;
diff --git a/WebCore/dom/Attr.cpp b/WebCore/dom/Attr.cpp
index 435c1af..aa5916b 100644
--- a/WebCore/dom/Attr.cpp
+++ b/WebCore/dom/Attr.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
-    : ContainerNode(docPtr)
+inline Attr::Attr(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+    : ContainerNode(document)
     , m_element(element)
-    , m_attribute(a)
+    , m_attribute(attribute)
     , m_ignoreChildrenChanged(0)
     , m_specified(true)  
 {
@@ -41,6 +41,13 @@ Attr::Attr(Element* element, Document* docPtr, PassRefPtr<Attribute> a)
     m_attribute->m_impl = this;
 }
 
+PassRefPtr<Attr> Attr::create(Element* element, Document* document, PassRefPtr<Attribute> attribute)
+{
+    RefPtr<Attr> attr = adoptRef(new Attr(element, document, attribute));
+    attr->createTextChild();
+    return attr.release();
+}
+
 Attr::~Attr()
 {
     ASSERT(m_attribute->attr() == this);
@@ -86,14 +93,14 @@ const AtomicString& Attr::prefix() const
     return m_attribute->prefix();
 }
 
-void Attr::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
+void Attr::setPrefix(const AtomicString& prefix, ExceptionCode& ec)
 {
     ec = 0;
-    checkSetPrefix(_prefix, ec);
+    checkSetPrefix(prefix, ec);
     if (ec)
         return;
 
-    m_attribute->setPrefix(_prefix);
+    m_attribute->setPrefix(prefix);
 }
 
 String Attr::nodeValue() const
@@ -101,11 +108,11 @@ String Attr::nodeValue() const
     return value();
 }
 
-void Attr::setValue(const String& v, ExceptionCode&)
+void Attr::setValue(const AtomicString& value, ExceptionCode&)
 {
     m_ignoreChildrenChanged++;
     removeChildren();
-    m_attribute->setValue(v.impl());
+    m_attribute->setValue(value);
     createTextChild();
     m_ignoreChildrenChanged--;
 
@@ -120,7 +127,7 @@ void Attr::setNodeValue(const String& v, ExceptionCode& ec)
 
 PassRefPtr<Node> Attr::cloneNode(bool /*deep*/)
 {
-    RefPtr<Attr> clone = new Attr(0, document(), m_attribute->clone());
+    RefPtr<Attr> clone = adoptRef(new Attr(0, document(), m_attribute->clone()));
     cloneChildNodes(clone.get());
     return clone.release();
 }
diff --git a/WebCore/dom/Attr.h b/WebCore/dom/Attr.h
index ed4dc07..e927a6e 100644
--- a/WebCore/dom/Attr.h
+++ b/WebCore/dom/Attr.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -39,48 +39,47 @@ namespace WebCore {
 class Attr : public ContainerNode {
     friend class NamedNodeMap;
 public:
-    Attr(Element*, Document*, PassRefPtr<Attribute>);
-    ~Attr();
+    static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
+    virtual ~Attr();
 
-    // Call this after calling the constructor so the
-    // Attr node isn't floating when we append the text node.
-    void createTextChild();
-    
-    // DOM methods & attributes for Attr
     String name() const { return qualifiedName().toString(); }
     bool specified() const { return m_specified; }
     Element* ownerElement() const { return m_element; }
 
-    String value() const { return m_attribute->value(); }
-    void setValue(const String&, ExceptionCode&);
+    const AtomicString& value() const { return m_attribute->value(); }
+    void setValue(const AtomicString&, ExceptionCode&);
+
+    Attribute* attr() const { return m_attribute.get(); }
+    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
+
+    // An extension to get presentational information for attributes.
+    CSSStyleDeclaration* style() { return m_attribute->style(); }
+
+    void setSpecified(bool specified) { m_specified = specified; }
+
+private:
+    Attr(Element*, Document*, PassRefPtr<Attribute>);
+
+    void createTextChild();
 
-    // DOM methods overridden from parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
+
     const AtomicString& localName() const;
     const AtomicString& namespaceURI() const;
     const AtomicString& prefix() const;
+
     virtual void setPrefix(const AtomicString&, ExceptionCode&);
 
     virtual String nodeValue() const;
     virtual void setNodeValue(const String&, ExceptionCode&);
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-    // Other methods (not part of DOM)
     virtual bool isAttributeNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    Attribute* attr() const { return m_attribute.get(); }
-    const QualifiedName& qualifiedName() const { return m_attribute->name(); }
-
-    // An extension to get presentational information for attributes.
-    CSSStyleDeclaration* style() { return m_attribute->style(); }
-
-    void setSpecified(bool specified) { m_specified = specified; }
-
-private:
     virtual const AtomicString& virtualPrefix() const { return prefix(); }
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
diff --git a/WebCore/dom/Attr.idl b/WebCore/dom/Attr.idl
index 29f4be1..c01f34a 100644
--- a/WebCore/dom/Attr.idl
+++ b/WebCore/dom/Attr.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
diff --git a/WebCore/dom/Attribute.cpp b/WebCore/dom/Attribute.cpp
index 048ac6a..0ab0bb6 100644
--- a/WebCore/dom/Attribute.cpp
+++ b/WebCore/dom/Attribute.cpp
@@ -37,10 +37,8 @@ PassRefPtr<Attribute> Attribute::clone() const
 PassRefPtr<Attr> Attribute::createAttrIfNeeded(Element* e)
 {
     RefPtr<Attr> r = m_impl;
-    if (!r) {
-        r = new Attr(e, e->document(), this);
-        r->createTextChild();
-    }
+    if (!r)
+        r = Attr::create(e, e->document(), this);
     return r.release();
 }
 
diff --git a/WebCore/dom/BeforeLoadEvent.h b/WebCore/dom/BeforeLoadEvent.h
new file mode 100644
index 0000000..8c86773
--- /dev/null
+++ b/WebCore/dom/BeforeLoadEvent.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef BeforeLoadEvent_h
+#define BeforeLoadEvent_h
+
+#include "Event.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+class BeforeLoadEvent : public Event {
+public:
+    static PassRefPtr<BeforeLoadEvent> create(const String& url)
+    {
+        return adoptRef(new BeforeLoadEvent(url));
+    }
+
+    void initBeforeLoadEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& url)
+    {
+        if (dispatched())
+            return;
+        
+        initEvent(type, canBubble, cancelable);
+
+        m_url = url;
+    }
+
+    const String& url() const { return m_url; }
+
+private:
+    BeforeLoadEvent(const String& url)
+        : Event(eventNames().beforeloadEvent, false, true)
+        , m_url(url)
+    {}
+
+    String m_url;
+};
+
+} // namespace WebCore
+
+#endif // BeforeLoadEvent_h
diff --git a/WebCore/dom/BeforeLoadEvent.idl b/WebCore/dom/BeforeLoadEvent.idl
new file mode 100644
index 0000000..d06a39d
--- /dev/null
+++ b/WebCore/dom/BeforeLoadEvent.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] BeforeLoadEvent : Event {
+        void initBeforeLoadEvent(in DOMString type,
+                                 in boolean canBubble, 
+                                 in boolean cancelable,
+                                 in DOMString url);
+        readonly attribute DOMString url;
+    };
+
+}
diff --git a/WebCore/dom/CDATASection.cpp b/WebCore/dom/CDATASection.cpp
index 72faa70..d73054e 100644
--- a/WebCore/dom/CDATASection.cpp
+++ b/WebCore/dom/CDATASection.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,13 +26,14 @@
 
 namespace WebCore {
 
-CDATASection::CDATASection(Document* document, const String& text)
-    : Text(document, text)
+inline CDATASection::CDATASection(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-CDATASection::~CDATASection()
+PassRefPtr<CDATASection> CDATASection::create(Document* document, const String& data)
 {
+    return adoptRef(new CDATASection(document, data));
 }
 
 String CDATASection::nodeName() const
@@ -47,19 +48,17 @@ Node::NodeType CDATASection::nodeType() const
 
 PassRefPtr<Node> CDATASection::cloneNode(bool /*deep*/)
 {
-    return new CDATASection(document(), m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool CDATASection::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> CDATASection::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> CDATASection::virtualCreate(const String& data)
 {
-    return new CDATASection(document(), string);
+    return create(document(), data);
 }
 
-
 } // namespace WebCore
diff --git a/WebCore/dom/CDATASection.h b/WebCore/dom/CDATASection.h
index 8b7df9d..5cf07e1 100644
--- a/WebCore/dom/CDATASection.h
+++ b/WebCore/dom/CDATASection.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,16 @@ namespace WebCore {
 
 class CDATASection : public Text {
 public:
+    static PassRefPtr<CDATASection> create(Document*, const String&);
+
+private:
     CDATASection(Document*, const String&);
-    virtual ~CDATASection();
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/CharacterData.cpp b/WebCore/dom/CharacterData.cpp
index 9a72de9..3c3dc37 100644
--- a/WebCore/dom/CharacterData.cpp
+++ b/WebCore/dom/CharacterData.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,20 +30,11 @@
 
 namespace WebCore {
 
-CharacterData::CharacterData(Document *doc, bool isText)
-    : Node(doc, false, false, isText)
-    , m_data(StringImpl::empty())
-{
-}
-
-CharacterData::CharacterData(Document* document, const String& text, bool isText)
-    : Node(document, false, false, isText)
-{
-    m_data = text.impl() ? text.impl() : StringImpl::empty();
-}
-
-CharacterData::~CharacterData()
+CharacterData::CharacterData(Document* document, const String& text, ConstructionType type)
+    : Node(document, type)
+    , m_data(text.impl() ? text.impl() : StringImpl::empty())
 {
+    ASSERT(type == CreateOther || type == CreateText);
 }
 
 void CharacterData::setData(const String& data, ExceptionCode&)
@@ -196,10 +187,8 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
 {
     if (parentNode())
         parentNode()->childrenChanged();
-    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
-        ExceptionCode ec;
-        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
-    }
+    if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER))
+        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data));
     dispatchSubtreeModifiedEvent();
 }
 
diff --git a/WebCore/dom/CharacterData.h b/WebCore/dom/CharacterData.h
index d9e55c0..6c31933 100644
--- a/WebCore/dom/CharacterData.h
+++ b/WebCore/dom/CharacterData.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,12 +29,6 @@ namespace WebCore {
 
 class CharacterData : public Node {
 public:
-    CharacterData(Document*, const String& text, bool isText = false);
-    CharacterData(Document*, bool isText = false);
-    virtual ~CharacterData();
-
-    // DOM methods & attributes for CharacterData
-
     String data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
     unsigned length() const { return m_data->length(); }
@@ -42,31 +36,30 @@ public:
     void appendData(const String&, ExceptionCode&);
     void insertData(unsigned offset, const String&, ExceptionCode&);
     void deleteData(unsigned offset, unsigned count, ExceptionCode&);
-    void replaceData(unsigned offset, unsigned count, const String &arg, ExceptionCode&);
+    void replaceData(unsigned offset, unsigned count, const String&, ExceptionCode&);
 
     bool containsOnlyWhitespace() const;
 
-    // DOM methods overridden from parent classes
-
-    virtual String nodeValue() const;
-    virtual void setNodeValue(const String&, ExceptionCode&);
-    
-    // Other methods (not part of DOM)
+    StringImpl* dataImpl() { return m_data.get(); }
 
-    virtual bool isCharacterDataNode() const { return true; }
-    virtual int maxCharacterOffset() const;
-    StringImpl* string() { return m_data.get(); }
+protected:
+    CharacterData(Document*, const String&, ConstructionType);
 
-    virtual bool offsetInCharacters() const;
     virtual bool rendererIsNeeded(RenderStyle*);
 
-protected:
-    RefPtr<StringImpl> m_data;
-
+    void setDataImpl(PassRefPtr<StringImpl> impl) { m_data = impl; }
     void dispatchModifiedEvent(StringImpl* oldValue);
 
 private:
+    virtual String nodeValue() const;
+    virtual void setNodeValue(const String&, ExceptionCode&);
+    virtual bool isCharacterDataNode() const { return true; }
+    virtual int maxCharacterOffset() const;
+    virtual bool offsetInCharacters() const;
+
     void checkCharDataOperation(unsigned offset, ExceptionCode&);
+
+    RefPtr<StringImpl> m_data;
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Clipboard.h b/WebCore/dom/Clipboard.h
index 0fea604..f6c09b2 100644
--- a/WebCore/dom/Clipboard.h
+++ b/WebCore/dom/Clipboard.h
@@ -64,7 +64,9 @@ namespace WebCore {
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
+#if ENABLE(DRAG_SUPPORT)
         virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*) = 0;
+#endif
         virtual void writeURL(const KURL&, const String&, Frame*) = 0;
         virtual void writeRange(Range*, Frame*) = 0;
 
diff --git a/WebCore/dom/Comment.cpp b/WebCore/dom/Comment.cpp
index a36a491..3dcde38 100644
--- a/WebCore/dom/Comment.cpp
+++ b/WebCore/dom/Comment.cpp
@@ -1,9 +1,7 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,22 +22,16 @@
 #include "config.h"
 #include "Comment.h"
 
-#include "Document.h"
-
 namespace WebCore {
 
-Comment::Comment(Document* doc, const String& text)
-    : CharacterData(doc, text)
-{
-}
-
-Comment::Comment(Document* doc)
-    : CharacterData(doc)
+inline Comment::Comment(Document* document, const String& text)
+    : CharacterData(document, text, CreateOther)
 {
 }
 
-Comment::~Comment()
+PassRefPtr<Comment> Comment::create(Document* document, const String& text)
 {
+    return adoptRef(new Comment(document, text));
 }
 
 String Comment::nodeName() const
@@ -54,10 +46,9 @@ Node::NodeType Comment::nodeType() const
 
 PassRefPtr<Node> Comment::cloneNode(bool /*deep*/)
 {
-    return document()->createComment(m_data);
+    return create(document(), data());
 }
 
-// DOM Section 1.1.1
 bool Comment::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/WebCore/dom/Comment.h b/WebCore/dom/Comment.h
index d00ba62..680ffae 100644
--- a/WebCore/dom/Comment.h
+++ b/WebCore/dom/Comment.h
@@ -1,9 +1,7 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,16 +29,14 @@ namespace WebCore {
 
 class Comment : public CharacterData {
 public:
-    Comment(Document*, const String &_text);
-    Comment(Document*);
-    virtual ~Comment();
+    static PassRefPtr<Comment> create(Document*, const String&);
+
+private:
+    Comment(Document*, const String&);
 
-    // DOM methods overridden from  parent classes
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
     virtual bool isCommentNode() const { return true; }
     virtual bool childTypeAllowed(NodeType);
 };
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index 2d79156..99b2c4f 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "BeforeLoadEvent.h"
 #include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
@@ -41,8 +42,8 @@
 
 namespace WebCore {
 
-static void dispatchChildInsertionEvents(Node*, ExceptionCode&);
-static void dispatchChildRemovalEvents(Node*, ExceptionCode&);
+static void dispatchChildInsertionEvents(Node*);
+static void dispatchChildRemovalEvents(Node*);
 
 typedef Vector<std::pair<NodeCallback, RefPtr<Node> > > NodeCallbackQueue;
 static NodeCallbackQueue* s_postAttachCallbackQueue;
@@ -144,7 +145,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
 
         // Dispatch the mutation events.
         childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree.
         if (attached() && !child->attached() && child->parent() == this) {
@@ -255,7 +256,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         allowEventDispatch();
 
         // Dispatch the mutation events
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
                 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -287,7 +288,7 @@ static ExceptionCode willRemoveChild(Node *child)
     ExceptionCode ec = 0;
 
     // fire removed from document mutation events.
-    dispatchChildRemovalEvents(child, ec);
+    dispatchChildRemovalEvents(child);
     if (ec)
         return ec;
 
@@ -480,7 +481,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
 
         // Dispatch the mutation events
         childrenChanged(false, prev.get(), 0, 1);
-        dispatchChildInsertionEvents(child.get(), ec);
+        dispatchChildInsertionEvents(child.get());
 
         // Add child to the rendering tree
         if (attached() && !child->attached() && child->parent() == this) {
@@ -690,7 +691,7 @@ bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
             point = o->container()->localToAbsolute();
             if (o->isText() && toRenderText(o)->firstTextBox()) {
                 point.move(toRenderText(o)->linesBoundingBox().x(),
-                           toRenderText(o)->firstTextBox()->root()->topOverflow());
+                           toRenderText(o)->firstTextBox()->root()->lineTop());
             } else if (o->isBox()) {
                 RenderBox* box = toRenderBox(o);
                 point.move(box->x(), box->y());
@@ -864,63 +865,57 @@ Node *ContainerNode::childNode(unsigned index) const
     return n;
 }
 
-static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildInsertionEvents(Node* child)
 {
     ASSERT(!eventDispatchForbidden());
 
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     if (c->parentNode() && c->parentNode()->inDocument())
         c->insertedIntoDocument();
     else
         c->insertedIntoTree(true);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEINSERTED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER)) {
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false));
+    }
 }
 
-static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
+static void dispatchChildRemovalEvents(Node* child)
 {
     RefPtr<Node> c = child;
-    DocPtr<Document> doc = child->document();
+    RefPtr<Document> document = child->document();
 
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
-    doc->nodeWillBeRemoved(child);
+    document->nodeWillBeRemoved(child);
 
-    doc->incDOMTreeVersion();
+    document->incDOMTreeVersion();
 
     // dispatch pre-removal mutation events
-    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
-        ec = 0;
-        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
-        if (ec)
-            return;
-    }
+    if (c->parentNode() && document->hasListenerType(Document::DOMNODEREMOVED_LISTENER))
+        c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, c->parentNode()));
 
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
-    if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
-        for (; c; c = c->traverseNextNode(child)) {
-            ec = 0;
-            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
-            if (ec)
-                return;
-        }
+    if (c->inDocument() && document->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER)) {
+        for (; c; c = c->traverseNextNode(child))
+            c->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false));
+    }
 }
 
+bool ContainerNode::dispatchBeforeLoadEvent(const String& sourceURL)
+{
+    RefPtr<ContainerNode> protector(this);
+    RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
+    dispatchEvent(beforeLoadEvent.get());
+    return inDocument() && !beforeLoadEvent->defaultPrevented();
 }
+
+} // namespace WebCore
diff --git a/WebCore/dom/ContainerNode.h b/WebCore/dom/ContainerNode.h
index 3ad932c..9789f1f 100644
--- a/WebCore/dom/ContainerNode.h
+++ b/WebCore/dom/ContainerNode.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,7 +38,6 @@ namespace Private {
 
 class ContainerNode : public Node {
 public:
-    ContainerNode(Document*, bool isElement = false);
     virtual ~ContainerNode();
 
     Node* firstChild() const { return m_firstChild; }
@@ -72,8 +71,12 @@ public:
     void removeAllChildren();
 
     void cloneChildNodes(ContainerNode* clone);
+    
+    bool dispatchBeforeLoadEvent(const String& sourceURL);
 
 protected:
+    ContainerNode(Document*, ConstructionType = CreateContainer);
+
     static void queuePostAttachCallback(NodeCallback, Node*);
     void suspendPostAttachCallbacks();
     void resumePostAttachCallbacks();
@@ -97,8 +100,8 @@ private:
     Node* m_lastChild;
 };
 
-inline ContainerNode::ContainerNode(Document* document, bool isElement)
-    : Node(document, isElement, true)
+inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
+    : Node(document, type)
     , m_firstChild(0)
     , m_lastChild(0)
 {
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 065f708..59b9703 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -223,12 +223,6 @@ DOMImplementation* DOMImplementation::getInterface(const String& /*feature*/)
 PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceURI,
     const String& qualifiedName, DocumentType* doctype, ExceptionCode& ec)
 {
-    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
-    // created from a different implementation.
-    bool shouldThrowWrongDocErr = false;
-    if (doctype && doctype->document())
-        shouldThrowWrongDocErr = true;
-
     RefPtr<Document> doc;
 #if ENABLE(SVG)
     if (namespaceURI == SVGNames::svgNamespaceURI)
@@ -245,24 +239,27 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
     else
         doc = Document::create(0);
 
-    // now get the interesting parts of the doctype
-    if (doctype)
-        doc->addChild(doctype);
-
+    RefPtr<Node> documentElement;
     if (!qualifiedName.isEmpty()) {
-        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
         if (ec)
             return 0;
-        doc->addChild(documentElement.release());
     }
 
+    // WRONG_DOCUMENT_ERR: Raised if doctype has already been used with a different document or was
+    // created from a different implementation.
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
-    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec)
-    if (shouldThrowWrongDocErr) {
+    // other exceptions to WRONG_DOCUMENT_ERR (based on order mentioned in spec).
+    if (doctype && doctype->document()) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
     }
 
+    if (doctype)
+        doc->addChild(doctype);
+    if (documentElement)
+        doc->addChild(documentElement.release());
+
     return doc.release();
 }
 
diff --git a/WebCore/dom/DocPtr.h b/WebCore/dom/DocPtr.h
deleted file mode 100644
index 8b50e8d..0000000
--- a/WebCore/dom/DocPtr.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * This file is part of the DOM implementation for KDE.
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef DocPtr_h
-#define DocPtr_h
-
-namespace WebCore {
-
-template <class T> class DocPtr {
-public:
-    DocPtr() : m_ptr(0) {}
-    DocPtr(T *ptr) : m_ptr(ptr) { if (ptr) ptr->selfOnlyRef(); }
-    DocPtr(const DocPtr &o) : m_ptr(o.m_ptr) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    ~DocPtr() { if (T *ptr = m_ptr) ptr->selfOnlyDeref(); }
-    
-    template <class U> DocPtr(const DocPtr<U> &o) : m_ptr(o.get()) { if (T *ptr = m_ptr) ptr->selfOnlyRef(); }
-    
-    void resetSkippingRef(T *o) { m_ptr = o; }
-    
-    T *get() const { return m_ptr; }
-    
-    T &operator*() const { return *m_ptr; }
-    T *operator->() const { return m_ptr; }
-    
-    bool operator!() const { return !m_ptr; }
-
-    // this type conversion operator allows implicit conversion to
-    // bool but not to other integer types
-    
-    typedef T * (DocPtr::*UnspecifiedBoolType)() const;
-    operator UnspecifiedBoolType() const
-    {
-        return m_ptr ? &DocPtr::get : 0;
-    }
-    
-    DocPtr &operator=(const DocPtr &);
-    DocPtr &operator=(T *);
-    
- private:
-    T *m_ptr;
-};
-
-template <class T> DocPtr<T> &DocPtr<T>::operator=(const DocPtr<T> &o) 
-{
-    T *optr = o.m_ptr;
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-        return *this;
-}
-
-template <class T> inline DocPtr<T> &DocPtr<T>::operator=(T *optr)
-{
-    if (optr)
-        optr->selfOnlyRef();
-    if (T *ptr = m_ptr)
-        ptr->selfOnlyDeref();
-    m_ptr = optr;
-    return *this;
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() == b.get(); 
-}
-
-template <class T> inline bool operator==(const DocPtr<T> &a, const T *b) 
-{ 
-    return a.get() == b; 
-}
-
-template <class T> inline bool operator==(const T *a, const DocPtr<T> &b) 
-{
-    return a == b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const DocPtr<T> &b) 
-{ 
-    return a.get() != b.get(); 
-}
-
-template <class T> inline bool operator!=(const DocPtr<T> &a, const T *b)
-{
-    return a.get() != b; 
-}
-
-template <class T> inline bool operator!=(const T *a, const DocPtr<T> &b) 
-{ 
-    return a != b.get(); 
-}
-
-} // namespace WebCore
-
-#endif // DocPtr_h
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index e4c5741..221473b 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -79,7 +79,7 @@
 #include "HitTestResult.h"
 #include "ImageLoader.h"
 #include "InspectorController.h"
-#include "ScriptEventListener.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MappedAttribute.h"
@@ -93,6 +93,8 @@
 #include "NodeWithIndex.h"
 #include "OverflowEvent.h"
 #include "Page.h"
+#include "PageGroup.h"
+#include "PageTransitionEvent.h"
 #include "PlatformKeyboardEvent.h"
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
@@ -103,6 +105,7 @@
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "ScriptElement.h"
+#include "ScriptEventListener.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
@@ -112,14 +115,17 @@
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
 #include "Timer.h"
+#include "TransformSource.h"
 #include "TreeWalker.h"
 #include "UIEvent.h"
+#include "UserContentURLPattern.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
 #include "WheelEvent.h"
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
+#include "htmlediting.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
@@ -131,6 +137,10 @@
 #include "DatabaseThread.h"
 #endif
 
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #if ENABLE(DOM_STORAGE)
 #include "StorageEvent.h"
 #endif
@@ -153,6 +163,7 @@
 #if ENABLE(SVG)
 #include "SVGDocumentExtensions.h"
 #include "SVGElementFactory.h"
+#include "SVGNames.h"
 #include "SVGZoomEvent.h"
 #include "SVGStyleElement.h"
 #endif
@@ -184,6 +195,12 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+#include "MathMLElementFactory.h"
+#include "MathMLNames.h"
+#endif
+
 #if ENABLE(XHTMLMP)
 #include "HTMLNoScriptElement.h"
 #endif
@@ -325,9 +342,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_titleSetExplicitly(false)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
     , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
-#if ENABLE(XSLT)
-    , m_transformSource(0)
-#endif
     , m_xmlVersion("1.0")
     , m_xmlStandalone(false)
 #if ENABLE(XBL)
@@ -361,7 +375,9 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_containsWMLContent(false)
 #endif
 {
-    m_document.resetSkippingRef(this);
+    m_document = this;
+
+    m_pageGroupUserSheetCacheValid = false;
 
     m_printing = false;
     
@@ -431,8 +447,7 @@ void Document::removedLastRef()
         // want the document to be destructed until after
         // removeAllChildren returns, so we guard ourselves with an
         // extra self-only ref.
-
-        DocPtr<Document> guard(this);
+        selfOnlyRef();
 
         // We must make sure not to be retaining any of our children through
         // these extra pointers or we will create a reference cycle.
@@ -456,6 +471,8 @@ void Document::removedLastRef()
 #ifndef NDEBUG
         m_inRemovedLastRefFunction = false;
 #endif
+
+        selfOnlyDeref();
     } else {
 #ifndef NDEBUG
         m_deletionHasBegun = true;
@@ -482,7 +499,7 @@ Document::~Document()
 #endif
 
     delete m_tokenizer;
-    m_document.resetSkippingRef(0);
+    m_document = 0;
     delete m_styleSelector;
     delete m_docLoader;
     
@@ -491,10 +508,6 @@ Document::~Document()
         m_renderArena = 0;
     }
 
-#if ENABLE(XSLT)
-    xmlFreeDoc((xmlDocPtr)m_transformSource);
-#endif
-
 #if ENABLE(XBL)
     delete m_bindingManager;
 #endif
@@ -518,8 +531,6 @@ Document::~Document()
 
     if (m_styleSheets)
         m_styleSheets->documentDestroyed();
-
-    m_document = 0;
 }
 
 void Document::resetLinkColor()
@@ -599,17 +610,17 @@ PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionC
 
 PassRefPtr<DocumentFragment> Document::createDocumentFragment()
 {
-    return new DocumentFragment(document());
+    return DocumentFragment::create(document());
 }
 
 PassRefPtr<Text> Document::createTextNode(const String& data)
 {
-    return new Text(this, data);
+    return Text::create(this, data);
 }
 
 PassRefPtr<Comment> Document::createComment(const String& data)
 {
-    return new Comment(this, data);
+    return Comment::create(this, data);
 }
 
 PassRefPtr<CDATASection> Document::createCDATASection(const String& data, ExceptionCode& ec)
@@ -618,7 +629,7 @@ PassRefPtr<CDATASection> Document::createCDATASection(const String& data, Except
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new CDATASection(this, data);
+    return CDATASection::create(this, data);
 }
 
 PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const String& target, const String& data, ExceptionCode& ec)
@@ -631,7 +642,7 @@ PassRefPtr<ProcessingInstruction> Document::createProcessingInstruction(const St
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new ProcessingInstruction(this, target, data);
+    return ProcessingInstruction::create(this, target, data);
 }
 
 PassRefPtr<EntityReference> Document::createEntityReference(const String& name, ExceptionCode& ec)
@@ -644,12 +655,12 @@ PassRefPtr<EntityReference> Document::createEntityReference(const String& name,
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return new EntityReference(this, name);
+    return EntityReference::create(this, name);
 }
 
 PassRefPtr<EditingText> Document::createEditingTextNode(const String& text)
 {
-    return new EditingText(this, text);
+    return EditingText::create(this, text);
 }
 
 PassRefPtr<CSSStyleDeclaration> Document::createCSSStyleDeclaration()
@@ -714,11 +725,8 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
 
             return newElement.release();
         }
-        case ATTRIBUTE_NODE: {
-            RefPtr<Attr> newAttr = new Attr(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
-            newAttr->createTextChild();
-            return newAttr.release();
-        }
+        case ATTRIBUTE_NODE:
+            return Attr::create(0, this, static_cast<Attr*>(importedNode)->attr()->clone());
         case DOCUMENT_FRAGMENT_NODE: {
             DocumentFragment* oldFragment = static_cast<DocumentFragment*>(importedNode);
             RefPtr<DocumentFragment> newFragment = createDocumentFragment();
@@ -828,9 +836,13 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
     else if (isWMLDocument())
         e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
+#if ENABLE(MATHML)
+    else if (qName.namespaceURI() == MathMLNames::mathmlNamespaceURI)
+        e = MathMLElementFactory::createMathMLElement(qName, this, createdByParser);
+#endif
     
     if (!e)
-        e = new Element(qName, document());
+        e = Element::create(qName, document());
 
     // <image> uses imgTag so we need a special rule.
 #if ENABLE(WML)
@@ -952,16 +964,25 @@ KURL Document::baseURI() const
 
 Element* Document::elementFromPoint(int x, int y) const
 {
+    // FIXME: Share code between this and caretRangeFromPoint.
     if (!renderer())
         return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
 
-    HitTestRequest request(HitTestRequest::ReadOnly |
-                           HitTestRequest::Active);
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
 
-    float zoomFactor = frame() ? frame()->pageZoomFactor() : 1.0f;
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
 
-    HitTestResult result(roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)));
-    renderView()->layer()->hitTest(request, result); 
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
 
     Node* n = result.innerNode();
     while (n && !n->isElementNode())
@@ -971,6 +992,50 @@ Element* Document::elementFromPoint(int x, int y) const
     return static_cast<Element*>(n);
 }
 
+PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
+{
+    // FIXME: Share code between this and elementFromPoint.
+    if (!renderer())
+        return 0;
+    Frame* frame = this->frame();
+    if (!frame)
+        return 0;
+    FrameView* frameView = frame->view();
+    if (!frameView)
+        return 0;
+
+    float zoomFactor = frame->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)) + view()->scrollOffset();
+
+    if (!frameView->visibleContentRect().contains(point))
+        return 0;
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    renderView()->layer()->hitTest(request, result);
+
+    Node* node = result.innerNode();
+    if (!node)
+        return 0;
+
+    Node* shadowAncestorNode = node->shadowAncestorNode();
+    if (shadowAncestorNode != node) {
+        unsigned offset = shadowAncestorNode->nodeIndex();
+        Node* container = shadowAncestorNode->parentNode();
+        return Range::create(this, container, offset, container, offset);
+    }
+
+    RenderObject* renderer = node->renderer();
+    if (!renderer)
+        return 0;
+    VisiblePosition visiblePosition = renderer->positionForPoint(result.localPoint());
+    if (visiblePosition.isNull())
+        return 0;
+
+    Position rangeCompliantPosition = rangeCompliantEquivalent(visiblePosition);
+    return Range::create(this, rangeCompliantPosition, rangeCompliantPosition);
+}
+
 void Document::addElementById(const AtomicString& elementId, Element* element)
 {
     typedef HashMap<AtomicStringImpl*, Element*>::iterator iterator;
@@ -1186,6 +1251,12 @@ void Document::recalcStyle(StyleChange change)
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willRecalculateStyle();
+#endif
+
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
     if (view())
@@ -1266,6 +1337,11 @@ bail_out:
         m_closeAfterStyleRecalc = false;
         implicitClose();
     }
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didRecalculateStyle();
+#endif
 }
 
 void Document::updateStyleIfNeeded()
@@ -1363,7 +1439,8 @@ void Document::attach()
         bool matchAuthorAndUserStyles = true;
         if (Settings* docSettings = settings())
             matchAuthorAndUserStyles = docSettings->authorAndUserStylesEnabled();
-        m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+        m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), pageUserSheet(), pageGroupUserSheets(), 
+                                               !inCompatMode(), matchAuthorAndUserStyles);
     }
 
     recalcStyle(Force);
@@ -1389,7 +1466,11 @@ void Document::detach()
     // Send out documentWillBecomeInactive() notifications to registered elements,
     // in order to stop media elements
     documentWillBecomeInactive();
-    
+
+#if ENABLE(SHARED_WORKERS)
+    SharedWorkerRepository::documentDetached(this);
+#endif
+
     if (m_frame) {
         FrameView* view = m_frame->view();
         if (view)
@@ -1436,31 +1517,14 @@ void Document::detach()
 
 void Document::removeAllEventListeners()
 {
+    EventTarget::removeAllEventListeners();
+
     if (DOMWindow* domWindow = this->domWindow())
         domWindow->removeAllEventListeners();
-    removeAllDisconnectedNodeEventListeners();
-    for (Node* node = this; node; node = node->traverseNextNode())
+    for (Node* node = firstChild(); node; node = node->traverseNextNode())
         node->removeAllEventListeners();
 }
 
-void Document::registerDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.add(node);
-}
-
-void Document::unregisterDisconnectedNodeWithEventListeners(Node* node)
-{
-    m_disconnectedNodesWithEventListeners.remove(node);
-}
-
-void Document::removeAllDisconnectedNodeEventListeners()
-{
-    HashSet<Node*>::iterator end = m_disconnectedNodesWithEventListeners.end();
-    for (HashSet<Node*>::iterator i = m_disconnectedNodesWithEventListeners.begin(); i != end; ++i)
-        (*i)->removeAllEventListeners();
-    m_disconnectedNodesWithEventListeners.clear();
-}
-
 RenderView* Document::renderView() const
 {
     return toRenderView(renderer());
@@ -1660,7 +1724,7 @@ void Document::implicitClose()
         return;
     }
 
-    bool wasLocationChangePending = frame() && frame()->loader()->isScheduledLocationChangePending();
+    bool wasLocationChangePending = frame() && frame()->redirectScheduler()->locationChangePending();
     bool doload = !parsing() && m_tokenizer && !m_processingLoadEvent && !wasLocationChangePending;
     
     if (!doload)
@@ -1708,7 +1772,8 @@ void Document::implicitClose()
         f->animation()->resumeAnimations(this);
 
     ImageLoader::dispatchPendingLoadEvents();
-    dispatchLoadEvent();
+    dispatchWindowLoadEvent();
+    dispatchWindowEvent(PageTransitionEvent::create(eventNames().pageshowEvent, false), this);
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1726,7 +1791,7 @@ void Document::implicitClose()
     // fires. This will improve onload scores, and other browsers do it.
     // If they wanna cheat, we can too. -dwh
 
-    if (frame()->loader()->isScheduledLocationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
+    if (frame()->redirectScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
         // Just bail out. Before or during the onload we were shifted to another page.
         // The old i-Bench suite does this. When this happens don't bother painting or laying out.        
         view()->unscheduleRelayout();
@@ -1755,7 +1820,7 @@ void Document::implicitClose()
         // exists in the cache (we ignore the return value because we don't need it here). This is 
         // only safe to call when a layout is not in progress, so it can not be used in postNotification.    
         axObjectCache()->getOrCreate(renderObject);
-        axObjectCache()->postNotification(renderObject, "AXLoadComplete", true);
+        axObjectCache()->postNotification(renderObject, AXObjectCache::AXLoadComplete, true);
     }
 #endif
 
@@ -1917,34 +1982,72 @@ String Document::userAgent(const KURL& url) const
     return frame() ? frame()->loader()->userAgent(url) : String();
 }
 
-void Document::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
+CSSStyleSheet* Document::pageUserSheet()
 {
-    m_sheet = CSSStyleSheet::create(this, url, charset);
-    m_sheet->parseString(sheet->sheetText());
+    if (m_pageUserSheet)
+        return m_pageUserSheet.get();
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+    
+    String userSheetText = owningPage->userStyleSheet();
+    if (userSheetText.isEmpty())
+        return 0;
+    
+    // Parse the sheet and cache it.
+    m_pageUserSheet = CSSStyleSheet::create(this, settings()->userStyleSheetLocation());
+    m_pageUserSheet->setIsUserStyleSheet(true);
+    m_pageUserSheet->parseString(userSheetText, !inCompatMode());
+    return m_pageUserSheet.get();
+}
 
+void Document::clearPageUserSheet()
+{
+    m_pageUserSheet = 0;
     updateStyleSelector();
 }
 
-#if FRAME_LOADS_USER_STYLESHEET
-void Document::setUserStyleSheet(const String& sheet)
+const Vector<RefPtr<CSSStyleSheet> >* Document::pageGroupUserSheets() const
 {
-    if (m_usersheet != sheet) {
-        m_usersheet = sheet;
-        updateStyleSelector();
+    if (m_pageGroupUserSheetCacheValid)
+        return m_pageGroupUserSheets.get();
+    
+    m_pageGroupUserSheetCacheValid = true;
+    
+    Page* owningPage = page();
+    if (!owningPage)
+        return 0;
+        
+    const PageGroup& pageGroup = owningPage->group();
+    const UserStyleSheetMap* sheetsMap = pageGroup.userStyleSheets();
+    if (!sheetsMap)
+        return 0;
+
+    UserStyleSheetMap::const_iterator end = sheetsMap->end();
+    for (UserStyleSheetMap::const_iterator it = sheetsMap->begin(); it != end; ++it) {
+        const UserStyleSheetVector* sheets = it->second;
+        for (unsigned i = 0; i < sheets->size(); ++i) {
+            const UserStyleSheet* sheet = sheets->at(i).get();
+            if (!UserContentURLPattern::matchesPatterns(url(), sheet->whitelist(), sheet->blacklist()))
+                continue;
+            RefPtr<CSSStyleSheet> parsedSheet = CSSStyleSheet::create(const_cast<Document*>(this), sheet->url());
+            parsedSheet->setIsUserStyleSheet(true);
+            parsedSheet->parseString(sheet->source(), !inCompatMode());
+            if (!m_pageGroupUserSheets)
+                m_pageGroupUserSheets.set(new Vector<RefPtr<CSSStyleSheet> >);
+            m_pageGroupUserSheets->append(parsedSheet.release());
+        }
     }
+
+    return m_pageGroupUserSheets.get();
 }
-#endif
 
-String Document::userStyleSheet() const
+void Document::clearPageGroupUserSheets()
 {
-#if FRAME_LOADS_USER_STYLESHEET
-    return m_usersheet;
-#else
-    Page* page = this->page();
-    if (!page)
-        return String();
-    return page->userStyleSheet();
-#endif
+    m_pageGroupUserSheets.clear();
+    m_pageGroupUserSheetCacheValid = false;
+    updateStyleSelector();
 }
 
 CSSStyleSheet* Document::elementSheet()
@@ -2175,7 +2278,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 url = frame->loader()->url().string();
             else
                 url = completeURL(url).string();
-            frame->loader()->scheduleHTTPRedirection(delay, url);
+            frame->redirectScheduler()->scheduleRedirect(delay, url);
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
@@ -2189,7 +2292,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
         FrameLoader* frameLoader = frame->loader();
         if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
             frameLoader->stopAllLoaders();
-            frameLoader->scheduleHTTPRedirection(0, blankURL());
+            frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
         }
     }
 }
@@ -2566,7 +2669,8 @@ void Document::recalcStyleSelector()
 
     // Create a new style selector
     delete m_styleSelector;
-    m_styleSelector = new CSSStyleSelector(this, userStyleSheet(), m_styleSheets.get(), m_mappedElementSheet.get(), !inCompatMode(), matchAuthorAndUserStyles);
+    m_styleSelector = new CSSStyleSelector(this, m_styleSheets.get(), m_mappedElementSheet.get(), 
+                                           pageUserSheet(), pageGroupUserSheets(), !inCompatMode(), matchAuthorAndUserStyles);
     m_didCalculateStyleSelector = true;
 }
 
@@ -2661,7 +2765,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = oldFocusedNode->renderer();
         if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
-            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
+            oldFocusedNode->dispatchEvent(Event::create(eventNames().changeEvent, true, false));
             r = oldFocusedNode->renderer();
             if (r && r->isTextControl())
                 toRenderTextControl(r)->setEdited(false);
@@ -2681,10 +2785,10 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        if ((oldFocusedNode.get() == this) && oldFocusedNode->hasOneRef())
+        if (oldFocusedNode == this && oldFocusedNode->hasOneRef())
             return true;
             
-        if (oldFocusedNode.get() == oldFocusedNode->rootEditableElement())
+        if (oldFocusedNode == oldFocusedNode->rootEditableElement())
             frame()->editor()->didEndEditing();
     }
 
@@ -2713,7 +2817,7 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
         m_focusedNode->setFocus();
 
-        if (m_focusedNode.get() == m_focusedNode->rootEditableElement())
+        if (m_focusedNode == m_focusedNode->rootEditableElement())
             frame()->editor()->didBeginEditing();
 
         // eww, I suck. set the qt focus correctly
@@ -2735,20 +2839,17 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
     }
 
-#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
-    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->handleFocusedUIElementChanged();
-#elif PLATFORM(GTK)
+#if ((PLATFORM(MAC) || PLATFORM(WIN)) && !PLATFORM(CHROMIUM)) || PLATFORM(GTK)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
         RenderObject* oldFocusedRenderer = 0;
         RenderObject* newFocusedRenderer = 0;
 
         if (oldFocusedNode)
-            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+            oldFocusedRenderer = oldFocusedNode->renderer();
         if (newFocusedNode)
-            newFocusedRenderer = newFocusedNode.get()->renderer();
+            newFocusedRenderer = newFocusedNode->renderer();
 
-        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+        axObjectCache()->handleFocusedUIElementChanged(oldFocusedRenderer, newFocusedRenderer);
     }
 #endif
 
@@ -2891,26 +2992,16 @@ EventListener* Document::getWindowAttributeEventListener(const AtomicString& eve
     return domWindow->getAttributeEventListener(eventType);
 }
 
-void Document::dispatchWindowEvent(PassRefPtr<Event> event)
-{
-    ASSERT(!eventDispatchForbidden());
-    DOMWindow* domWindow = this->domWindow();
-    if (!domWindow)
-        return;
-    ExceptionCode ec;
-    domWindow->dispatchEvent(event, ec);
-}
-
-void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+void Document::dispatchWindowEvent(PassRefPtr<Event> event,  PassRefPtr<EventTarget> target)
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
     if (!domWindow)
         return;
-    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+    domWindow->dispatchEvent(event, target);
 }
 
-void Document::dispatchLoadEvent()
+void Document::dispatchWindowLoadEvent()
 {
     ASSERT(!eventDispatchForbidden());
     DOMWindow* domWindow = this->domWindow();
@@ -2933,6 +3024,8 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
         return MutationEvent::create();
     if (eventType == "OverflowEvent")
         return OverflowEvent::create();
+    if (eventType == "PageTransitionEvent")
+        return PageTransitionEvent::create();
     if (eventType == "ProgressEvent")
         return ProgressEvent::create();
 #if ENABLE(DOM_STORAGE)
@@ -3039,7 +3132,7 @@ String Document::domain() const
     return securityOrigin()->domain();
 }
 
-void Document::setDomain(const String& newDomain)
+void Document::setDomain(const String& newDomain, ExceptionCode& ec)
 {
     // Both NS and IE specify that changing the domain is only allowed when
     // the new domain is a suffix of the old domain.
@@ -3062,19 +3155,25 @@ void Document::setDomain(const String& newDomain)
     int oldLength = domain().length();
     int newLength = newDomain.length();
     // e.g. newDomain = webkit.org (10) and domain() = www.webkit.org (14)
-    if (newLength >= oldLength)
+    if (newLength >= oldLength) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     String test = domain();
     // Check that it's a subdomain, not e.g. "ebkit.org"
-    if (test[oldLength - newLength - 1] != '.')
+    if (test[oldLength - newLength - 1] != '.') {
+        ec = SECURITY_ERR;
         return;
+    }
 
     // Now test is "webkit.org" from domain()
     // and we check that it's the same thing as newDomain
     test.remove(0, oldLength - newLength);
-    if (test != newDomain)
+    if (test != newDomain) {
+        ec = SECURITY_ERR;
         return;
+    }
 
     securityOrigin()->setDomainFromDOM(newDomain);
     if (m_frame)
@@ -3870,13 +3969,11 @@ void Document::applyXSLTransform(ProcessingInstruction* pi)
     processor->createDocumentFromSource(newSource, resultEncoding, resultMIMEType, this, frame());
 }
 
-void Document::setTransformSource(void* doc)
+void Document::setTransformSource(PassOwnPtr<TransformSource> source)
 {
-    if (doc == m_transformSource)
+    if (m_transformSource == source)
         return;
-
-    xmlFreeDoc((xmlDocPtr)m_transformSource);
-    m_transformSource = doc;
+    m_transformSource = source;
 }
 
 #endif
@@ -3946,7 +4043,7 @@ PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const S
 
     // FIXME: Assume this is a mapped attribute, since createAttribute isn't namespace-aware.  There's no harm to XML
     // documents if we're wrong.
-    return new Attr(0, this, MappedAttribute::create(qName, StringImpl::empty()));
+    return Attr::create(0, this, MappedAttribute::create(qName, StringImpl::empty()));
 }
 
 #if ENABLE(SVG)
@@ -4040,12 +4137,18 @@ CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicS
 void Document::finishedParsing()
 {
     setParsing(false);
+    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false));
+    if (Frame* f = frame()) {
+        f->loader()->finishedParsing();
 
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventNames().DOMContentLoadedEvent, true, false), ec);
+#if ENABLE(INSPECTOR)
+        if (!page())
+            return;
 
-    if (Frame* f = frame())
-        f->loader()->finishedParsing();
+        if (InspectorController* controller = page()->inspectorController())
+            controller->mainResourceFiredDOMContentEvent(f->loader()->documentLoader(), url());
+    }
+#endif
 }
 
 Vector<String> Document::formElementsState() const
@@ -4247,7 +4350,7 @@ void Document::initSecurityContext()
     if (!m_frame) {
         // No source for a security context.
         // This can occur via document.implementation.createDocument().
-        m_cookieURL = KURL("");
+        m_cookieURL = KURL(ParsedURLString, "");
         ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::createEmpty());
         return;
     }
@@ -4258,7 +4361,7 @@ void Document::initSecurityContext()
     m_cookieURL = url;
     ScriptExecutionContext::setSecurityOrigin(SecurityOrigin::create(url));
 
-    if (FrameLoader::allowSubstituteDataAccessToLocal()) {
+    if (SecurityOrigin::allowSubstituteDataAccessToLocal()) {
         // If this document was loaded with substituteData, then the document can
         // load local resources.  See https://bugs.webkit.org/show_bug.cgi?id=16756
         // and https://bugs.webkit.org/show_bug.cgi?id=19760 for further
@@ -4448,7 +4551,7 @@ void Document::detachRange(Range* range)
     m_ranges.remove(range);
 }
 
-CanvasRenderingContext2D* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
+CanvasRenderingContext* Document::getCSSCanvasContext(const String& type, const String& name, int width, int height)
 {
     HTMLCanvasElement* result = getCSSCanvasElement(name);
     if (!result)
@@ -4531,10 +4634,12 @@ void Document::reportException(const String& errorMessage, int lineNumber, const
 void Document::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
     switch (destination) {
+#if ENABLE(INSPECTOR)
     case InspectorControllerDestination:
         if (page())
             page()->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
         return;
+#endif
     case ConsoleDestination:
         if (DOMWindow* window = domWindow())
             window->console()->addMessage(source, type, level, message, lineNumber, sourceURL);
@@ -4545,8 +4650,10 @@ void Document::addMessage(MessageDestination destination, MessageSource source,
 
 void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+#endif
     Frame* frame = this->frame();
     if (frame) {
         FrameLoader* frameLoader = frame->loader();
@@ -4556,8 +4663,13 @@ void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const
 
 void Document::scriptImported(unsigned long identifier, const String& sourceString)
 {
+#if ENABLE(INSPECTOR)
     if (page())
         page()->inspectorController()->scriptImported(identifier, sourceString);
+#else
+    UNUSED_PARAM(identifier);
+    UNUSED_PARAM(sourceString);
+#endif
 }
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index fc4dc7e..82a5b98 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -33,18 +33,12 @@
 #include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
+#include "Page.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
-
-// FIXME: We should move Mac off of the old Frame-based user stylesheet loading
-// code and onto the new code in Page. We can't do that until the code in Page
-// supports non-file: URLs, however.
-#if PLATFORM(MAC) || PLATFORM(QT)
-#define FRAME_LOADS_USER_STYLESHEET 1
-#else
-#define FRAME_LOADS_USER_STYLESHEET 0
-#endif
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -53,7 +47,7 @@ namespace WebCore {
     class CDATASection;
     class CachedCSSStyleSheet;
     class CachedScript;
-    class CanvasRenderingContext2D;
+    class CanvasRenderingContext;
     class CharacterData;
     class CSSStyleDeclaration;
     class CSSStyleSelector;
@@ -83,12 +77,12 @@ namespace WebCore {
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
+    class InspectorTimelineAgent;
     class IntPoint;
     class JSNode;
     class MouseEventWithHitTestResults;
     class NodeFilter;
     class NodeIterator;
-    class Page;
     class PlatformMouseEvent;
     class ProcessingInstruction;
     class Range;
@@ -111,6 +105,10 @@ namespace WebCore {
     class SVGDocumentExtensions;
 #endif
     
+#if ENABLE(XSLT)
+    class TransformSource;
+#endif
+
 #if ENABLE(XBL)
     class XBLBindingManager;
 #endif
@@ -172,19 +170,16 @@ class Document : public ContainerNode, public ScriptExecutionContext {
 public:
     static PassRefPtr<Document> create(Frame* frame)
     {
-        return new Document(frame, false);
+        return adoptRef(new Document(frame, false));
     }
     static PassRefPtr<Document> createXHTML(Frame* frame)
     {
-        return new Document(frame, true);
+        return adoptRef(new Document(frame, true));
     }
     virtual ~Document();
 
-    virtual bool isDocument() const { return true; }
-
     using ContainerNode::ref;
     using ContainerNode::deref;
-    virtual void removedLastRef();
 
     // Nodes belonging to this document hold "self-only" references -
     // these are enough to keep the document from being destroyed, but
@@ -211,10 +206,52 @@ public:
 
     // DOM methods & attributes for Document
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
+
     DocumentType* doctype() const { return m_docType.get(); }
 
     DOMImplementation* implementation() const;
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     
     Element* documentElement() const
     {
@@ -240,6 +277,8 @@ public:
     bool containsMultipleElementsWithId(const AtomicString& elementId) { return m_duplicateIds.contains(elementId.impl()); }
 
     Element* elementFromPoint(int x, int y) const;
+    PassRefPtr<Range> caretRangeFromPoint(int x, int y);
+
     String readyState() const;
 
     String defaultCharset() const;
@@ -299,11 +338,6 @@ public:
 
     CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
-    // DOM methods overridden from  parent classes
-
-    virtual String nodeName() const;
-    virtual NodeType nodeType() const;
-
     // Other methods (not part of DOM)
     virtual bool isHTMLDocument() const { return false; }
     virtual bool isImageDocument() const { return false; }
@@ -392,6 +426,9 @@ public:
     Frame* frame() const { return m_frame; } // can be NULL
     Page* page() const; // can be NULL
     Settings* settings() const; // can be NULL
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
+#endif
 
     PassRefPtr<Range> createRange();
 
@@ -455,17 +492,15 @@ public:
 
     virtual String userAgent(const KURL&) const;
 
-    // from cachedObjectClient
-    virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
-
-#if FRAME_LOADS_USER_STYLESHEET
-    void setUserStyleSheet(const String& sheet);
-#endif
+    CSSStyleSheet* pageUserSheet();
+    void clearPageUserSheet();
 
-    String userStyleSheet() const;
+    const Vector<RefPtr<CSSStyleSheet> >* pageGroupUserSheets() const;
+    void clearPageGroupUserSheets();
 
     CSSStyleSheet* elementSheet();
     CSSStyleSheet* mappedElementSheet();
+    
     virtual Tokenizer* createTokenizer();
     Tokenizer* tokenizer() { return m_tokenizer; }
     
@@ -474,10 +509,6 @@ public:
 
     enum ParseMode { Compat, AlmostStrict, Strict };
 
-private:
-    virtual void determineParseMode() {}
-    
-public:
     void setParseMode(ParseMode m) { m_parseMode = m; }
     ParseMode parseMode() const { return m_parseMode; }
 
@@ -506,11 +537,6 @@ public:
     
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const IntPoint&, const PlatformMouseEvent&);
 
-    virtual bool childTypeAllowed(NodeType);
-    virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
-    
     StyleSheetList* styleSheets();
 
     /* Newly proposed CSS3 mechanism for selecting alternate
@@ -570,9 +596,8 @@ public:
     // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
     void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
     EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
-    void dispatchLoadEvent();
+    void dispatchWindowEvent(PassRefPtr<Event>, PassRefPtr<EventTarget> = 0);
+    void dispatchWindowLoadEvent();
 
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
@@ -661,7 +686,7 @@ public:
     String referrer() const;
 
     String domain() const;
-    void setDomain(const String& newDomain);
+    void setDomain(const String& newDomain, ExceptionCode&);
 
     String lastModified() const;
 
@@ -735,10 +760,11 @@ public:
 
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
-    void setTransformSource(void* doc);
-    const void* transformSource() { return m_transformSource; }
     PassRefPtr<Document> transformSourceDocument() { return m_transformSourceDocument; }
     void setTransformSourceDocument(Document* doc) { m_transformSourceDocument = doc; }
+
+    void setTransformSource(PassOwnPtr<TransformSource>);
+    TransformSource* transformSource() const { return m_transformSource.get(); }
 #endif
 
 #if ENABLE(XBL)
@@ -751,8 +777,6 @@ public:
 
     void setDocType(PassRefPtr<DocumentType>);
 
-    virtual void finishedParsing();
-
 #if ENABLE(XPATH)
     // XPathEvaluator methods
     PassRefPtr<XPathExpression> createExpression(const String& expression,
@@ -795,11 +819,10 @@ public:
     DOMSelection* getSelection() const;
     
     // Extension for manipulating canvas drawing contexts for use in CSS
-    CanvasRenderingContext2D* getCSSCanvasContext(const String& type, const String& name, int width, int height);
+    CanvasRenderingContext* getCSSCanvasContext(const String& type, const String& name, int width, int height);
     HTMLCanvasElement* getCSSCanvasElement(const String& name);
 
     bool isDNSPrefetchEnabled() const { return m_isDNSPrefetchEnabled; }
-    void initDNSPrefetch();
     void parseDNSPrefetchControlHeader(const String&);
 
     virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
@@ -808,10 +831,92 @@ public:
     virtual void scriptImported(unsigned long, const String&);
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
+    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
+    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
+
+    virtual void finishedParsing();
+
+    bool inPageCache() const { return m_inPageCache; }
+    void setInPageCache(bool flag);
+    
+    // Elements can register themselves for the "documentWillBecomeInactive()" and  
+    // "documentDidBecomeActive()" callbacks
+    void registerForDocumentActivationCallbacks(Element*);
+    void unregisterForDocumentActivationCallbacks(Element*);
+    void documentWillBecomeInactive();
+    void documentDidBecomeActive();
+
+    void registerForMediaVolumeCallbacks(Element*);
+    void unregisterForMediaVolumeCallbacks(Element*);
+    void mediaVolumeDidChange();
+
+    void setShouldCreateRenderers(bool);
+    bool shouldCreateRenderers();
+
+    void setDecoder(PassRefPtr<TextResourceDecoder>);
+    TextResourceDecoder* decoder() const { return m_decoder.get(); }
+
+    String displayStringModifiedByEncoding(const String&) const;
+    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
+
+    // Quirk for the benefit of Apple's Dictionary application.
+    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
+    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
+
+#if ENABLE(DASHBOARD_SUPPORT)
+    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
+    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
+    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
+    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
+    const Vector<DashboardRegionValue>& dashboardRegions() const;
+    void setDashboardRegions(const Vector<DashboardRegionValue>&);
+#endif
+
+    virtual void removeAllEventListeners();
+
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    
+#if ENABLE(SVG)
+    const SVGDocumentExtensions* svgExtensions();
+    SVGDocumentExtensions* accessSVGExtensions();
+#endif
+
+    void initSecurityContext();
+
+    // Explicitly override the security origin for this document.
+    // Note: It is dangerous to change the security origin of a document
+    //       that already contains content.
+    void setSecurityOrigin(SecurityOrigin*);
+
+    bool processingLoadEvent() const { return m_processingLoadEvent; }
+
+#if ENABLE(DATABASE)
+    void addOpenDatabase(Database*);
+    void removeOpenDatabase(Database*);
+    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
+    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+    bool hasOpenDatabases() { return m_hasOpenDatabases; }
+    void stopDatabases();
+#endif
+
+    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
+    bool usingGeolocation() const { return m_usingGeolocation; };
+
+#if ENABLE(WML)
+    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
+    bool containsWMLContent() const { return m_containsWMLContent; }
+
+    void resetWMLPageState();
+    void initializeWMLPageState();
+#endif
+
 protected:
     Document(Frame*, bool isXHTML);
 
-    void setStyleSelector(CSSStyleSelector* styleSelector) {  m_styleSelector = styleSelector; }
+    void setStyleSelector(CSSStyleSelector* styleSelector) { m_styleSelector = styleSelector; }
+
+    void clearXMLVersion() { m_xmlVersion = String(); }
 
 #if ENABLE(TOUCH_EVENTS) // Android
 public:
@@ -826,16 +931,36 @@ private:
 #endif  // ENABLE(TOUCH_EVENTS)
 
 private:
+    virtual bool isDocument() const { return true; }
+    virtual void removedLastRef();
+    virtual void determineParseMode() { }
+
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    virtual String nodeName() const;
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+    virtual PassRefPtr<Node> cloneNode(bool deep);
+    virtual bool canReplaceChild(Node* newChild, Node* oldChild);
+
     virtual void refScriptExecutionContext() { ref(); }
     virtual void derefScriptExecutionContext() { deref(); }
 
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
+    void initDNSPrefetch();
+
     String encoding() const;
 
     void executeScriptSoonTimerFired(Timer<Document>*);
 
+    void updateTitle();
+    void updateFocusAppearanceTimerFired(Timer<Document>*);
+    void updateBaseURL();
+
+    void cacheDocumentElement() const;
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -863,11 +988,6 @@ private:
     RefPtr<DocumentType> m_docType;
     mutable RefPtr<DOMImplementation> m_implementation;
 
-    RefPtr<StyleSheet> m_sheet;
-#if FRAME_LOADS_USER_STYLESHEET
-    String m_usersheet;
-#endif
-
     // Track the number of currently loading top-level stylesheets.  Sheets
     // loaded using the @import directive are not included in this count.
     // We use this count of pending sheets to detect when we can begin attaching
@@ -887,6 +1007,9 @@ private:
 
     RefPtr<CSSStyleSheet> m_elemSheet;
     RefPtr<CSSStyleSheet> m_mappedElementSheet;
+    RefPtr<CSSStyleSheet> m_pageUserSheet;
+    mutable OwnPtr<Vector<RefPtr<CSSStyleSheet> > > m_pageGroupUserSheets;
+    mutable bool m_pageGroupUserSheetCacheValid;
 
     bool m_printing;
     
@@ -963,7 +1086,7 @@ private:
     Timer<Document> m_executeScriptSoonTimer;
     
 #if ENABLE(XSLT)
-    void* m_transformSource;
+    OwnPtr<TransformSource> m_transformSource;
     RefPtr<Document> m_transformSourceDocument;
 #endif
 
@@ -974,8 +1097,6 @@ private:
     typedef HashMap<AtomicStringImpl*, HTMLMapElement*> ImageMapsByName;
     ImageMapsByName m_imageMapsByName;
 
-    HashSet<Node*> m_disconnectedNodesWithEventListeners;
-
     int m_docID; // A unique document identifier used for things like document-specific mapped attributes.
 
     String m_xmlEncoding;
@@ -988,96 +1109,6 @@ private:
     bool m_shouldProcessNoScriptElement;
 #endif
 
-public:
-    bool inPageCache() const { return m_inPageCache; }
-    void setInPageCache(bool flag);
-    
-    // Elements can register themselves for the "documentWillBecomeInactive()" and  
-    // "documentDidBecomeActive()" callbacks
-    void registerForDocumentActivationCallbacks(Element*);
-    void unregisterForDocumentActivationCallbacks(Element*);
-    void documentWillBecomeInactive();
-    void documentDidBecomeActive();
-
-    void registerForMediaVolumeCallbacks(Element*);
-    void unregisterForMediaVolumeCallbacks(Element*);
-    void mediaVolumeDidChange();
-
-    void setShouldCreateRenderers(bool);
-    bool shouldCreateRenderers();
-    
-    void setDecoder(PassRefPtr<TextResourceDecoder>);
-    TextResourceDecoder* decoder() const { return m_decoder.get(); }
-
-    String displayStringModifiedByEncoding(const String&) const;
-    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
-    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
-
-    // Quirk for the benefit of Apple's Dictionary application.
-    void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
-    bool frameElementsShouldIgnoreScrolling() const { return m_frameElementsShouldIgnoreScrolling; }
-
-#if ENABLE(DASHBOARD_SUPPORT)
-    void setDashboardRegionsDirty(bool f) { m_dashboardRegionsDirty = f; }
-    bool dashboardRegionsDirty() const { return m_dashboardRegionsDirty; }
-    bool hasDashboardRegions () const { return m_hasDashboardRegions; }
-    void setHasDashboardRegions(bool f) { m_hasDashboardRegions = f; }
-    const Vector<DashboardRegionValue>& dashboardRegions() const;
-    void setDashboardRegions(const Vector<DashboardRegionValue>&);
-#endif
-
-    void removeAllEventListeners();
-
-    void registerDisconnectedNodeWithEventListeners(Node*);
-    void unregisterDisconnectedNodeWithEventListeners(Node*);
-    
-    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
-    
-#if ENABLE(SVG)
-    const SVGDocumentExtensions* svgExtensions();
-    SVGDocumentExtensions* accessSVGExtensions();
-#endif
-
-    void initSecurityContext();
-
-    // Explicitly override the security origin for this document.
-    // Note: It is dangerous to change the security origin of a document
-    //       that already contains content.
-    void setSecurityOrigin(SecurityOrigin*);
-
-    bool processingLoadEvent() const { return m_processingLoadEvent; }
-
-#if ENABLE(DATABASE)
-    void addOpenDatabase(Database*);
-    void removeOpenDatabase(Database*);
-    DatabaseThread* databaseThread();   // Creates the thread as needed, but not if it has been already terminated.
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() { return m_hasOpenDatabases; }
-    void stopDatabases();
-#endif
-    
-    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
-    bool usingGeolocation() const { return m_usingGeolocation; };
-
-#if ENABLE(WML)
-    void setContainsWMLContent(bool value) { m_containsWMLContent = value; }
-    bool containsWMLContent() const { return m_containsWMLContent; }
-
-    void resetWMLPageState();
-    void initializeWMLPageState();
-#endif
-
-protected:
-    void clearXMLVersion() { m_xmlVersion = String(); }
-
-private:
-    void updateTitle();
-    void removeAllDisconnectedNodeEventListeners();
-    void updateFocusAppearanceTimerFired(Timer<Document>*);
-    void updateBaseURL();
-
-    void cacheDocumentElement() const;
-
     RenderObject* m_savedRenderer;
     int m_secureForms;
     
@@ -1131,10 +1162,6 @@ private:
 
     unsigned m_numNodeListCaches;
 
-public:
-    typedef HashMap<WebCore::Node*, JSNode*> JSWrapperCache;
-    JSWrapperCache& wrapperCache() { return m_wrapperCache; }
-private:
     JSWrapperCache m_wrapperCache;
 
 #if ENABLE(DATABASE)
@@ -1163,9 +1190,15 @@ inline bool Document::hasElementWithId(AtomicStringImpl* id) const
     
 inline bool Node::isDocumentNode() const
 {
-    return this == m_document.get();
+    return this == m_document;
 }
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* Document::inspectorTimelineAgent() const {
+    return page() ? page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // Document_h
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index cd3ec77..e7a43c7 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -35,7 +35,7 @@ module core {
         readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
-        [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
+        [ReturnsNew] Element createElement(in [ConvertNullToNullString, HintAtomic] DOMString tagName)
             raises (DOMException);
         DocumentFragment   createDocumentFragment();
         [ReturnsNew] Text createTextNode(in DOMString data);
@@ -64,7 +64,7 @@ module core {
             raises (DOMException);
         [OldStyleObjC] NodeList getElementsByTagNameNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                                        in DOMString localName);
-        Element            getElementById(in [V8Custom=HintAtomic] DOMString elementId);
+        Element            getElementById(in [HintAtomic] DOMString elementId);
 
         // DOM Level 3 Core
 
@@ -155,7 +155,8 @@ module core {
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString domain;
+                 attribute [ConvertNullToNullString] DOMString domain
+                     setter raises (DOMException);
 #else
         readonly attribute DOMString domain;
 #endif
@@ -191,6 +192,9 @@ module core {
         readonly attribute [ConvertNullStringTo=Undefined] DOMString readyState;
 
         Element            elementFromPoint(in long x, in long y);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        Range              caretRangeFromPoint(in long x, in long y);
+#endif
 
         // Mozilla extensions
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
@@ -264,6 +268,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -291,7 +296,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/WebCore/dom/DocumentFragment.cpp b/WebCore/dom/DocumentFragment.cpp
index 7a6174f..3663e99 100644
--- a/WebCore/dom/DocumentFragment.cpp
+++ b/WebCore/dom/DocumentFragment.cpp
@@ -1,10 +1,8 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,13 +21,18 @@
  */
 
 #include "config.h"
-
 #include "DocumentFragment.h"
 
 namespace WebCore {
 
-DocumentFragment::DocumentFragment(Document *doc) : ContainerNode(doc)
+inline DocumentFragment::DocumentFragment(Document* document)
+    : ContainerNode(document)
+{
+}
+
+PassRefPtr<DocumentFragment> DocumentFragment::create(Document* document)
 {
+    return adoptRef(new DocumentFragment(document));
 }
 
 String DocumentFragment::nodeName() const
@@ -42,7 +45,6 @@ Node::NodeType DocumentFragment::nodeType() const
     return DOCUMENT_FRAGMENT_NODE;
 }
 
-// DOM Section 1.1.1
 bool DocumentFragment::childTypeAllowed(NodeType type)
 {
     switch (type) {
@@ -60,7 +62,7 @@ bool DocumentFragment::childTypeAllowed(NodeType type)
 
 PassRefPtr<Node> DocumentFragment::cloneNode(bool deep)
 {
-    RefPtr<DocumentFragment> clone = new DocumentFragment(document());
+    RefPtr<DocumentFragment> clone = create(document());
     if (deep)
         cloneChildNodes(clone.get());
     return clone.release();
diff --git a/WebCore/dom/DocumentFragment.h b/WebCore/dom/DocumentFragment.h
index 46d8ecd..e624ee4 100644
--- a/WebCore/dom/DocumentFragment.h
+++ b/WebCore/dom/DocumentFragment.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,6 +30,9 @@ namespace WebCore {
 
 class DocumentFragment : public ContainerNode {
 public:
+    static PassRefPtr<DocumentFragment> create(Document*);
+
+private:
     DocumentFragment(Document*);
 
     virtual String nodeName() const;
diff --git a/WebCore/dom/DocumentType.cpp b/WebCore/dom/DocumentType.cpp
index 885a65b..b8185e7 100644
--- a/WebCore/dom/DocumentType.cpp
+++ b/WebCore/dom/DocumentType.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,11 +29,11 @@
 
 namespace WebCore {
 
-DocumentType::DocumentType(Document* document, const String& n, const String& p, const String& s)
-    : Node(document)
-    , m_name(n)
-    , m_publicId(p)
-    , m_systemId(s)
+DocumentType::DocumentType(Document* document, const String& name, const String& publicId, const String& systemId)
+    : Node(document, CreateOther)
+    , m_name(name)
+    , m_publicId(publicId)
+    , m_systemId(systemId)
 {
 }
 
@@ -54,7 +54,7 @@ Node::NodeType DocumentType::nodeType() const
 
 PassRefPtr<Node> DocumentType::cloneNode(bool /*deep*/)
 {
-    return new DocumentType(document(), m_name, m_publicId, m_systemId);
+    return create(document(), m_name, m_publicId, m_systemId);
 }
 
 void DocumentType::insertedIntoDocument()
diff --git a/WebCore/dom/DocumentType.h b/WebCore/dom/DocumentType.h
index 9fd3c6e..4f89d01 100644
--- a/WebCore/dom/DocumentType.h
+++ b/WebCore/dom/DocumentType.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,7 +34,7 @@ class DocumentType : public Node {
 public:
     static PassRefPtr<DocumentType> create(Document* document, const String& name, const String& publicId, const String& systemId)
     {
-        return new DocumentType(document, name, publicId, systemId);
+        return adoptRef(new DocumentType(document, name, publicId, systemId));
     }
 
     NamedNodeMap* entities() const { return m_entities.get(); }
diff --git a/WebCore/dom/EditingText.cpp b/WebCore/dom/EditingText.cpp
index 40cf97d..b36931a 100644
--- a/WebCore/dom/EditingText.cpp
+++ b/WebCore/dom/EditingText.cpp
@@ -1,9 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+/*
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,24 +20,19 @@
 #include "config.h"
 #include "EditingText.h"
 
-// FIXME: does this really require a class? Perhaps any Text node
-// inside an editable element should have the "always create a renderer"
-// behavior.
+// FIXME: Does this really require a class? Perhaps instead any text node
+// inside an editable element could have the "always create a renderer" behavior.
 
 namespace WebCore {
 
-EditingText::EditingText(Document *impl, const String &text)
-    : Text(impl, text)
-{
-}
-
-EditingText::EditingText(Document *impl)
-    : Text(impl)
+inline EditingText::EditingText(Document* document, const String& data)
+    : Text(document, data)
 {
 }
 
-EditingText::~EditingText()
+PassRefPtr<EditingText> EditingText::create(Document* document, const String& data)
 {
+    return adoptRef(new EditingText(document, data));
 }
 
 bool EditingText::rendererIsNeeded(RenderStyle*)
diff --git a/WebCore/dom/EditingText.h b/WebCore/dom/EditingText.h
index e114786..08223c2 100644
--- a/WebCore/dom/EditingText.h
+++ b/WebCore/dom/EditingText.h
@@ -1,9 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003 Apple Computer, Inc.
+ * Copyright (C) 2003, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,11 +27,12 @@ namespace WebCore {
 
 class EditingText : public Text {
 public:
-    EditingText(Document *impl, const String &text);
-    EditingText(Document *impl);
-    virtual ~EditingText();
+    static PassRefPtr<EditingText> create(Document*, const String&);
 
+private:
     virtual bool rendererIsNeeded(RenderStyle *);
+
+    EditingText(Document*, const String&);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index 1956be4..50ff033 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -28,6 +28,8 @@
 
 #include "AXObjectCache.h"
 #include "Attr.h"
+#include "CSSParser.h"
+#include "CSSSelectorList.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
 #include "ClientRect.h"
@@ -57,12 +59,17 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace XMLNames;
     
-Element::Element(const QualifiedName& tagName, Document* doc)
-    : ContainerNode(doc, true)
+Element::Element(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : ContainerNode(document, type)
     , m_tagName(tagName)
 {
 }
 
+PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new Element(tagName, document, CreateElement));
+}
+
 Element::~Element()
 {
     if (namedAttrMap)
@@ -275,42 +282,6 @@ static int adjustForLocalZoom(int value, RenderObject* renderer)
     return static_cast<int>(value / zoomFactor);
 }
 
-static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
-{
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return value;
-    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
-    if (zoomFactor > 1)
-        value++;
-    return static_cast<int>(value / zoomFactor);
-}
-
-static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
-{
-    // The result here is in floats, so we don't need the truncation hack from the integer version above.
-    float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1)
-        return point;
-    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
-}
-
-static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
-{
-    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
-    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
-    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
-    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
-}
-
-static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
-{
-    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
-    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
-    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
-    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
-}
-
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
@@ -597,16 +568,20 @@ void Element::attributeChanged(Attribute* attr, bool)
 
 void Element::updateAfterAttributeChanged(Attribute* attr)
 {
-    if (!document()->axObjectCache()->accessibilityEnabled())
+    AXObjectCache* axObjectCache = document()->axObjectCache();
+    if (!axObjectCache->accessibilityEnabled())
         return;
 
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
+        axObjectCache->handleActiveDescendantChanged(renderer());
     } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        document()->axObjectCache()->handleAriaRoleChanged(renderer());
+        axObjectCache->handleAriaRoleChanged(renderer());
+    } else if (attrName == aria_valuenowAttr) {
+        // If the valuenow attribute changes, AX clients need to be notified.
+        axObjectCache->postNotification(renderer(), AXObjectCache::AXValueChanged, true);
     }
 }
     
@@ -677,7 +652,7 @@ void Element::setPrefix(const AtomicString &_prefix, ExceptionCode& ec)
 
 KURL Element::baseURI() const
 {
-    KURL base(getAttribute(baseAttr));
+    KURL base(KURL(), getAttribute(baseAttr));
     if (!base.protocol().isEmpty())
         return base;
 
@@ -804,7 +779,8 @@ bool Element::pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderS
 
 void Element::recalcStyle(StyleChange change)
 {
-    RenderStyle* currentStyle = renderStyle();
+    // Ref currentStyle in case it would otherwise be deleted when setRenderStyle() is called.
+    RefPtr<RenderStyle> currentStyle(renderStyle());
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
     bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
@@ -820,7 +796,7 @@ void Element::recalcStyle(StyleChange change)
     }
     if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
-        StyleChange ch = diff(currentStyle, newStyle.get());
+        StyleChange ch = diff(currentStyle.get(), newStyle.get());
         if (ch == Detach || !currentStyle) {
             if (attached())
                 detach();
@@ -852,9 +828,9 @@ void Element::recalcStyle(StyleChange change)
                 newStyle->setChildrenAffectedByDirectAdjacentRules();
         }
 
-        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle, newStyle.get())) {
+        if (ch != NoChange || pseudoStyleCacheIsInvalid(currentStyle.get(), newStyle.get())) {
             setRenderStyle(newStyle);
-        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != SyntheticStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -863,7 +839,7 @@ void Element::recalcStyle(StyleChange change)
                 renderer()->setStyleInternal(newStyle.get());
             else
                 setRenderStyle(newStyle);
-        } else if (styleChangeType() == AnimationStyleChange)
+        } else if (styleChangeType() == SyntheticStyleChange)
              setRenderStyle(newStyle);
 
         if (change != Force) {
@@ -1215,14 +1191,24 @@ void Element::focus(bool restorePreviousSelection)
     if (doc->focusedNode() == this)
         return;
 
-    doc->updateLayoutIgnorePendingStylesheets();
-    
     if (!supportsFocus())
         return;
-    
+
+    // If the stylesheets have already been loaded we can reliably check isFocusable.
+    // If not, we continue and set the focused node on the focus controller below so
+    // that it can be updated soon after attach. 
+    if (doc->haveStylesheetsLoaded()) {
+        doc->updateLayoutIgnorePendingStylesheets();
+        if (!isFocusable())
+            return;
+    }
+
     if (Page* page = doc->page())
         page->focusController()->setFocusedNode(this, doc->frame());
 
+    // Setting the focused node above might have invalidated the layout due to scripts.
+    doc->updateLayoutIgnorePendingStylesheets();
+
     if (!isFocusable()) {
         ensureRareData()->setNeedsFocusAppearanceUpdateSoonAfterAttach(true);
         return;
@@ -1386,6 +1372,39 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
+{
+    if (selector.isEmpty()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    bool strictParsing = !document()->inCompatMode();
+    CSSParser p(strictParsing);
+
+    CSSSelectorList selectorList;
+    p.parseSelector(selector, document(), selectorList);
+
+    if (!selectorList.first()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
+    if (selectorList.selectorsNeedNamespaceResolution()) {
+        ec = NAMESPACE_ERR;
+        return false;
+    }
+
+    CSSStyleSelector::SelectorChecker selectorChecker(document(), strictParsing);
+    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
+        if (selectorChecker.checkSelector(selector, this))
+            return true;
+    }
+
+    return false;
+}
+
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #ifndef NDEBUG
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index 223c26a..8d12cc9 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -41,8 +41,53 @@ class IntSize;
 
 class Element : public ContainerNode {
 public:
-    Element(const QualifiedName&, Document*);
-    ~Element();
+    static PassRefPtr<Element> create(const QualifiedName&, Document*);
+    virtual ~Element();
+
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+
+    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // and HTMLFrameSetElement to forward to the DOMWindow.
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(load);
+
+    // WebKit extensions
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cut);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecopy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(copy);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(beforepaste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(paste);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(selectstart);
 
     const AtomicString& getIDAttribute() const;
     bool hasAttribute(const QualifiedName&) const;
@@ -64,7 +109,6 @@ public:
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
 
-    void scrollByUnits(int units, ScrollGranularity);
     void scrollByLines(int lines);
     void scrollByPages(int pages);
 
@@ -108,17 +152,11 @@ public:
 
     const AtomicString& localName() const { return m_tagName.localName(); }
     const AtomicString& prefix() const { return m_tagName.prefix(); }
-    virtual void setPrefix(const AtomicString&, ExceptionCode&);
     const AtomicString& namespaceURI() const { return m_tagName.namespaceURI(); }
 
     virtual KURL baseURI() const;
 
-    // DOM methods overridden from parent classes
-    virtual NodeType nodeType() const;
     virtual String nodeName() const;
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     PassRefPtr<Element> cloneElementWithChildren();
     PassRefPtr<Element> cloneElementWithoutChildren();
@@ -136,13 +174,9 @@ public:
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
-    // The implementation of Element::attributeChanged() calls the following two functions.
-    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
-    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
-    void updateAfterAttributeChanged(Attribute*);
-
     // not part of the DOM
     void setAttributeMap(PassRefPtr<NamedNodeMap>);
+    NamedNodeMap* attributeMap() const { return namedAttrMap.get(); }
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -153,10 +187,6 @@ public:
 
     virtual RenderStyle* computedStyle();
 
-    virtual bool childTypeAllowed(NodeType);
-
-    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
-    
     void dispatchAttrRemovalEvent(Attribute*);
     void dispatchAttrAdditionEvent(Attribute*);
 
@@ -170,12 +200,6 @@ public:
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     void blur();
 
-#ifndef NDEBUG
-    virtual void formatForDebugger(char* buffer, unsigned length) const;
-#endif
-
-    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
-
     String innerText() const;
     String outerText() const;
  
@@ -206,13 +230,17 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
-    // FormControlElement API
+    bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
     virtual bool isTextFormControl() const { return false; }
     virtual bool isOptionalFormControl() const { return false; }
     virtual bool isRequiredFormControl() const { return false; }
+    virtual bool isDefaultButtonForForm() const { return false; }
+    virtual bool willValidate() const { return false; }
+    virtual bool isValidFormControlElement() { return false; }
 
     virtual bool formControlValueMatchesRenderer() const { return false; }
     virtual void setFormControlValueMatchesRenderer(bool) { }
@@ -225,13 +253,39 @@ public:
 
     virtual void dispatchFormControlChangeEvent() { }
 
+protected:
+    Element(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    // The implementation of Element::attributeChanged() calls the following two functions.
+    // They are separated to allow a different flow of control in StyledElement::attributeChanged().
+    void recalcStyleIfNeededAfterAttributeChanged(Attribute*);
+    void updateAfterAttributeChanged(Attribute*);
+
 private:
+    void scrollByUnits(int units, ScrollGranularity);
+
+    virtual void setPrefix(const AtomicString&, ExceptionCode&);
+    virtual NodeType nodeType() const;
+    virtual bool childTypeAllowed(NodeType);
+
+    virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
+    
+#ifndef NDEBUG
+    virtual void formatForDebugger(char* buffer, unsigned length) const;
+#endif
+
+    bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
+
     virtual void createAttributeMap() const;
 
-    virtual void updateStyleAttribute() const {}
+    virtual void updateStyleAttribute() const { }
 
 #if ENABLE(SVG)
-    virtual void updateAnimatedSVGAttribute(const String&) const {}
+    virtual void updateAnimatedSVGAttribute(const String&) const { }
 #endif
 
     void updateFocusAppearanceSoonAfterAttach();
@@ -248,10 +302,10 @@ private:
     QualifiedName m_tagName;
     virtual NodeRareData* createRareData();
 
-protected:
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
+protected:
     mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
diff --git a/WebCore/dom/Element.idl b/WebCore/dom/Element.idl
index e8988e1..c24ef65 100644
--- a/WebCore/dom/Element.idl
+++ b/WebCore/dom/Element.idl
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
@@ -110,6 +111,10 @@ module core {
             raises(DOMException);
 
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // WebKit extension, pending specification.
+        boolean webkitMatchesSelector(in DOMString selectors)
+            raises(DOMException);
+
         // ElementTraversal API
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
@@ -148,6 +153,7 @@ module core {
         attribute [DontEnum] EventListener onerror;
         attribute [DontEnum] EventListener onfocus;
         attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener oninvalid;
         attribute [DontEnum] EventListener onkeydown;
         attribute [DontEnum] EventListener onkeypress;
         attribute [DontEnum] EventListener onkeyup;
@@ -175,7 +181,6 @@ module core {
         // attribute [DontEnum] EventListener onended;
         // attribute [DontEnum] EventListener onformchange;
         // attribute [DontEnum] EventListener onforminput;
-        // attribute [DontEnum] EventListener oninvalid;
         // attribute [DontEnum] EventListener onloadeddata;
         // attribute [DontEnum] EventListener onloadedmetadata;
         // attribute [DontEnum] EventListener onloadstart;
diff --git a/WebCore/dom/EntityReference.cpp b/WebCore/dom/EntityReference.cpp
index 012605c..c4c292a 100644
--- a/WebCore/dom/EntityReference.cpp
+++ b/WebCore/dom/EntityReference.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,12 +23,17 @@
 
 namespace WebCore {
 
-EntityReference::EntityReference(Document* document, const String& entityName)
+inline EntityReference::EntityReference(Document* document, const String& entityName)
     : ContainerNode(document)
     , m_entityName(entityName)
 {
 }
 
+PassRefPtr<EntityReference> EntityReference::create(Document* document, const String& entityName)
+{
+    return adoptRef(new EntityReference(document, entityName));
+}
+
 String EntityReference::nodeName() const
 {
     return m_entityName;
@@ -41,7 +46,7 @@ Node::NodeType EntityReference::nodeType() const
 
 PassRefPtr<Node> EntityReference::cloneNode(bool)
 {
-    return new EntityReference(document(), m_entityName);
+    return create(document(), m_entityName);
 }
 
 } // namespace
diff --git a/WebCore/dom/EntityReference.h b/WebCore/dom/EntityReference.h
index 4767a5e..7a6f6c3 100644
--- a/WebCore/dom/EntityReference.h
+++ b/WebCore/dom/EntityReference.h
@@ -28,13 +28,15 @@ namespace WebCore {
 
 class EntityReference : public ContainerNode {
 public:
+    static PassRefPtr<EntityReference> create(Document*, const String& entityName);
+
+private:
     EntityReference(Document*, const String& entityName);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
 
-private:
     String m_entityName;
 };
 
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index b711759..cae4122 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -124,6 +124,11 @@ bool Event::isOverflowEvent() const
     return false;
 }
 
+bool Event::isPageTransitionEvent() const
+{
+    return false;
+}
+
 bool Event::isProgressEvent() const
 {
     return false;
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index 0b9bcf0..30e5d27 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -109,6 +109,7 @@ namespace WebCore {
         virtual bool isWheelEvent() const;
         virtual bool isBeforeTextInsertedEvent() const;
         virtual bool isOverflowEvent() const;
+        virtual bool isPageTransitionEvent() const;
         virtual bool isProgressEvent() const;
         virtual bool isXMLHttpRequestProgressEvent() const;
         virtual bool isWebKitAnimationEvent() const;
diff --git a/WebCore/dom/EventListener.h b/WebCore/dom/EventListener.h
index 7c4812f..f834b31 100644
--- a/WebCore/dom/EventListener.h
+++ b/WebCore/dom/EventListener.h
@@ -31,31 +31,45 @@ namespace JSC {
 
 namespace WebCore {
 
+    class ScriptExecutionContext;
     class Event;
 
     class EventListener : public RefCounted<EventListener> {
     public:
+        enum Type { JSEventListenerType, 
+                    ImageEventListenerType, 
+                    InspectorDOMAgentType,
+                    InspectorDOMStorageResourceType,
+                    ObjCEventListenerType, 
+                    ConditionEventListenerType };
+                    
         virtual ~EventListener() { }
-        virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
+        virtual bool operator==(const EventListener&) = 0;
+        virtual void handleEvent(ScriptExecutionContext*, Event*) = 0;
         // Return true to indicate that the error is handled.
-        virtual bool reportError(const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
+        virtual bool reportError(ScriptExecutionContext*, const String& /*message*/, const String& /*url*/, int /*lineNumber*/) { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
 
 #if USE(JSC)
-        virtual JSC::JSObject* jsFunction() const { return 0; }
+        virtual JSC::JSObject* jsFunction(ScriptExecutionContext*) const { return 0; }
         virtual void markJSFunction(JSC::MarkStack&) { }
 #endif
 
         bool isAttribute() const { return virtualisAttribute(); }
+        Type type() const { return m_type; }
+
+    protected:
+        EventListener(Type type)
+            : m_type(type)
+        {
+        }
 
     private:
         virtual bool virtualisAttribute() const { return false; }
+        
+        Type m_type;
     };
 
-#if USE(JSC)
-    inline void markIfNotNull(JSC::MarkStack& markStack, EventListener* listener) { if (listener) listener->markJSFunction(markStack); }
-#endif
-
 }
 
 #endif
diff --git a/WebCore/dom/EventListener.idl b/WebCore/dom/EventListener.idl
index 9dc2e0a..1edf52f 100644
--- a/WebCore/dom/EventListener.idl
+++ b/WebCore/dom/EventListener.idl
@@ -24,8 +24,8 @@ module events {
     interface [
         NoStaticTables,
         ObjCProtocol,
+        PureInterface,
         InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
-        ImplementationUUID=DDFDD342-A78B-4f19-8F32-A5DF51B56E08
     ] EventListener {
         void               handleEvent(in Event evt);
     };
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index d28b154..31c29fb 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -32,6 +32,7 @@ namespace WebCore {
     macro(abort) \
     macro(beforecopy) \
     macro(beforecut) \
+    macro(beforeload) \
     macro(beforepaste) \
     macro(beforeunload) \
     macro(blur) \
@@ -45,6 +46,7 @@ namespace WebCore {
     macro(copy) \
     macro(cut) \
     macro(dblclick) \
+    macro(display) \
     macro(downloading) \
     macro(drag) \
     macro(dragend) \
@@ -57,10 +59,12 @@ namespace WebCore {
     macro(focus) \
     macro(hashchange) \
     macro(input) \
+    macro(invalid) \
     macro(keydown) \
     macro(keypress) \
     macro(keyup) \
     macro(load) \
+    macro(loadend) \
     macro(loadstart) \
     macro(message) \
     macro(mousedown) \
@@ -73,7 +77,10 @@ namespace WebCore {
     macro(obsolete) \
     macro(offline) \
     macro(online) \
+    macro(open) \
     macro(overflowchanged) \
+    macro(pagehide) \
+    macro(pageshow) \
     macro(paste) \
     macro(readystatechange) \
     macro(reset) \
@@ -137,6 +144,8 @@ namespace WebCore {
     \
     macro(webkitTransitionEnd) \
     \
+    macro(orientationchange) \
+    \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
     class EventNames {
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index 7ba0584..ceb5221 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -34,16 +34,49 @@
 #include "config.h"
 #include "EventTarget.h"
 
+#include "Event.h"
+#include "EventException.h"
+#include <wtf/StdLibExtras.h>
+
+using namespace WTF;
+
 namespace WebCore {
 
 #ifndef NDEBUG
 static int gEventDispatchForbidden = 0;
-#endif
+
+void forbidEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    ++gEventDispatchForbidden;
+}
+
+void allowEventDispatch()
+{
+    if (!isMainThread())
+        return;
+    if (gEventDispatchForbidden > 0)
+        --gEventDispatchForbidden;
+}
+
+bool eventDispatchForbidden()
+{
+    if (!isMainThread())
+        return false;
+    return gEventDispatchForbidden > 0;
+}
+#endif // NDEBUG
 
 EventTarget::~EventTarget()
 {
 }
 
+EventSource* EventTarget::toEventSource()
+{
+    return 0;
+}
+
 Node* EventTarget::toNode()
 {
     return 0;
@@ -78,6 +111,13 @@ SVGElementInstance* EventTarget::toSVGElementInstance()
 }
 #endif
 
+#if ENABLE(WEB_SOCKETS)
+WebSocket* EventTarget::toWebSocket()
+{
+    return 0;
+}
+#endif
+
 MessagePort* EventTarget::toMessagePort()
 {
     return 0;
@@ -106,22 +146,160 @@ SharedWorkerContext* EventTarget::toSharedWorkerContext()
 }
 #endif
 
-#ifndef NDEBUG
-void forbidEventDispatch()
+#if ENABLE(NOTIFICATIONS)
+Notification* EventTarget::toNotification()
 {
-    ++gEventDispatchForbidden;
+    return 0;
 }
+#endif
 
-void allowEventDispatch()
+bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    if (gEventDispatchForbidden > 0)
-        --gEventDispatchForbidden;
+    EventTargetData* d = ensureEventTargetData();
+
+    pair<EventListenerMap::iterator, bool> result = d->eventListenerMap.add(eventType, EventListenerVector());
+    EventListenerVector& entry = result.first->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    if (!result.second) { // pre-existing entry
+        if (entry.find(registeredListener) != notFound) // duplicate listener
+            return false;
+    }
+
+    entry.append(registeredListener);
+    return true;
 }
 
-bool eventDispatchForbidden()
+bool EventTarget::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    return gEventDispatchForbidden > 0;
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return false;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(eventType);
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RegisteredEventListener registeredListener(listener, useCapture);
+    size_t index = entry.find(registeredListener);
+    if (index == notFound)
+        return false;
+
+    entry.remove(index);
+    if (!entry.size())
+        d->eventListenerMap.remove(result);
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i) {
+        if (eventType == *d->firingEventEndIterators[i].eventType && index < *d->firingEventEndIterators[i].value)
+            --*d->firingEventEndIterators[i].value;
+    }
+
+    return true;
+}
+
+bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return addEventListener(eventType, listener, false);
+}
+
+EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType)
+{
+    const EventListenerVector& entry = getEventListeners(eventType);
+    for (size_t i = 0; i < entry.size(); ++i) {
+        if (entry[i].listener->isAttribute())
+            return entry[i].listener.get();
+    }
+    return 0;
+}
+
+bool EventTarget::clearAttributeEventListener(const AtomicString& eventType)
+{
+    EventListener* listener = getAttributeEventListener(eventType);
+    if (!listener)
+        return false;
+    return removeEventListener(eventType, listener, false);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+{
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return false;
+    }
+    return dispatchEvent(event);
+}
+
+bool EventTarget::dispatchEvent(PassRefPtr<Event> event)
+{
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
+    return fireEventListeners(event.get());
+}
+
+bool EventTarget::fireEventListeners(Event* event)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event && !event->type().isEmpty());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return true;
+
+    EventListenerMap::iterator result = d->eventListenerMap.find(event->type());
+    if (result == d->eventListenerMap.end())
+        return false;
+    EventListenerVector& entry = result->second;
+
+    RefPtr<EventTarget> protect = this;
+
+    size_t end = entry.size();
+    d->firingEventEndIterators.append(FiringEventEndIterator(&event->type(), &end));
+    for (size_t i = 0; i < end; ++i) {
+        RegisteredEventListener& registeredListener = entry[i];
+        if (event->eventPhase() == Event::CAPTURING_PHASE && !registeredListener.useCapture)
+            continue;
+        if (event->eventPhase() == Event::BUBBLING_PHASE && registeredListener.useCapture)
+            continue;
+        // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
+        // event listeners, even though that violates some versions of the DOM spec.
+        registeredListener.listener->handleEvent(scriptExecutionContext(), event);
+    }
+    d->firingEventEndIterators.removeLast();
+
+    return !event->defaultPrevented();
+}
+
+const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
+{
+    DEFINE_STATIC_LOCAL(EventListenerVector, emptyVector, ());
+
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return emptyVector;
+    EventListenerMap::iterator it = d->eventListenerMap.find(eventType);
+    if (it == d->eventListenerMap.end())
+        return emptyVector;
+    return it->second;
+}
+
+void EventTarget::removeAllEventListeners()
+{
+    EventTargetData* d = eventTargetData();
+    if (!d)
+        return;
+    d->eventListenerMap.clear();
+
+    // Notify firing events planning to invoke the listener at 'index' that
+    // they have one less listener to invoke.
+    for (size_t i = 0; i < d->firingEventEndIterators.size(); ++i)
+        *d->firingEventEndIterators[i].value = 0;
 }
-#endif // NDEBUG
 
-} // end namespace
+} // namespace WebCore
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index 2ededda..2d612e1 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -32,6 +32,9 @@
 #ifndef EventTarget_h
 #define EventTarget_h
 
+#include "AtomicStringHash.h"
+#include "EventNames.h"
+#include "RegisteredEventListener.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
@@ -43,20 +46,47 @@ namespace WebCore {
     class DOMWindow;
     class Event;
     class EventListener;
+    class EventSource;
     class MessagePort;
     class Node;
+    class Notification;
     class SVGElementInstance;
     class ScriptExecutionContext;
     class SharedWorker;
     class SharedWorkerContext;
+    class WebSocket;
     class Worker;
     class XMLHttpRequest;
     class XMLHttpRequestUpload;
 
     typedef int ExceptionCode;
 
+    struct FiringEventEndIterator {
+        FiringEventEndIterator(const AtomicString* eventType, size_t* value)
+            : eventType(eventType)
+            , value(value)
+        {
+        }
+        
+        const AtomicString* eventType;
+        size_t* value;
+    };
+    typedef Vector<FiringEventEndIterator, 1> FiringEventEndIteratorVector;
+
+    typedef Vector<RegisteredEventListener, 1> EventListenerVector;
+    typedef HashMap<AtomicString, EventListenerVector> EventListenerMap;
+
+    struct EventTargetData {
+        EventListenerMap eventListenerMap;
+        FiringEventEndIteratorVector firingEventEndIterators;
+    };
+
     class EventTarget {
     public:
+        void ref() { refEventTarget(); }
+        void deref() { derefEventTarget(); }
+
+        virtual EventSource* toEventSource();
         virtual MessagePort* toMessagePort();
         virtual Node* toNode();
         virtual DOMWindow* toDOMWindow();
@@ -72,44 +102,132 @@ namespace WebCore {
         virtual Worker* toWorker();
         virtual DedicatedWorkerContext* toDedicatedWorkerContext();
 #endif
-
 #if ENABLE(SHARED_WORKERS)
         virtual SharedWorker* toSharedWorker();
         virtual SharedWorkerContext* toSharedWorkerContext();
 #endif
+#if ENABLE(WEB_SOCKETS)
+        virtual WebSocket* toWebSocket();
+#endif
+
+#if ENABLE(NOTIFICATIONS)
+        virtual Notification* toNotification();
+#endif
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture) = 0;
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture) = 0;
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&) = 0;
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
+        virtual bool dispatchEvent(PassRefPtr<Event>);
+        bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&); // DOM API
 
-        void ref() { refEventTarget(); }
-        void deref() { derefEventTarget(); }
+        // Used for legacy "onEvent" attribute APIs.
+        bool setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        bool clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType);
 
-        // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
-        // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
-        virtual void* preDispatchEventHandler(Event*) { return 0; }
-        virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
+        bool hasEventListeners();
+        bool hasEventListeners(const AtomicString& eventType);
+        const EventListenerVector& getEventListeners(const AtomicString& eventType);
+
+        bool fireEventListeners(Event*);
+        bool isFiringEventListeners();
+
+#if USE(JSC)
+        void markEventListeners(JSC::MarkStack&);
+        void invalidateEventListeners();
+#endif
 
     protected:
         virtual ~EventTarget();
+        
+        virtual EventTargetData* eventTargetData() = 0;
+        virtual EventTargetData* ensureEventTargetData() = 0;
 
     private:
         virtual void refEventTarget() = 0;
         virtual void derefEventTarget() = 0;
     };
 
-    void forbidEventDispatch();
-    void allowEventDispatch();
+    #define DEFINE_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        virtual EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { document()->setWindowAttributeEventListener(eventNames().attribute##Event, listener); } \
+
+    #define DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(attribute, eventName) \
+        EventListener* on##attribute() { return getAttributeEventListener(eventNames().eventName##Event); } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().eventName##Event, listener); } \
+
+    #define DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(recipient, attribute) \
+        EventListener* on##attribute() { return recipient ? recipient->getAttributeEventListener(eventNames().attribute##Event) : 0; } \
+        void setOn##attribute(PassRefPtr<EventListener> listener) { if (recipient) recipient->setAttributeEventListener(eventNames().attribute##Event, listener); } \
 
 #ifndef NDEBUG
+    void forbidEventDispatch();
+    void allowEventDispatch();
     bool eventDispatchForbidden();
 #else
     inline void forbidEventDispatch() { }
     inline void allowEventDispatch() { }
 #endif
 
-}
-
+#if USE(JSC)
+    inline void EventTarget::markEventListeners(JSC::MarkStack& markStack)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        EventListenerMap::iterator end = d->eventListenerMap.end();
+        for (EventListenerMap::iterator it = d->eventListenerMap.begin(); it != end; ++it) {
+            EventListenerVector& entry = it->second;
+            for (size_t i = 0; i < entry.size(); ++i)
+                entry[i].listener->markJSFunction(markStack);
+        }
+    }
+
+    inline void EventTarget::invalidateEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return;
+
+        d->eventListenerMap.clear();
+    }
 #endif
+
+    inline bool EventTarget::isFiringEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->firingEventEndIterators.size() != 0;
+    }
+
+    inline bool EventTarget::hasEventListeners()
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return !d->eventListenerMap.isEmpty();
+    }
+
+    inline bool EventTarget::hasEventListeners(const AtomicString& eventType)
+    {
+        EventTargetData* d = eventTargetData();
+        if (!d)
+            return false;
+        return d->eventListenerMap.contains(eventType);
+    }
+
+} // namespace WebCore
+
+#endif // EventTarget_h
diff --git a/WebCore/dom/InputElement.cpp b/WebCore/dom/InputElement.cpp
index 0e2456d..c29cb1c 100644
--- a/WebCore/dom/InputElement.cpp
+++ b/WebCore/dom/InputElement.cpp
@@ -34,7 +34,6 @@
 #include "RenderTextControlSingleLine.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
-#include "TextBreakIterator.h"
 
 #if ENABLE(WML)
 #include "WMLInputElement.h"
@@ -46,25 +45,23 @@ namespace WebCore {
 using namespace HTMLNames;
 
 // FIXME: According to HTML4, the length attribute's value can be arbitrarily
-// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
+// large. However, due to https://bugs.webkit.org/show_bug.cgi?id=14536 things
 // get rather sluggish when a text field has a larger number of characters than
 // this, even when just clicking in the text field.
 const int InputElement::s_maximumLength = 524288;
 const int InputElement::s_defaultSize = 20;
 
-void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchFocusEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
-
     Document* document = element->document();
     if (inputElement->isPasswordField() && document->frame())
         document->setUseSecureKeyboardEntryWhenActive(true);
 }
 
-void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
+void InputElement::dispatchBlurEvent(InputElement* inputElement, Element* element)
 {
     if (!inputElement->isTextField())
         return;
@@ -74,28 +71,12 @@ void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* input
     if (!frame)
         return;
 
-    updatePlaceholderVisibility(data, inputElement, element);
-
     if (inputElement->isPasswordField())
         document->setUseSecureKeyboardEntryWhenActive(false);
 
     frame->textFieldDidEndEditing(element);
 }
 
-void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
-{
-    ASSERT(inputElement->isTextField());
-    Document* document = element->document();
-
-    bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
-    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
-                                       && document->focusedNode() != element
-                                       && !inputElement->placeholder().isEmpty());
-
-    if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
-        toRenderTextControlSingleLine(element->renderer())->updatePlaceholderVisibility();
-}
-
 void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
 {
     ASSERT(inputElement->isTextField());
@@ -137,11 +118,8 @@ void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
 
 void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
 {
-    // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
-
-    if (inputElement->isTextField())
-        updatePlaceholderVisibility(data, inputElement, element);
+    // Renderer and our event handler are responsible for sanitizing values.
+    ASSERT_UNUSED(inputElement, value == inputElement->sanitizeValue(value) || inputElement->sanitizeValue(value).isEmpty());
 
     // Workaround for bug where trailing \n is included in the result of textContent.
     // The assert macro above may also be simplified to:  value == constrainValue(value)
@@ -153,84 +131,58 @@ void InputElement::setValueFromRenderer(InputElementData& data, InputElement* in
 
     element->setFormControlValueMatchesRenderer(true);
 
-    // Fire the "input" DOM event
-    element->dispatchEvent(eventNames().inputEvent, true, false);
+    element->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
     notifyFormStateChanged(element);
 }
 
-static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
+String InputElement::sanitizeValue(const InputElement* inputElement, const String& proposedValue)
 {
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    for (int i = 0; i < numGraphemeClusters; ++i) {
-        if (textBreakNext(it) == TextBreakDone)
-            return s->length();
-    }
-
-    return textBreakCurrent(it);
+    return InputElement::sanitizeUserInputValue(inputElement, proposedValue, s_maximumLength);
 }
 
-String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
+String InputElement::sanitizeUserInputValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
 {
-    String string = proposedValue;
     if (!inputElement->isTextField())
-        return string;
+        return proposedValue;
 
+    String string = proposedValue;
     string.replace("\r\n", " ");
     string.replace('\r', ' ');
     string.replace('\n', ' ');
-    
-    StringImpl* s = string.impl();
-    int newLength = numCharactersInGraphemeClusters(s, maxLength);
-    for (int i = 0; i < newLength; ++i) {
-        const UChar& current = (*s)[i];
+
+    unsigned newLength = string.numCharactersInGraphemeClusters(maxLength);
+    for (unsigned i = 0; i < newLength; ++i) {
+        const UChar current = string[i];
         if (current < ' ' && current != '\t') {
             newLength = i;
             break;
         }
     }
-
-    if (newLength < static_cast<int>(string.length()))
-        return string.left(newLength);
-
-    return string;
-}
-
-static int numGraphemeClusters(StringImpl* s)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-
-    int num = 0;
-    while (textBreakNext(it) != TextBreakDone)
-        ++num;
-
-    return num;
+    return string.left(newLength);
 }
 
-void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Element* element, Event* event)
 {
     ASSERT(event->isBeforeTextInsertedEvent());
-
     // Make sure that the text to be inserted will not violate the maxLength.
-    int oldLength = numGraphemeClusters(inputElement->value().impl());
-    ASSERT(oldLength <= data.maxLength());
-    int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
+
+    // We use RenderTextControlSingleLine::text() instead of InputElement::value()
+    // because they can be mismatched by sanitizeValue() in
+    // RenderTextControlSingleLine::subtreeHasChanged() in some cases.
+    unsigned oldLength = toRenderTextControlSingleLine(element->renderer())->text().numGraphemeClusters();
+
+    // selection() may be a pre-edit text.
+    unsigned selectionLength = plainText(element->document()->frame()->selection()->selection().toNormalizedRange().get()).numGraphemeClusters();
     ASSERT(oldLength >= selectionLength);
-    int maxNewLength = data.maxLength() - (oldLength - selectionLength);
+
+    // Selected characters will be removed by the next text event.
+    unsigned baseLength = oldLength - selectionLength;
+    unsigned maxLength = static_cast<unsigned>(data.maxLength()); // maxLength() can never be negative.
+    unsigned appendableLength = maxLength > baseLength ? maxLength - baseLength : 0;
 
     // Truncate the inserted text to avoid violating the maxLength and other constraints.
     BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
-    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
+    textEvent->setText(sanitizeUserInputValue(inputElement, textEvent->text(), appendableLength));
 }
 
 void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
@@ -259,7 +211,7 @@ void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement*
 void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
 {
     String oldValue = data.value();
-    String newValue = inputElement->constrainValue(oldValue);
+    String newValue = sanitizeValue(inputElement, oldValue);
     if (newValue != oldValue)
         inputElement->setValue(newValue);
 }
@@ -277,8 +229,7 @@ void InputElement::notifyFormStateChanged(Element* element)
 
 // InputElementData
 InputElementData::InputElementData()
-    : m_placeholderShouldBeVisible(false)
-    , m_size(InputElement::s_defaultSize)
+    : m_size(InputElement::s_defaultSize)
     , m_maxLength(InputElement::s_maximumLength)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index 7ad3cbd..e0e7110 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -44,17 +44,13 @@ public:
     virtual bool isSearchField() const = 0;
     virtual bool isTextField() const = 0;
 
-    virtual bool placeholderShouldBeVisible() const = 0;
     virtual bool searchEventsShouldBeDispatched() const = 0;
 
     virtual int size() const = 0;
     virtual String value() const = 0;
     virtual void setValue(const String&) = 0;
 
-    virtual String placeholder() const = 0;
-    virtual void setPlaceholder(const String&) = 0;
-
-    virtual String constrainValue(const String&) const = 0;
+    virtual String sanitizeValue(const String&) const = 0;
     virtual void setValueFromRenderer(const String&) = 0;
 
     virtual void cacheSelection(int start, int end) = 0;
@@ -64,15 +60,19 @@ public:
     static const int s_defaultSize;
 
 protected:
-    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
-    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
-    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void dispatchFocusEvent(InputElement*, Element*);
+    static void dispatchBlurEvent(InputElement*, Element*);
     static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
     static void updateSelectionRange(InputElement*, Element*, int start, int end);
     static void aboutToUnload(InputElement*, Element*);
     static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
-    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
-    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    // Replaces CRs and LFs, shrinks the value for s_maximumLength.
+    // This should be applied to values from the HTML value attribute and the DOM value property.
+    static String sanitizeValue(const InputElement*, const String&);
+    // Replaces CRs and LFs, shrinks the value for the specified maximum length.
+    // This should be applied to values specified by users.
+    static String sanitizeUserInputValue(const InputElement*, const String&, int);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Element*, Event*);
     static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
     static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
     static void updateValueIfNeeded(InputElementData&, InputElement*);
@@ -85,9 +85,6 @@ class InputElementData {
 public:
     InputElementData();
 
-    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
-    void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
-
     const AtomicString& name() const;
     void setName(const AtomicString& value) { m_name = value; }
 
@@ -107,7 +104,6 @@ public:
     void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
 
 private:
-    bool m_placeholderShouldBeVisible;
     AtomicString m_name;
     String m_value;
     int m_size;
diff --git a/WebCore/dom/MessageEvent.cpp b/WebCore/dom/MessageEvent.cpp
index a0af32d..3c84642 100644
--- a/WebCore/dom/MessageEvent.cpp
+++ b/WebCore/dom/MessageEvent.cpp
@@ -34,16 +34,17 @@
 namespace WebCore {
 
 MessageEvent::MessageEvent()
+    : m_data(SerializedScriptValue::create())
 {
 }
 
-MessageEvent::MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
-    : Event(eventNames().messageEvent, false, true)
+MessageEvent::MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray> ports)
+    : Event(eventNames().messageEvent, false, false)
     , m_data(data)
     , m_origin(origin)
     , m_lastEventId(lastEventId)
     , m_source(source)
-    , m_messagePort(messagePort)
+    , m_ports(ports)
 {
 }
 
@@ -51,7 +52,7 @@ MessageEvent::~MessageEvent()
 {
 }
 
-void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* messagePort)
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray> ports)
 {
     if (dispatched())
         return;
@@ -62,7 +63,26 @@ void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bo
     m_origin = origin;
     m_lastEventId = lastEventId;
     m_source = source;
-    m_messagePort = messagePort;
+    m_ports = ports;
+}
+
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+MessagePort* MessageEvent::messagePort()
+{
+    if (!m_ports)
+        return 0;
+    ASSERT(m_ports->size() == 1);
+    return (*m_ports)[0].get();
+}
+
+void MessageEvent::initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort* port)
+{
+    MessagePortArray* ports = 0;
+    if (port) {
+        ports = new MessagePortArray();
+        ports->append(port);
+    }
+    initMessageEvent(type, canBubble, cancelable, data, origin, lastEventId, source, ports);
 }
 
 bool MessageEvent::isMessageEvent() const 
diff --git a/WebCore/dom/MessageEvent.h b/WebCore/dom/MessageEvent.h
index 87a6745..b7f9b02 100644
--- a/WebCore/dom/MessageEvent.h
+++ b/WebCore/dom/MessageEvent.h
@@ -28,8 +28,10 @@
 #ifndef MessageEvent_h
 #define MessageEvent_h
 
+#include "DOMWindow.h"
 #include "Event.h"
 #include "MessagePort.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
@@ -41,31 +43,36 @@ namespace WebCore {
         {
             return adoptRef(new MessageEvent);
         }
-        static PassRefPtr<MessageEvent> create(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort)
+        static PassRefPtr<MessageEvent> create(PassOwnPtr<MessagePortArray> ports, PassRefPtr<SerializedScriptValue> data = 0, const String& origin = "", const String& lastEventId = "", PassRefPtr<DOMWindow> source = 0)
         {
-            return adoptRef(new MessageEvent(data, origin, lastEventId, source, messagePort));
+            return adoptRef(new MessageEvent(data, origin, lastEventId, source, ports));
         }
         virtual ~MessageEvent();
 
-        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
-        
-        const String& data() const { return m_data; }
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, PassOwnPtr<MessagePortArray>);
+
+        SerializedScriptValue* data() const { return m_data.get(); }
         const String& origin() const { return m_origin; }
         const String& lastEventId() const { return m_lastEventId; }
         DOMWindow* source() const { return m_source.get(); }
-        MessagePort* messagePort() const { return m_messagePort.get(); }
-        
+        MessagePortArray* ports() const { return m_ports.get(); }
+
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        MessagePort* messagePort();
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void initMessageEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, DOMWindow* source, MessagePort*);
+
         virtual bool isMessageEvent() const;
 
-    private:    
+    private:
         MessageEvent();
-        MessageEvent(const String& data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassRefPtr<MessagePort> messagePort);
+        MessageEvent(PassRefPtr<SerializedScriptValue> data, const String& origin, const String& lastEventId, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortArray>);
 
-        String m_data;
+        RefPtr<SerializedScriptValue> m_data;
         String m_origin;
         String m_lastEventId;
         RefPtr<DOMWindow> m_source;
-        RefPtr<MessagePort> m_messagePort;
+        OwnPtr<MessagePortArray> m_ports;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessageEvent.idl b/WebCore/dom/MessageEvent.idl
index 8e8f271..7e497fc 100644
--- a/WebCore/dom/MessageEvent.idl
+++ b/WebCore/dom/MessageEvent.idl
@@ -30,14 +30,21 @@ module events {
         GenerateConstructor,
         NoStaticTables
     ] MessageEvent : Event {
+        readonly attribute SerializedScriptValue data;
 
-        readonly attribute DOMString data;
         readonly attribute DOMString origin;
         readonly attribute DOMString lastEventId;
         readonly attribute DOMWindow source;
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        readonly attribute [CustomGetter] Array ports;
+
+        [Custom] void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in Array messagePorts);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just expose a single port.
         readonly attribute MessagePort messagePort;
-        
-        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in DOMString dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+
+        void initMessageEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in SerializedScriptValue dataArg, in DOMString originArg, in DOMString lastEventIdArg, in DOMWindow sourceArg, in MessagePort messagePort);
+#endif
 
     };
 
diff --git a/WebCore/dom/MessagePort.cpp b/WebCore/dom/MessagePort.cpp
index 9f3e4d2..9f6e649 100644
--- a/WebCore/dom/MessagePort.cpp
+++ b/WebCore/dom/MessagePort.cpp
@@ -55,28 +55,41 @@ MessagePort::~MessagePort()
         m_scriptExecutionContext->destroyedMessagePort(this);
 }
 
-void MessagePort::postMessage(const String& message, ExceptionCode& ec)
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void MessagePort::postMessage(const String& message, MessagePort* dataPort, ExceptionCode& ec)
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
+{
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
+}
+
+void MessagePort::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (!m_entangledChannel)
         return;
     ASSERT(m_scriptExecutionContext);
 
-    OwnPtr<MessagePortChannel> channel;
-    if (dataPort) {
-        if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
-            ec = INVALID_STATE_ERR;
-            return;
+    OwnPtr<MessagePortChannelArray> channels;
+    // Make sure we aren't connected to any of the passed-in ports.
+    if (ports) {
+        for (unsigned int i = 0; i < ports->size(); ++i) {
+            MessagePort* dataPort = (*ports)[i].get();
+            if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
+                ec = INVALID_STATE_ERR;
+                return;
+            }
         }
-        channel = dataPort->disentangle(ec);
+        channels = MessagePort::disentanglePorts(ports, ec);
         if (ec)
             return;
     }
-    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channel.release()));
+    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channels.release()));
 }
 
 PassOwnPtr<MessagePortChannel> MessagePort::disentangle(ExceptionCode& ec)
@@ -155,20 +168,8 @@ void MessagePort::dispatchMessages()
 
     OwnPtr<MessagePortChannel::EventData> eventData;
     while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
-        RefPtr<MessagePort> port;
-        OwnPtr<MessagePortChannel> channel = eventData->channel();
-        if (channel) {
-            // The remote side sent over a MessagePortChannel, so create a MessagePort to wrap it.
-            port = MessagePort::create(*m_scriptExecutionContext);
-            port->entangle(channel.release());
-        }
-        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, port.release());
-
-        if (m_onMessageListener) {
-            evt->setTarget(this);
-            evt->setCurrentTarget(this);
-            m_onMessageListener->handleEvent(evt.get(), false);
-        }
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*m_scriptExecutionContext, eventData->channels());
+        RefPtr<Event> evt = MessageEvent::create(ports.release(), eventData->message());
 
         ExceptionCode ec = 0;
         dispatchEvent(evt.release(), ec);
@@ -176,73 +177,68 @@ void MessagePort::dispatchMessages()
     }
 }
 
-void MessagePort::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
+bool MessagePort::hasPendingActivity()
 {
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
+    // The spec says that entangled message ports should always be treated as if they have a strong reference.
+    // We'll also stipulate that the queue needs to be open (if the app drops its reference to the port before start()-ing it, then it's not really entangled as it's unreachable).
+    return m_started && m_entangledChannel && m_entangledChannel->hasPendingActivity();
 }
 
-void MessagePort::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
+MessagePort* MessagePort::locallyEntangledPort()
 {
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
+    return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
 }
 
-bool MessagePort::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
+PassOwnPtr<MessagePortChannelArray> MessagePort::disentanglePorts(const MessagePortArray* ports, ExceptionCode& ec)
 {
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
+    if (!ports || !ports->size())
+        return 0;
+
+    // HashSet used to efficiently check for duplicates in the passed-in array.
+    HashSet<MessagePort*> portSet;
+
+    // Walk the incoming array - if there are any duplicate ports, or null ports or cloned ports, throw an error (per section 8.3.3 of the HTML5 spec).
+    for (unsigned int i = 0; i < ports->size(); ++i) {
+        MessagePort* port = (*ports)[i].get();
+        if (!port || !port->isEntangled() || portSet.contains(port)) {
+            ec = INVALID_STATE_ERR;
+            return 0;
+        }
+        portSet.add(port);
     }
-    
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
+
+    // Passed-in ports passed validity checks, so we can disentangle them.
+    MessagePortChannelArray* portArray = new MessagePortChannelArray(ports->size());
+    for (unsigned int i = 0 ; i < ports->size() ; ++i) {
+        OwnPtr<MessagePortChannel> channel = (*ports)[i]->disentangle(ec);
+        ASSERT(!ec); // Can't generate exception here if passed above checks.
+        (*portArray)[i] = channel.release();
     }
-    
-    return !event->defaultPrevented();
+    return portArray;
 }
 
-void MessagePort::setOnmessage(PassRefPtr<EventListener> eventListener)
+PassOwnPtr<MessagePortArray> MessagePort::entanglePorts(ScriptExecutionContext& context, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    m_onMessageListener = eventListener;
-    start();
+    if (!channels || !channels->size())
+        return 0;
+
+    MessagePortArray* portArray = new MessagePortArray(channels->size());
+    for (unsigned int i = 0; i < channels->size(); ++i) {
+        RefPtr<MessagePort> port = MessagePort::create(context);
+        port->entangle((*channels)[i].release());
+        (*portArray)[i] = port.release();
+    }
+    return portArray;
 }
 
-bool MessagePort::hasPendingActivity()
+EventTargetData* MessagePort::eventTargetData()
 {
-    // The spec says that entangled message ports should always be treated as if they have a strong reference.
-    // We'll also stipulate that the queue needs to be open (if the app drops its reference to the port before start()-ing it, then it's not really entangled as it's unreachable).
-    return m_started && m_entangledChannel && m_entangledChannel->hasPendingActivity();
+    return &m_eventTargetData;
 }
 
-MessagePort* MessagePort::locallyEntangledPort()
+EventTargetData* MessagePort::ensureEventTargetData()
 {
-    return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessagePort.h b/WebCore/dom/MessagePort.h
index f416b9b..0ab0f50 100644
--- a/WebCore/dom/MessagePort.h
+++ b/WebCore/dom/MessagePort.h
@@ -29,9 +29,9 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "MessagePortChannel.h"
-
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -44,22 +44,38 @@ namespace WebCore {
     class AtomicStringImpl;
     class Event;
     class Frame;
+    class MessagePort;
     class ScriptExecutionContext;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
+
     class MessagePort : public RefCounted<MessagePort>, public EventTarget {
     public:
         static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
-        void postMessage(const String& message, ExceptionCode&);
-        void postMessage(const String& message, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
+
         void start();
         void close();
 
         void entangle(PassOwnPtr<MessagePortChannel>);
         PassOwnPtr<MessagePortChannel> disentangle(ExceptionCode&);
 
+        // Disentangle an array of ports, returning the entangled channels.
+        // Per section 8.3.3 of the HTML5 spec, generates an INVALID_STATE_ERR exception if any of the passed ports are null or not entangled.
+        // Returns 0 if there is an exception, or if the passed-in array is 0/empty.
+        static PassOwnPtr<MessagePortChannelArray> disentanglePorts(const MessagePortArray*, ExceptionCode&);
+
+        // Entangles an array of channels, returning an array of MessagePorts in matching order.
+        // Returns 0 if the passed array is 0/empty.
+        static PassOwnPtr<MessagePortArray> entanglePorts(ScriptExecutionContext&, PassOwnPtr<MessagePortChannelArray>);
+
         void messageAvailable();
         bool started() const { return m_started; }
 
@@ -71,21 +87,17 @@ namespace WebCore {
 
         void dispatchMessages();
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         using RefCounted<MessagePort>::ref;
         using RefCounted<MessagePort>::deref;
 
         bool hasPendingActivity();
 
-        void setOnmessage(PassRefPtr<EventListener>);
-        EventListener* onmessage() const { return m_onMessageListener.get(); }
+        void setOnmessage(PassRefPtr<EventListener> listener)
+        {
+            setAttributeEventListener(eventNames().messageEvent, listener);
+            start();
+        }
+        EventListener* onmessage() { return getAttributeEventListener(eventNames().messageEvent); }
 
         // Returns null if there is no entangled port, or if the entangled port is run by a different thread.
         // Returns null otherwise.
@@ -98,16 +110,15 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         OwnPtr<MessagePortChannel> m_entangledChannel;
 
         bool m_started;
 
         ScriptExecutionContext* m_scriptExecutionContext;
-
-        RefPtr<EventListener> m_onMessageListener;
-
-        EventListenersMap m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/dom/MessagePort.idl b/WebCore/dom/MessagePort.idl
index e5f9ad1..a9149ec 100644
--- a/WebCore/dom/MessagePort.idl
+++ b/WebCore/dom/MessagePort.idl
@@ -28,13 +28,14 @@ module events {
 
     interface [
         CustomMarkFunction,
+        EventTarget,
         GenerateConstructor,
         NoStaticTables
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+        [Custom] void postMessage(in DOMString message, in [Optional] Array messagePorts)
             raises(DOMException);
         void start();
         void close();
diff --git a/WebCore/dom/MessagePortChannel.cpp b/WebCore/dom/MessagePortChannel.cpp
index 05134c0..e1a3ac6 100644
--- a/WebCore/dom/MessagePortChannel.cpp
+++ b/WebCore/dom/MessagePortChannel.cpp
@@ -33,14 +33,14 @@
 namespace WebCore {
 
 
-PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    return new EventData(message, channel);
+    return new EventData(message, channels);
 }
 
-MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannel> channel)
-    : m_message(message.copy())
-    , m_channel(channel)
+MessagePortChannel::EventData::EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+    : m_message(message->release())
+    , m_channels(channels)
 {
 }
 
diff --git a/WebCore/dom/MessagePortChannel.h b/WebCore/dom/MessagePortChannel.h
index 93b224b..2321b1f 100644
--- a/WebCore/dom/MessagePortChannel.h
+++ b/WebCore/dom/MessagePortChannel.h
@@ -33,6 +33,8 @@
 
 #include "PlatformString.h"
 
+#include "SerializedScriptValue.h"
+
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -42,10 +44,15 @@
 namespace WebCore {
 
     class MessagePort;
+    class MessagePortChannel;
     class PlatformMessagePortChannel;
     class ScriptExecutionContext;
+    class SerializedScriptValue;
     class String;
 
+    // The overwhelmingly common case is sending a single port, so handle that efficiently with an inline buffer of size 1.
+    typedef Vector<OwnPtr<MessagePortChannel>, 1> MessagePortChannelArray;
+
     // MessagePortChannel is a platform-independent interface to the remote side of a message channel.
     // It acts as a wrapper around the platform-dependent PlatformMessagePortChannel implementation which ensures that the platform-dependent close() method is invoked before destruction.
     class MessagePortChannel : public Noncopyable {
@@ -73,15 +80,15 @@ namespace WebCore {
 
         class EventData {
         public:
-            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannel>);
+            static PassOwnPtr<EventData> create(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
 
-            const String& message() { return m_message; }
-            PassOwnPtr<MessagePortChannel> channel() { return m_channel.release(); }
+            SerializedScriptValue* message() { return m_message.get(); }
+            PassOwnPtr<MessagePortChannelArray> channels() { return m_channels.release(); }
 
         private:
-            EventData(const String& message, PassOwnPtr<MessagePortChannel>);
-            String m_message;
-            OwnPtr<MessagePortChannel> m_channel;
+            EventData(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray>);
+            RefPtr<SerializedScriptValue> m_message;
+            OwnPtr<MessagePortChannelArray> m_channels;
         };
 
         // Sends a message and optional cloned port to the remote port.
diff --git a/WebCore/dom/MutationEvent.h b/WebCore/dom/MutationEvent.h
index c5f2d1d..29b978c 100644
--- a/WebCore/dom/MutationEvent.h
+++ b/WebCore/dom/MutationEvent.h
@@ -41,10 +41,11 @@ namespace WebCore {
         {
             return adoptRef(new MutationEvent);
         }
-        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
-            const String& prevValue, const String& newValue, const String& attrName, unsigned short attrChange)
+
+        static PassRefPtr<MutationEvent> create(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode = 0,
+            const String& prevValue = String(), const String& newValue = String(), const String& attrName = String(), unsigned short attrChange = 0)
         {
-            return adoptRef(new MutationEvent(type, canBubble, cancelable, relatedNode, prevValue, newValue, attrName, attrChange));
+            return adoptRef(new MutationEvent(type, canBubble, false, relatedNode, prevValue, newValue, attrName, attrChange));
         }
 
         void initMutationEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
diff --git a/WebCore/dom/NamedAttrMap.cpp b/WebCore/dom/NamedAttrMap.cpp
index fe631c8..d4ec598 100644
--- a/WebCore/dom/NamedAttrMap.cpp
+++ b/WebCore/dom/NamedAttrMap.cpp
@@ -178,10 +178,8 @@ Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreA
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
-        if (!m_attributes[i]->name().hasPrefix() && 
-            m_attributes[i]->name().localName() == name)
-                return m_attributes[i].get();
-
+        if (!m_attributes[i]->name().hasPrefix() && m_attributes[i]->name().localName() == name)
+            return m_attributes[i].get();
         if (shouldIgnoreAttributeCase ? equalIgnoringCase(m_attributes[i]->name().toString(), name) : name == m_attributes[i]->name().toString())
             return m_attributes[i].get();
     }
@@ -206,10 +204,12 @@ void NamedNodeMap::clearAttributes()
 
 void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedNodeMap w/o an element in case someone still has a reference
-    // to if after the element gets deleted - but the map is now invalid
+    // This can't happen if the holder of the map is JavaScript, because we mark the
+    // element if the map is alive. So it has no impact on web page behavior. Because
+    // of that, we can simply clear all the attributes to avoid accessing stale
+    // pointers to do things like create Attr objects.
     m_element = 0;
-    detachAttributesFromElement();
+    clearAttributes();
 }
 
 void NamedNodeMap::setAttributes(const NamedNodeMap& other)
@@ -251,7 +251,7 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
         attr->m_element = m_element;
 
     // Notify the element that the attribute has been added, and dispatch appropriate mutation events
-    // Note that element may be null here if we are called from insertAttr() during parsing
+    // Note that element may be null here if we are called from insertAttribute() during parsing
     if (m_element) {
         m_element->attributeChanged(attribute.get());
         // Because of our updateStyleAttribute() style modification events are never sent at the right time, so don't bother sending them.
@@ -265,12 +265,13 @@ void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
-    unsigned index = len + 1;
-    for (unsigned i = 0; i < len; ++i)
+    unsigned index = len;
+    for (unsigned i = 0; i < len; ++i) {
         if (m_attributes[i]->name().matches(name)) {
             index = i;
             break;
         }
+    }
 
     if (index >= len)
         return;
diff --git a/WebCore/dom/NamedAttrMap.h b/WebCore/dom/NamedAttrMap.h
index 4fb96de..759900b 100644
--- a/WebCore/dom/NamedAttrMap.h
+++ b/WebCore/dom/NamedAttrMap.h
@@ -94,11 +94,11 @@ public:
     void addAttribute(PassRefPtr<Attribute>);
     void removeAttribute(const QualifiedName&);
 
+    Element* element() const { return m_element; }
+
 protected:
     virtual void clearAttributes();
 
-    Element* element() const { return m_element; }
-
 private:
     void detachAttributesFromElement();
     void detachFromElement();
diff --git a/WebCore/dom/NamedNodeMap.idl b/WebCore/dom/NamedNodeMap.idl
index 3310ded..8166853 100644
--- a/WebCore/dom/NamedNodeMap.idl
+++ b/WebCore/dom/NamedNodeMap.idl
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -21,6 +21,7 @@
 module core {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         HasIndexGetter,
         HasNameGetter,
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 11d2bcf..bee07cd 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -55,6 +55,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MouseEvent.h"
@@ -337,8 +338,69 @@ Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
     return ch;
 }
 
-Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
-    : m_document(doc)
+inline bool Node::initialRefCount(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateOther:
+        case CreateText:
+            return 1;
+        case CreateElementZeroRefCount:
+            return 0;
+    }
+    ASSERT_NOT_REACHED();
+    return 1;
+}
+
+inline bool Node::isContainer(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+        case CreateOther:
+        case CreateText:
+            return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isElement(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateOther:
+        case CreateText:
+            return false;
+        case CreateElement:
+        case CreateElementZeroRefCount:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+inline bool Node::isText(ConstructionType type)
+{
+    switch (type) {
+        case CreateContainer:
+        case CreateElement:
+        case CreateElementZeroRefCount:
+        case CreateOther:
+            return false;
+        case CreateText:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+Node::Node(Document* document, ConstructionType type)
+    : TreeShared<Node>(initialRefCount(type))
+    , m_document(document)
     , m_previous(0)
     , m_next(0)
     , m_renderer(0)
@@ -355,25 +417,27 @@ Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
     , m_inDetach(false)
     , m_inSubtreeMark(false)
     , m_hasRareData(false)
-    , m_isElement(isElement)
-    , m_isContainer(isContainer)
-    , m_isText(isText)
+    , m_isElement(isElement(type))
+    , m_isContainer(isContainer(type))
+    , m_isText(isText(type))
     , m_parsingChildrenFinished(true)
-#if ENABLE(SVG)
-    , m_areSVGAttributesValid(true)
-#endif
     , m_isStyleAttributeValid(true)
     , m_synchronizingStyleAttribute(false)
 #if ENABLE(SVG)
+    , m_areSVGAttributesValid(true)
     , m_synchronizingSVGAttributes(false)
 #endif
 {
+    if (m_document)
+        m_document->selfOnlyRef();
+
 #ifndef NDEBUG
     if (shouldIgnoreLeaks)
         ignoreSet.add(this);
     else
         nodeCounter.increment();
 #endif
+
 #if DUMP_NODE_STATISTICS
     liveNodeSet.add(this);
 #endif
@@ -393,9 +457,6 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
-    if (!eventListeners().isEmpty() && !inDocument())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     if (!hasRareData())
         ASSERT(!NodeRareData::rareDataMap().contains(this));
     else {
@@ -416,6 +477,9 @@ Node::~Node()
         m_previous->setNextSibling(0);
     if (m_next)
         m_next->setPreviousSibling(0);
+
+    if (m_document)
+        m_document->selfOnlyDeref();
 }
 
 #ifdef NDEBUG
@@ -450,14 +514,19 @@ void Node::setDocument(Document* document)
     if (inDocument() || m_document == document)
         return;
 
+    document->selfOnlyRef();
+
     setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
     ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
 #if USE(JSC)
-    updateDOMNodeDocument(this, m_document.get(), document);
+    updateDOMNodeDocument(this, m_document, document);
 #endif
 
+    if (m_document)
+        m_document->selfOnlyDeref();
+
     m_document = document;
 
     setDidMoveToNewOwnerDocumentWasCalled(false);
@@ -519,7 +588,8 @@ PassRefPtr<NodeList> Node::childNodes()
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
-        document()->addNodeListCache();
+        if (document())
+            document()->addNodeListCache();
     }
 
     return ChildNodeList::create(this, data->nodeLists()->m_childNodeListCaches.get());
@@ -699,7 +769,7 @@ void Node::setNeedsStyleRecalc(StyleChangeType changeType)
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
 
-    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == AnimationStyleChange)))
+    if (!(changeType == InlineStyleChange && (m_styleChange == FullStyleChange || m_styleChange == SyntheticStyleChange)))
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
@@ -762,10 +832,30 @@ bool Node::rareDataFocused() const
     ASSERT(hasRareData());
     return rareData()->isFocused();
 }
+
+bool Node::supportsFocus() const
+{
+    return hasRareData() && rareData()->tabIndexSetExplicitly();
+}
     
 bool Node::isFocusable() const
 {
-    return hasRareData() && rareData()->tabIndexSetExplicitly();
+    if (!inDocument() || !supportsFocus())
+        return false;
+    
+    if (renderer())
+        ASSERT(!renderer()->needsLayout());
+    else
+        // If the node is in a display:none tree it might say it needs style recalc but
+        // the whole document is atually up to date.
+        ASSERT(!document()->childNeedsStyleRecalc());
+    
+    // FIXME: Even if we are not visible, we might have a child that is visible.
+    // Hyatt wants to fix that some day with a "has visible content" flag or the like.
+    if (!renderer() || renderer()->style()->visibility() != VISIBLE)
+        return false;
+
+    return true;
 }
 
 bool Node::isKeyboardFocusable(KeyboardEvent*) const
@@ -793,7 +883,7 @@ void Node::registerDynamicNodeList(DynamicNodeList* list)
     if (!data->nodeLists()) {
         data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
-    } else if (!m_document->hasNodeListCaches()) {
+    } else if (!m_document || !m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
         data->nodeLists()->invalidateCaches();
     }
@@ -811,7 +901,8 @@ void Node::unregisterDynamicNodeList(DynamicNodeList* list)
         data->nodeLists()->m_listsWithCaches.remove(list);
         if (data->nodeLists()->isEmpty()) {
             data->clearNodeLists();
-            document()->removeNodeListCache();
+            if (document())
+                document()->removeNodeListCache();
         }
     }
 }
@@ -1540,52 +1631,6 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return ClassNodeList::create(this, classNames, result.first->second.get());
 }
 
-template <typename Functor>
-static bool forEachTagSelector(Functor& functor, CSSSelector* selector)
-{
-    ASSERT(selector);
-
-    do {
-        if (functor(selector))
-            return true;
-        if (CSSSelector* simpleSelector = selector->simpleSelector()) {
-            if (forEachTagSelector(functor, simpleSelector))
-                return true;
-        }
-    } while ((selector = selector->tagHistory()));
-
-    return false;
-}
-
-template <typename Functor>
-static bool forEachSelector(Functor& functor, const CSSSelectorList& selectorList)
-{
-    for (CSSSelector* selector = selectorList.first(); selector; selector = CSSSelectorList::next(selector)) {
-        if (forEachTagSelector(functor, selector))
-            return true;
-    }
-
-    return false;
-}
-
-class SelectorNeedsNamespaceResolutionFunctor {
-public:
-    bool operator()(CSSSelector* selector)
-    {
-        if (selector->hasTag() && selector->m_tag.prefix() != nullAtom && selector->m_tag.prefix() != starAtom)
-            return true;
-        if (selector->hasAttribute() && selector->attribute().prefix() != nullAtom && selector->attribute().prefix() != starAtom)
-            return true;
-        return false;
-    }
-};
-
-static bool selectorNeedsNamespaceResolution(const CSSSelectorList& selectorList)
-{
-    SelectorNeedsNamespaceResolutionFunctor functor;
-    return forEachSelector(functor, selectorList);
-}
-
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1604,7 +1649,7 @@ PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode&
     }
 
     // throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1652,7 +1697,7 @@ PassRefPtr<NodeList> Node::querySelectorAll(const String& selectors, ExceptionCo
     }
 
     // Throw a NAMESPACE_ERR if the selector includes any namespace prefixes.
-    if (selectorNeedsNamespaceResolution(querySelectorList)) {
+    if (querySelectorList.selectorsNeedNamespaceResolution()) {
         ec = NAMESPACE_ERR;
         return 0;
     }
@@ -1900,11 +1945,11 @@ void Node::appendTextContent(bool convertBRsToNewlines, StringBuilder& content)
         case TEXT_NODE:
         case CDATA_SECTION_NODE:
         case COMMENT_NODE:
-            content.append(static_cast<const CharacterData*>(this)->CharacterData::nodeValue());
+            content.append(static_cast<const CharacterData*>(this)->data());
             break;
 
         case PROCESSING_INSTRUCTION_NODE:
-            content.append(static_cast<const ProcessingInstruction*>(this)->ProcessingInstruction::nodeValue());
+            content.append(static_cast<const ProcessingInstruction*>(this)->data());
             break;
         
         case ELEMENT_NODE:
@@ -2313,46 +2358,24 @@ ScriptExecutionContext* Node::scriptExecutionContext() const
     return document();
 }
 
-const RegisteredEventListenerVector& Node::eventListeners() const
-{
-    if (hasRareData()) {
-        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
-            return *listeners;
-    }
-    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
-    return *emptyListenersVector;
-}
-
 void Node::insertedIntoDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     setInDocument(true);
 }
 
 void Node::removedFromDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     setInDocument(false);
 }
 
 void Node::willMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!willMoveToNewOwnerDocumentWasCalled);
     setWillMoveToNewOwnerDocumentWasCalled(true);
 }
 
 void Node::didMoveToNewOwnerDocument()
 {
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
     ASSERT(!didMoveToNewOwnerDocumentWasCalled);
     setDidMoveToNewOwnerDocumentWasCalled(true);
 }
@@ -2382,26 +2405,15 @@ static inline void updateSVGElementInstancesAfterEventListenerChange(Node* refer
 #endif
 }
 
-void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+bool Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    Document* document = this->document();
-    if (!document->attached())
-        return;
-
-    document->addListenerTypeIfNeeded(eventType);
-
-    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
-
-    // Remove existing identical listener set with identical arguments.
-    // The DOM2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
-
-    // adding the first one
-    if (listeners.isEmpty() && !inDocument())
-        document->registerDisconnectedNodeWithEventListeners(this);
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
 
-    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
     updateSVGElementInstancesAfterEventListenerChange(this);
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 
 #if ENABLE(TOUCH_EVENTS) // Android
     if (eventType == eventNames().touchstartEvent || 
@@ -2410,28 +2422,17 @@ void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListe
             eventType == eventNames().touchcancelEvent)
         document->addTouchEventListener(this);
 #endif
+=======
+    return true;
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+bool Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            r.setRemoved(true);
-            listeners->remove(i);
-
-            // removed last
-            if (listeners->isEmpty() && !inDocument())
-                document()->unregisterDisconnectedNodeWithEventListeners(this);
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
             updateSVGElementInstancesAfterEventListenerChange(this);
 #if ENABLE(TOUCH_EVENTS) // Android
             if (eventType == eventNames().touchstartEvent || 
@@ -2443,16 +2444,18 @@ void Node::removeEventListener(const AtomicString& eventType, EventListener* lis
             return;
         }
     }
+=======
+    updateSVGElementInstancesAfterEventListenerChange(this);
+    return true;
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::removeAllEventListenersSlowCase()
+EventTargetData* Node::eventTargetData()
 {
-    ASSERT(hasRareData());
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
+    return hasRareData() ? rareData()->eventTargetData() : 0;
+}
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 #if ENABLE(TOUCH_EVENTS) // Android
     document()->removeTouchEventListener(this);
 #endif
@@ -2461,20 +2464,22 @@ void Node::removeAllEventListenersSlowCase()
     for (size_t i = 0; i < size; ++i)
         listeners->at(i)->setRemoved(true);
     listeners->clear();
+=======
+EventTargetData* Node::ensureEventTargetData()
+{
+    return ensureRareData()->ensureEventTargetData();
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 }
 
-void Node::handleLocalEvents(Event* event, bool useCapture)
+void Node::handleLocalEvents(Event* event)
 {
+    if (!hasRareData() || !rareData()->eventTargetData())
+        return;
+
     if (disabled() && event->isMouseEvent())
         return;
 
-    RegisteredEventListenerVector listenersCopy = eventListeners();
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, false);
-    }
+    fireEventListeners(event);
 }
 
 #if ENABLE(SVG)
@@ -2515,19 +2520,29 @@ static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNo
     return referenceNode;
 }
 
-bool Node::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+void Node::eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors)
 {
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) { 
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
+    if (inDocument()) {
+        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
+#if ENABLE(SVG)
+            // Skip <use> shadow tree elements.
+            if (ancestor->isSVGElement() && ancestor->isShadowNode())
+                continue;
+#endif
+            ancestors.append(ancestor);
+        }
     }
+}
 
-    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
+bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
+{
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
+
+    event->setTarget(eventTargetRespectingSVGTargetRules(this));
 
     RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(evt.release());
+    return dispatchGenericEvent(event.release());
 }
 
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
@@ -2538,21 +2553,18 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
     ASSERT(event->target());
     ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willDispatchDOMEvent(*event);
+#endif
+
     // Make a vector of ancestors to send the event to.
     // If the node is not in a document just send the event to it.
     // Be sure to ref all of nodes since event handlers could result in the last reference going away.
     RefPtr<Node> thisNode(this);
     Vector<RefPtr<ContainerNode> > ancestors;
-    if (inDocument()) {
-        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
-#if ENABLE(SVG)
-            // Skip <use> shadow tree elements.
-            if (ancestor->isSVGElement() && ancestor->isShadowNode())
-                continue;
-#endif
-            ancestors.append(ancestor);
-        }
-    }
+    eventAncestors(ancestors);
 
     // Set up a pointer to indicate whether / where to dispatch window events.
     // We don't dispatch load events to the window. That quirk was originally
@@ -2574,27 +2586,22 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 
     if (targetForWindowEvents) {
         event->setCurrentTarget(targetForWindowEvents);
-        targetForWindowEvents->handleEvent(event.get(), true);
+        targetForWindowEvents->fireEventListeners(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
     for (size_t i = ancestors.size(); i; --i) {
         ContainerNode* ancestor = ancestors[i - 1].get();
         event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-        ancestor->handleLocalEvents(event.get(), true);
+        ancestor->handleLocalEvents(event.get());
         if (event->propagationStopped())
             goto doneDispatching;
     }
 
     event->setEventPhase(Event::AT_TARGET);
 
-    // We do want capturing event listeners to be invoked here, even though
-    // that violates some versions of the DOM specification; Mozilla does it.
     event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get(), true);
-    if (event->propagationStopped())
-        goto doneDispatching;
-    handleLocalEvents(event.get(), false);
+    handleLocalEvents(event.get());
     if (event->propagationStopped())
         goto doneDispatching;
 
@@ -2606,13 +2613,13 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
         for (size_t i = 0; i < size; ++i) {
             ContainerNode* ancestor = ancestors[i].get();
             event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-            ancestor->handleLocalEvents(event.get(), false);
+            ancestor->handleLocalEvents(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
         if (targetForWindowEvents) {
             event->setCurrentTarget(targetForWindowEvents);
-            targetForWindowEvents->handleEvent(event.get(), false);
+            targetForWindowEvents->fireEventListeners(event.get());
             if (event->propagationStopped() || event->cancelBubble())
                 goto doneDispatching;
         }
@@ -2649,6 +2656,11 @@ doneDispatching:
     }
 
 doneWithDefault:
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didDispatchDOMEvent();
+#endif
+
     Document::updateStyleForAllDocuments();
 
     return !event->defaultPrevented();
@@ -2665,8 +2677,7 @@ void Node::dispatchSubtreeModifiedEvent()
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
         return;
 
-    ExceptionCode ec = 0;
-    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
+    dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true));
 }
 
 void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
@@ -2676,18 +2687,15 @@ void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr
     
     bool cancelable = eventType == eventNames().DOMActivateEvent;
     
-    ExceptionCode ec = 0;
-    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
-    evt->setUnderlyingEvent(underlyingEvent);
-    dispatchEvent(evt.release(), ec);
+    RefPtr<UIEvent> event = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
+    event->setUnderlyingEvent(underlyingEvent);
+    dispatchEvent(event.release());
 }
 
 bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
 {
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
     RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent, ec);
+    bool r = dispatchEvent(keyboardEvent);
     
     // we want to return false if default is prevented (already taken care of)
     // or if the element is default-handled by the DOM. Otherwise we let it just
@@ -2781,8 +2789,6 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     
     bool cancelable = eventType != eventNames().mousemoveEvent;
     
-    ExceptionCode ec = 0;
-    
     bool swallowEvent = false;
     
     // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
@@ -2807,7 +2813,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
     mouseEvent->setUnderlyingEvent(underlyingEvent.get());
     mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
     
-    dispatchEvent(mouseEvent, ec);
+    dispatchEvent(mouseEvent);
     bool defaultHandled = mouseEvent->defaultHandled();
     bool defaultPrevented = mouseEvent->defaultPrevented();
     if (defaultHandled || defaultPrevented)
@@ -2825,7 +2831,7 @@ bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int det
         doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
         if (defaultHandled)
             doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent, ec);
+        dispatchEvent(doubleClickEvent);
         if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
             swallowEvent = true;
     }
@@ -2862,102 +2868,18 @@ void Node::dispatchWheelEvent(PlatformWheelEvent& e)
 
     we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
 
-    ExceptionCode ec = 0;
-    if (!dispatchEvent(we.release(), ec))
+    if (!dispatchEvent(we.release()))
         e.accept();
 }
 
-void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
-}
-
-void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
-}
-
-void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
-}
-
 void Node::dispatchFocusEvent()
 {
-    dispatchEvent(eventNames().focusEvent, false, false);
+    dispatchEvent(Event::create(eventNames().focusEvent, false, false));
 }
 
 void Node::dispatchBlurEvent()
 {
-    dispatchEvent(eventNames().blurEvent, false, false);
-}
-
-bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
-}
-
-void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
-}
-
-void Node::clearAttributeEventListener(const AtomicString& eventType)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isAttribute())
-            continue;
-
-        r.setRemoved(true);
-        listeners->remove(i);
-
-        // removed last
-        if (listeners->isEmpty() && !inDocument())
-            document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-        updateSVGElementInstancesAfterEventListenerChange(this);
-        return;
-    }
-}
-
-void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
-{
-    const RegisteredEventListenerVector& listeners = eventListeners();
-    size_t size = listeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
+    dispatchEvent(Event::create(eventNames().blurEvent, false, false));
 }
 
 bool Node::disabled() const
@@ -2977,10 +2899,12 @@ void Node::defaultEventHandler(Event* event)
     } else if (eventType == eventNames().clickEvent) {
         int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
         dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
+#if ENABLE(CONTEXT_MENUS)
     } else if (eventType == eventNames().contextmenuEvent) {
         if (Frame* frame = document()->frame())
             if (Page* page = frame->page())
                 page->contextMenuController()->handleContextMenuEvent(event);
+#endif
     } else if (eventType == eventNames().textInputEvent) {
         if (event->isTextEvent())
             if (Frame* frame = document()->frame())
@@ -2988,6 +2912,7 @@ void Node::defaultEventHandler(Event* event)
     }
 }
 
+<<<<<<< HEAD:WebCore/dom/Node.cpp
 EventListener* Node::onabort() const
 {
     return getAttributeEventListener(eventNames().abortEvent);
@@ -3410,6 +3335,8 @@ void Node::setOntouchcancel(PassRefPtr<EventListener> eventListener)
 }
 #endif // ENABLE(TOUCH_EVENT)
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.cpp
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 753f20e..c57c49f 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -25,7 +25,6 @@
 #ifndef Node_h
 #define Node_h
 
-#include "DocPtr.h"
 #include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
@@ -68,7 +67,10 @@ class StringBuilder;
 
 typedef int ExceptionCode;
 
-enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, AnimationStyleChange };
+// SyntheticStyleChange means that we need to go through the entire style change logic even though
+// no style property has actually changed. It is used to restructure the tree when, for instance,
+// RenderLayers are created or destroyed due to animation changes.
+enum StyleChangeType { NoStyleChange, InlineStyleChange, FullStyleChange, SyntheticStyleChange };
 
 const unsigned short DOCUMENT_POSITION_EQUIVALENT = 0x00;
 const unsigned short DOCUMENT_POSITION_DISCONNECTED = 0x01;
@@ -108,7 +110,6 @@ public:
     enum StyleChange { NoChange, NoInherit, Inherit, Detach, Force };    
     static StyleChange diff(const RenderStyle*, const RenderStyle*);
 
-    Node(Document*, bool isElement = false, bool isContainer = false, bool isText = false);
     virtual ~Node();
 
     // DOM methods & attributes for Node
@@ -182,6 +183,14 @@ public:
     static bool isWMLElement() { return false; }
 #endif
 
+#if ENABLE(MATHML)
+    virtual bool isMathMLElement() const { return false; }
+#else
+    static bool isMathMLElement() { return false; }
+#endif
+
+
+    virtual bool isMediaControlElement() const { return false; }
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
@@ -197,6 +206,9 @@ public:
     // The node's parent for the purpose of event capture and bubbling.
     virtual ContainerNode* eventParentNode();
 
+    // Node ancestors when concerned about event flow
+    void eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors);
+
     bool isBlockFlow() const;
     bool isBlockFlowOrBlockTable() const;
     
@@ -289,10 +301,10 @@ public:
 
     virtual short tabIndex() const;
 
-    /**
-     * Whether this node can receive the keyboard focus.
-     */
-    virtual bool supportsFocus() const { return isFocusable(); }
+    // Whether this kind of node can receive focus by default. Most nodes are
+    // not focusable but some elements, such as form controls and links are.
+    virtual bool supportsFocus() const;
+    // Whether the node can actually be focused.
     virtual bool isFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
@@ -316,7 +328,7 @@ public:
     {
         ASSERT(this);
         ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-        return m_document.get();
+        return m_document;
     }
     void setDocument(Document*);
 
@@ -499,6 +511,7 @@ public:
 
     unsigned short compareDocumentPosition(Node*);
 
+<<<<<<< HEAD:WebCore/dom/Node.h
 #ifdef ANDROID_INSTRUMENT
     // Overridden to prevent the normal new from being called.
     void* operator new(size_t) throw();
@@ -522,23 +535,25 @@ protected:
     NodeRareData* ensureRareData();
 
 public:
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.h
     virtual Node* toNode() { return this; }
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-    // Used for standard DOM addEventListener / removeEventListener APIs.
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+    virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+    virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
 
-    // Used for legacy "onEvent" property APIs.
-    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void clearAttributeEventListener(const AtomicString& eventType);
-    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+    // Handlers to do/undo actions on the target node before an event is dispatched to it and after the event
+    // has been dispatched.  The data pointer is handed back by the preDispatch and passed to postDispatch.
+    virtual void* preDispatchEventHandler(Event*) { return 0; }
+    virtual void postDispatchEventHandler(Event*, void* /*dataFromPreDispatch*/) { }
 
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+    using EventTarget::dispatchEvent;
+    virtual bool dispatchEvent(PassRefPtr<Event>);
 
-    void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
+    bool dispatchGenericEvent(PassRefPtr<Event>);
+    virtual void handleLocalEvents(Event*);
 
     void dispatchSubtreeModifiedEvent();
     void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
@@ -552,14 +567,6 @@ public:
         bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
     void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
-    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
-
-    bool dispatchGenericEvent(PassRefPtr<Event>);
-
-    virtual void handleLocalEvents(Event*, bool useCapture);
 
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
@@ -575,6 +582,7 @@ public:
      */
     virtual bool disabled() const;
 
+<<<<<<< HEAD:WebCore/dom/Node.h
     const RegisteredEventListenerVector& eventListeners() const;
 
     // These 4 attribute event handler attributes are overrided by HTMLBodyElement
@@ -670,16 +678,42 @@ public:
     void setOntouchcancel(PassRefPtr<EventListener>);
 #endif
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/dom/Node.h
     using TreeShared<Node>::ref;
     using TreeShared<Node>::deref;
- 
+
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
+
+protected:
+    // CreateElementZeroRefCount is deprecated and can be removed once we convert all element
+    // classes to start with a reference count of 1.
+    enum ConstructionType { CreateContainer, CreateElement, CreateOther, CreateText, CreateElementZeroRefCount };
+    Node(Document*, ConstructionType);
+
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
+    
+    virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
+    void setTabIndexExplicitly(short);
+    
+    bool hasRareData() const { return m_hasRareData; }
+    
+    NodeRareData* rareData() const;
+    NodeRareData* ensureRareData();
+
 private:
+    static bool initialRefCount(ConstructionType);
+    static bool isContainer(ConstructionType);
+    static bool isElement(ConstructionType);
+    static bool isText(ConstructionType);
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
 
     void removeAllEventListenersSlowCase();
 
-private:
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
     unsigned containerChildNodeCount() const;
@@ -697,7 +731,7 @@ private:
 
     void appendTextContent(bool convertBRsToNewlines, StringBuilder&) const;
 
-    DocPtr<Document> m_document;
+    Document* m_document;
     Node* m_previous;
     Node* m_next;
     RenderObject* m_renderer;
@@ -720,22 +754,16 @@ private:
     const bool m_isText : 1;
 
 protected:
-    // These bits are used by the Element derived class, pulled up here so they can
+    // These bits are used by derived classes, pulled up here so they can
     // be stored in the same memory word as the Node bits above.
-    bool m_parsingChildrenFinished : 1;
-#if ENABLE(SVG)
-    mutable bool m_areSVGAttributesValid : 1;
-#endif
 
-    // These bits are used by the StyledElement derived class, and live here for the
-    // same reason as above.
-    mutable bool m_isStyleAttributeValid : 1;
-    mutable bool m_synchronizingStyleAttribute : 1;
+    bool m_parsingChildrenFinished : 1; // Element
+    mutable bool m_isStyleAttributeValid : 1; // StyledElement
+    mutable bool m_synchronizingStyleAttribute : 1; // StyledElement
 
 #if ENABLE(SVG)
-    // This bit is used by the SVGElement derived class, and lives here for the same
-    // reason as above.
-    mutable bool m_synchronizingSVGAttributes : 1;
+    mutable bool m_areSVGAttributesValid : 1; // Element
+    mutable bool m_synchronizingSVGAttributes : 1; // SVGElement
 #endif
 
     // 11 bits remaining
diff --git a/WebCore/dom/Node.idl b/WebCore/dom/Node.idl
index 1e31aea..45ea132 100644
--- a/WebCore/dom/Node.idl
+++ b/WebCore/dom/Node.idl
@@ -24,6 +24,7 @@ module core {
         CustomMarkFunction,
         CustomPushEventHandlerScope,
         CustomToJS,
+        EventTarget,
         GenerateConstructor,
         GenerateNativeConverter,
         InlineGetOwnPropertySlot,
diff --git a/WebCore/dom/NodeRareData.h b/WebCore/dom/NodeRareData.h
index 7740344..8b9e1bf 100644
--- a/WebCore/dom/NodeRareData.h
+++ b/WebCore/dom/NodeRareData.h
@@ -93,12 +93,12 @@ public:
     void setTabIndexExplicitly(short index) { m_tabIndex = index; m_tabIndexWasSetExplicitly = true; }
     bool tabIndexSetExplicitly() const { return m_tabIndexWasSetExplicitly; }
 
-    RegisteredEventListenerVector* listeners() { return m_eventListeners.get(); }
-    RegisteredEventListenerVector& ensureListeners()
+    EventTargetData* eventTargetData() { return m_eventTargetData.get(); }
+    EventTargetData* ensureEventTargetData()
     {
-        if (!m_eventListeners)
-            m_eventListeners.set(new RegisteredEventListenerVector);
-        return *m_eventListeners;
+        if (!m_eventTargetData)
+            m_eventTargetData.set(new EventTargetData);
+        return m_eventTargetData.get();
     }
 
     bool isFocused() const { return m_isFocused; }
@@ -111,7 +111,7 @@ protected:
 
 private:
     OwnPtr<NodeListsNodeData> m_nodeLists;
-    OwnPtr<RegisteredEventListenerVector > m_eventListeners;
+    OwnPtr<EventTargetData> m_eventTargetData;
     short m_tabIndex;
     bool m_tabIndexWasSetExplicitly : 1;
     bool m_isFocused : 1;
diff --git a/WebCore/dom/Notation.cpp b/WebCore/dom/Notation.cpp
index 7081d98..cade384 100644
--- a/WebCore/dom/Notation.cpp
+++ b/WebCore/dom/Notation.cpp
@@ -1,8 +1,6 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
+/*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,17 +17,14 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "Notation.h"
 
 namespace WebCore {
 
-Notation::Notation(Document* doc) : ContainerNode(doc)
-{
-}
-
-Notation::Notation(Document* doc, const String& name, const String& publicId, const String& systemId)
-    : ContainerNode(doc)
+Notation::Notation(Document* document, const String& name, const String& publicId, const String& systemId)
+    : ContainerNode(document)
     , m_name(name)
     , m_publicId(publicId)
     , m_systemId(systemId)
@@ -52,7 +47,6 @@ PassRefPtr<Node> Notation::cloneNode(bool /*deep*/)
     return 0;
 }
 
-// DOM Section 1.1.1
 bool Notation::childTypeAllowed(NodeType)
 {
     return false;
diff --git a/WebCore/dom/Notation.h b/WebCore/dom/Notation.h
index 2bd5363..547c9e7 100644
--- a/WebCore/dom/Notation.h
+++ b/WebCore/dom/Notation.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,26 +22,25 @@
 #ifndef Notation_h
 #define Notation_h
 
-#include "CachedResourceClient.h"
 #include "ContainerNode.h"
 
 namespace WebCore {
 
+// FIXME: This class is never instantiated. Maybe it should be removed.
+
 class Notation : public ContainerNode {
 public:
-    Notation(Document*);
-    Notation(Document*, const String& name, const String& publicId, const String& systemId);
+    const String& publicId() const { return m_publicId; }
+    const String& systemId() const { return m_systemId; }
 
-    // DOM methods & attributes for Notation
-    String publicId() const { return m_publicId; }
-    String systemId() const { return m_systemId; }
+private:
+    Notation(Document*, const String& name, const String& publicId, const String& systemId);
 
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual bool childTypeAllowed(NodeType);
 
-private:
     String m_name;
     String m_publicId;
     String m_systemId;
diff --git a/WebCore/dom/PageTransitionEvent.cpp b/WebCore/dom/PageTransitionEvent.cpp
new file mode 100644
index 0000000..f9c487d
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "PageTransitionEvent.h"
+
+#include "EventNames.h"
+
+namespace WebCore {
+        
+PageTransitionEvent::PageTransitionEvent()
+    : m_persisted(false)
+{
+}
+
+PageTransitionEvent::PageTransitionEvent(const AtomicString& type, bool persisted)
+    : Event(type, true, true)
+    , m_persisted(persisted)
+{
+}
+
+PageTransitionEvent::~PageTransitionEvent()
+{
+}
+
+void PageTransitionEvent::initPageTransitionEvent(const AtomicString& type, 
+                                            bool canBubbleArg,
+                                            bool cancelableArg,
+                                            bool persisted)
+{
+    if (dispatched())
+        return;
+    
+    initEvent(type, canBubbleArg, cancelableArg);
+    
+    m_persisted = persisted;
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/PageTransitionEvent.h b/WebCore/dom/PageTransitionEvent.h
new file mode 100644
index 0000000..33c5a0c
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PageTransitionEvent_h
+#define PageTransitionEvent_h
+
+#include "Event.h"
+
+namespace WebCore {
+
+    class PageTransitionEvent : public Event {
+    public:
+        static PassRefPtr<PageTransitionEvent> create()
+        {
+            return adoptRef(new PageTransitionEvent);
+        }
+        static PassRefPtr<PageTransitionEvent> create(const AtomicString& type, bool persisted)
+        {
+            return adoptRef(new PageTransitionEvent(type, persisted));
+        }
+
+        virtual ~PageTransitionEvent();
+
+        void initPageTransitionEvent(const AtomicString& type, 
+                                bool canBubbleArg,
+                                bool cancelableArg,
+                                bool persisted);
+
+        virtual bool isPageTransitionEvent() const { return true; }
+
+        bool persisted() const { return m_persisted; }
+
+    private:
+        PageTransitionEvent();
+        PageTransitionEvent(const AtomicString& type, bool persisted);
+
+        bool m_persisted;
+    };
+
+} // namespace WebCore
+
+#endif // PageTransitionEvent_h
diff --git a/WebCore/dom/PageTransitionEvent.idl b/WebCore/dom/PageTransitionEvent.idl
new file mode 100644
index 0000000..a09f94b
--- /dev/null
+++ b/WebCore/dom/PageTransitionEvent.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module events {
+
+    interface [
+        GenerateConstructor
+    ] PageTransitionEvent : Event {
+
+        readonly attribute boolean persisted;
+
+        void initPageTransitionEvent(in DOMString typeArg, in boolean canBubbleArg, in boolean cancelableArg, in boolean persisted);
+    };
+
+}
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 3b4c3e8..060b28c 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -138,10 +138,7 @@ int Position::computeOffsetInContainerNode() const
 
     switch (anchorType()) {
     case PositionIsOffsetInAnchor:
-    {
-        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
-        return std::min(maximumValidOffset, m_offset);
-    }
+        return std::min(lastOffsetInNode(m_anchorNode.get()), m_offset);
     case PositionIsBeforeAnchor:
         return m_anchorNode->nodeIndex();
     case PositionIsAfterAnchor:
@@ -1115,28 +1112,7 @@ void Position::showTreeForThis() const
 
 #endif
 
-Position startPosition(const Range* r)
-{
-    return r ? r->startPosition() : Position();
-}
-
-Position endPosition(const Range* r)
-{
-    return r ? r->endPosition() : Position();
-}
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, 0);
-}
-
-Position lastDeepEditingPositionForNode(Node* node)
-{
-    return Position(node, lastOffsetForEditing(node));
-}
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/Position.h b/WebCore/dom/Position.h
index b434ec9..c08872d 100644
--- a/WebCore/dom/Position.h
+++ b/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include "Node.h" // for position creation functions
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -188,14 +189,53 @@ inline bool operator!=(const Position& a, const Position& b)
     return !(a == b);
 }
 
-Position startPosition(const Range*);
-Position endPosition(const Range*);
+// We define position creation functions to make callsites more readable.
+// These are inline to prevent ref-churn when returning a Position object.
+// If we ever add a PassPosition we can make these non-inline.
 
-// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
-// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
-// as "the last position before the img"
-Position firstDeepEditingPositionForNode(Node*);
-Position lastDeepEditingPositionForNode(Node*);
+inline Position positionInParentBeforeNode(const Node* node)
+{
+    // FIXME: This should ASSERT(node->parentNode())
+    // At least one caller currently hits this ASSERT though, which indicates
+    // that the caller is trying to make a position relative to a disconnected node (which is likely an error)
+    // Specifically, editing/deleting/delete-ligature-001.html crashes with ASSERT(node->parentNode())
+    return Position(node->parentNode(), node->nodeIndex(), Position::PositionIsOffsetInAnchor);
+}
+
+inline Position positionInParentAfterNode(const Node* node)
+{
+    ASSERT(node->parentNode());
+    return Position(node->parentNode(), node->nodeIndex() + 1, Position::PositionIsOffsetInAnchor);
+}
+
+// positionBeforeNode and positionAfterNode return neighbor-anchored positions, construction is O(1)
+inline Position positionBeforeNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsBeforeAnchor);
+}
+
+inline Position positionAfterNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, Position::PositionIsAfterAnchor);
+}
+
+inline int lastOffsetInNode(Node* node)
+{
+    return node->offsetInCharacters() ? node->maxCharacterOffset() : node->childNodeCount();
+}
+
+// firstPositionInNode and lastPositionInNode return parent-anchored positions, lastPositionInNode construction is O(n) due to childNodeCount()
+inline Position firstPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, 0, Position::PositionIsOffsetInAnchor);
+}
+
+inline Position lastPositionInNode(Node* anchorNode)
+{
+    return Position(anchorNode, lastOffsetInNode(anchorNode), Position::PositionIsOffsetInAnchor);
+}
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/PositionCreationFunctions.h b/WebCore/dom/PositionCreationFunctions.h
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/WebCore/dom/PositionCreationFunctions.h
diff --git a/WebCore/dom/PositionIterator.cpp b/WebCore/dom/PositionIterator.cpp
index a029b5e..8d881ba 100644
--- a/WebCore/dom/PositionIterator.cpp
+++ b/WebCore/dom/PositionIterator.cpp
@@ -38,7 +38,7 @@ PositionIterator::operator Position() const
 {
     if (m_nodeAfterPositionInAnchor) {
         ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
-        return positionBeforeNode(m_nodeAfterPositionInAnchor);
+        return positionInParentBeforeNode(m_nodeAfterPositionInAnchor);
     }
     if (m_anchorNode->hasChildNodes())
         return lastDeepEditingPositionForNode(m_anchorNode);
diff --git a/WebCore/dom/ProcessingInstruction.cpp b/WebCore/dom/ProcessingInstruction.cpp
index 806bf92..72993dd 100644
--- a/WebCore/dom/ProcessingInstruction.cpp
+++ b/WebCore/dom/ProcessingInstruction.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,8 +35,10 @@
 
 namespace WebCore {
 
-ProcessingInstruction::ProcessingInstruction(Document* doc)
-    : ContainerNode(doc)
+inline ProcessingInstruction::ProcessingInstruction(Document* document, const String& target, const String& data)
+    : ContainerNode(document)
+    , m_target(target)
+    , m_data(data)
     , m_cachedSheet(0)
     , m_loading(false)
     , m_alternate(false)
@@ -46,17 +48,9 @@ ProcessingInstruction::ProcessingInstruction(Document* doc)
 {
 }
 
-ProcessingInstruction::ProcessingInstruction(Document* doc, const String& target, const String& data)
-    : ContainerNode(doc)
-    , m_target(target)
-    , m_data(data)
-    , m_cachedSheet(0)
-    , m_loading(false)
-    , m_alternate(false)
-#if ENABLE(XSLT)
-    , m_isXSL(false)
-#endif
+PassRefPtr<ProcessingInstruction> ProcessingInstruction::create(Document* document, const String& target, const String& data)
 {
+    return adoptRef(new ProcessingInstruction(document, target, data));
 }
 
 ProcessingInstruction::~ProcessingInstruction()
@@ -70,6 +64,7 @@ void ProcessingInstruction::setData(const String& data, ExceptionCode&)
     int oldLength = m_data.length();
     m_data = data;
     document()->textRemoved(this, 0, oldLength);
+    checkStyleSheet();
 }
 
 String ProcessingInstruction::nodeName() const
@@ -95,8 +90,9 @@ void ProcessingInstruction::setNodeValue(const String& nodeValue, ExceptionCode&
 
 PassRefPtr<Node> ProcessingInstruction::cloneNode(bool /*deep*/)
 {
-    // ### copy m_localHref
-    return new ProcessingInstruction(document(), m_target, m_data);
+    // FIXME: Is it a problem that this does not copy m_localHref?
+    // What about other data members?
+    return create(document(), m_target, m_data);
 }
 
 // DOM Section 1.1.1
@@ -147,13 +143,21 @@ void ProcessingInstruction::checkStyleSheet()
             }
 #endif
         } else {
+            if (m_cachedSheet) {
+                m_cachedSheet->removeClient(this);
+                m_cachedSheet = 0;
+            }
+            
+            String url = document()->completeURL(href).string();
+            if (!dispatchBeforeLoadEvent(url))
+                return;
+            
             m_loading = true;
             document()->addPendingSheet();
-            if (m_cachedSheet)
-                m_cachedSheet->removeClient(this);
+            
 #if ENABLE(XSLT)
             if (m_isXSL)
-                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(document()->completeURL(href).string());
+                m_cachedSheet = document()->docLoader()->requestXSLStyleSheet(url);
             else
 #endif
             {
@@ -161,10 +165,15 @@ void ProcessingInstruction::checkStyleSheet()
                 if (charset.isEmpty())
                     charset = document()->frame()->loader()->encoding();
 
-                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(document()->completeURL(href).string(), charset);
+                m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(url, charset);
             }
             if (m_cachedSheet)
                 m_cachedSheet->addClient(this);
+            else {
+                // The request may have been denied if (for example) the stylesheet is local and the document is remote.
+                m_loading = false;
+                document()->removePendingSheet();
+            }
         }
     }
 }
diff --git a/WebCore/dom/ProcessingInstruction.h b/WebCore/dom/ProcessingInstruction.h
index d133019..4b7dc86 100644
--- a/WebCore/dom/ProcessingInstruction.h
+++ b/WebCore/dom/ProcessingInstruction.h
@@ -1,8 +1,6 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 2000 Peter Kelly (pmk@post.com)
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,15 +33,28 @@ class CSSStyleSheet;
 
 class ProcessingInstruction : public ContainerNode, private CachedResourceClient {
 public:
-    ProcessingInstruction(Document*);
-    ProcessingInstruction(Document*, const String& target, const String& data);
+    static PassRefPtr<ProcessingInstruction> create(Document*, const String& target, const String& data);
     virtual ~ProcessingInstruction();
 
-    // DOM methods & attributes for Notation
-    String target() const { return m_target; }
-    String data() const { return m_data; }
+    const String& target() const { return m_target; }
+    const String& data() const { return m_data; }
     void setData(const String&, ExceptionCode&);
 
+    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
+
+    virtual void finishParsingChildren();
+
+    const String& localHref() const { return m_localHref; }
+    StyleSheet* sheet() const { return m_sheet.get(); }
+    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
+#if ENABLE(XSLT)
+    bool isXSL() const { return m_isXSL; }
+#endif
+
+private:
+    ProcessingInstruction(Document*, const String& target, const String& data);
+
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual String nodeValue() const;
@@ -55,28 +66,18 @@ public:
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
-    void setCreatedByParser(bool createdByParser) { m_createdByParser = createdByParser; }
-    virtual void finishParsingChildren();
 
-    // Other methods (not part of DOM)
-    String localHref() const { return m_localHref; }
-    StyleSheet* sheet() const { return m_sheet.get(); }
     void checkStyleSheet();
     virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
 #if ENABLE(XSLT)
     virtual void setXSLStyleSheet(const String& url, const String& sheet);
 #endif
-    void setCSSStyleSheet(PassRefPtr<CSSStyleSheet>);
+
     bool isLoading() const;
     virtual bool sheetLoaded();
 
-#if ENABLE(XSLT)
-    bool isXSL() const { return m_isXSL; }
-#endif
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void parseStyleSheet(const String& sheet);
 
     String m_target;
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index edee305..122130d 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,13 +26,17 @@
 #include "RangeException.h"
 
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "DocumentFragment.h"
+#include "FrameView.h"
 #include "HTMLElement.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
+#include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -586,7 +590,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
 
     RefPtr<DocumentFragment> fragment;
     if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
-        fragment = new DocumentFragment(m_ownerDocument.get());
+        fragment = DocumentFragment::create(m_ownerDocument.get());
     
     ec = 0;
     if (collapsed(ec))
@@ -1798,4 +1802,111 @@ void Range::textNodeSplit(Text* oldNode)
     boundaryTextNodesSplit(m_end, oldNode);
 }
 
+void Range::expand(const String& unit, ExceptionCode& ec)
+{
+    VisiblePosition start(startPosition());
+    VisiblePosition end(endPosition());
+    if (unit == "word") {
+        start = startOfWord(start);
+        end = endOfWord(end);
+    } else if (unit == "sentence") {
+        start = startOfSentence(start);
+        end = endOfSentence(end);
+    } else if (unit == "block") {
+        start = startOfParagraph(start);
+        end = endOfParagraph(end);
+    } else if (unit == "document") {
+        start = startOfDocument(start);
+        end = endOfDocument(end);
+    } else
+        return;
+    setStart(start.deepEquivalent().containerNode(), start.deepEquivalent().computeOffsetInContainerNode(), ec);
+    setEnd(end.deepEquivalent().containerNode(), end.deepEquivalent().computeOffsetInContainerNode(), ec);
+}
+
+PassRefPtr<ClientRectList> Range::getClientRects() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Range::getBoundingClientRect() const
+{
+    if (!m_start.container())
+        return 0;
+
+    m_ownerDocument->updateLayoutIgnorePendingStylesheets();
+
+    Vector<FloatQuad> quads;
+    getBorderAndTextQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result;
+    for (size_t i = 0; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    return ClientRect::create(result);
 }
+
+static void adjustFloatQuadsForScrollAndAbsoluteZoom(Vector<FloatQuad>& quads, Document* document, RenderObject* renderer)
+{
+    FrameView* view = document->view();
+    if (!view)
+        return;
+
+    IntRect visibleContentRect = view->visibleContentRect();
+    for (size_t i = 0; i < quads.size(); ++i) {
+        quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+        adjustFloatQuadForAbsoluteZoom(quads[i], renderer);
+    }
+}
+
+void Range::getBorderAndTextQuads(Vector<FloatQuad>& quads) const
+{
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
+    Node* stopNode = pastLastNode();
+
+    HashSet<Node*> nodeSet;
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode())
+            nodeSet.add(node);
+    }
+
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        if (node->isElementNode()) {
+            if (!nodeSet.contains(node->parentNode())) {
+                if (RenderBoxModelObject* renderBoxModelObject = static_cast<Element*>(node)->renderBoxModelObject()) {
+                    Vector<FloatQuad> elementQuads;
+                    renderBoxModelObject->absoluteQuads(elementQuads);
+                    adjustFloatQuadsForScrollAndAbsoluteZoom(elementQuads, m_ownerDocument.get(), renderBoxModelObject);
+
+                    quads.append(elementQuads);
+                }
+            }
+        } else if (node->isTextNode()) {
+            if (RenderObject* renderer = static_cast<Text*>(node)->renderer()) {
+                RenderText* renderText = toRenderText(renderer);
+                int startOffset = (node == startContainer) ? m_start.offset() : 0;
+                int endOffset = (node == endContainer) ? m_end.offset() : INT_MAX;
+                
+                Vector<FloatQuad> textQuads;
+                renderText->absoluteQuadsForRange(textQuads, startOffset, endOffset);
+                adjustFloatQuadsForScrollAndAbsoluteZoom(textQuads, m_ownerDocument.get(), renderText);
+
+                quads.append(textQuads);
+            }
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/Range.h b/WebCore/dom/Range.h
index 1487a7c..e2e282b 100644
--- a/WebCore/dom/Range.h
+++ b/WebCore/dom/Range.h
@@ -3,7 +3,7 @@
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,12 +25,15 @@
 #ifndef Range_h
 #define Range_h
 
+#include "FloatQuad.h"
 #include "RangeBoundaryPoint.h"
+#include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
+class ClientRect;
+class ClientRectList;
 class DocumentFragment;
 class NodeWithIndex;
 class Text;
@@ -112,6 +115,14 @@ public:
     void textNodesMerged(NodeWithIndex& oldNode, unsigned offset);
     void textNodeSplit(Text* oldNode);
 
+    // Expand range to a unit (word or sentence or block or document) boundary.
+    // Please refer to https://bugs.webkit.org/show_bug.cgi?id=27632 comment #5 
+    // for details.
+    void expand(const String&, ExceptionCode&);
+
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
+
 #ifndef NDEBUG
     void formatForDebugger(char* buffer, unsigned length) const;
 #endif
@@ -130,6 +141,8 @@ private:
     enum ActionType { DELETE_CONTENTS, EXTRACT_CONTENTS, CLONE_CONTENTS };
     PassRefPtr<DocumentFragment> processContents(ActionType, ExceptionCode&);
 
+    void getBorderAndTextQuads(Vector<FloatQuad>&) const;
+
     RefPtr<Document> m_ownerDocument;
     RangeBoundaryPoint m_start;
     RangeBoundaryPoint m_end;
diff --git a/WebCore/dom/Range.idl b/WebCore/dom/Range.idl
index 0750c32..9024e09 100644
--- a/WebCore/dom/Range.idl
+++ b/WebCore/dom/Range.idl
@@ -85,6 +85,13 @@ module ranges {
         void detach()
             raises(DOMException);
 
+#if defined(LANGUAGE_JAVASCRIPT) || LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API extensions
+
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
         // extensions
 
         DocumentFragment createContextualFragment(in DOMString html)
@@ -112,6 +119,9 @@ module ranges {
                                in long offset)
             raises(RangeException, DOMException);
 
+        void expand(in DOMString unit)
+            raises(RangeException, DOMException);
+
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
diff --git a/WebCore/dom/RegisteredEventListener.cpp b/WebCore/dom/RegisteredEventListener.cpp
index f257e56..e8bc594 100644
--- a/WebCore/dom/RegisteredEventListener.cpp
+++ b/WebCore/dom/RegisteredEventListener.cpp
@@ -27,12 +27,4 @@
 
 namespace WebCore {
 
-RegisteredEventListener::RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-    : m_eventType(eventType)
-    , m_listener(listener)
-    , m_useCapture(useCapture)
-    , m_removed(false)
-{
-}
-
 } // namespace WebCore
diff --git a/WebCore/dom/RegisteredEventListener.h b/WebCore/dom/RegisteredEventListener.h
index 034f6c3..c34a341 100644
--- a/WebCore/dom/RegisteredEventListener.h
+++ b/WebCore/dom/RegisteredEventListener.h
@@ -29,47 +29,22 @@
 
 namespace WebCore {
 
-    class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
+    class RegisteredEventListener {
     public:
-        static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+        RegisteredEventListener(PassRefPtr<EventListener> listener, bool useCapture)
+            : listener(listener)
+            , useCapture(useCapture)
         {
-            return adoptRef(new RegisteredEventListener(eventType, listener, useCapture));
         }
 
-        const AtomicString& eventType() const { return m_eventType; }
-        EventListener* listener() const { return m_listener.get(); }
-        bool useCapture() const { return m_useCapture; }
-        
-        bool removed() const { return m_removed; }
-        void setRemoved(bool removed) { m_removed = removed; }
-    
-    private:
-        RegisteredEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-
-        AtomicString m_eventType;
-        RefPtr<EventListener> m_listener;
-        bool m_useCapture;
-        bool m_removed;
+        RefPtr<EventListener> listener;
+        bool useCapture;
     };
-
-    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
-#if USE(JSC)
-    inline void markEventListeners(JSC::MarkStack& markStack, const RegisteredEventListenerVector& listeners)
-    {
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->listener()->markJSFunction(markStack);
-    }
-
-    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    
+    inline bool operator==(const RegisteredEventListener& a, const RegisteredEventListener& b)
     {
-        // For efficiency's sake, we just set the "removed" bit, instead of
-        // actually removing the event listener. The node that owns these
-        // listeners is about to be deleted, anyway.
-        for (size_t i = 0; i < listeners.size(); ++i)
-            listeners[i]->setRemoved(true);
+        return *a.listener == *b.listener && a.useCapture == b.useCapture;
     }
-#endif
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/ScriptElement.cpp b/WebCore/dom/ScriptElement.cpp
index fe38b46..827aff3 100644
--- a/WebCore/dom/ScriptElement.cpp
+++ b/WebCore/dom/ScriptElement.cpp
@@ -151,6 +151,9 @@ void ScriptElementData::requestScript(const String& sourceUrl)
     if (!document->frame())
         return;
 
+    if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
+        return;
+
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
     m_requested = true;
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index 3f8febc..bb78b6f 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -44,7 +44,9 @@ namespace WebCore {
     class String;
 
     enum MessageDestination {
+#if ENABLE(INSPECTOR)
         InspectorControllerDestination,
+#endif
         ConsoleDestination,
     };
 
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index 1eb001e..49713ba 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -48,11 +48,11 @@
 #endif
 
 // Configure platform-specific behavior when focused pop-up receives arrow/space/return keystroke.
-// (PLATFORM(MAC) is always false in Chromium, hence the extra test.)
+// (PLATFORM(MAC) and PLATFORM(GTK) are always false in Chromium, hence the extra tests.)
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #define ARROW_KEYS_POP_MENU 1
 #define SPACE_OR_RETURN_POP_MENU 0
-#elif PLATFORM(GTK)
+#elif PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(LINUX))
 #define ARROW_KEYS_POP_MENU 0
 #define SPACE_OR_RETURN_POP_MENU 1
 #else
@@ -644,14 +644,16 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         element->focus();
-        if (RenderMenuList* menuList = toRenderMenuList(element->renderer())) {
-            if (menuList->popupIsVisible())
-                menuList->hidePopup();
-            else {
-                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-                saveLastSelection(data, element);
-                menuList->showPopup();
+        if (element->renderer() && element->renderer()->isMenuList()) {
+            if (RenderMenuList* menuList = toRenderMenuList(element->renderer())) {
+                if (menuList->popupIsVisible())
+                    menuList->hidePopup();
+                else {
+                    // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                    // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                    saveLastSelection(data, element);
+                    menuList->showPopup();
+                }
             }
         }
         event->setDefaultHandled();
@@ -676,7 +678,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             data.setActiveSelectionState(true);
             
             bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
             multiSelectKeyPressed = mouseEvent->metaKey();
 #else
             multiSelectKeyPressed = mouseEvent->ctrlKey();
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index 456cc52..5212380 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -101,11 +101,6 @@ void StyledElement::removeMappedAttributeDecl(MappedAttributeEntry entryType, co
     mappedAttributeDecls->remove(MappedAttributeKey(entryType, attrName.localName().impl(), attrValue.impl()));
 }
 
-void StyledElement::invalidateStyleAttribute()
-{
-    m_isStyleAttributeValid = false;
-}
-
 void StyledElement::updateStyleAttribute() const
 {
     ASSERT(!m_isStyleAttributeValid);
@@ -116,8 +111,8 @@ void StyledElement::updateStyleAttribute() const
     m_synchronizingStyleAttribute = false;
 }
 
-StyledElement::StyledElement(const QualifiedName& name, Document *doc)
-    : Element(name, doc)
+StyledElement::StyledElement(const QualifiedName& name, Document* document, ConstructionType type)
+    : Element(name, document, type)
 {
 }
 
@@ -280,14 +275,6 @@ CSSStyleDeclaration* StyledElement::style()
     return getInlineStyleDecl();
 }
 
-static inline int toHex(UChar c)
-{
-    return ((c >= '0' && c <= '9') ? (c - '0')
-        : ((c >= 'a' && c <= 'f') ? (c - 'a' + 10)
-        : ((c >= 'A' && c <= 'F') ? (c - 'A' + 10)
-        : -1)));
-}
-
 void StyledElement::addCSSProperty(MappedAttribute* attr, int id, const String &value)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -300,12 +287,6 @@ void StyledElement::addCSSProperty(MappedAttribute* attr, int id, int value)
     attr->decl()->setProperty(id, value, false);
 }
 
-void StyledElement::addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes type)
-{
-    if (!attr->decl()) createMappedDecl(attr);
-    attr->decl()->setStringProperty(id, value, type, false);
-}
-
 void StyledElement::addCSSImageProperty(MappedAttribute* attr, int id, const String& url)
 {
     if (!attr->decl()) createMappedDecl(attr);
@@ -393,10 +374,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
                 // search forward for digits in the string
                 int numDigits = 0;
                 while (pos < (int)color.length() && numDigits < basicLength) {
-                    int hex = toHex(color[pos]);
-                    colors[component] = (colors[component] << 4);
-                    if (hex > 0) {
-                        colors[component] += hex;
+                    colors[component] <<= 4;
+                    if (isASCIIHexDigit(color[pos])) {
+                        colors[component] += toASCIIHexValue(color[pos]);
                         maxDigit = min(maxDigit, numDigits);
                     }
                     numDigits++;
@@ -410,10 +390,9 @@ void StyledElement::addCSSColor(MappedAttribute* attr, int id, const String& c)
             
             // normalize to 00-ff. The highest filled digit counts, minimum is 2 digits
             maxDigit -= 2;
-            colors[0] >>= 4*maxDigit;
-            colors[1] >>= 4*maxDigit;
-            colors[2] >>= 4*maxDigit;
-            // ASSERT(colors[0] < 0x100 && colors[1] < 0x100 && colors[2] < 0x100);
+            colors[0] >>= 4 * maxDigit;
+            colors[1] >>= 4 * maxDigit;
+            colors[2] >>= 4 * maxDigit;
             
             color = String::format("#%02x%02x%02x", colors[0], colors[1], colors[2]);
             if (attr->decl()->setProperty(id, color, false))
diff --git a/WebCore/dom/StyledElement.h b/WebCore/dom/StyledElement.h
index 158992e..85fa7a7 100644
--- a/WebCore/dom/StyledElement.h
+++ b/WebCore/dom/StyledElement.h
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -38,54 +38,49 @@ class MappedAttribute;
 
 class StyledElement : public Element {
 public:
-    StyledElement(const QualifiedName&, Document*);
     virtual ~StyledElement();
 
-    virtual bool isStyledElement() const { return true; }
-
     NamedMappedAttrMap* mappedAttributes() { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
     const NamedMappedAttrMap* mappedAttributes() const { return static_cast<NamedMappedAttrMap*>(namedAttrMap.get()); }
+
     bool hasMappedAttributes() const { return namedAttrMap && mappedAttributes()->hasMappedAttributes(); }
     bool isMappedAttribute(const QualifiedName& name) const { MappedAttributeEntry res = eNone; mapToEntry(name, res); return res != eNone; }
 
-    void addCSSLength(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, const String &value);
-    void addCSSProperty(MappedAttribute* attr, int id, int value);
-    void addCSSStringProperty(MappedAttribute* attr, int id, const String &value, CSSPrimitiveValue::UnitTypes = CSSPrimitiveValue::CSS_STRING);
+    void addCSSLength(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, const String& value);
+    void addCSSProperty(MappedAttribute*, int id, int value);
     void addCSSImageProperty(MappedAttribute*, int propertyID, const String& url);
-    void addCSSColor(MappedAttribute* attr, int id, const String &c);
-    void createMappedDecl(MappedAttribute* attr);
-    
-    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    void addCSSColor(MappedAttribute*, int id, const String& color);
+
+    static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
     static void setMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value, CSSMappedAttributeDeclaration*);
-    static void removeMappedAttributeDecl(MappedAttributeEntry type, const QualifiedName& name, const AtomicString& value);
+    static void removeMappedAttributeDecl(MappedAttributeEntry, const QualifiedName& name, const AtomicString& value);
 
     static CSSMappedAttributeDeclaration* getMappedAttributeDecl(MappedAttributeEntry, Attribute*);
     static void setMappedAttributeDecl(MappedAttributeEntry, Attribute*, CSSMappedAttributeDeclaration*);
-    
+
     CSSMutableStyleDeclaration* inlineStyleDecl() const { return m_inlineStyleDecl.get(); }
     virtual bool canHaveAdditionalAttributeStyleDecls() const { return false; }
     virtual void additionalAttributeStyleDecls(Vector<CSSMutableStyleDeclaration*>&) {};
     CSSMutableStyleDeclaration* getInlineStyleDecl();
     CSSStyleDeclaration* style();
-    void createInlineStyleDecl();
-    void destroyInlineStyleDecl();
     void invalidateStyleAttribute();
-    virtual void updateStyleAttribute() const;
-    
+
     const ClassNames& classNames() const { ASSERT(hasClass()); ASSERT(mappedAttributes()); return mappedAttributes()->classNames(); }
 
-    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
-    virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void createAttributeMap() const;
+
     virtual PassRefPtr<Attribute> createAttribute(const QualifiedName&, const AtomicString& value);
 
+protected:
+    StyledElement(const QualifiedName&, Document*, ConstructionType);
+
+    virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+    virtual void parseMappedAttribute(MappedAttribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-protected:
     // classAttributeChanged() exists to share code between
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
@@ -93,9 +88,25 @@ protected:
     
     virtual void didMoveToNewOwnerDocument();
 
+private:
+    virtual bool isStyledElement() const { return true; }
+
+    void createMappedDecl(MappedAttribute*);
+
+    void createInlineStyleDecl();
+    void destroyInlineStyleDecl();
+    virtual void updateStyleAttribute() const;
+
+    virtual void createAttributeMap() const;
+
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
 
+inline void StyledElement::invalidateStyleAttribute()
+{
+    m_isStyleAttributeValid = false;
+}
+
 } //namespace
 
 #endif
diff --git a/WebCore/dom/Text.cpp b/WebCore/dom/Text.cpp
index bbd926b..1ce074a 100644
--- a/WebCore/dom/Text.cpp
+++ b/WebCore/dom/Text.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,22 +37,18 @@
 #include "WMLVariables.h"
 #endif
 
-namespace WebCore {
-
-// DOM Section 1.1.1
+using namespace std;
 
-Text::Text(Document* document, const String& text)
-    : CharacterData(document, text, true)
-{
-}
+namespace WebCore {
 
-Text::Text(Document* document)
-    : CharacterData(document, true)
+Text::Text(Document* document, const String& data)
+    : CharacterData(document, data, CreateText)
 {
 }
 
-Text::~Text()
+PassRefPtr<Text> Text::create(Document* document, const String& data)
 {
+    return adoptRef(new Text(document, data));
 }
 
 PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
@@ -61,14 +57,14 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
 
     // INDEX_SIZE_ERR: Raised if the specified offset is negative or greater than
     // the number of 16-bit units in data.
-    if (offset > m_data->length()) {
+    if (offset > length()) {
         ec = INDEX_SIZE_ERR;
         return 0;
     }
 
-    RefPtr<StringImpl> oldStr = m_data;
-    RefPtr<Text> newText = createNew(oldStr->substring(offset));
-    m_data = oldStr->substring(0, offset);
+    RefPtr<StringImpl> oldStr = dataImpl();
+    RefPtr<Text> newText = virtualCreate(oldStr->substring(offset));
+    setDataImpl(oldStr->substring(0, offset));
 
     dispatchModifiedEvent(oldStr.get());
 
@@ -81,7 +77,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        toRenderText(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(dataImpl());
 
     return newText.release();
 }
@@ -199,7 +195,7 @@ Node::NodeType Text::nodeType() const
 
 PassRefPtr<Node> Text::cloneNode(bool /*deep*/)
 {
-    return document()->createTextNode(m_data);
+    return create(document(), data());
 }
 
 bool Text::rendererIsNeeded(RenderStyle *style)
@@ -244,7 +240,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     return true;
 }
 
-RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
+RenderObject* Text::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(SVG)
     if (parentNode()->isSVGElement()
@@ -252,17 +248,17 @@ RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
         && !parentNode()->hasTagName(SVGNames::foreignObjectTag)
 #endif
     )
-        return new (arena) RenderSVGInlineText(this, m_data);
+        return new (arena) RenderSVGInlineText(this, dataImpl());
 #endif
     
-    return new (arena) RenderText(this, m_data);
+    return new (arena) RenderText(this, dataImpl());
 }
 
 void Text::attach()
 {
 #if ENABLE(WML)
     if (document()->isWMLDocument() && !containsOnlyWhitespace()) {
-        String text = m_data;
+        String text = data();
         ASSERT(!text.isEmpty());
 
         text = substituteVariableReferences(text, document());
@@ -286,7 +282,7 @@ void Text::recalcStyle(StyleChange change)
     if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
-                toRenderText(renderer())->setText(m_data);
+                toRenderText(renderer())->setText(dataImpl());
         } else {
             if (attached())
                 detach();
@@ -296,40 +292,47 @@ void Text::recalcStyle(StyleChange change)
     setNeedsStyleRecalc(NoStyleChange);
 }
 
-// DOM Section 1.1.1
 bool Text::childTypeAllowed(NodeType)
 {
     return false;
 }
 
-PassRefPtr<Text> Text::createNew(PassRefPtr<StringImpl> string)
+PassRefPtr<Text> Text::virtualCreate(const String& data)
 {
-    return new Text(document(), string);
+    return create(document(), data);
 }
 
-PassRefPtr<Text> Text::createWithLengthLimit(Document* doc, const String& text, unsigned& charsLeft, unsigned maxChars)
+PassRefPtr<Text> Text::createWithLengthLimit(Document* document, const String& data, unsigned& charsLeft, unsigned maxChars)
 {
-    if (charsLeft == text.length() && charsLeft <= maxChars) {
+    unsigned dataLength = data.length();
+
+    if (charsLeft == dataLength && charsLeft <= maxChars) {
         charsLeft = 0;
-        return new Text(doc, text);
+        return create(document, data);
     }
+
+    unsigned start = dataLength - charsLeft;
+    unsigned end = start + min(charsLeft, maxChars);
     
-    unsigned start = text.length() - charsLeft;
-    unsigned end = start + std::min(charsLeft, maxChars);
+    // Check we are not on an unbreakable boundary.
+    // Some text break iterator implementations work best if the passed buffer is as small as possible, 
+    // see <https://bugs.webkit.org/show_bug.cgi?id=29092>. 
+    // We need at least two characters look-ahead to account for UTF-16 surrogates.
+    if (end < dataLength) {
+        TextBreakIterator* it = characterBreakIterator(data.characters() + start, (end + 2 > dataLength) ? dataLength - start : end - start + 2);
+        if (!isTextBreak(it, end - start))
+            end = textBreakPreceding(it, end - start) + start;
+    }
     
-    // check we are not on an unbreakable boundary
-    TextBreakIterator* it = characterBreakIterator(text.characters(), text.length());
-    if (end < text.length() && !isTextBreak(it, end))
-        end = textBreakPreceding(it, end);
-        
-    // maxChars of unbreakable characters could lead to infinite loop
+    // If we have maxChars of unbreakable characters the above could lead to
+    // an infinite loop.
+    // FIXME: It would be better to just have the old value of end before calling
+    // textBreakPreceding rather than this, because this exceeds the length limit.
     if (end <= start)
-        end = text.length();
+        end = dataLength;
     
-    String nodeText = text.substring(start, end - start);
-    charsLeft = text.length() - end;
-        
-    return new Text(doc, nodeText);
+    charsLeft = dataLength - end;
+    return create(document, data.substring(start, end - start));
 }
 
 #ifndef NDEBUG
@@ -343,7 +346,7 @@ void Text::formatForDebugger(char *buffer, unsigned length) const
         result += s;
     }
           
-    s = nodeValue();
+    s = data();
     if (s.length() > 0) {
         if (result.length() > 0)
             result += "; ";
diff --git a/WebCore/dom/Text.h b/WebCore/dom/Text.h
index e5a6e69..4722736 100644
--- a/WebCore/dom/Text.h
+++ b/WebCore/dom/Text.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,44 +27,39 @@
 
 namespace WebCore {
     
-const unsigned cTextNodeLengthLimit = 1 << 16;
-
 class Text : public CharacterData {
 public:
-    Text(Document *impl, const String &_text);
-    Text(Document *impl);
-    virtual ~Text();
+    static const unsigned defaultLengthLimit = 1 << 16;
 
-    // DOM methods & attributes for CharacterData
+    static PassRefPtr<Text> create(Document*, const String&);
+    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned lengthLimit = defaultLengthLimit);
 
     PassRefPtr<Text> splitText(unsigned offset, ExceptionCode&);
 
     // DOM Level 3: http://www.w3.org/TR/DOM-Level-3-Core/core.html#ID-1312295772
+
     String wholeText() const;
     PassRefPtr<Text> replaceWholeText(const String&, ExceptionCode&);
 
-    // DOM methods overridden from parent classes
+    virtual void attach();
+
+protected:
+    Text(Document*, const String&);
 
+private:
     virtual String nodeName() const;
     virtual NodeType nodeType() const;
     virtual PassRefPtr<Node> cloneNode(bool deep);
-
-    // Other methods (not part of DOM)
-
-    virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void recalcStyle(StyleChange = NoChange);
     virtual bool childTypeAllowed(NodeType);
 
-    static PassRefPtr<Text> createWithLengthLimit(Document*, const String&, unsigned& charsLeft, unsigned maxChars = cTextNodeLengthLimit);
+    virtual PassRefPtr<Text> virtualCreate(const String&);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 #endif
-
-protected:
-    virtual PassRefPtr<Text> createNew(PassRefPtr<StringImpl>);
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/TransformSource.h b/WebCore/dom/TransformSource.h
new file mode 100644
index 0000000..f97afcf
--- /dev/null
+++ b/WebCore/dom/TransformSource.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TransformSource_h
+#define TransformSource_h
+
+#if ENABLE(XSLT)
+
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+#if USE(QXMLQUERY)
+    typedef String PlatformTransformSource;
+#else
+    typedef void* PlatformTransformSource;
+#endif
+
+    class TransformSource : public Noncopyable {
+    public:
+        TransformSource(const PlatformTransformSource& source);
+        ~TransformSource();
+
+        PlatformTransformSource platformSource() const { return m_source; }
+
+    private:
+        PlatformTransformSource m_source;
+    };
+
+} // namespace WebCore
+
+#endif
+
+#endif // TransformSource_h
diff --git a/WebCore/dom/TransformSourceLibxslt.cpp b/WebCore/dom/TransformSourceLibxslt.cpp
new file mode 100644
index 0000000..33a85e8
--- /dev/null
+++ b/WebCore/dom/TransformSourceLibxslt.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TransformSource.h"
+
+#include <libxml/tree.h>
+
+namespace WebCore {
+
+TransformSource::TransformSource(const PlatformTransformSource& source)
+    : m_source(source)
+{
+}
+
+TransformSource::~TransformSource()
+{
+    xmlFreeDoc((xmlDocPtr)m_source);
+}
+
+}
diff --git a/WebCore/dom/TransformSourceQt.cpp b/WebCore/dom/TransformSourceQt.cpp
new file mode 100644
index 0000000..074f2cb
--- /dev/null
+++ b/WebCore/dom/TransformSourceQt.cpp
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "TransformSource.h"
+
+namespace WebCore {
+
+TransformSource::TransformSource(const PlatformTransformSource& source)
+    : m_source(source)
+{
+}
+
+TransformSource::~TransformSource()
+{
+}
+
+}
diff --git a/WebCore/dom/XMLTokenizer.cpp b/WebCore/dom/XMLTokenizer.cpp
index 1747c3c..4d06343 100644
--- a/WebCore/dom/XMLTokenizer.cpp
+++ b/WebCore/dom/XMLTokenizer.cpp
@@ -136,7 +136,7 @@ bool XMLTokenizer::enterText()
 #if !USE(QXMLSTREAM)
     ASSERT(m_bufferedText.size() == 0);
 #endif
-    RefPtr<Node> newNode = new Text(m_doc, "");
+    RefPtr<Node> newNode = Text::create(m_doc, "");
     if (!m_currentNode->addChild(newNode.get()))
         return false;
     setCurrentNode(newNode.get());
diff --git a/WebCore/dom/XMLTokenizerLibxml2.cpp b/WebCore/dom/XMLTokenizerLibxml2.cpp
index 4387a66..e4a98d5 100644
--- a/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -50,6 +50,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "TransformSource.h"
 #include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
@@ -850,7 +851,8 @@ void XMLTokenizer::endElementNs()
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
-            if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
+            if (element->dispatchBeforeLoadEvent(scriptHref) &&
+                (m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
                 m_pendingScript->addClient(this);
 
@@ -951,7 +953,7 @@ void XMLTokenizer::cdataBlock(const xmlChar* s, int len)
     
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, toString(s, len));
+    RefPtr<Node> newNode = CDATASection::create(m_doc, toString(s, len));
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -970,7 +972,7 @@ void XMLTokenizer::comment(const xmlChar* s)
     
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, toString(s));
+    RefPtr<Node> newNode = Comment::create(m_doc, toString(s));
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
@@ -1280,7 +1282,8 @@ void XMLTokenizer::doEnd()
 {
 #if ENABLE(XSLT)
     if (m_sawXSLTransform) {
-        m_doc->setTransformSource(xmlDocPtrForString(m_doc->docLoader(), m_originalSourceForTransform, m_doc->url().string()));
+        void* doc = xmlDocPtrForString(m_doc->docLoader(), m_originalSourceForTransform, m_doc->url().string());
+        m_doc->setTransformSource(new TransformSource(doc));
         
         m_doc->setParsing(false); // Make the doc think it's done, so it will apply xsl sheets.
         m_doc->updateStyleSelector();
diff --git a/WebCore/dom/XMLTokenizerQt.cpp b/WebCore/dom/XMLTokenizerQt.cpp
index 16c637f..04405d6 100644
--- a/WebCore/dom/XMLTokenizerQt.cpp
+++ b/WebCore/dom/XMLTokenizerQt.cpp
@@ -50,6 +50,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "TransformSource.h"
 #include <QDebug>
 #include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
@@ -237,7 +238,7 @@ void XMLTokenizer::doWrite(const String& parseString)
     return;
 }
 
-void XMLTokenizer::initializeParserContext(const char* chunk)
+void XMLTokenizer::initializeParserContext(const char*)
 {
     m_parserStopped = false;
     m_sawError = false;
@@ -248,45 +249,19 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
 void XMLTokenizer::doEnd()
 {
 #if ENABLE(XSLT)
-    #warning Look at XMLTokenizerLibXml.cpp
-#endif
-
-    if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError || (m_wroteText && !m_sawFirstElement)) {
-        handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(),
-                    columnNumber());
+    if (m_sawXSLTransform) {
+        m_doc->setTransformSource(new TransformSource(m_originalSourceForTransform));
+        m_doc->setParsing(false); // Make the doc think it's done, so it will apply xsl sheets.
+        m_doc->updateStyleSelector();
+        m_doc->setParsing(true);
+        m_parserStopped = true;
     }
-}
-
-#if ENABLE(XSLT)
-void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const String& url)
-{
-    if (source.isEmpty())
-        return 0;
-
-    // Parse in a single chunk into an xmlDocPtr
-    // FIXME: Hook up error handlers so that a failure to parse the main document results in
-    // good error messages.
-    const UChar BOM = 0xFEFF;
-    const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
-
-    xmlGenericErrorFunc oldErrorFunc = xmlGenericError;
-    void* oldErrorContext = xmlGenericErrorContext;
-    
-    setLoaderForLibXMLCallbacks(docLoader);        
-    xmlSetGenericErrorFunc(0, errorFunc);
-    
-    xmlDocPtr sourceDoc = xmlReadMemory(reinterpret_cast<const char*>(source.characters()),
-                                        source.length() * sizeof(UChar),
-                                        url.latin1().data(),
-                                        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
-                                        XSLT_PARSE_OPTIONS);
-    
-    setLoaderForLibXMLCallbacks(0);
-    xmlSetGenericErrorFunc(oldErrorContext, oldErrorFunc);
+#endif
     
-    return sourceDoc;
+    if (m_stream.error() == QXmlStreamReader::PrematureEndOfDocumentError
+        || (m_wroteText && !m_sawFirstElement && !m_sawXSLTransform))
+        handleError(fatal, qPrintable(m_stream.errorString()), lineNumber(), columnNumber());
 }
-#endif
 
 int XMLTokenizer::lineNumber() const
 {
@@ -683,7 +658,7 @@ void XMLTokenizer::parseProcessingInstruction()
 
 #if ENABLE(XSLT)
     m_sawXSLTransform = !m_sawFirstElement && pi->isXSL();
-    if (m_sawXSLTransform && !m_doc->transformSourceDocument()))
+    if (m_sawXSLTransform && !m_doc->transformSourceDocument())
         stopParsing();
 #endif
 }
@@ -692,7 +667,7 @@ void XMLTokenizer::parseCdata()
 {
     exitText();
 
-    RefPtr<Node> newNode = new CDATASection(m_doc, m_stream.text());
+    RefPtr<Node> newNode = CDATASection::create(m_doc, m_stream.text());
     if (!m_currentNode->addChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
@@ -703,7 +678,7 @@ void XMLTokenizer::parseComment()
 {
     exitText();
 
-    RefPtr<Node> newNode = new Comment(m_doc, m_stream.text());
+    RefPtr<Node> newNode = Comment::create(m_doc, m_stream.text());
     m_currentNode->addChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
diff --git a/WebCore/dom/make_names.pl b/WebCore/dom/make_names.pl
index e6d59a0..6b5ddb4 100755
--- a/WebCore/dom/make_names.pl
+++ b/WebCore/dom/make_names.pl
@@ -48,28 +48,30 @@ my %parameters = ();
 my $extraDefines = 0;
 my $preprocessor = "/usr/bin/gcc -E -P -x c++";
 
-GetOptions('tags=s' => \$tagsFile, 
+GetOptions(
+    'tags=s' => \$tagsFile, 
     'attrs=s' => \$attrsFile,
     'factory' => \$printFactory,
     'outputDir=s' => \$outputDir,
     'extraDefines=s' => \$extraDefines,
     'preprocessor=s' => \$preprocessor,
-    'wrapperFactory' => \$printWrapperFactory);
+    'wrapperFactory' => \$printWrapperFactory
+);
 
 die "You must specify at least one of --tags <file> or --attrs <file>" unless (length($tagsFile) || length($attrsFile));
 
 readNames($tagsFile, "tags") if length($tagsFile);
 readNames($attrsFile, "attrs") if length($attrsFile);
 
-die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{'namespace'};
-die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{'namespaceURI'};
+die "You must specify a namespace (e.g. SVG) for <namespace>Names.h" unless $parameters{namespace};
+die "You must specify a namespaceURI (e.g. http://www.w3.org/2000/svg)" unless $parameters{namespaceURI};
 
-$parameters{'namespacePrefix'} = $parameters{'namespace'} unless $parameters{'namespacePrefix'};
+$parameters{namespacePrefix} = $parameters{namespace} unless $parameters{namespacePrefix};
 
 mkpath($outputDir);
-my $namesBasePath = "$outputDir/$parameters{'namespace'}Names";
-my $factoryBasePath = "$outputDir/$parameters{'namespace'}ElementFactory";
-my $wrapperFactoryBasePath = "$outputDir/JS$parameters{'namespace'}ElementWrapperFactory";
+my $namesBasePath = "$outputDir/$parameters{namespace}Names";
+my $factoryBasePath = "$outputDir/$parameters{namespace}ElementFactory";
+my $wrapperFactoryBasePath = "$outputDir/JS$parameters{namespace}ElementWrapperFactory";
 
 printNamesHeaderFile("$namesBasePath.h");
 printNamesCppFile("$namesBasePath.cpp");
@@ -86,39 +88,44 @@ if ($printWrapperFactory) {
 
 ### Hash initialization
 
-sub initializeTagPropertyHash
+sub defaultTagPropertyHash
 {
-    return ('constructorNeedsCreatedByParser' => 0,
-            'constructorNeedsFormElement' => 0,
-            'exportString' => 0,
-            'interfaceName' => defaultInterfaceName($_[0]),
-            # By default, the JSInterfaceName is the same as the interfaceName.
-            'JSInterfaceName' => defaultInterfaceName($_[0]),
-            'mapToTagName' => '',
-            'wrapperOnlyIfMediaIsAvailable' => 0,
-            'conditional' => 0);
+    return (
+        'constructorNeedsCreatedByParser' => 0,
+        'constructorNeedsFormElement' => 0,
+        'createWithNew' => 0,
+        'exportString' => 0,
+        'interfaceName' => defaultInterfaceName($_[0]),
+        # By default, the JSInterfaceName is the same as the interfaceName.
+        'JSInterfaceName' => defaultInterfaceName($_[0]),
+        'mapToTagName' => '',
+        'wrapperOnlyIfMediaIsAvailable' => 0,
+        'conditional' => 0
+    );
 }
 
-sub initializeAttrPropertyHash
+sub defaultAttrPropertyHash
 {
     return ('exportString' => 0);
 }
 
-sub initializeParametersHash
+sub defaultParametersHash
 {
-    return ('namespace' => '',
-            'namespacePrefix' => '',
-            'namespaceURI' => '',
-            'guardFactoryWith' => '',
-            'tagsNullNamespace' => 0,
-            'attrsNullNamespace' => 0,
-            'exportStrings' => 0);
+    return (
+        'namespace' => '',
+        'namespacePrefix' => '',
+        'namespaceURI' => '',
+        'guardFactoryWith' => '',
+        'tagsNullNamespace' => 0,
+        'attrsNullNamespace' => 0,
+        'exportStrings' => 0
+    );
 }
 
 sub defaultInterfaceName
 {
-    die "No namespace found" if !$parameters{'namespace'};
-    return $parameters{'namespace'} . upperCaseName($_[0]) . "Element"
+    die "No namespace found" if !$parameters{namespace};
+    return $parameters{namespace} . upperCaseName($_[0]) . "Element"
 }
 
 ### Parsing handlers
@@ -129,16 +136,16 @@ sub tagsHandler
 
     $tag =~ s/-/_/g;
 
-    # Initialize default properties' values.
-    $tags{$tag} = { initializeTagPropertyHash($tag) } if !defined($tags{$tag});
+    # Initialize default property values.
+    $tags{$tag} = { defaultTagPropertyHash($tag) } if !defined($tags{$tag});
 
     if ($property) {
         die "Unknown property $property for tag $tag\n" if !defined($tags{$tag}{$property});
-        # The code rely on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
-        # So just override JSInterfaceName if it was not already set.
-        if ($property eq "interfaceName" && $tags{$tag}{'JSInterfaceName'} eq $tags{$tag}{'interfaceName'}) {
-                $tags{$tag}{'JSInterfaceName'} = $value;
-        }
+
+        # The code relies on JSInterfaceName deriving from interfaceName to check for custom JSInterfaceName.
+        # So override JSInterfaceName if it was not already set.
+        $tags{$tag}{JSInterfaceName} = $value if $property eq "interfaceName" && $tags{$tag}{JSInterfaceName} eq $tags{$tag}{interfaceName};
+
         $tags{$tag}{$property} = $value;
     }
 }
@@ -150,7 +157,7 @@ sub attrsHandler
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
-    $attrs{$attr} = { initializeAttrPropertyHash($attr) } if !defined($attrs{$attr});
+    $attrs{$attr} = { defaultAttrPropertyHash($attr) } if !defined($attrs{$attr});
 
     if ($property) {
         die "Unknown property $property for attribute $attr\n" if !defined($attrs{$attr}{$property});
@@ -163,7 +170,7 @@ sub parametersHandler
     my ($parameter, $value) = @_;
 
     # Initialize default properties' values.
-    %parameters = initializeParametersHash() if !(keys %parameters);
+    %parameters = defaultParametersHash() if !(keys %parameters);
 
     die "Unknown parameter $parameter for tags/attrs\n" if !defined($parameters{$parameter});
     $parameters{$parameter} = $value;
@@ -214,7 +221,7 @@ sub printMacros
     for my $name (sort keys %$namesRef) {
         print F "$macro $name","$suffix;\n";
 
-        if ($parameters{'exportStrings'} or $names{$name}{"exportString"}) { 
+        if ($parameters{exportStrings} or $names{$name}{exportString}) { 
             print F "extern char $name", "${suffix}String[];\n";
         }
     }
@@ -223,7 +230,7 @@ sub printMacros
 sub usesDefaultWrapper
 {
     my $tagName = shift;
-    return $tagName eq $parameters{'namespace'} . "Element";
+    return $tagName eq $parameters{namespace} . "Element";
 }
 
 # Build a direct mapping from the tags to the Element to create, excluding
@@ -232,16 +239,16 @@ sub buildConstructorMap
 {
     my %tagConstructorMap = ();
     for my $tagName (keys %tags) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if (usesDefaultWrapper($interfaceName));
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{'mapToTagName'}}{'mapToTagName'};
-            $interfaceName = $tags{ $tags{$tagName}{'mapToTagName'} }{'interfaceName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{mapToTagName}}{mapToTagName};
+            $interfaceName = $tags{ $tags{$tagName}{mapToTagName} }{interfaceName};
         }
 
         # Chop the string to keep the interesting part.
-        $interfaceName =~ s/$parameters{'namespace'}(.*)Element/$1/;
+        $interfaceName =~ s/$parameters{namespace}(.*)Element/$1/;
         $tagConstructorMap{$tagName} = lc($interfaceName);
     }
 
@@ -254,17 +261,13 @@ sub printConstructorSignature
 {
     my ($F, $tagName, $constructorName, $constructorTagName) = @_;
 
-    print F "static PassRefPtr<$parameters{'namespace'}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* doc";
-    if ($parameters{'namespace'} eq "HTML") {
+    print F "static PassRefPtr<$parameters{namespace}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* document";
+    if ($parameters{namespace} eq "HTML") {
         print F ", HTMLFormElement*";
-        if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-            print F " formElement";
-        }
+        print F " formElement" if $tags{$tagName}{constructorNeedsFormElement};
     }
     print F ", bool";
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F " createdByParser"; 
-    }
+    print F " createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ")\n{\n";
 }
 
@@ -276,22 +279,26 @@ sub printConstructorInterior
     my ($F, $tagName, $interfaceName, $constructorTagName) = @_;
 
     # Handle media elements.
-    if ($tags{$tagName}{'wrapperOnlyIfMediaIsAvailable'}) {
+    if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
         print F <<END
     if (!MediaPlayer::isAvailable())
-        return new HTMLElement($constructorTagName, doc);
+        return HTMLElement::create($constructorTagName, document);
 END
 ;
     }
 
-    # Now call the constructor with the right parameters.
-    print F "    return new ${interfaceName}($constructorTagName, doc";
-    if ($tags{$tagName}{'constructorNeedsFormElement'}) {
-        print F ", formElement";
-    }
-    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
-        print F ", createdByParser";
+    my $newPrefix = "";
+    my $createSuffix = "::create";
+
+    if ($tags{$tagName}{createWithNew}) {
+        $newPrefix = "new ";
+        $createSuffix = "";
     }
+
+    # Call the constructor with the right parameters.
+    print F "    return $newPrefix$interfaceName${createSuffix}($constructorTagName, document";
+    print F ", formElement" if $tags{$tagName}{constructorNeedsFormElement};
+    print F ", createdByParser" if $tags{$tagName}{constructorNeedsCreatedByParser};
     print F ");\n}\n\n";
 }
 
@@ -300,20 +307,20 @@ sub printConstructors
     my ($F, $tagConstructorMapRef) = @_;
     my %tagConstructorMap = %$tagConstructorMapRef;
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     # This is to avoid generating the same constructor several times.
     my %uniqueTags = ();
     for my $tagName (sort keys %tagConstructorMap) {
-        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        my $interfaceName = $tags{$tagName}{interfaceName};
 
         # Ignore the mapped tag
         # FIXME: It could be moved inside this loop but was split for readibility.
-        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{'mapToTagName'});
+        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{mapToTagName});
 
         $uniqueTags{$interfaceName} = '1';
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -323,20 +330,20 @@ sub printConstructors
         printConstructorInterior($F, $tagName, $interfaceName, "tagName");
 
         if ($conditional) {
-            print F "#endif\n\n";
+            print F "#endif\n";
         }
     }
 
     # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
     for my $tagName (sort keys %tagConstructorMap) {
-        if ($tags{$tagName}{'mapToTagName'}) {
-            my $mappedName = $tags{$tagName}{'mapToTagName'};
+        if ($tags{$tagName}{mapToTagName}) {
+            my $mappedName = $tags{$tagName}{mapToTagName};
             printConstructorSignature($F, $mappedName, $mappedName . "To" . $tagName, "tagName");
-            printConstructorInterior($F, $mappedName, $tags{$mappedName}{'interfaceName'}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
+            printConstructorInterior($F, $mappedName, $tags{$mappedName}{interfaceName}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
         }
     }
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 }
 
 sub printFunctionInits
@@ -346,14 +353,14 @@ sub printFunctionInits
 
     for my $tagName (sort keys %tagConstructorMap) {
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        if ($tags{$tagName}{'mapToTagName'}) {
-            print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
+        if ($tags{$tagName}{mapToTagName}) {
+            print F "    addTag(${tagName}Tag, $tags{$tagName}{mapToTagName}To${tagName}Constructor);\n";
         } else {
             print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
         }
@@ -368,9 +375,7 @@ sub svgCapitalizationHacks
 {
     my $name = shift;
 
-    if ($name =~ /^fe(.+)$/) {
-        $name = "FE" . ucfirst $1;
-    }
+    $name = "FE" . ucfirst $1 if $name =~ /^fe(.+)$/;
 
     return $name;
 }
@@ -379,7 +384,7 @@ sub upperCaseName
 {
     my $name = shift;
     
-    $name = svgCapitalizationHacks($name) if ($parameters{'namespace'} eq "SVG");
+    $name = svgCapitalizationHacks($name) if ($parameters{namespace} eq "SVG");
 
     while ($name =~ /^(.*?)_(.*)/) {
         $name = $1 . ucfirst $2;
@@ -392,10 +397,11 @@ sub printLicenseHeader
 {
     my $F = shift;
     print F "/*
- * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ * THIS FILE WAS AUTOMATICALLY GENERATED, DO NOT EDIT.
  *
+ * This file was generated by the dom/make_names.pl script.
  *
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -416,10 +422,9 @@ sub printLicenseHeader
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-
 ";
 }
 
@@ -428,16 +433,16 @@ sub printNamesHeaderFile
     my ($headerPath) = shift;
     my $F;
     open F, ">$headerPath";
-    
+
     printLicenseHeader($F);
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_H\n";
-    print F "#define DOM_$parameters{'namespace'}NAMES_H\n\n";
+    print F "#ifndef DOM_$parameters{namespace}NAMES_H\n";
+    print F "#define DOM_$parameters{namespace}NAMES_H\n\n";
     print F "#include \"QualifiedName.h\"\n\n";
-    
-    print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {\n\n";
-    
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
-    print F "#ifndef DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS\n";
+
+    print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {\n\n";
+
+    my $lowerNamespace = lc($parameters{namespacePrefix});
+    print F "#ifndef DOM_$parameters{namespace}NAMES_HIDE_GLOBALS\n";
     print F "// Namespace\n";
     print F "extern const WebCore::AtomicString ${lowerNamespace}NamespaceURI;\n\n";
 
@@ -451,19 +456,19 @@ sub printNamesHeaderFile
         printMacros($F, "extern const WebCore::QualifiedName", "Attr", \%attrs);
     }
     print F "#endif\n\n";
-    
+
     if (keys %tags) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size);\n";
     }
 
     if (keys %attrs) {
-        print F "WebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size);\n";
+        print F "WebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size);\n";
     }
-    
+
     print F "\nvoid init();\n\n";
     print F "} }\n\n";
     print F "#endif\n\n";
-    
+
     close F;
 }
 
@@ -475,25 +480,25 @@ sub printNamesCppFile
     
     printLicenseHeader($F);
     
-    my $lowerNamespace = lc($parameters{'namespacePrefix'});
+    my $lowerNamespace = lc($parameters{namespacePrefix});
 
 print F "#include \"config.h\"\n";
 
 print F "#ifdef SKIP_STATIC_CONSTRUCTORS_ON_GCC\n";
-print F "#define DOM_$parameters{'namespace'}NAMES_HIDE_GLOBALS 1\n";
+print F "#define DOM_$parameters{namespace}NAMES_HIDE_GLOBALS 1\n";
 print F "#else\n";
 print F "#define QNAME_DEFAULT_CONSTRUCTOR 1\n";
 print F "#endif\n\n";
 
 
-print F "#include \"$parameters{'namespace'}Names.h\"\n\n";
+print F "#include \"$parameters{namespace}Names.h\"\n\n";
 print F "#include \"StaticConstructors.h\"\n";
 
-print F "namespace WebCore {\n\n namespace $parameters{'namespace'}Names {
+print F "namespace WebCore {\n\n namespace $parameters{namespace}Names {
 
 using namespace WebCore;
 
-DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namespaceURI'}\")
+DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{namespaceURI}\")
 ";
 
     if (keys %tags) {
@@ -502,14 +507,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Tag, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
         
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Tags[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Tags(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Tags[] = {\n";
         for my $name (sort keys %tags) {
             print F "        (WebCore::QualifiedName*)&${name}Tag,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %tags), ";\n";
-        print F "    return $parameters{'namespace'}Tags;\n";
+        print F "    return $parameters{namespace}Tags;\n";
         print F "}\n";
     }
 
@@ -518,14 +523,14 @@ DEFINE_GLOBAL(AtomicString, ${lowerNamespace}NamespaceURI, \"$parameters{'namesp
         for my $name (sort keys %attrs) {
             print F "DEFINE_GLOBAL(QualifiedName, ", $name, "Attr, nullAtom, \"$name\", ${lowerNamespace}NamespaceURI);\n";
         }
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size)\n";
-        print F "{\n    static WebCore::QualifiedName* $parameters{'namespace'}Attr[] = {\n";
+        print F "\n\nWebCore::QualifiedName** get$parameters{namespace}Attrs(size_t* size)\n";
+        print F "{\n    static WebCore::QualifiedName* $parameters{namespace}Attr[] = {\n";
         for my $name (sort keys %attrs) {
             print F "        (WebCore::QualifiedName*)&${name}Attr,\n";
         }
         print F "    };\n";
         print F "    *size = ", scalar(keys %attrs), ";\n";
-        print F "    return $parameters{'namespace'}Attr;\n";
+        print F "    return $parameters{namespace}Attr;\n";
         print F "}\n";
     }
 
@@ -549,16 +554,16 @@ print F "\nvoid init()
     AtomicString::init();
 ";
     
-    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{'namespaceURI'}\");\n\n");
+    print(F "    AtomicString ${lowerNamespace}NS(\"$parameters{namespaceURI}\");\n\n");
 
     print(F "    // Namespace\n");
     print(F "    new ((void*)&${lowerNamespace}NamespaceURI) AtomicString(${lowerNamespace}NS);\n\n");
     if (keys %tags) {
-        my $tagsNamespace = $parameters{'tagsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $tagsNamespace = $parameters{tagsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%tags, "tags", $tagsNamespace);
     }
     if (keys %attrs) {
-        my $attrsNamespace = $parameters{'attrsNullNamespace'} ? "nullAtom" : "${lowerNamespace}NS";
+        my $attrsNamespace = $parameters{attrsNullNamespace} ? "nullAtom" : "${lowerNamespace}NS";
         printDefinitions($F, \%attrs, "attributes", $attrsNamespace);
     }
 
@@ -572,7 +577,7 @@ sub printJSElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
@@ -586,7 +591,7 @@ sub printElementIncludes
 
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
-        my $interfaceName = $tags{$tagName}{"interfaceName"};
+        my $interfaceName = $tags{$tagName}{interfaceName};
         next if defined($tagsSeen{$interfaceName});
         $tagsSeen{$interfaceName} = 1;
 
@@ -604,7 +609,7 @@ sub printDefinitionStrings
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if (!$parameters{'exportStrings'} and !$names{$name}{"exportString"});
+        next if (!$parameters{exportStrings} and !$names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -625,7 +630,7 @@ sub printDefinitions
 
     my %names = %$namesRef;
     for my $name (sort keys %$namesRef) {
-        next if ($parameters{'exportStrings'} or $names{$name}{"exportString"});
+        next if ($parameters{exportStrings} or $names{$name}{exportString});
 
         my $realName = $name;
         $realName =~ s/_/-/g;
@@ -651,39 +656,31 @@ printLicenseHeader($F);
 
 print F <<END
 #include "config.h"
-#include "$parameters{'namespace'}ElementFactory.h"
-
-#include "$parameters{'namespace'}Names.h"
-#if ENABLE(DASHBOARD_SUPPORT)
-#include "Document.h"
-#include "Settings.h"
-#endif
+#include "$parameters{namespace}ElementFactory.h"
 
+#include "$parameters{namespace}Names.h"
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "#include \"HTMLFormElement.h\"\n";
-}
-
 printElementIncludes($F);
 
 print F <<END
 #include <wtf/HashMap.h>
 
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
 END
 ;
 
-print F "typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement*";
-}
-
+print F "typedef PassRefPtr<$parameters{namespace}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
+print F ", HTMLFormElement*" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser);\n";
 print F <<END
 typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
@@ -697,7 +694,7 @@ my %tagConstructorMap = buildConstructorMap();
 
 printConstructors($F, \%tagConstructorMap);
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
 static void addTag(const QualifiedName& tag, ConstructorFunction func)
@@ -705,10 +702,10 @@ static void addTag(const QualifiedName& tag, ConstructorFunction func)
     gFunctionMap->set(tag.localName().impl(), func);
 }
 
-static inline void createFunctionMapIfNecessary()
+static void createFunctionMap()
 {
-    if (gFunctionMap)
-        return;
+    ASSERT(!gFunctionMap);
+
     // Create the table.
     gFunctionMap = new FunctionMap;
     
@@ -719,30 +716,25 @@ END
 printFunctionInits($F, \%tagConstructorMap);
 
 print F "}\n";
-print F "#endif\n" if $parameters{'guardFactoryWith'};
-
-print F "\nPassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc";
-
-if ($parameters{"namespace"} eq "HTML") {
-    print F ", HTMLFormElement* formElement";
-}
+print F "#endif\n" if $parameters{guardFactoryWith};
 
+print F "\nPassRefPtr<$parameters{namespace}Element> $parameters{namespace}ElementFactory::create$parameters{namespace}Element(const QualifiedName& qName, Document* document";
+print F ", HTMLFormElement* formElement" if $parameters{namespace} eq "HTML";
 print F ", bool createdByParser)\n{\n";
 
-print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
 print F <<END
-    // Don't make elements without a document
-    if (!doc)
+    if (!document)
         return 0;
 
 END
 ;
 
-if ($parameters{'namespace'} ne "HTML") {
+if ($parameters{namespace} ne "HTML") {
 print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
-    Settings* settings = doc->settings();
+    Settings* settings = document->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
@@ -752,21 +744,21 @@ END
 }
 
 print F <<END
-    createFunctionMapIfNecessary();
-    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
-    if (func)
+    if (!gFunctionMap)
+        createFunctionMap();
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
 END
 ;
 
-if ($parameters{"namespace"} eq "HTML") {
-    print F "        return func(qName, doc, formElement, createdByParser);\n";
+if ($parameters{namespace} eq "HTML") {
+    print F "        return function(qName, document, formElement, createdByParser);\n";
 } else {
-    print F "        return func(qName, doc, createdByParser);\n";
+    print F "        return function(qName, document, createdByParser);\n";
 }
 
-print F "    return new $parameters{'namespace'}Element(qName, doc);\n";
+print F "    return $parameters{namespace}Element::create(qName, document);\n";
 
-if ($parameters{'guardFactoryWith'}) {
+if ($parameters{guardFactoryWith}) {
 
 print F <<END
 #else
@@ -797,8 +789,8 @@ sub printFactoryHeaderFile
     printLicenseHeader($F);
 
     print F<<END
-#ifndef $parameters{'namespace'}ElementFactory_h
-#define $parameters{'namespace'}ElementFactory_h
+#ifndef $parameters{namespace}ElementFactory_h
+#define $parameters{namespace}ElementFactory_h
 
 #include <wtf/PassRefPtr.h>
 
@@ -811,35 +803,29 @@ namespace WebCore {
 
 namespace WebCore {
 
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 END
 ;
 
-if ($parameters{'namespace'} eq "HTML") {
-    print F "     class HTMLFormElement;\n";
-}
+print F "     class HTMLFormElement;\n" if $parameters{namespace} eq "HTML";
 
 print F<<END
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
-    class $parameters{'namespace'}ElementFactory {
+    class $parameters{namespace}ElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
 END
 ;
-print F "        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*";
-
-if ($parameters{'namespace'} eq "HTML") {
-    print F ", HTMLFormElement* = 0";
-}
-
+print F "        static PassRefPtr<$parameters{namespace}Element> create$parameters{namespace}Element(const WebCore::QualifiedName&, WebCore::Document*";
+print F ", HTMLFormElement* = 0" if $parameters{namespace} eq "HTML";
 print F ", bool /*createdByParser*/ = true);\n";
 
 printf F<<END
     };
 }
 
-#endif // $parameters{'namespace'}ElementFactory_h
+#endif // $parameters{namespace}ElementFactory_h
 
 END
 ;
@@ -854,7 +840,7 @@ sub usesDefaultJSWrapper
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
+    return $tags{$name}{JSInterfaceName} eq $parameters{namespace} . "Element" || $tags{$name}{JSInterfaceName} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
@@ -864,11 +850,11 @@ sub printWrapperFunctions
     my %tagsSeen;
     for my $tagName (sort keys %tags) {
         # Avoid defining the same wrapper method twice.
-        my $JSInterfaceName = $tags{$tagName}{"JSInterfaceName"};
+        my $JSInterfaceName = $tags{$tagName}{JSInterfaceName};
         next if defined($tagsSeen{$JSInterfaceName}) || usesDefaultJSWrapper($tagName);
         $tagsSeen{$JSInterfaceName} = 1;
 
-        my $conditional = $tags{$tagName}{"conditional"};
+        my $conditional = $tags{$tagName}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n\n";
@@ -876,12 +862,12 @@ sub printWrapperFunctions
 
         # Hack for the media tags
         # FIXME: This should have been done via a CustomWrapper attribute and a separate *Custom file.
-        if ($tags{$tagName}{"wrapperOnlyIfMediaIsAvailable"}) {
+        if ($tags{$tagName}{wrapperOnlyIfMediaIsAvailable}) {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     if (!MediaPlayer::isAvailable())
-        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+        return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
 
@@ -889,7 +875,7 @@ END
 ;
         } else {
             print F <<END
-static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
 }
@@ -897,6 +883,7 @@ static JSNode* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObjec
 END
 ;
         }
+
         if ($conditional) {
             print F "#endif\n\n";
         }
@@ -913,13 +900,13 @@ sub printWrapperFactoryCppFile
 
     print F "#include \"config.h\"\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#include \"JS$parameters{'namespace'}ElementWrapperFactory.h\"\n";
+    print F "#include \"JS$parameters{namespace}ElementWrapperFactory.h\"\n";
 
     printJSElementIncludes($F);
 
-    print F "\n#include \"$parameters{'namespace'}Names.h\"\n\n";
+    print F "\n#include \"$parameters{namespace}Names.h\"\n\n";
 
     printElementIncludes($F);
 
@@ -930,9 +917,9 @@ using namespace JSC;
 
 namespace WebCore {
 
-using namespace $parameters{'namespace'}Names;
+using namespace $parameters{namespace}Names;
 
-typedef JSNode* (*Create$parameters{'namespace'}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+typedef JSNode* (*Create$parameters{namespace}ElementWrapperFunction)(ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 END
 ;
@@ -940,9 +927,9 @@ END
     printWrapperFunctions($F);
 
     print F <<END
-JSNode* createJS$parameters{'namespace'}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{'namespace'}Element> element)
+JSNode* createJS$parameters{namespace}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
 {   
-    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{'namespace'}ElementWrapperFunction> FunctionMap;
+    typedef HashMap<WebCore::AtomicStringImpl*, Create$parameters{namespace}ElementWrapperFunction> FunctionMap;
     DEFINE_STATIC_LOCAL(FunctionMap, map, ());
     if (map.isEmpty()) {
 END
@@ -952,13 +939,13 @@ END
         # Do not add the name to the map if it does not have a JS wrapper constructor or uses the default wrapper.
         next if usesDefaultJSWrapper($tag, \%tags);
 
-        my $conditional = $tags{$tag}{"conditional"};
+        my $conditional = $tags{$tag}{conditional};
         if ($conditional) {
             my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
             print F "#if ${conditionalString}\n";
         }
 
-        my $ucTag = $tags{$tag}{"JSInterfaceName"};
+        my $ucTag = $tags{$tag}{JSInterfaceName};
         print F "       map.set(${tag}Tag.localName().impl(), create${ucTag}Wrapper);\n";
 
         if ($conditional) {
@@ -968,10 +955,10 @@ END
 
     print F <<END
     }
-    Create$parameters{'namespace'}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
+    Create$parameters{namespace}ElementWrapperFunction createWrapperFunction = map.get(element->localName().impl());
     if (createWrapperFunction)
         return createWrapperFunction(exec, globalObject, element);
-    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{'namespace'}Element, element.get());
+    return CREATE_DOM_NODE_WRAPPER(exec, globalObject, $parameters{namespace}Element, element.get());
 }
 
 }
@@ -979,7 +966,7 @@ END
 END
 ;
 
-    print F "#endif\n" if $parameters{'guardFactoryWith'};
+    print F "#endif\n" if $parameters{guardFactoryWith};
 
     close F;
 }
@@ -992,10 +979,10 @@ sub printWrapperFactoryHeaderFile
 
     printLicenseHeader($F);
 
-    print F "#ifndef JS$parameters{'namespace'}ElementWrapperFactory_h\n";
-    print F "#define JS$parameters{'namespace'}ElementWrapperFactory_h\n\n";
+    print F "#ifndef JS$parameters{namespace}ElementWrapperFactory_h\n";
+    print F "#define JS$parameters{namespace}ElementWrapperFactory_h\n\n";
 
-    print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
+    print F "#if $parameters{guardFactoryWith}\n" if $parameters{guardFactoryWith};
 
     print F <<END
 #include <wtf/Forward.h>
@@ -1008,18 +995,18 @@ namespace WebCore {
 
     class JSNode;
     class JSDOMGlobalObject;
-    class $parameters{'namespace'}Element;
+    class $parameters{namespace}Element;
 
-    JSNode* createJS$parameters{'namespace'}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{'namespace'}Element>);
+    JSNode* createJS$parameters{namespace}Wrapper(JSC::ExecState*, JSDOMGlobalObject*, PassRefPtr<$parameters{namespace}Element>);
 
 }
  
 END
 ;
 
-    print F "#endif // $parameters{'guardFactoryWith'}\n\n" if $parameters{'guardFactoryWith'};
+    print F "#endif // $parameters{guardFactoryWith}\n\n" if $parameters{guardFactoryWith};
 
-    print F "#endif // JS$parameters{'namespace'}ElementWrapperFactory_h\n";
+    print F "#endif // JS$parameters{namespace}ElementWrapperFactory_h\n";
 
     close F;
 }
diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index 86ef214..83d0bd3 100644
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -58,6 +58,8 @@ public:
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
     bool applyItalic() const { return m_applyItalic; }
+    bool applyUnderline() const { return m_applyUnderline; }
+    bool applyLineThrough() const { return m_applyLineThrough; }
     bool applySubscript() const { return m_applySubscript; }
     bool applySuperscript() const { return m_applySuperscript; }
     bool applyFontColor() const { return m_applyFontColor.length() > 0; }
@@ -70,12 +72,14 @@ public:
 
 private:
     void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
-    bool checkForLegacyHTMLStyleChange(const CSSProperty*);
-    static bool currentlyHasStyle(const Position&, const CSSProperty*);
-    
+    void reconcileTextDecorationProperties(CSSMutableStyleDeclaration*);
+    void extractTextStyles(CSSMutableStyleDeclaration*);
+
     String m_cssStyle;
     bool m_applyBold;
     bool m_applyItalic;
+    bool m_applyUnderline;
+    bool m_applyLineThrough;
     bool m_applySubscript;
     bool m_applySuperscript;
     String m_applyFontColor;
@@ -87,6 +91,8 @@ private:
 StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
     : m_applyBold(false)
     , m_applyItalic(false)
+    , m_applyUnderline(false)
+    , m_applyLineThrough(false)
     , m_applySubscript(false)
     , m_applySuperscript(false)
 {
@@ -99,103 +105,135 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& po
     if (!document || !document->frame())
         return;
 
-    bool useHTMLFormattingTags = !document->frame()->editor()->shouldStyleWithCSS();
-    RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
-    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
-    ASSERT(!mutableStyle->getPropertyCSSValue(CSSPropertyTextDecoration) || !mutableStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect));
-    String styleText("");
-    bool addedDirection = false;
-    CSSMutableStyleDeclaration::const_iterator end = mutableStyle->end();
-    for (CSSMutableStyleDeclaration::const_iterator it = mutableStyle->begin(); it != end; ++it) {
-        const CSSProperty *property = &*it;
-
-        // If position is empty or the position passed in already has the 
-        // style, just move on.
-        if (position.isNotNull() && currentlyHasStyle(position, property))
-            continue;
-        
-        // Changing the whitespace style in a tab span would collapse the tab into a space.
-        if (property->id() == CSSPropertyWhiteSpace && (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node()))))
-            continue;
-        
-        // If needed, figure out if this change is a legacy HTML style change.
-        if (useHTMLFormattingTags && checkForLegacyHTMLStyleChange(property))
-            continue;
+    RefPtr<CSSComputedStyleDeclaration> computedStyle = position.computedStyle();
+    RefPtr<CSSMutableStyleDeclaration> mutableStyle = getPropertiesNotInComputedStyle(style.get(), computedStyle.get());
 
-        if (property->id() == CSSPropertyDirection) {
-            if (addedDirection)
-                continue;
-            addedDirection = true;
-        }
+    reconcileTextDecorationProperties(mutableStyle.get());
+    if (!document->frame()->editor()->shouldStyleWithCSS())
+        extractTextStyles(mutableStyle.get());
 
-        // Add this property
-        if (property->id() == CSSPropertyTextDecoration || property->id() == CSSPropertyWebkitTextDecorationsInEffect) {
-            // Always use text-decoration because -webkit-text-decoration-in-effect is internal.
-            CSSProperty alteredProperty(CSSPropertyTextDecoration, property->value(), property->isImportant());
-            // We don't add "text-decoration: none" because it doesn't override the existing text decorations; i.e. redundant
-            if (!equalIgnoringCase(alteredProperty.value()->cssText(), "none"))
-                styleText += alteredProperty.cssText();
-        } else
-            styleText += property->cssText();
+    // Changing the whitespace style in a tab span would collapse the tab into a space.
+    if (isTabSpanTextNode(position.node()) || isTabSpanNode((position.node())))
+        mutableStyle->removeProperty(CSSPropertyWhiteSpace);
 
-        if (!addedDirection && property->id() == CSSPropertyUnicodeBidi) {
-            styleText += "direction: " + style->getPropertyValue(CSSPropertyDirection) + "; ";
-            addedDirection = true;
-        }
-    }
+    // If unicode-bidi is present in mutableStyle and direction is not, then add direction to mutableStyle.
+    // FIXME: Shouldn't this be done in getPropertiesNotInComputedStyle?
+    if (mutableStyle->getPropertyCSSValue(CSSPropertyUnicodeBidi) && !style->getPropertyCSSValue(CSSPropertyDirection))
+        mutableStyle->setProperty(CSSPropertyDirection, style->getPropertyValue(CSSPropertyDirection));
 
     // Save the result for later
-    m_cssStyle = styleText.stripWhiteSpace();
+    m_cssStyle = mutableStyle->cssText().stripWhiteSpace();
 }
 
-// This function is the mapping from CSS styles to styling tags (like font-weight: bold to <b>)
-bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
+void StyleChange::reconcileTextDecorationProperties(CSSMutableStyleDeclaration* style)
+{    
+    RefPtr<CSSValue> textDecorationsInEffect = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration);
+    // We shouldn't have both text-decoration and -webkit-text-decorations-in-effect because that wouldn't make sense.
+    ASSERT(!textDecorationsInEffect || !textDecoration);
+    if (textDecorationsInEffect) {
+        style->setProperty(CSSPropertyTextDecoration, textDecorationsInEffect->cssText());
+        style->removeProperty(CSSPropertyWebkitTextDecorationsInEffect);
+        textDecoration = textDecorationsInEffect;
+    }
+
+    // If text-decration is set to "none", remove the property because we don't want to add redundant "text-decoration: none".
+    if (textDecoration && !textDecoration->isValueList())
+        style->removeProperty(CSSPropertyTextDecoration);
+}
+
+static int getIdentifierValue(CSSMutableStyleDeclaration* style, int propertyID)
 {
-    if (!property || !property->value())
-        return false;
-    
-    String valueText(property->value()->cssText());
-    switch (property->id()) {
-        case CSSPropertyFontWeight:
-            if (equalIgnoringCase(valueText, "bold")) {
-                m_applyBold = true;
-                return true;
-            }
-            break;
-        case CSSPropertyVerticalAlign:
-            if (equalIgnoringCase(valueText, "sub")) {
-                m_applySubscript = true;
-                return true;
-            }
-            if (equalIgnoringCase(valueText, "super")) {
-                m_applySuperscript = true;
-                return true;
-            }
-            break;
-        case CSSPropertyFontStyle:
-            if (equalIgnoringCase(valueText, "italic") || equalIgnoringCase(valueText, "oblique")) {
-                m_applyItalic = true;
-                return true;
-            }
-            break;
-        case CSSPropertyColor: {
-            RGBA32 rgba = 0;
-            CSSParser::parseColor(rgba, valueText);
-            Color color(rgba);
-            m_applyFontColor = color.name();
-            return true;
-        }
-        case CSSPropertyFontFamily:
-            m_applyFontFace = valueText;
-            return true;
-        case CSSPropertyFontSize:
-            if (property->value()->cssValueType() == CSSValue::CSS_PRIMITIVE_VALUE) {
-                CSSPrimitiveValue *value = static_cast<CSSPrimitiveValue *>(property->value());
+    if (!style)
+        return 0;
+
+    RefPtr<CSSValue> value = style->getPropertyCSSValue(propertyID);
+    if (!value || !value->isPrimitiveValue())
+        return 0;
+
+    return static_cast<CSSPrimitiveValue*>(value.get())->getIdent();
+}
 
-                if (value->primitiveType() < CSSPrimitiveValue::CSS_PX || value->primitiveType() > CSSPrimitiveValue::CSS_PC)
-                    // Size keyword or relative unit.
-                    return false;
+static void setTextDecorationProperty(CSSMutableStyleDeclaration* style, const CSSValueList* newTextDecoration, int propertyID)
+{
+    if (newTextDecoration->length())
+        style->setProperty(propertyID, newTextDecoration->cssText(), style->getPropertyPriority(propertyID));
+    else {
+        // text-decoration: none is redundant since it does not remove any text decorations.
+        ASSERT(!style->getPropertyPriority(propertyID));
+        style->removeProperty(propertyID);
+    }
+}
 
+void StyleChange::extractTextStyles(CSSMutableStyleDeclaration* style)
+{
+    ASSERT(style);
+
+    if (getIdentifierValue(style, CSSPropertyFontWeight) == CSSValueBold) {
+        style->removeProperty(CSSPropertyFontWeight);
+        m_applyBold = true;
+    }
+
+    int fontStyle = getIdentifierValue(style, CSSPropertyFontStyle);
+    if (fontStyle == CSSValueItalic || fontStyle == CSSValueOblique) {
+        style->removeProperty(CSSPropertyFontStyle);
+        m_applyItalic = true;
+    }
+
+    // Assuming reconcileTextDecorationProperties has been called, there should not be -webkit-text-decorations-in-effect
+    // Furthermore, text-decoration: none has been trimmed so that text-decoration property is always a CSSValueList.
+    if (RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(CSSPropertyTextDecoration)) {
+        ASSERT(textDecoration->isValueList());
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, underline, (CSSPrimitiveValue::createIdentifier(CSSValueUnderline)));
+        DEFINE_STATIC_LOCAL(RefPtr<CSSPrimitiveValue>, lineThrough, (CSSPrimitiveValue::createIdentifier(CSSValueLineThrough)));
+
+        RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+        if (newTextDecoration->removeAll(underline.get()))
+            m_applyUnderline = true;
+        if (newTextDecoration->removeAll(lineThrough.get()))
+            m_applyLineThrough = true;
+
+        // If trimTextDecorations, delete underline and line-through
+        setTextDecorationProperty(style, newTextDecoration.get(), CSSPropertyTextDecoration);
+    }
+
+    int verticalAlign = getIdentifierValue(style, CSSPropertyVerticalAlign);
+    switch (verticalAlign) {
+    case CSSValueSub:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySubscript = true;
+        break;
+    case CSSValueSuper:
+        style->removeProperty(CSSPropertyVerticalAlign);
+        m_applySuperscript = true;
+        break;
+    }
+
+    if (RefPtr<CSSValue> colorValue = style->getPropertyCSSValue(CSSPropertyColor)) {
+        ASSERT(colorValue->isPrimitiveValue());
+        CSSPrimitiveValue* primitiveColor = static_cast<CSSPrimitiveValue*>(colorValue.get());
+        RGBA32 rgba;
+        if (primitiveColor->primitiveType() != CSSPrimitiveValue::CSS_RGBCOLOR) {
+            CSSParser::parseColor(rgba, colorValue->cssText());
+            // Need to take care of named color such as green and black
+            // This code should be removed after https://bugs.webkit.org/show_bug.cgi?id=28282 is fixed.
+        } else
+            rgba = primitiveColor->getRGBA32Value();
+        m_applyFontColor = Color(rgba).name();
+        style->removeProperty(CSSPropertyColor);
+    }
+
+    m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    style->removeProperty(CSSPropertyFontFamily);
+
+    if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
+        if (!fontSize->isPrimitiveValue())
+            style->removeProperty(CSSPropertyFontSize); // Can't make sense of the number. Put no font size.
+        else {
+            CSSPrimitiveValue* value = static_cast<CSSPrimitiveValue*>(fontSize.get());
+
+            // Only accept absolute scale
+            if (value->primitiveType() >= CSSPrimitiveValue::CSS_PX && value->primitiveType() <= CSSPrimitiveValue::CSS_PC) {
                 float number = value->getFloatValue(CSSPrimitiveValue::CSS_PX);
                 if (number <= 9)
                     m_applyFontSize = "1";
@@ -211,34 +249,12 @@ bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
                     m_applyFontSize = "6";
                 else
                     m_applyFontSize = "7";
-                // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
-                // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
-                // like Eudora). Yes, they write out *both*. We need to write out both as well. Return false.
-                return false; 
-            }
-            else {
-                // Can't make sense of the number. Put no font size.
-                return true;
             }
+            // Huge quirk in Microsft Entourage is that they understand CSS font-size, but also write 
+            // out legacy 1-7 values in font tags (I guess for mailers that are not CSS-savvy at all, 
+            // like Eudora). Yes, they write out *both*. We need to write out both as well.
+        }
     }
-    return false;
-}
-
-bool StyleChange::currentlyHasStyle(const Position &pos, const CSSProperty *property)
-{
-    ASSERT(pos.isNotNull());
-    RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value;
-    if (property->id() == CSSPropertyFontSize)
-        value = style->getFontSizeCSSValuePreferringKeyword();
-    // We need to use -webkit-text-decorations-in-effect to take care of text decorations set by u, s, and strike
-    else if (property->id() == CSSPropertyTextDecoration)
-        value = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    else
-        value = style->getPropertyCSSValue(property->id());
-    if (!value)
-        return false;
-    return equalIgnoringCase(value->cssText(), property->value()->cssText());
 }
 
 static String& styleSpanClassString()
@@ -302,7 +318,22 @@ PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
     styleElement->setAttribute(classAttr, styleSpanClassString());
     return styleElement.release();
 }
-    
+
+static void diffTextDecorations(CSSMutableStyleDeclaration* style, int propertID, CSSValue* refTextDecoration)
+{
+    RefPtr<CSSValue> textDecoration = style->getPropertyCSSValue(propertID);
+    if (!textDecoration || !textDecoration->isValueList() || !refTextDecoration || !refTextDecoration->isValueList())
+        return;
+
+    RefPtr<CSSValueList> newTextDecoration = static_cast<CSSValueList*>(textDecoration.get())->copy();
+    CSSValueList* valuesInRefTextDecoration = static_cast<CSSValueList*>(refTextDecoration);
+
+    for (size_t i = 0; i < valuesInRefTextDecoration->length(); i++)
+        newTextDecoration->removeAll(valuesInRefTextDecoration->item(i));
+
+    setTextDecorationProperty(style, newTextDecoration.get(), propertID);
+}
+
 RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDeclaration* style, CSSComputedStyleDeclaration* computedStyle)
 {
     ASSERT(style);
@@ -310,27 +341,9 @@ RefPtr<CSSMutableStyleDeclaration> getPropertiesNotInComputedStyle(CSSStyleDecla
     RefPtr<CSSMutableStyleDeclaration> result = style->copy();
     computedStyle->diff(result.get());
 
-    // If text decorations in effect is not present in the computed style, then there is nothing to remove from result
-    RefPtr<CSSValue> computedValue = computedStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
-    if (!computedValue || !computedValue->isValueList())
-        return result;
-
-    // Take care of both text-decoration and -webkit-text-decorations-in-effect
-    static const int textDecorationProperties[]={CSSPropertyTextDecoration, CSSPropertyWebkitTextDecorationsInEffect};
-    for (size_t n = 0; n < sizeof(textDecorationProperties)/sizeof(textDecorationProperties[1]); n++) {
-        RefPtr<CSSValue> styleValue = style->getPropertyCSSValue(textDecorationProperties[n]);
-        if (!styleValue || !styleValue->isValueList())
-            continue;
-
-        CSSValueList* desiredValueList = static_cast<CSSValueList*>(styleValue.get());
-        CSSValueList* computedValueList = static_cast<CSSValueList*>(computedValue.get());
-        for (size_t i = 0; i < desiredValueList->length(); i++) {
-            if (!computedValueList->hasValue(desiredValueList->item(i))) {
-                result->removeProperty(textDecorationProperties[n]);
-                break;
-            }
-        }
-    }
+    RefPtr<CSSValue> computedTextDecorationsInEffect = computedStyle->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
+    diffTextDecorations(result.get(), CSSPropertyTextDecoration, computedTextDecorationsInEffect.get());
+    diffTextDecorations(result.get(), CSSPropertyWebkitTextDecorationsInEffect, computedTextDecorationsInEffect.get());
 
     return result;
 }
@@ -370,7 +383,11 @@ size_t numEditingStyleProperties = sizeof(editingStyleProperties)/sizeof(editing
 PassRefPtr<CSSMutableStyleDeclaration> editingStyleAtPosition(Position pos, ShouldIncludeTypingStyle shouldIncludeTypingStyle)
 {
     RefPtr<CSSComputedStyleDeclaration> computedStyleAtPosition = pos.computedStyle();
-    RefPtr<CSSMutableStyleDeclaration> style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
+    RefPtr<CSSMutableStyleDeclaration> style;
+    if (!computedStyleAtPosition)
+        style = CSSMutableStyleDeclaration::create();
+    else
+        style = computedStyleAtPosition->copyPropertiesInSet(editingStyleProperties, numEditingStyleProperties);
 
     if (style && pos.node() && pos.node()->computedStyle()) {
         RenderStyle* renderStyle = pos.node()->computedStyle();
@@ -895,9 +912,9 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     if (unicodeBidi) {
         // Avoid removing the dir attribute and the unicode-bidi and direction properties from the unsplit ancestors.
         if (startUnsplitAncestor && nodeFullySelected(startUnsplitAncestor, removeStart, end))
-            embeddingRemoveStart = positionAfterNode(startUnsplitAncestor);
+            embeddingRemoveStart = positionInParentAfterNode(startUnsplitAncestor);
         if (endUnsplitAncestor && nodeFullySelected(endUnsplitAncestor, removeStart, end))
-            embeddingRemoveEnd = positionBeforeNode(endUnsplitAncestor).downstream();
+            embeddingRemoveEnd = positionInParentBeforeNode(endUnsplitAncestor).downstream();
     }
 
     if (embeddingRemoveStart != removeStart || embeddingRemoveEnd != end) {
@@ -947,7 +964,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyStart = positionAfterNode(n);
+                        embeddingApplyStart = positionInParentAfterNode(n);
                         break;
                     }
                 }
@@ -961,7 +978,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
                 if (ancestorUnicodeBidi) {
                     ASSERT(ancestorUnicodeBidi->isPrimitiveValue());
                     if (static_cast<CSSPrimitiveValue*>(ancestorUnicodeBidi.get())->getIdent() == CSSValueEmbed) {
-                        embeddingApplyEnd = positionBeforeNode(n);
+                        embeddingApplyEnd = positionInParentBeforeNode(n);
                         break;
                     }
                 }
@@ -1300,7 +1317,7 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
         return;
 
     HTMLElement *element = static_cast<HTMLElement *>(node);
-        
+
     StyleChange styleChange(style, Position(element, 0));
     if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
@@ -1309,6 +1326,12 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
             cssText += decl->cssText();
         setNodeAttribute(element, styleAttr, cssText);
     }
+
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(node, node, createHTMLElement(document(), sTag));    
 }
 
 void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node* targetNode, bool forceNegate)
@@ -1360,6 +1383,7 @@ void ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries(const Position &
     pushDownTextDecorationStyleAroundNode(end.node(), true);
 }
 
+// FIXME: Why does this exist?  Callers should either use lastOffsetForEditing or lastOffsetInNode
 static int maxRangeOffset(Node *n)
 {
     if (n->offsetInCharacters())
@@ -1743,6 +1767,12 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
     if (styleChange.applyItalic())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
 
+    if (styleChange.applyUnderline())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), uTag));
+
+    if (styleChange.applyLineThrough())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), sTag));
+
     if (styleChange.applySubscript())
         surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
     else if (styleChange.applySuperscript())
diff --git a/WebCore/editing/BreakBlockquoteCommand.cpp b/WebCore/editing/BreakBlockquoteCommand.cpp
index 1ca2d87..2da6047 100644
--- a/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -51,7 +51,16 @@ void BreakBlockquoteCommand::doApply()
     if (endingSelection().isRange())
         deleteSelection(false, false);
     
+    // This is a scenario that should never happen, but we want to
+    // make sure we don't dereference a null pointer below.    
+
+    ASSERT(!endingSelection().isNone());
+    
+    if (endingSelection().isNone())
+        return;
+        
     VisiblePosition visiblePos = endingSelection().visibleStart();
+    
     // pos is a position equivalent to the caret.  We use downstream() so that pos will 
     // be in the first node that we need to move (there are a few exceptions to this, see below).
     Position pos = endingSelection().start().downstream();
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 25f167c..0496a8f 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -343,13 +343,13 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     Node* tabSpan = tabSpanNode(pos.node());
     
     if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
-        return positionBeforeNode(tabSpan);
+        return positionInParentBeforeNode(tabSpan);
         
     if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
-        return positionAfterNode(tabSpan);
+        return positionInParentAfterNode(tabSpan);
 
     splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
-    return positionBeforeNode(tabSpan);
+    return positionInParentBeforeNode(tabSpan);
 }
 
 void CompositeEditCommand::insertNodeAtTabSpanPosition(PassRefPtr<Node> node, const Position& pos)
@@ -519,7 +519,7 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
             gapStart = max(gapStart, start);
             gapEnd = min(gapEnd, end);
             if (str.isNull())
-                str = textNode->string()->substring(start, end - start);
+                str = textNode->data().substring(start, end - start);
             // remove text in the gap
             str.remove(gapStart - start - removed, gapLen);
             removed += gapLen;
@@ -890,31 +890,57 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     Node* emptyListItem = enclosingEmptyListItem(endingSelection().visibleStart());
     if (!emptyListItem)
         return false;
-        
+
     RefPtr<CSSMutableStyleDeclaration> style = editingStyleAtPosition(endingSelection().start(), IncludeTypingStyle);
 
     Node* listNode = emptyListItem->parentNode();
-    
-    if (!listNode->isContentEditable())
+    // FIXME: Can't we do something better when the immediate parent wasn't a list node?
+    if (!listNode
+        || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
+        || !listNode->isContentEditable())
         return false;
-    
-    RefPtr<Element> newBlock = isListElement(listNode->parentNode()) ? createListItemElement(document()) : createDefaultParagraphElement(document());
-    
+
+    RefPtr<Element> newBlock = 0;
+    if (Node* blockEnclosingList = listNode->parentNode()) {
+        if (blockEnclosingList->hasTagName(liTag)) { // listNode is inside another list item
+            if (visiblePositionAfterNode(blockEnclosingList) == visiblePositionAfterNode(listNode)) {
+                // If listNode appears at the end of the outer list item, then move listNode outside of this list item
+                // e.g. <ul><li>hello <ul><li><br></li></ul> </li></ul> should become <ul><li>hello</li> <ul><li><br></li></ul> </ul> after this section
+                // If listNode does NOT appear at the end, then we should consider it as a regular paragraph.
+                // e.g. <ul><li> <ul><li><br></li></ul> hello</li></ul> should become <ul><li> <div><br></div> hello</li></ul> at the end
+                splitElement(static_cast<Element*>(blockEnclosingList), listNode);
+                removeNodePreservingChildren(listNode->parentNode());
+                newBlock = createListItemElement(document());
+            }
+            // If listNode does NOT appear at the end of the outer list item, then behave as if in a regular paragraph. 
+        } else if (blockEnclosingList->hasTagName(olTag) || blockEnclosingList->hasTagName(ulTag))
+            newBlock = createListItemElement(document());
+    }
+    if (!newBlock)
+        newBlock = createDefaultParagraphElement(document());
+
     if (emptyListItem->renderer()->nextSibling()) {
+        // If emptyListItem follows another list item, split the list node.
         if (emptyListItem->renderer()->previousSibling())
             splitElement(static_cast<Element*>(listNode), emptyListItem);
+
+        // If emptyListItem is followed by other list item, then insert newBlock before the list node.
+        // Because we have splitted the element, emptyListItem is the first element in the list node.
+        // i.e. insert newBlock before ul or ol whose first element is emptyListItem
         insertNodeBefore(newBlock, listNode);
         removeNode(emptyListItem);
     } else {
+        // When emptyListItem does not follow any list item, insert newBlock after the enclosing list node.
+        // Remove the enclosing node if emptyListItem is the only child; otherwise just remove emptyListItem.
         insertNodeAfter(newBlock, listNode);
         removeNode(emptyListItem->renderer()->previousSibling() ? emptyListItem : listNode);
     }
-    
+
     appendBlockPlaceholder(newBlock);
     setEndingSelection(VisibleSelection(Position(newBlock.get(), 0), DOWNSTREAM));
-    
-    computedStyle(endingSelection().start().node())->diff(style.get());
-    if (style->length() > 0)
+
+    prepareEditingStyleToApplyAt(style.get(), endingSelection().start());
+    if (style->length())
         applyStyle(style.get());
     
     return true;
@@ -960,7 +986,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     ASSERT(caretPos.node()->hasTagName(brTag) || caretPos.node()->isTextNode() && caretPos.node()->renderer()->style()->preserveNewline());
     
     if (caretPos.node()->hasTagName(brTag)) {
-        Position beforeBR(positionBeforeNode(caretPos.node()));
+        Position beforeBR(positionInParentBeforeNode(caretPos.node()));
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
@@ -1013,7 +1039,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
-            result = positionAfterNode(enclosingAnchor);
+            result = positionInParentAfterNode(enclosingAnchor);
         }
         // If visually just before an anchor, insert *outside* the anchor unless it's the first
         // VisiblePosition in a paragraph, to match NSTextView.
@@ -1027,7 +1053,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             if (!enclosingAnchor)
                 return original;
 
-            result = positionBeforeNode(enclosingAnchor);
+            result = positionInParentBeforeNode(enclosingAnchor);
         }
     }
         
diff --git a/WebCore/editing/CreateLinkCommand.cpp b/WebCore/editing/CreateLinkCommand.cpp
index 263feab..d7048fe 100644
--- a/WebCore/editing/CreateLinkCommand.cpp
+++ b/WebCore/editing/CreateLinkCommand.cpp
@@ -43,7 +43,7 @@ void CreateLinkCommand::doApply()
     if (endingSelection().isNone())
         return;
         
-    RefPtr<HTMLAnchorElement> anchorElement = new HTMLAnchorElement(document());
+    RefPtr<HTMLAnchorElement> anchorElement = HTMLAnchorElement::create(document());
     anchorElement->setHref(m_url);
     
     if (endingSelection().isRange()) {
@@ -51,9 +51,9 @@ void CreateLinkCommand::doApply()
         applyStyledElement(anchorElement.get());
     } else {
         insertNodeAt(anchorElement.get(), endingSelection().start());
-        RefPtr<Text> textNode = new Text(document(), m_url);
+        RefPtr<Text> textNode = Text::create(document(), m_url);
         appendNode(textNode.get(), anchorElement.get());
-        setEndingSelection(VisibleSelection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentBeforeNode(anchorElement.get()), positionInParentAfterNode(anchorElement.get()), DOWNSTREAM));
     }
 }
 
diff --git a/WebCore/editing/DeleteButtonController.cpp b/WebCore/editing/DeleteButtonController.cpp
index 725c01d..c154426 100644
--- a/WebCore/editing/DeleteButtonController.cpp
+++ b/WebCore/editing/DeleteButtonController.cpp
@@ -187,7 +187,7 @@ void DeleteButtonController::respondToChangedSelection(const VisibleSelection& o
 void DeleteButtonController::createDeletionUI()
 {
     RefPtr<HTMLDivElement> container = new HTMLDivElement(divTag, m_target->document());
-    container->setId(containerElementIdentifier);
+    container->setAttribute(idAttr, containerElementIdentifier);
 
     CSSMutableStyleDeclaration* style = container->getInlineStyleDecl();
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
@@ -202,7 +202,7 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
-    outline->setId(outlineElementIdentifier);
+    outline->setAttribute(idAttr, outlineElementIdentifier);
 
     const int borderWidth = 4;
     const int borderRadius = 6;
@@ -225,7 +225,7 @@ void DeleteButtonController::createDeletionUI()
         return;
 
     RefPtr<DeleteButton> button = new DeleteButton(m_target->document());
-    button->setId(buttonElementIdentifier);
+    button->setAttribute(idAttr, buttonElementIdentifier);
 
     const int buttonWidth = 30;
     const int buttonHeight = 30;
@@ -350,7 +350,7 @@ void DeleteButtonController::deleteTarget()
     // Because the deletion UI only appears when the selection is entirely
     // within the target, we unconditionally update the selection to be
     // a caret where the target had been.
-    Position pos = positionBeforeNode(element.get());
+    Position pos = positionInParentBeforeNode(element.get());
     applyCommand(RemoveNodeCommand::create(element.release()));
     m_frame->selection()->setSelection(VisiblePosition(pos));
 }
diff --git a/WebCore/editing/DeleteSelectionCommand.cpp b/WebCore/editing/DeleteSelectionCommand.cpp
index d57c241..fbb5aea 100644
--- a/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/WebCore/editing/DeleteSelectionCommand.cpp
@@ -137,16 +137,15 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
             
         if (VisiblePosition(start) != m_selectionToDelete.visibleStart() || VisiblePosition(end) != m_selectionToDelete.visibleEnd())
             break;
-        
-        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
 
-        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
+        // If we're going to expand to include the startSpecialContainer, it must be fully selected.
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionInParentAfterNode(startSpecialContainer), end) > -1)
             break;
 
         // If we're going to expand to include the endSpecialContainer, it must be fully selected.
-        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionInParentBeforeNode(endSpecialContainer)) > -1)
             break;
-        
+
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
             // Don't adjust the end yet, it is the end of a special element that contains the start
             // special element (which may or may not be fully selected).
@@ -317,7 +316,7 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
     if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
         position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
-        position = positionBeforeNode(node);
+        position = positionInParentBeforeNode(node);
 }
 
 void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
@@ -538,8 +537,6 @@ void DeleteSelectionCommand::mergeParagraphs()
 {
     if (!m_mergeBlocksAfterDelete) {
         if (m_pruneStartBlockIfNecessary) {
-            // Make sure that the ending position isn't inside the block we're about to prune.
-            m_endingPosition = m_downstreamEnd;
             // We aren't going to merge into the start block, so remove it if it's empty.
             prune(m_startBlock);
             // Removing the start block during a deletion is usually an indication that we need
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index b9dfc5d..3f3f736 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -393,7 +393,7 @@ void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), AXObjectCache::AXValueChanged, false);
     }
     
     if (client())
diff --git a/WebCore/editing/EditorCommand.cpp b/WebCore/editing/EditorCommand.cpp
index 55750ff..abd0174 100644
--- a/WebCore/editing/EditorCommand.cpp
+++ b/WebCore/editing/EditorCommand.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Igalia S.L.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,6 +41,7 @@
 #include "FormatBlockCommand.h"
 #include "Frame.h"
 #include "HTMLFontElement.h"
+#include "HTMLHRElement.h"
 #include "HTMLImageElement.h"
 #include "IndentOutdentCommand.h"
 #include "InsertListCommand.h"
@@ -198,7 +200,7 @@ static bool executeInsertFragment(Frame* frame, PassRefPtr<DocumentFragment> fra
 
 static bool executeInsertNode(Frame* frame, PassRefPtr<Node> content)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(frame->document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(frame->document());
     ExceptionCode ec = 0;
     fragment->appendChild(content, ec);
     if (ec)
@@ -467,9 +469,9 @@ static bool executeInsertBacktab(Frame* frame, Event* event, EditorCommandSource
 
 static bool executeInsertHorizontalRule(Frame* frame, Event*, EditorCommandSource, const String& value)
 {
-    RefPtr<HTMLElement> hr = new HTMLElement(hrTag, frame->document());
+    RefPtr<HTMLHRElement> hr = new HTMLHRElement(hrTag, frame->document());
     if (!value.isEmpty())
-        hr->setId(value);
+        hr->setAttribute(idAttr, value);
     return executeInsertNode(frame, hr.release());
 }
 
@@ -1095,6 +1097,19 @@ static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSou
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
+static bool caretBrowsingEnabled(Frame* frame)
+{
+    return frame->settings() && frame->settings()->caretBrowsingEnabled();
+}
+
+static EditorCommandSource dummyEditorCommandSource = static_cast<EditorCommandSource>(0);
+
+static bool enabledVisibleSelectionOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledVisibleSelection, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledVisibleSelection(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
     const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
@@ -1139,6 +1154,12 @@ static bool enabledInEditableText(Frame* frame, Event* event, EditorCommandSourc
     return frame->editor()->selectionForCommand(event).isContentEditable();
 }
 
+static bool enabledInEditableTextOrCaretBrowsing(Frame* frame, Event* event, EditorCommandSource)
+{
+    // The EditorCommandSource parameter is unused in enabledInEditableText, so just pass a dummy variable
+    return caretBrowsingEnabled(frame) || enabledInEditableText(frame, event, dummyEditorCommandSource);
+}
+
 static bool enabledInRichlyEditableText(Frame* frame, Event*, EditorCommandSource)
 {
     return frame->selection()->isCaretOrRange() && frame->selection()->isContentRichlyEditable();
@@ -1193,7 +1214,7 @@ static TriState stateOrderedList(Frame* frame, Event*)
 
 static TriState stateStrikethrough(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "line-through");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "line-through");
 }
 
 static TriState stateStyleWithCSS(Frame* frame, Event*)
@@ -1228,7 +1249,7 @@ static TriState stateTextWritingDirectionRightToLeft(Frame* frame, Event*)
 
 static TriState stateUnderline(Frame* frame, Event*)
 {
-    return stateStyle(frame, CSSPropertyTextDecoration, "underline");
+    return stateStyle(frame, CSSPropertyWebkitTextDecorationsInEffect, "underline");
 }
 
 static TriState stateUnorderedList(Frame* frame, Event*)
@@ -1329,20 +1350,20 @@ static const CommandMap& createCommandMap()
         { "MakeTextWritingDirectionRightToLeft", { executeMakeTextWritingDirectionRightToLeft, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateTextWritingDirectionRightToLeft, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackward", { executeMoveBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveBackwardAndModifySelection", { executeMoveBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDown", { executeMoveDown, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveDownAndModifySelection", { executeMoveDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForward", { executeMoveForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveForwardAndModifySelection", { executeMoveForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeft", { executeMoveLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveLeftAndModifySelection", { executeMoveLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDown", { executeMovePageDown, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageDownAndModifySelection", { executeMovePageDownAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUp", { executeMovePageUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MovePageUpAndModifySelection", { executeMovePageUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphBackwardAndModifySelection", { executeMoveParagraphBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveParagraphForwardAndModifySelection", { executeMoveParagraphForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRight", { executeMoveRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveRightAndModifySelection", { executeMoveRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocument", { executeMoveToBeginningOfDocument, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfDocumentAndModifySelection", { executeMoveToBeginningOfDocumentAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToBeginningOfLine", { executeMoveToBeginningOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1363,16 +1384,16 @@ static const CommandMap& createCommandMap()
         { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackwardAndModifySelection", { executeMoveWordBackwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForward", { executeMoveWordForward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordForwardAndModifySelection", { executeMoveWordForwardAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeft", { executeMoveWordLeft, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordLeftAndModifySelection", { executeMoveWordLeftAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRight", { executeMoveWordRight, supportedFromMenuOrKeyBinding, enabledInEditableTextOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveWordRightAndModifySelection", { executeMoveWordRightAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelectionOrCaretBrowsing, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Outdent", { executeOutdent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Paste", { executePaste, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "PasteAndMatchStyle", { executePasteAndMatchStyle, supportedPaste, enabledPaste, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index 8c4ba01..308ba74 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -121,12 +121,6 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& startOfCu
         targetBlockquote = 0;
 }
 
-bool IndentOutdentCommand::isAtUnsplittableElement(const Position& pos) const
-{
-    Node* node = pos.node();
-    return node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell);
-}
-
 // Enclose all nodes between start and end by newParent, which is a sibling node of nodes between start and end
 // FIXME: moveParagraph is overly complicated.  We need to clean up moveParagraph so that it uses appendParagraphIntoNode
 // or prepare more specialized functions and delete moveParagraph
@@ -173,7 +167,7 @@ void IndentOutdentCommand::removeUnnecessaryLineBreakAt(const Position& endOfPar
     Node* parentNode = br->parentNode();
 
     // If the node isn't br or the parent node is empty, then don't remove.
-    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionBeforeNode(parentNode), positionAfterNode(parentNode)))
+    if (!br->hasTagName(brTag) || isVisiblyAdjacent(positionInParentBeforeNode(parentNode), positionInParentAfterNode(parentNode)))
         return;
 
     removeNodeAndPruneAncestors(br);
@@ -211,7 +205,7 @@ void IndentOutdentCommand::indentRegion()
             blockquoteForNextIndent = 0;
         else {
             VisiblePosition startOfCurrentParagraph = startOfParagraph(endOfCurrentParagraph);
-            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node());
+            Node* blockNode = enclosingBlock(endOfCurrentParagraph.deepEquivalent().node()->parentNode());
             // extend the region so that it contains all the ancestor blocks within the selection
             ExceptionCode ec;
             Element* unsplittableNode = unsplittableElementForPosition(endOfCurrentParagraph.deepEquivalent());
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index 104a0e7..d83128e 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -46,8 +46,6 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
-    // FIXME: Does this belong in htmlediting.cpp?
-    bool isAtUnsplittableElement(const Position&) const;
     void appendParagraphIntoNode(const VisiblePosition& start, const VisiblePosition& end, Node* newParent);
     void removeUnnecessaryLineBreakAt(const Position& endOfParagraph);
 
diff --git a/WebCore/editing/InsertLineBreakCommand.cpp b/WebCore/editing/InsertLineBreakCommand.cpp
index f020459..caaae0a 100644
--- a/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/WebCore/editing/InsertLineBreakCommand.cpp
@@ -125,12 +125,12 @@ void InsertLineBreakCommand::doApply()
         if (!isStartOfParagraph(VisiblePosition(Position(nodeToInsert.get(), 0))))
             insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
         
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     // If we're inserting after all of the rendered text in a text node, or into a non-text node,
     // a simple insertion is sufficient.
     } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
-        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionInParentAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
         // Split a text node
         ASSERT(pos.node()->isTextNode());
@@ -144,7 +144,7 @@ void InsertLineBreakCommand::doApply()
         // Handle whitespace that occurs after the split
         updateLayout();
         if (!endingPosition.isRenderedCharacter()) {
-            Position positionBeforeTextNode(positionBeforeNode(textNode));
+            Position positionBeforeTextNode(positionInParentBeforeNode(textNode));
             // Clear out all whitespace and insert one non-breaking space
             deleteInsignificantTextDownstream(endingPosition);
             ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
diff --git a/WebCore/editing/InsertListCommand.cpp b/WebCore/editing/InsertListCommand.cpp
index ec707d2..beb5d08 100644
--- a/WebCore/editing/InsertListCommand.cpp
+++ b/WebCore/editing/InsertListCommand.cpp
@@ -251,7 +251,7 @@ void InsertListCommand::doApply()
             // Also avoid the containing list item.
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
-                insertionPos = positionBeforeNode(listChild);
+                insertionPos = positionInParentBeforeNode(listChild);
 
             insertNodeAt(listElement, insertionPos);
 
diff --git a/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index c5fbf0a..695f46a 100644
--- a/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -103,6 +103,30 @@ bool InsertParagraphSeparatorCommand::shouldUseDefaultParagraphElement(Node* enc
            enclosingBlock->hasTagName(h5Tag);
 }
 
+void InsertParagraphSeparatorCommand::getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors)
+{
+    ancestors.clear();
+    
+    // Build up list of ancestors elements between the insertion node and the outer block.
+    if (insertionNode != outerBlock) {
+        for (Element* n = insertionNode->parentElement(); n && n != outerBlock; n = n->parentElement())
+            ancestors.append(n);
+    }
+}
+
+PassRefPtr<Element> InsertParagraphSeparatorCommand::cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert)
+{
+    // Make clones of ancestors in between the start node and the start block.
+    RefPtr<Element> parent = blockToInsert;
+    for (size_t i = ancestors.size(); i != 0; --i) {
+        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
+        appendNode(child, parent);
+        parent = child.release();
+    }
+    
+    return parent.release();
+}
+
 void InsertParagraphSeparatorCommand::doApply()
 {
     bool splitText = false;
@@ -193,12 +217,18 @@ void InsertParagraphSeparatorCommand::doApply()
             insertNodeAfter(blockToInsert, startBlock);
         }
 
-        appendBlockPlaceholder(blockToInsert);
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        if (shouldApplyStyleAfterInsertion)
-            applyStyleAfterInsertion(startBlock);
+        // Recreate the same structure in the new paragraph.
+        
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);      
+        RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
+        
+        appendBlockPlaceholder(parent);
+
+        setEndingSelection(VisibleSelection(Position(parent.get(), 0), DOWNSTREAM));
         return;
     }
+    
 
     //---------------------------------------------------------------------
     // Handle case when position is in the first visible position in its block, and
@@ -217,9 +247,15 @@ void InsertParagraphSeparatorCommand::doApply()
         insertionPosition = insertionPosition.downstream();
         
         insertNodeBefore(blockToInsert, refNode);
-        appendBlockPlaceholder(blockToInsert.get());
-        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        applyStyleAfterInsertion(startBlock);
+
+        // Recreate the same structure in the new paragraph.
+
+        Vector<Element*> ancestors;
+        getAncestorsInsideBlock(positionAvoidingSpecialElementBoundary(insertionPosition).node(), startBlock, ancestors);
+        
+        appendBlockPlaceholder(cloneHierarchyUnderNewBlock(ancestors, blockToInsert));
+        
+        // In this case, we need to set the new ending selection.
         setEndingSelection(VisibleSelection(insertionPosition, DOWNSTREAM));
         return;
     }
@@ -234,7 +270,7 @@ void InsertParagraphSeparatorCommand::doApply()
     if (isStartOfParagraph(visiblePos)) {
         RefPtr<Element> br = createBreakElement(document());
         insertNodeAt(br.get(), insertionPosition);
-        insertionPosition = positionAfterNode(br.get());
+        insertionPosition = positionInParentAfterNode(br.get());
     }
     
     // Move downstream. Typing style code will take care of carrying along the 
@@ -248,10 +284,7 @@ void InsertParagraphSeparatorCommand::doApply()
 
     // Build up list of ancestors in between the start node and the start block.
     Vector<Element*> ancestors;
-    if (insertionPosition.node() != startBlock) {
-        for (Element* n = insertionPosition.node()->parentElement(); n && n != startBlock; n = n->parentElement())
-            ancestors.append(n);
-    }
+    getAncestorsInsideBlock(insertionPosition.node(), startBlock, ancestors);
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
@@ -284,13 +317,8 @@ void InsertParagraphSeparatorCommand::doApply()
 
     updateLayout();
     
-    // Make clones of ancestors in between the start node and the start block.
-    RefPtr<Element> parent = blockToInsert;
-    for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
-        appendNode(child, parent);
-        parent = child.release();
-    }
+    // Make clones of ancestors in between the start node and the outer block.
+    RefPtr<Element> parent = cloneHierarchyUnderNewBlock(ancestors, blockToInsert);
 
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
diff --git a/WebCore/editing/InsertParagraphSeparatorCommand.h b/WebCore/editing/InsertParagraphSeparatorCommand.h
index 01c08bf..23ee51c 100644
--- a/WebCore/editing/InsertParagraphSeparatorCommand.h
+++ b/WebCore/editing/InsertParagraphSeparatorCommand.h
@@ -44,6 +44,8 @@ private:
 
     void calculateStyleBeforeInsertion(const Position&);
     void applyStyleAfterInsertion(Node* originalEnclosingBlock);
+    void getAncestorsInsideBlock(const Node* insertionNode, Element* outerBlock, Vector<Element*>& ancestors);
+    PassRefPtr<Element> cloneHierarchyUnderNewBlock(const Vector<Element*>& ancestors, PassRefPtr<Element> blockToInsert);
     
     bool shouldUseDefaultParagraphElement(Node*) const;
 
diff --git a/WebCore/editing/InsertTextCommand.cpp b/WebCore/editing/InsertTextCommand.cpp
index 6b0af9b..f10d71b 100644
--- a/WebCore/editing/InsertTextCommand.cpp
+++ b/WebCore/editing/InsertTextCommand.cpp
@@ -145,7 +145,7 @@ void InsertTextCommand::input(const String& text, bool selectInsertedText)
     
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
-    Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
+    Position positionBeforeStartNode(positionInParentBeforeNode(startPosition.node()));
     deleteInsignificantText(startPosition.upstream(), startPosition.downstream());
     if (!startPosition.node()->inDocument())
         startPosition = positionBeforeStartNode;
diff --git a/WebCore/editing/ReplaceSelectionCommand.cpp b/WebCore/editing/ReplaceSelectionCommand.cpp
index 8ae083c..b40dab2 100644
--- a/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -528,7 +528,7 @@ VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
 {
     // Return the inserted content's first VisiblePosition.
-    return VisiblePosition(nextCandidate(positionBeforeNode(m_firstNodeInserted.get())));
+    return VisiblePosition(nextCandidate(positionInParentBeforeNode(m_firstNodeInserted.get())));
 }
 
 // Remove style spans before insertion if they are unnecessary.  It's faster because we'll 
@@ -695,8 +695,17 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     
     VisiblePosition destination = mergeForward ? endOfInsertedContent.next() : endOfInsertedContent;
     VisiblePosition startOfParagraphToMove = mergeForward ? startOfParagraph(endOfInsertedContent) : endOfInsertedContent.next();
+   
+    // Merging forward could result in deleting the destination anchor node.
+    // To avoid this, we add a placeholder node before the start of the paragraph.
+    if (endOfParagraph(startOfParagraphToMove) == destination) {
+        RefPtr<Node> placeholder = createBreakElement(document());
+        insertNodeBefore(placeholder, startOfParagraphToMove.deepEquivalent().node());
+        destination = VisiblePosition(Position(placeholder.get(), 0));
+    }
 
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
+    
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
     // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
@@ -705,6 +714,10 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
             m_firstNodeInserted = endingSelection().visibleStart().deepEquivalent().node();
+        // If we merged text nodes, m_lastLeafInserted could be null. If this is the case,
+        // we use m_firstNodeInserted.
+        if (!m_lastLeafInserted)
+            m_lastLeafInserted = m_firstNodeInserted;
     }
 }
 
@@ -794,7 +807,7 @@ void ReplaceSelectionCommand::doApply()
         Node* br = endingSelection().start().node(); 
         ASSERT(br->hasTagName(brTag)); 
         // Insert content between the two blockquotes, but remove the br (since it was just a placeholder). 
-        insertionPos = positionBeforeNode(br); 
+        insertionPos = positionInParentBeforeNode(br);
         removeNode(br);
     }
     
@@ -817,9 +830,9 @@ void ReplaceSelectionCommand::doApply()
         ASSERT(startBlock != currentRoot);
         VisiblePosition visibleInsertionPos(insertionPos);
         if (isEndOfBlock(visibleInsertionPos) && !(isStartOfBlock(visibleInsertionPos) && fragment.hasInterchangeNewlineAtEnd()))
-            insertionPos = positionAfterNode(startBlock);
+            insertionPos = positionInParentAfterNode(startBlock);
         else if (isStartOfBlock(visibleInsertionPos))
-            insertionPos = positionBeforeNode(startBlock);
+            insertionPos = positionInParentBeforeNode(startBlock);
     }
 
     // Paste into run of tabs splits the tab span.
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index b6874d6..7d99916 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -90,7 +90,8 @@ void SelectionController::moveTo(const Position &pos, EAffinity affinity, bool u
 
 void SelectionController::moveTo(const Range *r, EAffinity affinity, bool userTriggered)
 {
-    setSelection(VisibleSelection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
+    VisibleSelection selection = r ? VisibleSelection(r->startPosition(), r->endPosition(), affinity) : VisibleSelection(Position(), Position(), affinity);
+    setSelection(selection, true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &base, const Position &extent, EAffinity affinity, bool userTriggered)
diff --git a/WebCore/editing/SplitTextNodeCommand.cpp b/WebCore/editing/SplitTextNodeCommand.cpp
index 07a54e3..3b04e01 100644
--- a/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/WebCore/editing/SplitTextNodeCommand.cpp
@@ -55,7 +55,7 @@ void SplitTextNodeCommand::doApply()
     if (prefixText.isEmpty())
         return;
 
-    RefPtr<Text> prefixTextNode = new Text(document(), prefixText);
+    RefPtr<Text> prefixTextNode = Text::create(document(), prefixText);
     ASSERT(prefixTextNode);
     document()->copyMarkers(m_text2.get(), 0, m_offset, prefixTextNode.get(), 0);
 
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index 08fda16..d36849c 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -33,7 +33,6 @@
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
-#include "Position.h"
 #include "Range.h"
 #include "RenderTableCell.h"
 #include "RenderTableRow.h"
@@ -941,7 +940,7 @@ SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range* r)
     if (!endNode->offsetInCharacters()) {
         if (endOffset > 0 && endOffset <= static_cast<int>(endNode->childNodeCount())) {
             endNode = endNode->childNode(endOffset - 1);
-            endOffset = endNode->offsetInCharacters() ? endNode->maxCharacterOffset() : endNode->childNodeCount();
+            endOffset = lastOffsetInNode(endNode);
         }
     }
 
diff --git a/WebCore/editing/UnlinkCommand.cpp b/WebCore/editing/UnlinkCommand.cpp
index 0ba9a06..7234a3b 100644
--- a/WebCore/editing/UnlinkCommand.cpp
+++ b/WebCore/editing/UnlinkCommand.cpp
@@ -37,14 +37,13 @@ UnlinkCommand::UnlinkCommand(Document* document)
 
 void UnlinkCommand::doApply()
 {
-    // FIXME: If a caret is inside a link, remove it.
+    // FIXME: If a caret is inside a link, we should remove it, but currently we don't.
     if (!endingSelection().isRange())
         return;
         
     pushPartiallySelectedAnchorElementsDown();
 
-    HTMLAnchorElement* anchorElement = new HTMLAnchorElement(document());
-    removeStyledElement(anchorElement);
+    removeStyledElement(HTMLAnchorElement::create(document()));
 }
 
 }
diff --git a/WebCore/editing/VisibleSelection.cpp b/WebCore/editing/VisibleSelection.cpp
index 56ad6b3..8adfd71 100644
--- a/WebCore/editing/VisibleSelection.cpp
+++ b/WebCore/editing/VisibleSelection.cpp
@@ -511,7 +511,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = lastDeepEditingPositionForNode(shadowAncestor);
             }
@@ -540,7 +540,7 @@ void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
-                p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+                p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
                     p = Position(shadowAncestor, 0);
             }
diff --git a/WebCore/editing/haiku/EditorHaiku.cpp b/WebCore/editing/haiku/EditorHaiku.cpp
index 17fde1f..723d4ff 100644
--- a/WebCore/editing/haiku/EditorHaiku.cpp
+++ b/WebCore/editing/haiku/EditorHaiku.cpp
@@ -28,9 +28,8 @@
 #include "config.h"
 #include "Editor.h"
 
-#include "ClipboardAccessPolicy.h"
 #include "Clipboard.h"
-
+#include "ClipboardAccessPolicy.h"
 #include "ClipboardHaiku.h"
 
 
@@ -38,7 +37,7 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 {
-    return new ClipboardHaiku(policy, false);
+    return ClipboardHaiku::create(policy, false);
 }
 
 } // namespace WebCore
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index 4124c48..d19ef6b 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -183,6 +183,13 @@ bool isEditablePosition(const Position& p)
     return node->isContentEditable();
 }
 
+bool isAtUnsplittableElement(const Position& pos)
+{
+    Node* node = pos.node();
+    return (node == editableRootForPosition(pos) || node == enclosingNodeOfType(pos, &isTableCell));
+}
+    
+    
 bool isRichlyEditablePosition(const Position& p)
 {
     Node* node = p.node();
@@ -280,7 +287,7 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
             p = lastDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -301,7 +308,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
             p = firstDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
-        p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
+        p = isAtomicNode(p.node()) ? positionInParentBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
     
     if (p.node() && !p.node()->isDescendantOf(highestRoot))
         return VisiblePosition();
@@ -339,7 +346,7 @@ Position rangeCompliantEquivalent(const Position& pos)
 
     if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
-            return positionBeforeNode(node);
+            return positionInParentBeforeNode(node);
         return Position(node, 0);
     }
 
@@ -349,7 +356,7 @@ Position rangeCompliantEquivalent(const Position& pos)
     int maxCompliantOffset = node->childNodeCount();
     if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
-            return positionAfterNode(node);
+            return positionInParentAfterNode(node);
 
         // there is no other option at this point than to
         // use the highest allowed position in the node
@@ -359,11 +366,11 @@ Position rangeCompliantEquivalent(const Position& pos)
     // Editing should never generate positions like this.
     if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
-        return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
+        return node->parentNode() ? positionInParentBeforeNode(node) : Position(node, 0);
     }
     
     if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
-        return positionAfterNode(node);
+        return positionInParentAfterNode(node);
     
     return Position(pos);
 }
@@ -384,10 +391,10 @@ int lastOffsetForEditing(const Node* node)
         return 0;
     if (node->offsetInCharacters())
         return node->maxCharacterOffset();
-        
+
     if (node->hasChildNodes())
         return node->childNodeCount();
-    
+
     // NOTE: This should preempt the childNodeCount for, e.g., select nodes
     if (editingIgnoresContent(node))
         return 1;
@@ -459,24 +466,30 @@ bool isSpecialElement(const Node *n)
 }
 
 // Checks if a string is a valid tag for the FormatBlockCommand function of execCommand. Expects lower case strings.
-bool validBlockTag(const String& blockTag)
-{
-    if (blockTag == "address" ||
-        blockTag == "blockquote" ||
-        blockTag == "dd" ||
-        blockTag == "div" ||
-        blockTag == "dl" ||
-        blockTag == "dt" ||
-        blockTag == "h1" ||
-        blockTag == "h2" ||
-        blockTag == "h3" ||
-        blockTag == "h4" ||
-        blockTag == "h5" ||
-        blockTag == "h6" ||
-        blockTag == "p" ||
-        blockTag == "pre")
-        return true;
-    return false;
+bool validBlockTag(const AtomicString& blockTag)
+{
+    if (blockTag.isEmpty())
+        return false;
+
+    DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
+    if (blockTags.isEmpty()) {
+        blockTags.add(addressTag.localName());
+        blockTags.add(blockquoteTag.localName());
+        blockTags.add(ddTag.localName());
+        blockTags.add(divTag.localName());
+        blockTags.add(dlTag.localName());
+        blockTags.add(dtTag.localName());
+        blockTags.add(h1Tag.localName());
+        blockTags.add(h2Tag.localName());
+        blockTags.add(h3Tag.localName());
+        blockTags.add(h4Tag.localName());
+        blockTags.add(h5Tag.localName());
+        blockTags.add(h6Tag.localName());
+        blockTags.add(navTag.localName());
+        blockTags.add(pTag.localName());
+        blockTags.add(preTag.localName());
+    }
+    return blockTags.contains(blockTag);
 }
 
 static Node* firstInSpecialElement(const Position& pos)
@@ -519,7 +532,7 @@ Position positionBeforeContainingSpecialElement(const Position& pos, Node** cont
     Node* n = firstInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionBeforeNode(n);
+    Position result = positionInParentBeforeNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -537,7 +550,7 @@ Position positionAfterContainingSpecialElement(const Position& pos, Node **conta
     Node* n = lastInSpecialElement(pos);
     if (!n)
         return pos;
-    Position result = positionAfterNode(n);
+    Position result = positionInParentAfterNode(n);
     if (result.isNull() || result.node()->rootEditableElement() != pos.node()->rootEditableElement())
         return pos;
     if (containingSpecialElement)
@@ -572,20 +585,6 @@ Node* isLastPositionBeforeTable(const VisiblePosition& visiblePosition)
     return 0;
 }
 
-Position positionBeforeNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex());
-}
-
-Position positionAfterNode(const Node* node)
-{
-    ASSERT(node);
-    // FIXME: Should ASSERT(node->parentNode()) but doing so results in editing/deleting/delete-ligature-001.html crashing
-    return Position(node->parentNode(), node->nodeIndex() + 1);
-}
-
 // Returns the visible position at the beginning of a node
 VisiblePosition visiblePositionBeforeNode(Node* node)
 {
@@ -593,7 +592,7 @@ VisiblePosition visiblePositionBeforeNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, 0, DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 // Returns the visible position at the ending of a node
@@ -603,7 +602,7 @@ VisiblePosition visiblePositionAfterNode(Node* node)
     if (node->childNodeCount())
         return VisiblePosition(node, node->childNodeCount(), DOWNSTREAM);
     ASSERT(node->parentNode());
-    return positionAfterNode(node);
+    return positionInParentAfterNode(node);
 }
 
 // Create a range object with two visible positions, start and end.
@@ -818,7 +817,7 @@ bool canMergeLists(Element* firstList, Element* secondList)
     return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
     && firstList->isContentEditable() && secondList->isContentEditable()// both lists are editable
     && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
-    && isVisiblyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    && isVisiblyAdjacent(positionInParentAfterNode(firstList), positionInParentBeforeNode(secondList));
     // Make sure there is no visible content between this li and the previous list
 }
 
@@ -908,7 +907,7 @@ Position positionBeforeTabSpan(const Position& pos)
     else if (!isTabSpanNode(node))
         return pos;
     
-    return positionBeforeNode(node);
+    return positionInParentBeforeNode(node);
 }
 
 PassRefPtr<Element> createTabSpanElement(Document* document, PassRefPtr<Node> tabTextNode)
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index f98b149..f44181c 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -29,6 +29,7 @@
 #include <wtf/Forward.h>
 #include "HTMLNames.h"
 #include "ExceptionCode.h"
+#include "Position.h"
 
 namespace WebCore {
 
@@ -42,47 +43,146 @@ class String;
 class VisiblePosition;
 class VisibleSelection;
 
-Position rangeCompliantEquivalent(const Position&);
-Position rangeCompliantEquivalent(const VisiblePosition&);
+
+// This file contains a set of helper functions used by the editing commands
+
+// -------------------------------------------------------------------------
+// Node
+// -------------------------------------------------------------------------
+
+// Functions returning Node
+
+Node* highestAncestor(Node*);
+Node* highestEditableRoot(const Position&);
+Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
+Node* lowestEditableAncestor(Node*);   
+
+Node* enclosingBlock(Node*);
+Node* enclosingTableCell(const Position&);
+Node* enclosingEmptyListItem(const VisiblePosition&);
+Node* enclosingAnchorElement(const Position&);
+Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
+Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
+
+Node* tabSpanNode(const Node*);
+Node* nearestMailBlockquote(const Node*);
+Node* isLastPositionBeforeTable(const VisiblePosition&);
+Node* isFirstPositionAfterTable(const VisiblePosition&);
+
+// offset functions on Node
+
 int lastOffsetForEditing(const Node*);
-bool isAtomicNode(const Node*);
+int caretMinOffset(const Node*);
+int caretMaxOffset(const Node*);
+
+// boolean functions on Node
+
 bool editingIgnoresContent(const Node*);
 bool canHaveChildrenForEditing(const Node*);
-Node* highestEditableRoot(const Position&);
-VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
-VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
-int comparePositions(const Position&, const Position&);
-int comparePositions(const VisiblePosition&, const VisiblePosition&);
-Node* lowestEditableAncestor(Node*);
+bool isAtomicNode(const Node*);
+bool isBlock(const Node*);
+bool isSpecialElement(const Node*);
+bool isTabSpanNode(const Node*);
+bool isTabSpanTextNode(const Node*);
+bool isMailBlockquote(const Node*);
+bool isTableElement(Node*);
+bool isTableCell(const Node*);
+bool isTableStructureNode(const Node*);
+bool isListElement(Node*);
+bool isNodeRendered(const Node*);
+bool isNodeVisiblyContainedWithin(Node*, const Range*);
+    
+    
+// -------------------------------------------------------------------------
+// Position
+// -------------------------------------------------------------------------
+    
+// Functions returning Position
+    
+Position rangeCompliantEquivalent(const Position&);
+Position rangeCompliantEquivalent(const VisiblePosition&);
+    
 Position nextCandidate(const Position&);
-Position nextVisuallyDistinctCandidate(const Position&);
 Position previousCandidate(const Position&);
+    
+Position nextVisuallyDistinctCandidate(const Position&);
 Position previousVisuallyDistinctCandidate(const Position&);
+
+Position positionBeforeTabSpan(const Position&);
+Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
+    
+// Position creation functions are inline to prevent ref-churn.
+// Other Position creation functions are in Position.h
+// but these depend on lastOffsetForEditing which is defined in htmlediting.h.
+
+// NOTE: first/lastDeepEditingPositionForNode return legacy editing positions (like [img, 0])
+// for elements which editing ignores.  The rest of the editing code will treat [img, 0]
+// as "the last position before the img".
+// New code should use the creation functions in Position.h instead.
+inline Position firstDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, 0);
+}
+
+inline Position lastDeepEditingPositionForNode(Node* anchorNode)
+{
+    ASSERT(anchorNode);
+    return Position(anchorNode, lastOffsetForEditing(anchorNode));
+}
+       
+// comparision functions on Position
+    
+int comparePositions(const Position&, const Position&);
+
+// boolean functions on Position
+    
 bool isEditablePosition(const Position&);
 bool isRichlyEditablePosition(const Position&);
-Element* editableRootForPosition(const Position&);
-Element* unsplittableElementForPosition(const Position&);
-bool isBlock(const Node*);
-Node* enclosingBlock(Node*);
+bool isFirstVisiblePositionInSpecialElement(const Position&);
+bool isLastVisiblePositionInSpecialElement(const Position&);
+bool lineBreakExistsAtPosition(const Position&);
+bool isVisiblyAdjacent(const Position& first, const Position& second);
+bool isAtUnsplittableElement(const Position&);
 
-String stringWithRebalancedWhitespace(const String&, bool, bool);
-const String& nonBreakingSpaceString();
+// miscellaneous functions on Position
 
-//------------------------------------------------------------------------------------------
+unsigned numEnclosingMailBlockquotes(const Position&);
 
-Position positionBeforeNode(const Node*);
-Position positionAfterNode(const Node*);
+// -------------------------------------------------------------------------
+// VisiblePosition
+// -------------------------------------------------------------------------
+    
+// Functions returning VisiblePosition
+    
+VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
+VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 VisiblePosition visiblePositionBeforeNode(Node*);
 VisiblePosition visiblePositionAfterNode(Node*);
+
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
+int indexForVisiblePosition(const VisiblePosition&);
+
+// -------------------------------------------------------------------------
+// Range
+// -------------------------------------------------------------------------
+
+// Functions returning Range
+
 PassRefPtr<Range> createRange(PassRefPtr<Document>, const VisiblePosition& start, const VisiblePosition& end, ExceptionCode&);
 PassRefPtr<Range> extendRangeToWrappingNodes(PassRefPtr<Range> rangeToExtend, const Range* maximumRange, const Node* rootNode);
-
 PassRefPtr<Range> avoidIntersectionWithNode(const Range*, Node*);
-VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
-
-bool isSpecialElement(const Node*);
-bool validBlockTag(const String&);
 
+// -------------------------------------------------------------------------
+// HTMLElement
+// -------------------------------------------------------------------------
+    
+// Functions returning HTMLElement
+    
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document*);
 PassRefPtr<HTMLElement> createBreakElement(Document*);
 PassRefPtr<HTMLElement> createOrderedListElement(Document*);
@@ -91,57 +191,45 @@ PassRefPtr<HTMLElement> createListItemElement(Document*);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const QualifiedName&);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
-bool isTabSpanNode(const Node*);
-bool isTabSpanTextNode(const Node*);
-Node* tabSpanNode(const Node*);
-Position positionBeforeTabSpan(const Position&);
+HTMLElement* enclosingList(Node*);
+HTMLElement* outermostEnclosingList(Node*);
+HTMLElement* enclosingListChild(Node*);
+
+// -------------------------------------------------------------------------
+// Element
+// -------------------------------------------------------------------------
+    
+// Functions returning Element
+    
 PassRefPtr<Element> createTabSpanElement(Document*);
 PassRefPtr<Element> createTabSpanElement(Document*, PassRefPtr<Node> tabTextNode);
 PassRefPtr<Element> createTabSpanElement(Document*, const String& tabText);
-
-bool isNodeRendered(const Node*);
-bool isMailBlockquote(const Node*);
-Node* nearestMailBlockquote(const Node*);
-unsigned numEnclosingMailBlockquotes(const Position&);
-int caretMinOffset(const Node*);
-int caretMaxOffset(const Node*);
-
-//------------------------------------------------------------------------------------------
-
-bool isTableStructureNode(const Node*);
 PassRefPtr<Element> createBlockPlaceholderElement(Document*);
 
-bool isFirstVisiblePositionInSpecialElement(const Position&);
-Position positionBeforeContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-bool isLastVisiblePositionInSpecialElement(const Position&);
-Position positionAfterContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Position positionOutsideContainingSpecialElement(const Position&, Node** containingSpecialElement=0);
-Node* isLastPositionBeforeTable(const VisiblePosition&);
-Node* isFirstPositionAfterTable(const VisiblePosition&);
+Element* editableRootForPosition(const Position&);
+Element* unsplittableElementForPosition(const Position&);
 
-Node* enclosingNodeWithTag(const Position&, const QualifiedName&);
-Node* enclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*), bool onlyReturnEditableNodes = true);
-Node* highestEnclosingNodeOfType(const Position&, bool (*nodeIsOfType)(const Node*));
-Node* enclosingTableCell(const Position&);
-Node* enclosingEmptyListItem(const VisiblePosition&);
-Node* enclosingAnchorElement(const Position&);
-bool isListElement(Node*);
-HTMLElement* enclosingList(Node*);
-HTMLElement* outermostEnclosingList(Node*);
-HTMLElement* enclosingListChild(Node*);
+// Boolean functions on Element
+    
 bool canMergeLists(Element* firstList, Element* secondList);
-Node* highestAncestor(Node*);
-bool isTableElement(Node*);
-bool isTableCell(const Node*);
-
-bool lineBreakExistsAtPosition(const Position&);
-bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
+    
+// -------------------------------------------------------------------------
+// VisibleSelection
+// -------------------------------------------------------------------------
+    
+// Functions returning VisibleSelection
 
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
+    
+
+// Miscellaneous functions on String
+    
+String stringWithRebalancedWhitespace(const String&, bool, bool);
+const String& nonBreakingSpaceString();
+bool validBlockTag(const AtomicString&);
+    
 
-int indexForVisiblePosition(const VisiblePosition&);
-bool isVisiblyAdjacent(const Position& first, const Position& second);
-bool isNodeVisiblyContainedWithin(Node*, const Range*);
 }
 
 #endif
diff --git a/WebCore/editing/mac/SelectionControllerMac.mm b/WebCore/editing/mac/SelectionControllerMac.mm
index 5970f99..47fb434 100644
--- a/WebCore/editing/mac/SelectionControllerMac.mm
+++ b/WebCore/editing/mac/SelectionControllerMac.mm
@@ -38,7 +38,7 @@ void SelectionController::notifyAccessibilityForSelectionChange()
     Document* document = m_frame->document();
 
     if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull())
-        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), "AXSelectedTextChanged", false);
+        document->axObjectCache()->postNotification(m_sel.start().node()->renderer(), AXObjectCache::AXSelectedTextChanged, false);
 
     // if zoom feature is enabled, insertion point changes should update the zoom
     if (!UAZoomEnabled() || !m_sel.isCaret())
diff --git a/WebCore/editing/markup.cpp b/WebCore/editing/markup.cpp
index 14ce7f6..47714e7 100644
--- a/WebCore/editing/markup.cpp
+++ b/WebCore/editing/markup.cpp
@@ -420,7 +420,7 @@ static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Ran
         case Node::COMMENT_NODE:
             // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
             append(result, "<!--");
-            append(result, static_cast<const Comment*>(node)->nodeValue());
+            append(result, static_cast<const Comment*>(node)->data());
             append(result, "-->");
             break;
         case Node::DOCUMENT_NODE:
@@ -645,7 +645,7 @@ static void completeURLs(Node* node, const String& baseURL)
 {
     Vector<AttributeChange> changes;
 
-    KURL parsedBaseURL(baseURL);
+    KURL parsedBaseURL(ParsedURLString, baseURL);
 
     Node* end = node->traverseNextSibling();
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
@@ -983,8 +983,16 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
                     fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (fullySelectedRootStyle->length())
+                if (fullySelectedRootStyle->length()) {
+                    // Reset the CSS properties to avoid an assertion error in addStyleMarkup().
+                    // This assertion is caused at least when we select all text of a <body> element whose
+                    // 'text-decoration' property is "inherit", and copy it.
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyTextDecoration))
+                        fullySelectedRootStyle->setProperty(CSSPropertyTextDecoration, CSSValueNone);
+                    if (!propertyMissingOrEqualToNone(fullySelectedRootStyle.get(), CSSPropertyWebkitTextDecorationsInEffect))
+                        fullySelectedRootStyle->setProperty(CSSPropertyWebkitTextDecorationsInEffect, CSSValueNone);
                     addStyleMarkup(preMarkups, markups, fullySelectedRootStyle.get(), document, true);
+                }
             } else {
                 // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
                 // so that styles that affect the exterior of the node are not included.
diff --git a/WebCore/editing/visible_units.cpp b/WebCore/editing/visible_units.cpp
index 869c893..c96fdfd 100644
--- a/WebCore/editing/visible_units.cpp
+++ b/WebCore/editing/visible_units.cpp
@@ -611,7 +611,7 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
@@ -712,7 +712,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         Node* node = renderer->node();
         if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->lineTop()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
diff --git a/WebCore/editing/wx/EditorWx.cpp b/WebCore/editing/wx/EditorWx.cpp
index 0a63215..cb9e836 100644
--- a/WebCore/editing/wx/EditorWx.cpp
+++ b/WebCore/editing/wx/EditorWx.cpp
@@ -27,6 +27,7 @@
 #include "Editor.h"
 
 #include "ClipboardWx.h"
+#include "NotImplemented.h"
 
 namespace WebCore {
 
@@ -35,4 +36,19 @@ PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
     return ClipboardWx::create(policy, true);
 }
 
+void Editor::showColorPanel()
+{
+    notImplemented();
+}
+
+void Editor::showFontPanel()
+{
+    notImplemented();
+}
+
+void Editor::showStylesPanel()
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/history/CachedFrame.cpp b/WebCore/history/CachedFrame.cpp
index 5f4e746..16c7087 100644
--- a/WebCore/history/CachedFrame.cpp
+++ b/WebCore/history/CachedFrame.cpp
@@ -29,10 +29,13 @@
 #include "CachedFramePlatformData.h"
 #include "CString.h"
 #include "DocumentLoader.h"
+#include "ExceptionCode.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "Logging.h"
+#include "PageTransitionEvent.h"
 #include <wtf/RefCountedLeakCounter.h>
 
 #if ENABLE(SVG)
@@ -49,12 +52,58 @@ static WTF::RefCountedLeakCounter& cachedFrameCounter()
 }
 #endif
 
-CachedFrame::CachedFrame(Frame* frame)
+CachedFrameBase::CachedFrameBase(Frame* frame)
     : m_document(frame->document())
     , m_documentLoader(frame->loader()->documentLoader())
     , m_view(frame->view())
     , m_mousePressNode(frame->eventHandler()->mousePressNode())
     , m_url(frame->loader()->url())
+    , m_isMainFrame(!frame->tree()->parent())
+{
+}
+
+CachedFrameBase::~CachedFrameBase()
+{
+#ifndef NDEBUG
+    cachedFrameCounter().decrement();
+#endif
+    // CachedFrames should always have had destroy() called by their parent CachedPage
+    ASSERT(!m_document);
+}
+
+void CachedFrameBase::restore()
+{
+    ASSERT(m_document->view() == m_view);
+    
+    Frame* frame = m_view->frame();
+    m_cachedFrameScriptData->restore(frame);
+
+#if ENABLE(SVG)
+    if (m_document->svgExtensions())
+        m_document->accessSVGExtensions()->unpauseAnimations();
+#endif
+
+    frame->animation()->resumeAnimations(m_document.get());
+    frame->eventHandler()->setMousePressNode(m_mousePressNode.get());
+    m_document->resumeActiveDOMObjects();
+
+    // It is necessary to update any platform script objects after restoring the
+    // cached page.
+    frame->script()->updatePlatformScriptObjects();
+
+    // Reconstruct the FrameTree
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->appendChild(m_childFrames[i]->view()->frame());
+
+    // Open the child CachedFrames in their respective FrameLoaders.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        m_childFrames[i]->open();
+
+    m_document->dispatchWindowEvent(PageTransitionEvent::create(EventNames().pageshowEvent, true), m_document);
+}
+
+CachedFrame::CachedFrame(Frame* frame)
+    : CachedFrameBase(frame)
 {
 #ifndef NDEBUG
     cachedFrameCounter().increment();
@@ -67,46 +116,38 @@ CachedFrame::CachedFrame(Frame* frame)
     m_document->suspendActiveDOMObjects();
     m_cachedFrameScriptData.set(new ScriptCachedFrameData(frame));
     
+    // Custom scrollbar renderers will get reattached when the document comes out of the page cache
+    m_view->detachCustomScrollbars();
+
     m_document->documentWillBecomeInactive(); 
     frame->clearTimers();
     m_document->setInPageCache(true);
     
     frame->loader()->client()->savePlatformDataToCachedFrame(this);
 
+    // Create the CachedFrames for all Frames in the FrameTree.
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         m_childFrames.append(CachedFrame::create(child));
 
-    LOG(PageCache, "Finished creating CachedFrame with url %s and documentloader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
-}
+    // Deconstruct the FrameTree, to restore it later.
+    // We do this for two reasons:
+    // 1 - We reuse the main frame, so when it navigates to a new page load it needs to start with a blank FrameTree.
+    // 2 - It's much easier to destroy a CachedFrame while it resides in the PageCache if it is disconnected from its parent.
+    for (unsigned i = 0; i < m_childFrames.size(); ++i)
+        frame->tree()->removeChild(m_childFrames[i]->view()->frame());
 
-CachedFrame::~CachedFrame()
-{
 #ifndef NDEBUG
-    cachedFrameCounter().decrement();
+    if (m_isMainFrame)
+        LOG(PageCache, "Finished creating CachedFrame for main frame url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
+    else
+        LOG(PageCache, "Finished creating CachedFrame for child frame with url '%s' and DocumentLoader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
 #endif
-
-    clear();
 }
 
-void CachedFrame::restore()
+void CachedFrame::open()
 {
-    ASSERT(m_document->view() == m_view);
-    
-    Frame* frame = m_view->frame();
-    m_cachedFrameScriptData->restore(frame);
-
-#if ENABLE(SVG)
-    if (m_document->svgExtensions())
-        m_document->accessSVGExtensions()->unpauseAnimations();
-#endif
-
-    frame->animation()->resumeAnimations(m_document.get());
-    frame->eventHandler()->setMousePressNode(mousePressNode());
-    m_document->resumeActiveDOMObjects();
-
-    // It is necessary to update any platform script objects after restoring the
-    // cached page.
-    frame->script()->updatePlatformScriptObjects();
+    ASSERT(m_view);
+    m_view->frame()->loader()->open(*this);
 }
 
 void CachedFrame::clear()
@@ -114,26 +155,16 @@ void CachedFrame::clear()
     if (!m_document)
         return;
 
-    if (m_cachedFramePlatformData)
-        m_cachedFramePlatformData->clear();
-        
+    // clear() should only be called for Frames representing documents that are no longer in the page cache.
+    // This means the CachedFrame has been:
+    // 1 - Successfully restore()'d by going back/forward.
+    // 2 - destroy()'ed because the PageCache is pruning or the WebView was closed.
+    ASSERT(!m_document->inPageCache());
     ASSERT(m_view);
     ASSERT(m_document->frame() == m_view->frame());
 
-    if (m_document->inPageCache()) {
-        Frame::clearTimers(m_view.get(), m_document.get());
-
-        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
-        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
-        m_document->removeAllEventListeners();
-
-        m_document->setInPageCache(false);
-        // FIXME: We don't call willRemove here. Why is that OK?
-        m_document->detach();
-        m_view->clearFrame();
-    }
-
-    ASSERT(!m_document->inPageCache());
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->clear();
 
     m_document = 0;
     m_view = 0;
@@ -141,10 +172,44 @@ void CachedFrame::clear()
     m_url = KURL();
 
     m_cachedFramePlatformData.clear();
-
     m_cachedFrameScriptData.clear();
 }
 
+void CachedFrame::destroy()
+{
+    if (!m_document)
+        return;
+    
+    // Only CachedFrames that are still in the PageCache should be destroyed in this manner
+    ASSERT(m_document->inPageCache());
+    ASSERT(m_view);
+    ASSERT(m_document->frame() == m_view->frame());
+
+    if (!m_isMainFrame) {
+        m_view->frame()->detachFromPage();
+        m_view->frame()->loader()->detachViewsAndDocumentLoader();
+    }
+    
+    for (int i = m_childFrames.size() - 1; i >= 0; --i)
+        m_childFrames[i]->destroy();
+
+    if (m_cachedFramePlatformData)
+        m_cachedFramePlatformData->clear();
+
+    Frame::clearTimers(m_view.get(), m_document.get());
+
+    // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+    // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+    m_document->removeAllEventListeners();
+
+    m_document->setInPageCache(false);
+    // FIXME: We don't call willRemove here. Why is that OK?
+    m_document->detach();
+    m_view->clearFrame();
+
+    clear();
+}
+
 void CachedFrame::setCachedFramePlatformData(CachedFramePlatformData* data)
 {
     m_cachedFramePlatformData.set(data);
diff --git a/WebCore/history/CachedFrame.h b/WebCore/history/CachedFrame.h
index 0302444..883c12a 100644
--- a/WebCore/history/CachedFrame.h
+++ b/WebCore/history/CachedFrame.h
@@ -43,29 +43,20 @@ namespace WebCore {
 
 typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
 
-class CachedFrame : public RefCounted<CachedFrame> {
+class CachedFrameBase {
 public:
-    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
-    ~CachedFrame();
-
     void restore();
-    void clear();
 
     Document* document() const { return m_document.get(); }
-    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
     FrameView* view() const { return m_view.get(); }
-    Node* mousePressNode() const { return m_mousePressNode.get(); }
     const KURL& url() const { return m_url; }
     DOMWindow* domWindow() const { return m_cachedFrameScriptData->domWindow(); }
+    bool isMainFrame() { return m_isMainFrame; }
 
-    void setCachedFramePlatformData(CachedFramePlatformData*);
-    CachedFramePlatformData* cachedFramePlatformData();
+protected:
+    CachedFrameBase(Frame*);
+    ~CachedFrameBase();
     
-    int descendantFrameCount() const;
-
-private:
-    CachedFrame(Frame*);
-
     RefPtr<Document> m_document;
     RefPtr<DocumentLoader> m_documentLoader;
     RefPtr<FrameView> m_view;
@@ -73,10 +64,33 @@ private:
     KURL m_url;
     OwnPtr<ScriptCachedFrameData> m_cachedFrameScriptData;
     OwnPtr<CachedFramePlatformData> m_cachedFramePlatformData;
+    bool m_isMainFrame;
     
     CachedFrameVector m_childFrames;
 };
 
+class CachedFrame : public RefCounted<CachedFrame>, private CachedFrameBase {
+public:
+    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
+
+    void open();
+    void clear();
+    void destroy();
+
+    void setCachedFramePlatformData(CachedFramePlatformData* data);
+    CachedFramePlatformData* cachedFramePlatformData();
+
+    using CachedFrameBase::document;
+    using CachedFrameBase::view;
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    Node* mousePressNode() const { return m_mousePressNode.get(); }
+
+    int descendantFrameCount() const;
+
+private:
+    CachedFrame(Frame*);
+};
+
 } // namespace WebCore
 
 #endif // CachedFrame_h
diff --git a/WebCore/history/CachedPage.cpp b/WebCore/history/CachedPage.cpp
index 8898ce2..20c5fd7 100644
--- a/WebCore/history/CachedPage.cpp
+++ b/WebCore/history/CachedPage.cpp
@@ -61,14 +61,17 @@ CachedPage::~CachedPage()
     cachedPageCounter.decrement();
 #endif
 
-    clear();
+    destroy();
+    ASSERT(!m_cachedMainFrame);
 }
 
 void CachedPage::restore(Page* page)
 {
+    ASSERT(m_cachedMainFrame);
     ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
-    m_cachedMainFrame->restore();
 
+    m_cachedMainFrame->open();
+    
     // Restore the focus appearance for the focused element.
     // FIXME: Right now we don't support pages w/ frames in the b/f cache.  This may need to be tweaked when we add support for that.
     Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
@@ -76,11 +79,23 @@ void CachedPage::restore(Page* page)
         if (node->isElementNode())
             static_cast<Element*>(node)->updateFocusAppearance(true);
     }
+    
+    clear();
 }
 
 void CachedPage::clear()
 {
-    m_cachedMainFrame.clear();
+    ASSERT(m_cachedMainFrame);
+    m_cachedMainFrame->clear();
+    m_cachedMainFrame = 0;
+}
+
+void CachedPage::destroy()
+{
+    if (m_cachedMainFrame)
+        m_cachedMainFrame->destroy();
+
+    m_cachedMainFrame = 0;
 }
 
 } // namespace WebCore
diff --git a/WebCore/history/CachedPage.h b/WebCore/history/CachedPage.h
index 430cf3a..c68c753 100644
--- a/WebCore/history/CachedPage.h
+++ b/WebCore/history/CachedPage.h
@@ -46,12 +46,10 @@ public:
 
     void restore(Page*);
     void clear();
+    void destroy();
 
     Document* document() const { return m_cachedMainFrame->document(); }
     DocumentLoader* documentLoader() const { return m_cachedMainFrame->documentLoader(); }
-    FrameView* mainFrameView() const { return m_cachedMainFrame->view(); }
-    const KURL& url() const { return m_cachedMainFrame->url(); }
-    DOMWindow* domWindow() const { return m_cachedMainFrame->domWindow(); }
 
     double timeStamp() const { return m_timeStamp; }
     
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 08143e8..efd7078 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -176,12 +176,12 @@ double HistoryItem::lastVisitedTime() const
 
 KURL HistoryItem::url() const
 {
-    return KURL(m_urlString);
+    return KURL(ParsedURLString, m_urlString);
 }
 
 KURL HistoryItem::originalURL() const
 {
-    return KURL(m_originalURLString);
+    return KURL(ParsedURLString, m_originalURLString);
 }
 
 const String& HistoryItem::referrer() const
diff --git a/WebCore/history/PageCache.cpp b/WebCore/history/PageCache.cpp
index 8d04f6f..9a3ecd7 100644
--- a/WebCore/history/PageCache.cpp
+++ b/WebCore/history/PageCache.cpp
@@ -182,7 +182,7 @@ void PageCache::releaseAutoreleasedPagesNow()
 
     CachedPageSet::iterator end = tmp.end();
     for (CachedPageSet::iterator it = tmp.begin(); it != end; ++it)
-        (*it)->clear();
+        (*it)->destroy();
 
     // Now do the prune.
     cache()->setPruneEnabled(true);
diff --git a/WebCore/history/qt/HistoryItemQt.cpp b/WebCore/history/qt/HistoryItemQt.cpp
index 68fee87..098a786 100644
--- a/WebCore/history/qt/HistoryItemQt.cpp
+++ b/WebCore/history/qt/HistoryItemQt.cpp
@@ -45,7 +45,7 @@ bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
     WebCore::IntPoint scrollPoint;
     WTF::Vector<int> weeklyVisitCounts;
     WTF::Vector<int> dailyVisitCounts;
-    bool loadFormdata;
+    // bool loadFormdata;
     // WebCore::String formContentType;
     // WTF::Vector<char> formData;
 
diff --git a/WebCore/html/CollectionType.h b/WebCore/html/CollectionType.h
index e5973a3..9d7bb54 100644
--- a/WebCore/html/CollectionType.h
+++ b/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    DataListOptions,
     MapAreas,
 
     OtherCollection
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index 1515460..daa7919 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -40,51 +40,46 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAnchorElement::HTMLAnchorElement(Document* document)
-    : HTMLElement(aTag, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
+HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_wasShiftKeyDownOnMouseDown(false)
 {
 }
 
-HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
-    , m_rootEditableElementForSelectionOnMouseDown(0)
-    , m_wasShiftKeyDownOnMouseDown(false)
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document* document)
 {
+    return adoptRef(new HTMLAnchorElement(aTag, document));
 }
 
-bool HTMLAnchorElement::supportsFocus() const
+PassRefPtr<HTMLAnchorElement> HTMLAnchorElement::create(const QualifiedName& tagName, Document* document)
 {
-    if (isContentEditable())
-        return HTMLElement::supportsFocus();
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
+    return adoptRef(new HTMLAnchorElement(tagName, document));
 }
 
-bool HTMLAnchorElement::isFocusable() const
+bool HTMLAnchorElement::supportsFocus() const
 {
     if (isContentEditable())
-        return HTMLElement::isFocusable();
-
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+        return HTMLElement::supportsFocus();
+    // If not a link we should still be able to focus the element if it has tabIndex.
+    return isLink() || HTMLElement::supportsFocus();
 }
 
 bool HTMLAnchorElement::isMouseFocusable() const
 {
-#if PLATFORM(GTK)
-    return HTMLElement::isMouseFocusable();
-#else
-    return false;
+    // Anchor elements should be mouse focusable, https://bugs.webkit.org/show_bug.cgi?id=26856
+#if !PLATFORM(GTK)
+    if (isLink())
+        return false;
 #endif
+    // Allow tab index etc to control focus.
+    return HTMLElement::isMouseFocusable();
 }
 
 bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
 {
+    if (!isLink())
+        return HTMLElement::isKeyboardFocusable(event);
+
     if (!isFocusable())
         return false;
     
@@ -350,15 +345,17 @@ String HTMLAnchorElement::hash() const
 
 String HTMLAnchorElement::host() const
 {
-    return href().host();
+    const KURL& url = href();
+    if (url.hostEnd() == url.pathStart())
+        return url.host();
+    if (SecurityOrigin::isDefaultPortForProtocol(url.port(), url.protocol()))
+        return url.host();
+    return url.host() + ":" + String::number(url.port());
 }
 
 String HTMLAnchorElement::hostname() const
 {
-    const KURL& url = href();
-    if (url.port() == 0)
-        return url.host();
-    return url.host() + ":" + String::number(url.port());
+    return href().host();
 }
 
 String HTMLAnchorElement::pathname() const
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index 7779bed..8274af4 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -30,8 +30,8 @@ namespace WebCore {
 
 class HTMLAnchorElement : public HTMLElement {
 public:
-    HTMLAnchorElement(Document*);
-    HTMLAnchorElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAnchorElement> create(Document*);
+    static PassRefPtr<HTMLAnchorElement> create(const QualifiedName&, Document*);
 
     KURL href() const;
     void setHref(const AtomicString&);
@@ -53,6 +53,8 @@ public:
     bool isLiveLink() const;
 
 protected:
+    HTMLAnchorElement(const QualifiedName&, Document*);
+
     virtual void parseMappedAttribute(MappedAttribute*);
 
 private:
@@ -70,7 +72,7 @@ private:
     virtual short tabIndex() const;
     virtual bool draggable() const;
 
-    Element* m_rootEditableElementForSelectionOnMouseDown;
+    RefPtr<Element> m_rootEditableElementForSelectionOnMouseDown;
     bool m_wasShiftKeyDownOnMouseDown;
 };
 
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index dfa2597..46045d6 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -34,12 +34,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInElement(tagName, doc)
+inline HTMLAppletElement::HTMLAppletElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInElement(tagName, document)
 {
     ASSERT(hasTagName(appletTag));
 }
 
+PassRefPtr<HTMLAppletElement> HTMLAppletElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLAppletElement(tagName, document));
+}
+
 void HTMLAppletElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == altAttr ||
diff --git a/WebCore/html/HTMLAppletElement.h b/WebCore/html/HTMLAppletElement.h
index c616bb4..baaab38 100644
--- a/WebCore/html/HTMLAppletElement.h
+++ b/WebCore/html/HTMLAppletElement.h
@@ -27,12 +27,9 @@
 
 namespace WebCore {
 
-class HTMLFormElement;
-class HTMLImageLoader;
-
 class HTMLAppletElement : public HTMLPlugInElement {
 public:
-    HTMLAppletElement(const QualifiedName&, Document*);
+    static PassRefPtr<HTMLAppletElement> create(const QualifiedName&, Document*);
 
     String hspace() const;
     void setHspace(const String&);
@@ -41,6 +38,8 @@ public:
     void setVspace(const String&);
 
 private:
+    HTMLAppletElement(const QualifiedName&, Document*);
+
     virtual int tagPriority() const { return 1; }
 
     virtual void parseMappedAttribute(MappedAttribute*);
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index b878a1a..b202cae 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -34,9 +34,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
+inline HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
     : HTMLAnchorElement(tagName, document)
-    , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
     , m_shape(Unknown)
@@ -44,9 +43,9 @@ HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* documen
     ASSERT(hasTagName(areaTag));
 }
 
-HTMLAreaElement::~HTMLAreaElement()
+PassRefPtr<HTMLAreaElement> HTMLAreaElement::create(const QualifiedName& tagName, Document* document)
 {
-    delete [] m_coords;
+    return adoptRef(new HTMLAreaElement(tagName, document));
 }
 
 void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
@@ -61,8 +60,7 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute* attr)
         else if (equalIgnoringCase(attr->value(), "rect"))
             m_shape = Rect;
     } else if (attr->name() == coordsAttr) {
-        delete [] m_coords;
-        m_coords = newCoordsArray(attr->value().string(), m_coordsLen);
+        m_coords.set(newCoordsArray(attr->value().string(), m_coordsLen));
     } else if (attr->name() == altAttr || attr->name() == accesskeyAttr) {
         // Do nothing.
     } else
@@ -164,9 +162,10 @@ void HTMLAreaElement::setNoHref(bool noHref)
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
 
-bool HTMLAreaElement::isFocusable() const
+bool HTMLAreaElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    // Skip HTMLAnchorElements isLink() check.
+    return HTMLElement::supportsFocus();
 }
 
 String HTMLAreaElement::target() const
diff --git a/WebCore/html/HTMLAreaElement.h b/WebCore/html/HTMLAreaElement.h
index fffd45e..7b2497c 100644
--- a/WebCore/html/HTMLAreaElement.h
+++ b/WebCore/html/HTMLAreaElement.h
@@ -25,6 +25,7 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
+#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -33,8 +34,7 @@ class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
 public:
-    HTMLAreaElement(const QualifiedName&, Document*);
-    virtual ~HTMLAreaElement();
+    static PassRefPtr<HTMLAreaElement> create(const QualifiedName&, Document*);
 
     bool isDefault() const { return m_shape == Default; }
 
@@ -48,17 +48,19 @@ public:
     void setNoHref(bool);
 
 private:
+    HTMLAreaElement(const QualifiedName&, Document*);
+
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual String target() const;
 
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
 
     OwnPtr<Path> m_region;
-    Length* m_coords;
+    OwnArrayPtr<Length> m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
     Shape m_shape;
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 05c0cb7..3e16015 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -78,6 +78,7 @@ expanded
 face
 focused
 for
+formnovalidate
 frame
 frameborder
 headers
@@ -97,6 +98,7 @@ lang
 language
 leftmargin
 link
+list
 longdesc
 loop
 playcount
@@ -117,11 +119,13 @@ name
 nohref
 noresize
 noshade
+novalidate
 nowrap
 object
 onabort
 onbeforecopy
 onbeforecut
+onbeforeload
 onbeforepaste
 onbeforeunload
 onblur
@@ -147,12 +151,14 @@ onerror
 onfocus
 onhashchange
 oninput
+oninvalid
 onkeydown
 onkeypress
 onkeyup
 onload
 onloadeddata
 onloadedmetadata
+onloadend
 onloadstart
 onmousedown
 onmousemove
@@ -162,6 +168,9 @@ onmouseup
 onmousewheel
 ononline
 onoffline
+onorientationchange
+onpagehide
+onpageshow
 onpaste
 onpause
 onplay
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index 4667381..b203cc0 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -140,10 +140,18 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
         document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpagehideAttr)
+        document()->setWindowAttributeEventListener(eventNames().pagehideEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onpageshowAttr)
+        document()->setWindowAttributeEventListener(eventNames().pageshowEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+#if ENABLE(ORIENTATION_EVENTS)
+    else if (attr->name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+#endif
     else if (attr->name() == onhashchangeAttr)
         document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
@@ -341,114 +349,4 @@ void HTMLBodyElement::didMoveToNewOwnerDocument()
     HTMLElement::didMoveToNewOwnerDocument();
 }
 
-EventListener* HTMLBodyElement::onblur() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
-}
-
-void HTMLBodyElement::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onerror() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
-}
-
-void HTMLBodyElement::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onfocus() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
-}
-
-void HTMLBodyElement::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
-}
-
-void HTMLBodyElement::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onbeforeunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void HTMLBodyElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onmessage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
-}
-
-void HTMLBodyElement::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onoffline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
-}
-
-void HTMLBodyElement::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::ononline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
-}
-
-void HTMLBodyElement::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onresize() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
-}
-
-void HTMLBodyElement::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onstorage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
-}
-
-void HTMLBodyElement::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* HTMLBodyElement::onunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
-}
-
-void HTMLBodyElement::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index 575d562..e898c88 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -25,6 +25,7 @@
 #define HTMLBodyElement_h
 
 #include "HTMLElement.h"
+#include "Document.h"
 
 namespace WebCore {
 
@@ -44,29 +45,23 @@ public:
     String vLink() const;
     void setVLink(const String&);
 
-    virtual EventListener* onblur() const;
-    virtual void setOnblur(PassRefPtr<EventListener>);
-    virtual EventListener* onerror() const;
-    virtual void setOnerror(PassRefPtr<EventListener>);
-    virtual EventListener* onfocus() const;
-    virtual void setOnfocus(PassRefPtr<EventListener>);
-    virtual EventListener* onload() const;
-    virtual void setOnload(PassRefPtr<EventListener>);
+    // Declared virtual in Element
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
 
-    EventListener* onbeforeunload() const;
-    void setOnbeforeunload(PassRefPtr<EventListener>);
-    EventListener* onmessage() const;
-    void setOnmessage(PassRefPtr<EventListener>);
-    EventListener* onoffline() const;
-    void setOnoffline(PassRefPtr<EventListener>);
-    EventListener* ononline() const;
-    void setOnonline(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onstorage() const;
-    void setOnstorage(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+#if ENABLE(ORIENTATION_EVENTS)
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+#endif
 
 private:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
diff --git a/WebCore/html/HTMLBodyElement.idl b/WebCore/html/HTMLBodyElement.idl
index 097b4ac..2e93e2e 100644
--- a/WebCore/html/HTMLBodyElement.idl
+++ b/WebCore/html/HTMLBodyElement.idl
@@ -36,6 +36,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -43,10 +44,19 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute [DontEnum] EventListener onorientationchange;
+#endif
+
+        // Overrides of Element attributes (left in for completeness).
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLButtonElement.idl b/WebCore/html/HTMLButtonElement.idl
index 5fd0075..55803df 100644
--- a/WebCore/html/HTMLButtonElement.idl
+++ b/WebCore/html/HTMLButtonElement.idl
@@ -26,6 +26,7 @@ module html {
         ImplementationUUID=1be13b5f-40df-4550-b70e-8c805e546cad
     ] HTMLButtonElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
+                 attribute  boolean              formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute  ValidityState        validity;
 #endif
@@ -36,6 +37,7 @@ module html {
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
         readonly attribute boolean               willValidate;
+        boolean  checkValidity();
         void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void click();
     };
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 203579b..e3fe329 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -30,6 +30,9 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
+#if ENABLE(3D_CANVAS)    
+#include "CanvasRenderingContext3D.h"
+#endif
 #include "CanvasStyle.h"
 #include "Chrome.h"
 #include "Document.h"
@@ -146,17 +149,45 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, ExceptionCode& ec)
 
 CanvasRenderingContext* HTMLCanvasElement::getContext(const String& type)
 {
+    // A Canvas can either be "2D" or "3D" never both. If you request a 2D canvas and the existing
+    // context is already 2D, just return that. If the existing context is 3D, then destroy it
+    // before creating a new 2D context. Vice versa when requesting a 3D canvas. Requesting a
+    // context with any other type string will destroy any existing context.
+    
+    // FIXME - The code depends on the context not going away once created, to prevent JS from
+    // seeing a dangling pointer. So for now we will disallow the context from being changed
+    // once it is created.
     if (type == "2d") {
-        if (!m_2DContext)
-            m_2DContext.set(new CanvasRenderingContext2D(this));
-        return m_2DContext.get();
+        if (m_context && !m_context->is2d())
+            return 0;
+        if (!m_context)
+            m_context = new CanvasRenderingContext2D(this);
+        return m_context.get();
+    }
+#if ENABLE(3D_CANVAS)    
+    Settings* settings = document()->settings();
+    if (settings && settings->webGLEnabled()) {
+        if ((type == "webkit-3d") ||
+            (type == "GL")) {
+            if (m_context && !m_context->is3d())
+                return 0;
+            if (!m_context) {
+                m_context = new CanvasRenderingContext3D(this);
+
+                // Need to make sure a RenderLayer and compositing layer get created for the Canvas
+                setNeedsStyleRecalc(SyntheticStyleChange);
+            }
+            return m_context.get();
+        }
     }
+#endif
     return 0;
 }
 
 void HTMLCanvasElement::willDraw(const FloatRect& rect)
 {
-    m_imageBuffer->clearImage();
+    if (m_imageBuffer)
+        m_imageBuffer->clearImage();
     
     if (RenderBox* ro = renderBox()) {
         FloatRect destRect = ro->contentBoxRect();
@@ -192,8 +223,8 @@ void HTMLCanvasElement::reset()
     bool hadImageBuffer = m_createdImageBuffer;
     m_createdImageBuffer = false;
     m_imageBuffer.clear();
-    if (m_2DContext)
-        m_2DContext->reset();
+    if (m_context && m_context->is2d())
+        static_cast<CanvasRenderingContext2D*>(m_context.get())->reset();
 
     if (RenderObject* renderer = this->renderer()) {
         if (m_rendererIsCanvas) {
@@ -216,11 +247,26 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (context->paintingDisabled())
         return;
     
+#if ENABLE(3D_CANVAS)
+    CanvasRenderingContext3D* context3D = NULL;
+    if (m_context && m_context->is3d()) {
+        context3D = static_cast<CanvasRenderingContext3D*>(m_context.get());
+        context3D->beginPaint();
+    }
+#endif
+
     if (m_imageBuffer) {
         Image* image = m_imageBuffer->image();
         if (image)
             context->drawImage(image, r);
     }
+
+#if ENABLE(3D_CANVAS)
+    if (context3D != NULL) {
+        context3D->reshape(r.width(), r.height());
+        context3D->endPaint();
+    }
+#endif
 }
 
 IntRect HTMLCanvasElement::convertLogicalToDevice(const FloatRect& logicalRect) const
@@ -293,4 +339,11 @@ TransformationMatrix HTMLCanvasElement::baseTransform() const
     return transform;
 }
 
+#if ENABLE(3D_CANVAS)    
+bool HTMLCanvasElement::is3D() const
+{
+    return m_context && m_context->is3d();
+}
+#endif
+
 }
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index bba1f2d..edae9e5 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,14 @@
 #include "TransformationMatrix.h"
 #include "FloatRect.h"
 #include "HTMLElement.h"
+#if ENABLE(3D_CANVAS)    
+#include "GraphicsContext3D.h"
+#endif
 #include "IntSize.h"
 
 namespace WebCore {
 
-class CanvasRenderingContext2D;
-typedef CanvasRenderingContext2D CanvasRenderingContext;
+class CanvasRenderingContext;
 class FloatPoint;
 class FloatRect;
 class FloatSize;
@@ -47,7 +49,7 @@ class IntSize;
 
 class CanvasObserver {
 public:
-    virtual ~CanvasObserver() {};
+    virtual ~CanvasObserver() { }
 
     virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
     virtual void canvasResized(HTMLCanvasElement*) = 0;
@@ -59,11 +61,6 @@ public:
     HTMLCanvasElement(const QualifiedName&, Document*);
     virtual ~HTMLCanvasElement();
 
-#if ENABLE(DASHBOARD_SUPPORT)
-    virtual HTMLTagStatus endTagRequirement() const;
-    virtual int tagPriority() const;
-#endif
-
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
     void setWidth(int);
@@ -73,10 +70,7 @@ public:
 
     CanvasRenderingContext* getContext(const String&);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    IntSize size() const { return m_size; }
+    const IntSize& size() const { return m_size; }
     void setSize(const IntSize& size)
     { 
         if (size == m_size)
@@ -103,18 +97,33 @@ public:
     void setOriginTainted() { m_originClean = false; } 
     bool originClean() const { return m_originClean; }
 
-    static const float MaxCanvasArea;
-
-    void setObserver(CanvasObserver* o) { m_observer = o; }
+    void setObserver(CanvasObserver* observer) { m_observer = observer; }
 
     TransformationMatrix baseTransform() const;
+
+    CanvasRenderingContext* renderingContext() const { return m_context.get(); }
+
+#if ENABLE(3D_CANVAS)    
+    bool is3D() const;
+#endif
+
 private:
+#if ENABLE(DASHBOARD_SUPPORT)
+    virtual HTMLTagStatus endTagRequirement() const;
+    virtual int tagPriority() const;
+#endif
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
     void createImageBuffer() const;
     void reset();
 
+    static const float MaxCanvasArea;
+
     bool m_rendererIsCanvas;
 
-    OwnPtr<CanvasRenderingContext2D> m_2DContext;
+    OwnPtr<CanvasRenderingContext> m_context;
     IntSize m_size;    
     CanvasObserver* m_observer;
 
diff --git a/WebCore/html/HTMLCanvasElement.idl b/WebCore/html/HTMLCanvasElement.idl
index 13fc623..4b1b057 100644
--- a/WebCore/html/HTMLCanvasElement.idl
+++ b/WebCore/html/HTMLCanvasElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 module html {
 
     interface [
+        CustomMarkFunction,
         GenerateConstructor,
         InterfaceUUID=a14d88c8-c6af-4e34-ad17-659700c77a10,
         ImplementationUUID=7ae731bc-c264-4ee3-a4b4-5d4540af26c3
diff --git a/WebCore/html/HTMLCollection.cpp b/WebCore/html/HTMLCollection.cpp
index de4c424..76de60a 100644
--- a/WebCore/html/HTMLCollection.cpp
+++ b/WebCore/html/HTMLCollection.cpp
@@ -27,6 +27,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLOptionElement.h"
 #include "NodeList.h"
 
 #include <utility>
@@ -104,6 +105,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case MapAreas:
         case OtherCollection:
         case SelectOptions:
+        case DataListOptions:
         case WindowNamedItems:
             break;
         case NodeChildren:
@@ -153,6 +155,13 @@ Element* HTMLCollection::itemAfter(Element* previous) const
                 if (e->hasLocalName(optionTag))
                     return e;
                 break;
+            case DataListOptions:
+                if (e->hasLocalName(optionTag)) {
+                    HTMLOptionElement* option = static_cast<HTMLOptionElement*>(e);
+                    if (!option->disabled() && !option->value().isEmpty())
+                        return e;
+                }
+                break;
             case MapAreas:
                 if (e->hasLocalName(areaTag))
                     return e;
diff --git a/WebCore/html/HTMLDataListElement.cpp b/WebCore/html/HTMLDataListElement.cpp
new file mode 100644
index 0000000..a6ca525
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATALIST)
+#include "HTMLDataListElement.h"
+
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+HTMLDataListElement::HTMLDataListElement(const QualifiedName& tagName, Document *doc)
+    : HTMLElement(tagName, doc)
+{
+}
+
+HTMLDataListElement::~HTMLDataListElement()
+{
+}
+
+bool HTMLDataListElement::checkDTD(const Node* newChild)
+{
+    return newChild->hasTagName(HTMLNames::optionTag) || HTMLElement::inInlineTagList(newChild);
+}
+
+PassRefPtr<HTMLCollection> HTMLDataListElement::options()
+{
+    return HTMLCollection::create(this, DataListOptions);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
diff --git a/WebCore/html/HTMLDataListElement.h b/WebCore/html/HTMLDataListElement.h
new file mode 100644
index 0000000..8c4cfbc
--- /dev/null
+++ b/WebCore/html/HTMLDataListElement.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLDataListElement_h
+#define HTMLDataListElement_h
+
+#if ENABLE(DATALIST)
+
+#include "HTMLCollection.h"
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+    class HTMLDataListElement : public HTMLElement {
+    public:
+        HTMLDataListElement(const QualifiedName&, Document*);
+        virtual ~HTMLDataListElement();
+        PassRefPtr<HTMLCollection> options();
+
+    private:
+        virtual bool checkDTD(const Node*);
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(DATALIST)
+
+#endif  // HTMLDataListElement_h
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp b/WebCore/html/HTMLDataListElement.idl
index 3582448..916c0a1 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumLinux.cpp
+++ b/WebCore/html/HTMLDataListElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (c) 2009, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,15 +28,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "SQLiteFileSystem.h"
-
-namespace WebCore {
-
-void SQLiteFileSystem::registerSQLiteVFS()
-{
-    // stub for registering Chromium's SQLite VFS for Linux
-    ASSERT_NOT_REACHED();
+module html {
+    interface [
+        GenerateConstructor,
+        Conditional=DATALIST
+    ] HTMLDataListElement : HTMLElement {
+        readonly attribute HTMLCollection options;
+    };
 }
-
-} // namespace WebCore
diff --git a/WebCore/html/HTMLDocument.cpp b/WebCore/html/HTMLDocument.cpp
index 96ae9e4..fd939c8 100644
--- a/WebCore/html/HTMLDocument.cpp
+++ b/WebCore/html/HTMLDocument.cpp
@@ -109,14 +109,14 @@ String HTMLDocument::dir()
     HTMLElement* b = body();
     if (!b)
         return String();
-    return b->dir();
+    return b->getAttribute(dirAttr);
 }
 
 void HTMLDocument::setDir(const String& value)
 {
     HTMLElement* b = body();
     if (b)
-        b->setDir(value);
+        b->setAttribute(dirAttr, value);
 }
 
 String HTMLDocument::designMode() const
@@ -284,8 +284,10 @@ void HTMLDocument::releaseEvents()
 Tokenizer *HTMLDocument::createTokenizer()
 {
     bool reportErrors = false;
+#if ENABLE(INSPECTOR)
     if (Page* page = this->page())
         reportErrors = page->inspectorController()->windowVisible();
+#endif
 
     return new HTMLTokenizer(this, reportErrors);
 }
diff --git a/WebCore/html/HTMLDocument.h b/WebCore/html/HTMLDocument.h
index eda7593..4b14d0c 100644
--- a/WebCore/html/HTMLDocument.h
+++ b/WebCore/html/HTMLDocument.h
@@ -37,7 +37,7 @@ class HTMLDocument : public Document, public CachedResourceClient {
 public:
     static PassRefPtr<HTMLDocument> create(Frame* frame)
     {
-        return new HTMLDocument(frame);
+        return adoptRef(new HTMLDocument(frame));
     }
     virtual ~HTMLDocument();
 
@@ -71,10 +71,6 @@ public:
     void captureEvents();
     void releaseEvents();
 
-    virtual bool childAllowed(Node*);
-
-    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
-
     void addNamedItem(const AtomicString& name);
     void removeNamedItem(const AtomicString& name);
     bool hasNamedItem(AtomicStringImpl* name);
@@ -87,6 +83,10 @@ protected:
     HTMLDocument(Frame*);
 
 private:
+    virtual bool childAllowed(Node*);
+
+    virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
+
     virtual bool isHTMLDocument() const { return true; }
     virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index b310cad..a4807ba 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -56,13 +56,9 @@ using namespace HTMLNames;
 using std::min;
 using std::max;
 
-HTMLElement::HTMLElement(const QualifiedName& tagName, Document *doc)
-    : StyledElement(tagName, doc)
-{
-}
-
-HTMLElement::~HTMLElement()
+PassRefPtr<HTMLElement> HTMLElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLElement(tagName, document, CreateElement));
 }
 
 String HTMLElement::nodeName() const
@@ -92,7 +88,7 @@ int HTMLElement::tagPriority() const
         return 0;
     if (hasLocalName(addressTag) || hasLocalName(ddTag) || hasLocalName(dtTag) || hasLocalName(noscriptTag) || hasLocalName(rpTag) || hasLocalName(rtTag))
         return 3;
-    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag))
+    if (hasLocalName(centerTag) || hasLocalName(nobrTag) || hasLocalName(rubyTag) || hasLocalName(navTag))
         return 5;
     if (hasLocalName(noembedTag) || hasLocalName(noframesTag))
         return 10;
@@ -234,6 +230,8 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
 #endif
     } else if (attr->name() == oninputAttr) {
         setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == oninvalidAttr) {
+        setAttributeEventListener(eventNames().invalidEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -257,7 +255,7 @@ PassRefPtr<DocumentFragment> HTMLElement::createContextualFragment(const String
         hasLocalName(headTag) || hasLocalName(styleTag) || hasLocalName(titleTag))
         return 0;
 
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     
     if (document()->isHTMLDocument())
          parseHTMLDocumentFragment(html, fragment.get());
@@ -319,7 +317,7 @@ static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<Documen
     }
 
     if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->string(), ec);
+        static_cast<Text*>(element->firstChild())->setData(static_cast<Text*>(fragment->firstChild())->data(), ec);
         return;
     }
 
@@ -339,7 +337,7 @@ static void replaceChildrenWithText(HTMLElement* element, const String& text, Ex
         return;
     }
 
-    RefPtr<Text> textNode = new Text(element->document(), text);
+    RefPtr<Text> textNode = Text::create(element->document(), text);
 
     if (hasOneChild(element)) {
         element->replaceChild(textNode.release(), element->firstChild(), ec);
@@ -425,7 +423,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
 
     // Add text nodes and <br> elements.
     ec = 0;
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(document());
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document());
     int lineStart = 0;
     UChar prev = 0;
     int length = text.length();
@@ -433,7 +431,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         UChar c = text[i];
         if (c == '\n' || c == '\r') {
             if (i > lineStart) {
-                fragment->appendChild(new Text(document(), text.substring(lineStart, i - lineStart)), ec);
+                fragment->appendChild(Text::create(document(), text.substring(lineStart, i - lineStart)), ec);
                 if (ec)
                     return;
             }
@@ -447,7 +445,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
         prev = c;
     }
     if (length > lineStart)
-        fragment->appendChild(new Text(document(), text.substring(lineStart, length - lineStart)), ec);
+        fragment->appendChild(Text::create(document(), text.substring(lineStart, length - lineStart)), ec);
     replaceChildrenWithFragment(this, fragment.release(), ec);
 }
 
@@ -475,7 +473,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
     // FIXME: This creates a new text node even when the text is empty.
     // FIXME: This creates a single text node even when the text has CR and LF
     // characters in it. Instead it should create <br> elements.
-    RefPtr<Text> t = new Text(document(), text);
+    RefPtr<Text> t = Text::create(document(), text);
     ec = 0;
     parent->replaceChild(t, this, ec);
     if (ec)
@@ -613,9 +611,9 @@ void HTMLElement::addHTMLAlignmentToStyledElement(StyledElement* element, Mapped
         element->addCSSProperty(attr, CSSPropertyVerticalAlign, verticalAlignValue);
 }
 
-bool HTMLElement::isFocusable() const
+bool HTMLElement::supportsFocus() const
 {
-    return Element::isFocusable() || (isContentEditable() && parent() && !parent()->isContentEditable());
+    return Element::supportsFocus() || (isContentEditable() && parent() && !parent()->isContentEditable());
 }
 
 bool HTMLElement::isContentEditable() const 
@@ -737,56 +735,11 @@ void HTMLElement::accessKeyAction(bool sendToAnyElement)
         dispatchSimulatedClick(0, true);
 }
 
-String HTMLElement::id() const
-{
-    return getAttribute(idAttr);
-}
-
-void HTMLElement::setId(const String& value)
-{
-    setAttribute(idAttr, value);
-}
-
 String HTMLElement::title() const
 {
     return getAttribute(titleAttr);
 }
 
-void HTMLElement::setTitle(const String& value)
-{
-    setAttribute(titleAttr, value);
-}
-
-String HTMLElement::lang() const
-{
-    return getAttribute(langAttr);
-}
-
-void HTMLElement::setLang(const String& value)
-{
-    setAttribute(langAttr, value);
-}
-
-String HTMLElement::dir() const
-{
-    return getAttribute(dirAttr);
-}
-
-void HTMLElement::setDir(const String &value)
-{
-    setAttribute(dirAttr, value);
-}
-
-String HTMLElement::className() const
-{
-    return getAttribute(classAttr);
-}
-
-void HTMLElement::setClassName(const String &value)
-{
-    setAttribute(classAttr, value);
-}
-
 short HTMLElement::tabIndex() const
 {
     if (supportsFocus())
@@ -894,6 +847,7 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(textareaTag.localName().impl());
         tagList.add(labelTag.localName().impl());
         tagList.add(buttonTag.localName().impl());
+        tagList.add(datalistTag.localName().impl());
         tagList.add(insTag.localName().impl());
         tagList.add(delTag.localName().impl());
         tagList.add(nobrTag.localName().impl());
@@ -936,6 +890,7 @@ static HashSet<AtomicStringImpl*>* blockTagList()
         tagList.add(listingTag.localName().impl());
         tagList.add(marqueeTag.localName().impl());
         tagList.add(menuTag.localName().impl());
+        tagList.add(navTag.localName().impl());
         tagList.add(noembedTag.localName().impl());
         tagList.add(noframesTag.localName().impl());
         tagList.add(nolayerTag.localName().impl());
diff --git a/WebCore/html/HTMLElement.h b/WebCore/html/HTMLElement.h
index 21b3bb5..c6a384b 100644
--- a/WebCore/html/HTMLElement.h
+++ b/WebCore/html/HTMLElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,28 +35,12 @@ enum HTMLTagStatus { TagStatusOptional, TagStatusRequired, TagStatusForbidden };
                        
 class HTMLElement : public StyledElement {
 public:
-    HTMLElement(const QualifiedName& tagName, Document*);
-    virtual ~HTMLElement();
-
-    virtual bool isHTMLElement() const { return true; }
-
-    virtual String nodeName() const;
-
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
+    static PassRefPtr<HTMLElement> create(const QualifiedName& tagName, Document*);
 
     PassRefPtr<HTMLCollection> children();
     
-    String id() const;
-    void setId(const String&);
     virtual String title() const;
-    void setTitle(const String&);
-    String lang() const;
-    void setLang(const String&);
-    String dir() const;
-    void setDir(const String&);
-    String className() const;
-    void setClassName(const String&);
+
     virtual short tabIndex() const;
     void setTabIndex(int);
 
@@ -72,12 +56,13 @@ public:
     void insertAdjacentHTML(const String& where, const String& html, ExceptionCode&);
     void insertAdjacentText(const String& where, const String& text, ExceptionCode&);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
+    
     virtual bool isContentEditable() const;
     virtual bool isContentRichlyEditable() const;
-    virtual String contentEditable() const;
-    virtual void setContentEditable(MappedAttribute*);
-    virtual void setContentEditable(const String&);
+
+    String contentEditable() const;
+    void setContentEditable(const String&);
 
     virtual bool draggable() const;
     void setDraggable(bool);
@@ -88,31 +73,51 @@ public:
 
     virtual HTMLTagStatus endTagRequirement() const;
     virtual int tagPriority() const;
+
+    virtual bool rendererIsNeeded(RenderStyle*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+    HTMLFormElement* form() const { return virtualForm(); }
+
+    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+
+protected:
+    HTMLElement(const QualifiedName& tagName, Document*, ConstructionType = CreateElementZeroRefCount);
+
+    void addHTMLAlignment(MappedAttribute*);
+
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
     virtual bool childAllowed(Node* newChild); // Error-checking during parsing that checks the DTD
 
     // Helper function to check the DTD for a given child node.
     virtual bool checkDTD(const Node*);
+
     static bool inEitherTagList(const Node*);
     static bool inInlineTagList(const Node*);
     static bool inBlockTagList(const Node*);
     static bool isRecognizedTagName(const QualifiedName&);
 
-    virtual bool rendererIsNeeded(RenderStyle*);
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-
-    HTMLFormElement* form() const { return virtualForm(); }
     HTMLFormElement* findFormAncestor() const;
 
-    static void addHTMLAlignmentToStyledElement(StyledElement*, MappedAttribute*);
+private:
+    virtual bool isHTMLElement() const { return true; }
 
-protected:
-    void addHTMLAlignment(MappedAttribute*);
+    virtual String nodeName() const;
+
+    void setContentEditable(MappedAttribute*);
 
-private:
     virtual HTMLFormElement* virtualForm() const;
+
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
 };
 
+inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document, ConstructionType type)
+    : StyledElement(tagName, document, type)
+{
+}
+
 } // namespace WebCore
 
 #endif // HTMLElement_h
diff --git a/WebCore/html/HTMLEmbedElement.cpp b/WebCore/html/HTMLEmbedElement.cpp
index 3f6db9a..81b88a4 100644
--- a/WebCore/html/HTMLEmbedElement.cpp
+++ b/WebCore/html/HTMLEmbedElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -42,15 +42,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* doc)
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLEmbedElement::HTMLEmbedElement(const QualifiedName& tagName, Document* document)
+    : HTMLPlugInImageElement(tagName, document)
     , m_needWidgetUpdate(false)
 {
     ASSERT(hasTagName(embedTag));
 }
 
-HTMLEmbedElement::~HTMLEmbedElement()
+PassRefPtr<HTMLEmbedElement> HTMLEmbedElement::create(const QualifiedName& tagName, Document* document)
 {
+    return adoptRef(new HTMLEmbedElement(tagName, document));
 }
 
 static inline RenderWidget* findWidgetRenderer(const Node* n) 
@@ -238,31 +239,11 @@ const QualifiedName& HTMLEmbedElement::imageSourceAttributeName() const
     return srcAttr;
 }
 
-String HTMLEmbedElement::src() const
-{
-    return getAttribute(srcAttr);
-}
-
-void HTMLEmbedElement::setSrc(const String& value)
-{
-    setAttribute(srcAttr, value);
-}
-
-String HTMLEmbedElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLEmbedElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
 void HTMLEmbedElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, document()->completeURL(src()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(srcAttr)));
 }
 
 }
diff --git a/WebCore/html/HTMLEmbedElement.h b/WebCore/html/HTMLEmbedElement.h
index 2ce182a..16f0893 100644
--- a/WebCore/html/HTMLEmbedElement.h
+++ b/WebCore/html/HTMLEmbedElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,8 +29,12 @@ namespace WebCore {
 
 class HTMLEmbedElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLEmbedElement> create(const QualifiedName&, Document*);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+private:
     HTMLEmbedElement(const QualifiedName&, Document*);
-    ~HTMLEmbedElement();
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
@@ -50,19 +54,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String src() const;
-    void setSrc(const String&);
-
-    String type() const;
-    void setType(const String&);
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     bool m_needWidgetUpdate;
 };
 
diff --git a/WebCore/html/HTMLEmbedElement.idl b/WebCore/html/HTMLEmbedElement.idl
index a38402c..05c10db 100644
--- a/WebCore/html/HTMLEmbedElement.idl
+++ b/WebCore/html/HTMLEmbedElement.idl
@@ -29,17 +29,17 @@ module html {
         InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
-                 attribute [ConvertNullToNullString] DOMString align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString align;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
 #endif
-                 attribute [ConvertNullToNullString] DOMString name;
-                 attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type;
+                 attribute [ConvertNullToNullString, Reflect] DOMString name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString type;
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-                 attribute [ConvertNullToNullString] DOMString width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
diff --git a/WebCore/html/HTMLFieldSetElement.cpp b/WebCore/html/HTMLFieldSetElement.cpp
index eb83173..b792075 100644
--- a/WebCore/html/HTMLFieldSetElement.cpp
+++ b/WebCore/html/HTMLFieldSetElement.cpp
@@ -48,9 +48,9 @@ bool HTMLFieldSetElement::checkDTD(const Node* newChild)
     return newChild->hasTagName(legendTag) || HTMLElement::checkDTD(newChild);
 }
 
-bool HTMLFieldSetElement::isFocusable() const
+bool HTMLFieldSetElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLFieldSetElement::formControlType() const
diff --git a/WebCore/html/HTMLFieldSetElement.h b/WebCore/html/HTMLFieldSetElement.h
index e79f2c5..0900317 100644
--- a/WebCore/html/HTMLFieldSetElement.h
+++ b/WebCore/html/HTMLFieldSetElement.h
@@ -44,7 +44,7 @@ public:
     virtual int tagPriority() const { return 3; }
     virtual bool checkDTD(const Node* newChild);
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual const AtomicString& formControlType() const;
 
diff --git a/WebCore/html/HTMLFieldSetElement.idl b/WebCore/html/HTMLFieldSetElement.idl
index 4d11304..ca8563b 100644
--- a/WebCore/html/HTMLFieldSetElement.idl
+++ b/WebCore/html/HTMLFieldSetElement.idl
@@ -29,6 +29,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
     };
 
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 09d91df..ea46980 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -27,6 +27,7 @@
 
 #include "ChromeClient.h"
 #include "Document.h"
+#include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -38,7 +39,9 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderBox.h"
+#include "RenderTextControl.h"
 #include "RenderTheme.h"
+#include "ScriptEventListener.h"
 #include "ValidityState.h"
 
 namespace WebCore {
@@ -50,6 +53,7 @@ HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Doc
     , m_form(f)
     , m_disabled(false)
     , m_readOnly(false)
+    , m_required(false)
     , m_valueMatchesRenderer(false)
 {
     if (!m_form)
@@ -64,6 +68,16 @@ HTMLFormControlElement::~HTMLFormControlElement()
         m_form->removeFormElement(this);
 }
 
+bool HTMLFormControlElement::formNoValidate() const
+{
+    return !getAttribute(formnovalidateAttr).isNull();
+}
+
+void HTMLFormControlElement::setFormNoValidate(bool formnovalidate)
+{
+    setAttribute(formnovalidateAttr, formnovalidate ? "" : 0);
+}
+
 ValidityState* HTMLFormControlElement::validity()
 {
     if (!m_validityState)
@@ -74,9 +88,9 @@ ValidityState* HTMLFormControlElement::validity()
 
 void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
 {
-    if (attr->name() == nameAttr) {
-        // Do nothing.
-    } else if (attr->name() == disabledAttr) {
+    if (attr->name() == nameAttr)
+        setNeedsStyleRecalc();
+    else if (attr->name() == disabledAttr) {
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
@@ -92,6 +106,11 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
             if (renderer() && renderer()->style()->hasAppearance())
                 renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
+    } else if (attr->name() == requiredAttr) {
+        bool oldRequired = m_required;
+        m_required = !attr->isNull();
+        if (oldRequired != m_required)
+            setNeedsStyleRecalc();
     } else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -176,7 +195,7 @@ void HTMLFormControlElement::setName(const AtomicString &value)
 
 void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEvent(eventNames().changeEvent, true, false);
+    dispatchEvent(Event::create(eventNames().changeEvent, true, false));
 }
 
 bool HTMLFormControlElement::disabled() const
@@ -206,7 +225,7 @@ void HTMLFormControlElement::setAutofocus(bool b)
 
 bool HTMLFormControlElement::required() const
 {
-    return hasAttribute(requiredAttr);
+    return m_required;
 }
 
 void HTMLFormControlElement::setRequired(bool b)
@@ -222,13 +241,19 @@ void HTMLFormControlElement::recalcStyle(StyleChange change)
         renderer()->updateFromElement();
 }
 
+bool HTMLFormControlElement::supportsFocus() const
+{
+    return !disabled();
+}
+
 bool HTMLFormControlElement::isFocusable() const
 {
-    if (disabled() || !renderer() || 
-        (renderer()->style() && renderer()->style()->visibility() != VISIBLE) || 
+    if (!renderer() || 
         !renderer()->isBox() || toRenderBox(renderer())->size().isEmpty())
         return false;
-    return true;
+    // HTMLElement::isFocusable handles visibility and calls suportsFocus which
+    // will cover the disabled case.
+    return HTMLElement::isFocusable();
 }
 
 bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent* event) const
@@ -260,7 +285,25 @@ bool HTMLFormControlElement::willValidate() const
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
+    return form() && !name().isEmpty() && !disabled() && !isReadOnlyFormControl();
+}
+
+bool HTMLFormControlElement::checkValidity()
+{
+    if (willValidate() && !isValidFormControlElement()) {
+        dispatchEvent(Event::create(EventNames().invalidEvent, false, true));
+        return false;
+    }
+
+    return true;
+}
+
+void HTMLFormControlElement::updateValidity()
+{
+    if (willValidate()) {
+        // Update style for pseudo classes such as :valid :invalid.
+        setNeedsStyleRecalc();
+    }
 }
 
 void HTMLFormControlElement::setCustomValidity(const String& error)
@@ -284,14 +327,19 @@ void HTMLFormControlElement::dispatchBlurEvent()
     HTMLElement::dispatchBlurEvent();
 }
 
-bool HTMLFormControlElement::supportsFocus() const
+HTMLFormElement* HTMLFormControlElement::virtualForm() const
 {
-    return isFocusable() || (!disabled() && !document()->haveStylesheetsLoaded());
+    return m_form;
 }
 
-HTMLFormElement* HTMLFormControlElement::virtualForm() const
+bool HTMLFormControlElement::isDefaultButtonForForm() const
 {
-    return m_form;
+    return isSuccessfulSubmitButton() && m_form && m_form->defaultButton() == this;
+}
+
+bool HTMLFormControlElement::isValidFormControlElement()
+{
+    return validity()->valid();
 }
 
 void HTMLFormControlElement::removeFromForm()
@@ -336,4 +384,120 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     }
 }
 
+HTMLTextFormControlElement::HTMLTextFormControlElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, doc, form)
+{
+}
+
+HTMLTextFormControlElement::~HTMLTextFormControlElement()
+{
+}
+
+void HTMLTextFormControlElement::dispatchFocusEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleFocusEvent();
+    HTMLFormControlElementWithState::dispatchFocusEvent();
+}
+
+void HTMLTextFormControlElement::dispatchBlurEvent()
+{
+    if (supportsPlaceholder())
+        updatePlaceholderVisibility(false);
+    handleBlurEvent();
+    HTMLFormControlElementWithState::dispatchBlurEvent();
+}
+
+bool HTMLTextFormControlElement::placeholderShouldBeVisible() const
+{
+    return supportsPlaceholder()
+        && isEmptyValue()
+        && document()->focusedNode() != this
+        && !getAttribute(placeholderAttr).isEmpty();
+}
+
+void HTMLTextFormControlElement::updatePlaceholderVisibility(bool placeholderValueChanged)
+{
+    if (supportsPlaceholder() && renderer())
+        toRenderTextControl(renderer())->updatePlaceholderVisibility(placeholderShouldBeVisible(), placeholderValueChanged);
+}
+
+RenderTextControl* HTMLTextFormControlElement::textRendererAfterUpdateLayout()
+{
+    if (!isTextFormControl())
+        return 0;
+    document()->updateLayoutIgnorePendingStylesheets();
+    return toRenderTextControl(renderer());
+}
+
+void HTMLTextFormControlElement::setSelectionStart(int start)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionStart(start);
+}
+
+void HTMLTextFormControlElement::setSelectionEnd(int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionEnd(end);
+}
+
+void HTMLTextFormControlElement::select()
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->select();
+}
+
+void HTMLTextFormControlElement::setSelectionRange(int start, int end)
+{
+    if (RenderTextControl* renderer = textRendererAfterUpdateLayout())
+        renderer->setSelectionRange(start, end);
+}
+
+int HTMLTextFormControlElement::selectionStart()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionStart() >= 0)
+        return cachedSelectionStart();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionStart();
+}
+
+int HTMLTextFormControlElement::selectionEnd()
+{
+    if (!isTextFormControl())
+        return 0;
+    if (document()->focusedNode() != this && cachedSelectionEnd() >= 0)
+        return cachedSelectionEnd();
+    if (!renderer())
+        return 0;
+    return toRenderTextControl(renderer())->selectionEnd();
+}
+
+VisibleSelection HTMLTextFormControlElement::selection() const
+{
+    if (!renderer() || !isTextFormControl() || cachedSelectionStart() < 0 || cachedSelectionEnd() < 0)
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(cachedSelectionStart(), cachedSelectionEnd());
+}
+
+void HTMLTextFormControlElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility(true);
+    else if (attr->name() == onfocusAttr)
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onblurAttr)
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onselectAttr)
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onchangeAttr)
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
+    else
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+}
+
 } // namespace Webcore
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index a30f46c..b5dc7ce 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -30,7 +30,9 @@ namespace WebCore {
 
 class FormDataList;
 class HTMLFormElement;
+class RenderTextControl;
 class ValidityState;
+class VisibleSelection;
 
 class HTMLFormControlElement : public HTMLElement {
 public:
@@ -43,6 +45,9 @@ public:
     HTMLFormElement* form() const { return m_form; }
     virtual ValidityState* validity();
 
+    bool formNoValidate() const;
+    void setFormNoValidate(bool);
+
     virtual bool isTextFormControl() const { return false; }
     virtual bool isEnabledFormControl() const { return !disabled(); }
 
@@ -102,10 +107,12 @@ public:
     virtual short tabIndex() const;
 
     virtual bool willValidate() const;
+    bool checkValidity();
+    void updateValidity();
     void setCustomValidity(const String&);
-
     virtual bool valueMissing() const { return false; }
     virtual bool patternMismatch() const { return false; }
+    virtual bool tooLong() const { return false; }
 
     void formDestroyed() { m_form = 0; }
 
@@ -117,12 +124,15 @@ protected:
 
 private:
     virtual HTMLFormElement* virtualForm() const;
+    virtual bool isDefaultButtonForForm() const;
+    virtual bool isValidFormControlElement();
 
     HTMLFormElement* m_form;
     RefPtr<ValidityState> m_validityState;
-    bool m_disabled;
-    bool m_readOnly;
-    bool m_valueMatchesRenderer;
+    bool m_disabled : 1;
+    bool m_readOnly : 1;
+    bool m_required : 1;
+    bool m_valueMatchesRenderer : 1;
 };
 
 class HTMLFormControlElementWithState : public HTMLFormControlElement {
@@ -137,6 +147,40 @@ protected:
     virtual void didMoveToNewOwnerDocument();
 };
 
+class HTMLTextFormControlElement : public HTMLFormControlElementWithState {
+public:
+    HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
+    virtual ~HTMLTextFormControlElement();
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    int selectionStart();
+    int selectionEnd();
+    void setSelectionStart(int);
+    void setSelectionEnd(int);
+    void select();
+    void setSelectionRange(int start, int end);
+    VisibleSelection selection() const;
+
+protected:
+    bool placeholderShouldBeVisible() const;
+    void updatePlaceholderVisibility(bool);
+    virtual int cachedSelectionStart() const = 0;
+    virtual int cachedSelectionEnd() const = 0;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+private:
+    // A subclass should return true if placeholder processing is needed.
+    virtual bool supportsPlaceholder() const = 0;
+    // Returns true if user-editable value is empty.  This is used to check placeholder visibility.
+    virtual bool isEmptyValue() const = 0;
+    // Called in dispatchFocusEvent(), after placeholder process, before calling parent's dispatchFocusEvent().
+    virtual void handleFocusEvent() { }
+    // Called in dispatchBlurEvent(), after placeholder process, before calling parent's dispatchBlurEvent().
+    virtual void handleBlurEvent() { }
+    RenderTextControl* textRendererAfterUpdateLayout();
+};
+
 } //namespace
 
 #endif
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index 54986b0..ace0f2f 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -47,6 +47,7 @@
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
+#include "ValidityState.h"
 #include <limits>
 #include <wtf/CurrentTime.h>
 #include <wtf/RandomNumber.h>
@@ -149,14 +150,14 @@ void HTMLFormElement::removedFromDocument()
     HTMLElement::removedFromDocument();
 }
 
-void HTMLFormElement::handleLocalEvents(Event* event, bool useCapture)
+void HTMLFormElement::handleLocalEvents(Event* event)
 {
     Node* targetNode = event->target()->toNode();
-    if (!useCapture && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
+    if (event->eventPhase() != Event::CAPTURING_PHASE && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
         event->stopPropagation();
         return;
     }
-    HTMLElement::handleLocalEvents(event, useCapture);
+    HTMLElement::handleLocalEvents(event);
 }
 
 unsigned HTMLFormElement::length() const
@@ -295,7 +296,7 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     m_insubmit = true;
     m_doingsubmit = false;
 
-    if (dispatchEvent(eventNames().submitEvent, true, true) && !m_doingsubmit)
+    if (dispatchEvent(Event::create(eventNames().submitEvent, true, true)) && !m_doingsubmit)
         m_doingsubmit = true;
 
     m_insubmit = false;
@@ -415,7 +416,7 @@ void HTMLFormElement::reset()
 
     // ### DOM2 labels this event as not cancelable, however
     // common browsers( sick! ) allow it be cancelled.
-    if ( !dispatchEvent(eventNames().resetEvent, true, true) ) {
+    if (!dispatchEvent(Event::create(eventNames().resetEvent, true, true))) {
         m_inreset = false;
         return;
     }
@@ -537,6 +538,16 @@ void HTMLFormElement::setName(const String &value)
     setAttribute(nameAttr, value);
 }
 
+bool HTMLFormElement::noValidate() const
+{
+    return !getAttribute(novalidateAttr).isNull();
+}
+
+void HTMLFormElement::setNoValidate(bool novalidate)
+{
+    setAttribute(novalidateAttr, novalidate ? "" : 0);
+}
+
 void HTMLFormElement::setAcceptCharset(const String &value)
 {
     setAttribute(accept_charsetAttr, value);
@@ -577,6 +588,31 @@ void HTMLFormElement::setTarget(const String &value)
     setAttribute(targetAttr, value);
 }
 
+HTMLFormControlElement* HTMLFormElement::defaultButton() const
+{
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (control->isSuccessfulSubmitButton())
+            return control;
+    }
+
+    return 0;
+}
+
+bool HTMLFormElement::checkValidity()
+{
+    // TODO: Check for unhandled invalid controls, see #27452 for tips.
+
+    bool hasOnlyValidControls = true;
+    for (unsigned i = 0; i < formElements.size(); ++i) {
+        HTMLFormControlElement* control = formElements[i];
+        if (!control->checkValidity())
+            hasOnlyValidControls = false;
+    }
+
+    return hasOnlyValidControls;
+}
+
 PassRefPtr<HTMLFormControlElement> HTMLFormElement::elementForAlias(const AtomicString& alias)
 {
     if (alias.isEmpty() || !m_elementAliases)
diff --git a/WebCore/html/HTMLFormElement.h b/WebCore/html/HTMLFormElement.h
index 6b7812a..a2e9585 100644
--- a/WebCore/html/HTMLFormElement.h
+++ b/WebCore/html/HTMLFormElement.h
@@ -54,7 +54,7 @@ public:
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
  
-    virtual void handleLocalEvents(Event*, bool useCapture);
+    virtual void handleLocalEvents(Event*);
      
     PassRefPtr<HTMLCollection> elements();
     void getNamedElements(const AtomicString&, Vector<RefPtr<Node> >&);
@@ -96,6 +96,9 @@ public:
     String name() const;
     void setName(const String&);
 
+    bool noValidate() const;
+    void setNoValidate(bool);
+
     String acceptCharset() const { return m_formDataBuilder.acceptCharset(); }
     void setAcceptCharset(const String&);
 
@@ -107,7 +110,11 @@ public:
 
     virtual String target() const;
     void setTarget(const String&);
-    
+
+    HTMLFormControlElement* defaultButton() const;
+
+    bool checkValidity();
+
     PassRefPtr<HTMLFormControlElement> elementForAlias(const AtomicString&);
     void addElementAlias(HTMLFormControlElement*, const AtomicString& alias);
 
diff --git a/WebCore/html/HTMLFormElement.idl b/WebCore/html/HTMLFormElement.idl
index f3aca87..3e846d6 100644
--- a/WebCore/html/HTMLFormElement.idl
+++ b/WebCore/html/HTMLFormElement.idl
@@ -30,6 +30,7 @@ module html {
         readonly attribute HTMLCollection  elements;
         readonly attribute long            length;
                  attribute [ConvertNullToNullString] DOMString       name;
+                 attribute boolean         noValidate;
                  attribute [ConvertNullToNullString] DOMString       acceptCharset;
                  attribute [ConvertNullToNullString] DOMString       action;
                  attribute [ConvertNullToNullString] DOMString       encoding;  /* Netscape/Firefox legacy attribute. Same as enctype. */
@@ -39,5 +40,6 @@ module html {
         
         [Custom] void submit();
         void reset();
+        boolean  checkValidity();
     };
 }
diff --git a/WebCore/html/HTMLFrameElement.cpp b/WebCore/html/HTMLFrameElement.cpp
index adc3ff1..b456ac3 100644
--- a/WebCore/html/HTMLFrameElement.cpp
+++ b/WebCore/html/HTMLFrameElement.cpp
@@ -1,9 +1,9 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,18 +34,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
+    , m_noResize(false)
 {
     ASSERT(hasTagName(frameTag));
 }
 
+PassRefPtr<HTMLFrameElement> HTMLFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLFrameElement(tagName, document));
+}
+
 bool HTMLFrameElement::rendererIsNeeded(RenderStyle*)
 {
     // For compatibility, frames render even when display: none is set.
-    return isURLAllowed(m_URL);
+    return isURLAllowed();
 }
 
 RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -55,9 +61,10 @@ RenderObject* HTMLFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
 
 static inline HTMLFrameSetElement* containingFrameSetElement(Node* node)
 {
-    while ((node = node->parentNode()))
+    while ((node = node->parentNode())) {
         if (node->hasTagName(framesetTag))
             return static_cast<HTMLFrameSetElement*>(node);
+    }
     return 0;
 }
 
@@ -73,14 +80,26 @@ void HTMLFrameElement::attach()
     }
 }
 
-void HTMLFrameElement::parseMappedAttribute(MappedAttribute *attr)
+void HTMLFrameElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == frameborderAttr) {
         m_frameBorder = attr->value().toInt();
         m_frameBorderSet = !attr->isNull();
         // FIXME: If we are already attached, this has no effect.
+    } else if (attr->name() == noresizeAttr) {
+        m_noResize = true;
+        // FIXME: If we are already attached, this has no effect.
+        // FIXME: Since this does not check attr->isNull(), it can
+        // never reset m_noResize to false if the attribute is removed.
+        // FIXME: There seems to be no code that looks at this
+        // value and prevents resizing.
     } else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
+void HTMLFrameElement::setNoResize(bool noResize)
+{
+    setAttribute(noresizeAttr, noResize ? "" : 0);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.h b/WebCore/html/HTMLFrameElement.h
index ab602ee..4a8e16c 100644
--- a/WebCore/html/HTMLFrameElement.h
+++ b/WebCore/html/HTMLFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,13 +28,16 @@
 
 namespace WebCore {
 
-class Document;
-class RenderObject;
-class RenderArena;
-class RenderStyle;
-
 class HTMLFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLFrameElement> create(const QualifiedName&, Document*);
+
+    bool hasFrameBorder() const { return m_frameBorder; }
+
+    bool noResize() const { return m_noResize; }
+    void setNoResize(bool);
+
+private:
     HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
@@ -47,11 +50,10 @@ public:
     
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool hasFrameBorder() const { return m_frameBorder; }
-
-private:
     bool m_frameBorder;
     bool m_frameBorderSet;
+
+    bool m_noResize;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.idl b/WebCore/html/HTMLFrameElement.idl
index 106e57e..d0076eb 100644
--- a/WebCore/html/HTMLFrameElement.idl
+++ b/WebCore/html/HTMLFrameElement.idl
@@ -26,14 +26,14 @@ module html {
         ImplementationUUID=38c9e3c8-3384-40b6-a484-cb845c48b67d
     ] HTMLFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
                  attribute boolean         noResize;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, ReflectURL] DOMString       src;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index a4f0a5e..1bc4995 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -50,18 +50,17 @@ HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Documen
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
-    , m_noResize(false)
     , m_viewSource(false)
     , m_shouldOpenURLAfterAttach(false)
 {
 }
 
-bool HTMLFrameElementBase::isURLAllowed(const AtomicString& URLString) const
+bool HTMLFrameElementBase::isURLAllowed() const
 {
-    if (URLString.isEmpty())
+    if (m_URL.isEmpty())
         return true;
 
-    const KURL& completeURL = document()->completeURL(URLString);
+    const KURL& completeURL = document()->completeURL(m_URL);
 
     // Don't allow more than 200 total frames in a set. This seems
     // like a reasonable upper bound, and otherwise mutually recursive
@@ -93,7 +92,7 @@ void HTMLFrameElementBase::openURL()
 {
     ASSERT(!m_frameName.isEmpty());
 
-    if (!isURLAllowed(m_URL))
+    if (!isURLAllowed())
         return;
 
     if (m_URL.isEmpty())
@@ -127,9 +126,6 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == marginheightAttr) {
         m_marginHeight = attr->value().toInt();
         // FIXME: If we are already attached, this has no effect.
-    } else if (attr->name() == noresizeAttr) {
-        m_noResize = true;
-        // FIXME: If we are already attached, this has no effect.
     } else if (attr->name() == scrollingAttr) {
         // Auto and yes both simply mean "allow scrolling." No means "don't allow scrolling."
         if (equalIgnoringCase(attr->value(), "auto") || equalIgnoringCase(attr->value(), "yes"))
@@ -201,7 +197,7 @@ void HTMLFrameElementBase::attach()
 
 KURL HTMLFrameElementBase::location() const
 {
-    return src();
+    return document()->completeURL(getAttribute(srcAttr));
 }
 
 void HTMLFrameElementBase::setLocation(const String& str)
@@ -216,9 +212,9 @@ void HTMLFrameElementBase::setLocation(const String& str)
         openURL();
 }
 
-bool HTMLFrameElementBase::isFocusable() const
+bool HTMLFrameElementBase::supportsFocus() const
 {
-    return renderer();
+    return true;
 }
 
 void HTMLFrameElementBase::setFocus(bool received)
@@ -233,81 +229,6 @@ bool HTMLFrameElementBase::isURLAttribute(Attribute *attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLFrameElementBase::frameBorder() const
-{
-    return getAttribute(frameborderAttr);
-}
-
-void HTMLFrameElementBase::setFrameBorder(const String &value)
-{
-    setAttribute(frameborderAttr, value);
-}
-
-String HTMLFrameElementBase::longDesc() const
-{
-    return getAttribute(longdescAttr);
-}
-
-void HTMLFrameElementBase::setLongDesc(const String &value)
-{
-    setAttribute(longdescAttr, value);
-}
-
-String HTMLFrameElementBase::marginHeight() const
-{
-    return getAttribute(marginheightAttr);
-}
-
-void HTMLFrameElementBase::setMarginHeight(const String &value)
-{
-    setAttribute(marginheightAttr, value);
-}
-
-String HTMLFrameElementBase::marginWidth() const
-{
-    return getAttribute(marginwidthAttr);
-}
-
-void HTMLFrameElementBase::setMarginWidth(const String &value)
-{
-    setAttribute(marginwidthAttr, value);
-}
-
-String HTMLFrameElementBase::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLFrameElementBase::setName(const String &value)
-{
-    setAttribute(nameAttr, value);
-}
-
-void HTMLFrameElementBase::setNoResize(bool noResize)
-{
-    setAttribute(noresizeAttr, noResize ? "" : 0);
-}
-
-String HTMLFrameElementBase::scrolling() const
-{
-    return getAttribute(scrollingAttr);
-}
-
-void HTMLFrameElementBase::setScrolling(const String &value)
-{
-    setAttribute(scrollingAttr, value);
-}
-
-KURL HTMLFrameElementBase::src() const
-{
-    return document()->completeURL(getAttribute(srcAttr));
-}
-
-void HTMLFrameElementBase::setSrc(const String &value)
-{
-    setAttribute(srcAttr, value);
-}
-
 int HTMLFrameElementBase::width() const
 {
     if (!renderer())
diff --git a/WebCore/html/HTMLFrameElementBase.h b/WebCore/html/HTMLFrameElementBase.h
index 4a24451..c211ba7 100644
--- a/WebCore/html/HTMLFrameElementBase.h
+++ b/WebCore/html/HTMLFrameElementBase.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,60 +31,39 @@ namespace WebCore {
 
 class HTMLFrameElementBase : public HTMLFrameOwnerElement {
 public:
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-
-    virtual void attach();
-    virtual bool canLazyAttach() { return false; }
-
     KURL location() const;
     void setLocation(const String&);
 
-    virtual bool isFocusable() const;
-    virtual void setFocus(bool);
-    
-    virtual bool isURLAttribute(Attribute*) const;
-
     virtual ScrollbarMode scrollingMode() const { return m_scrolling; }
     
     int getMarginWidth() const { return m_marginWidth; }
     int getMarginHeight() const { return m_marginHeight; }
 
-    String frameBorder() const;
-    void setFrameBorder(const String&);
-
-    String longDesc() const;
-    void setLongDesc(const String&);
+    int width() const;
+    int height() const;
 
-    String marginHeight() const;
-    void setMarginHeight(const String&);
+protected:
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
-    String marginWidth() const;
-    void setMarginWidth(const String&);
+    bool isURLAllowed() const;
 
-    String name() const;
-    void setName(const String&);
+    virtual void parseMappedAttribute(MappedAttribute*);
 
-    bool noResize() const { return m_noResize; }
-    void setNoResize(bool);
+    virtual void insertedIntoDocument();
+    virtual void removedFromDocument();
 
-    String scrolling() const;
-    void setScrolling(const String&);
+    virtual void attach();
 
-    KURL src() const;
-    void setSrc(const String&);
+private:
+    virtual bool canLazyAttach() { return false; }
 
-    int width() const;
-    int height() const;
+    virtual bool supportsFocus() const;
+    virtual void setFocus(bool);
+    
+    virtual bool isURLAttribute(Attribute*) const;
 
     bool viewSourceMode() const { return m_viewSource; }
 
-protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*);
-
-    bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
     void openURL();
 
@@ -98,7 +77,6 @@ protected:
     int m_marginWidth;
     int m_marginHeight;
 
-    bool m_noResize;
     bool m_viewSource;
 
     bool m_shouldOpenURLAfterAttach;
diff --git a/WebCore/html/HTMLFrameOwnerElement.cpp b/WebCore/html/HTMLFrameOwnerElement.cpp
index a98a3df..84958c2 100644
--- a/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,7 +33,7 @@
 namespace WebCore {
 
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
+    : HTMLElement(tagName, document, CreateElement)
     , m_contentFrame(0)
 {
 }
diff --git a/WebCore/html/HTMLFrameOwnerElement.h b/WebCore/html/HTMLFrameOwnerElement.h
index 3f50a02..1437e2c 100644
--- a/WebCore/html/HTMLFrameOwnerElement.h
+++ b/WebCore/html/HTMLFrameOwnerElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,36 +27,36 @@ namespace WebCore {
 
 class DOMWindow;
 class Frame;
-class KeyboardEvent;
 
 #if ENABLE(SVG)
 class SVGDocument;
 #endif
 
 class HTMLFrameOwnerElement : public HTMLElement {
-protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
-
 public:
     virtual ~HTMLFrameOwnerElement();
 
-    virtual void willRemove();
-
     Frame* contentFrame() const { return m_contentFrame; }
     DOMWindow* contentWindow() const;
     Document* contentDocument() const;
 
-    virtual bool isFrameOwnerElement() const { return true; }
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
-    
-    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
-
 #if ENABLE(SVG)
     SVGDocument* getSVGDocument(ExceptionCode&) const;
 #endif
 
+    virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
+
+protected:
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
+
 private:
     friend class Frame;
+
+    virtual bool isFrameOwnerElement() const { return true; }
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
+    
+    virtual void willRemove();
+
     Frame* m_contentFrame;
 };
 
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index a8f544b..5874b84 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -135,6 +135,10 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
         document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+#if ENABLE(ORIENTATION_EVENTS)
+    else if (attr->name() == onorientationchangeAttr)
+        document()->setWindowAttributeEventListener(eventNames().orientationchangeEvent, createAttributeEventListener(document()->frame(), attr));
+#endif
     else if (attr->name() == onhashchangeAttr)
         document()->setWindowAttributeEventListener(eventNames().hashchangeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
@@ -233,114 +237,4 @@ void HTMLFrameSetElement::setRows(const String &value)
     setAttribute(rowsAttr, value);
 }
 
-EventListener* HTMLFrameSetElement::onblur() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
-}
-
-void HTMLFrameSetElement::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onerror() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
-}
-
-void HTMLFrameSetElement::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onfocus() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
-}
-
-void HTMLFrameSetElement::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
-}
-
-void HTMLFrameSetElement::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onbeforeunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void HTMLFrameSetElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onmessage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
-}
-
-void HTMLFrameSetElement::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onoffline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
-}
-
-void HTMLFrameSetElement::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::ononline() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
-}
-
-void HTMLFrameSetElement::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onresize() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
-}
-
-void HTMLFrameSetElement::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onstorage() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
-}
-
-void HTMLFrameSetElement::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* HTMLFrameSetElement::onunload() const
-{
-    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
-}
-
-void HTMLFrameSetElement::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index 4319c7a..2b2d7ea 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -24,8 +24,9 @@
 #ifndef HTMLFrameSetElement_h
 #define HTMLFrameSetElement_h
 
-#include "HTMLElement.h"
 #include "Color.h"
+#include "Document.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
@@ -67,30 +68,23 @@ public:
     const Length* rowLengths() const { return m_rows; }
     const Length* colLengths() const { return m_cols; }
 
-    // Event handler attributes
-    virtual EventListener* onblur() const;
-    virtual void setOnblur(PassRefPtr<EventListener>);
-    virtual EventListener* onerror() const;
-    virtual void setOnerror(PassRefPtr<EventListener>);
-    virtual EventListener* onfocus() const;
-    virtual void setOnfocus(PassRefPtr<EventListener>);
-    virtual EventListener* onload() const;
-    virtual void setOnload(PassRefPtr<EventListener>);
-
-    EventListener* onbeforeunload() const;
-    void setOnbeforeunload(PassRefPtr<EventListener>);
-    EventListener* onmessage() const;
-    void setOnmessage(PassRefPtr<EventListener>);
-    EventListener* onoffline() const;
-    void setOnoffline(PassRefPtr<EventListener>);
-    EventListener* ononline() const;
-    void setOnonline(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onstorage() const;
-    void setOnstorage(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
+    // Declared virtual in Element
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(blur);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(focus);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(load);
+
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(hashchange);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(message);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(offline);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(online);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(resize);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(storage);
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(unload);
+#if ENABLE(ORIENTATION_EVENTS)
+    DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+#endif
 
 private:
     Length* m_rows;
diff --git a/WebCore/html/HTMLFrameSetElement.idl b/WebCore/html/HTMLFrameSetElement.idl
index 4050f2c..b44a071 100644
--- a/WebCore/html/HTMLFrameSetElement.idl
+++ b/WebCore/html/HTMLFrameSetElement.idl
@@ -33,6 +33,7 @@ module html {
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Event handler attributes
         attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onhashchange;
         attribute [DontEnum] EventListener onmessage;
         attribute [DontEnum] EventListener onoffline;
         attribute [DontEnum] EventListener ononline;
@@ -40,7 +41,11 @@ module html {
         attribute [DontEnum] EventListener onstorage;
         attribute [DontEnum] EventListener onunload;
 
-        // Overrides of Element attributes.
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute [DontEnum] EventListener onorientationchange;
+#endif
+
+        // Overrides of Element attributes (left in for completeness).
         // attribute [DontEnum] EventListener onblur;
         // attribute [DontEnum] EventListener onerror;
         // attribute [DontEnum] EventListener onfocus;
@@ -49,7 +54,6 @@ module html {
         // Not implemented yet.
         // attribute [DontEnum] EventListener onafterprint;
         // attribute [DontEnum] EventListener onbeforeprint;
-        // attribute [DontEnum] EventListener onhashchange;
         // attribute [DontEnum] EventListener onpopstate;
         // attribute [DontEnum] EventListener onredo;
         // attribute [DontEnum] EventListener onundo;
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index 478925a..cae9b8d 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -35,12 +35,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+inline HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
     : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
 
+PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tagName, Document* document)
+{
+    return adoptRef(new HTMLIFrameElement(tagName, document));
+}
+
 bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == widthAttr || attrName == heightAttr) {
@@ -89,7 +94,7 @@ void HTMLIFrameElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool HTMLIFrameElement::rendererIsNeeded(RenderStyle* style)
 {
-    return isURLAllowed(m_URL) && style->display() != NONE;
+    return isURLAllowed() && style->display() != NONE;
 }
 
 RenderObject* HTMLIFrameElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -126,34 +131,4 @@ bool HTMLIFrameElement::isURLAttribute(Attribute* attr) const
     return attr->name() == srcAttr;
 }
 
-String HTMLIFrameElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLIFrameElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLIFrameElement::height() const
-{
-    return getAttribute(heightAttr);
-}
-
-void HTMLIFrameElement::setHeight(const String &value)
-{
-    setAttribute(heightAttr, value);
-}
-
-String HTMLIFrameElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLIFrameElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLIFrameElement.h b/WebCore/html/HTMLIFrameElement.h
index 362b991..f1c6a35 100644
--- a/WebCore/html/HTMLIFrameElement.h
+++ b/WebCore/html/HTMLIFrameElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,6 +30,9 @@ namespace WebCore {
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
+    static PassRefPtr<HTMLIFrameElement> create(const QualifiedName&, Document*);
+
+private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -48,16 +51,6 @@ public:
     
     virtual bool isURLAttribute(Attribute*) const;
 
-    String align() const;
-    void setAlign(const String&);
-
-    String height() const;
-    void setHeight(const String&);
-
-    String width() const;
-    void setWidth(const String&);
-
-private:
     AtomicString m_name;
 };
 
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index b5684ca..e288b54 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,16 +26,16 @@ module html {
         ImplementationUUID=370c6318-f804-49f9-bc8a-46b99cd87399
     ] HTMLIFrameElement : HTMLElement {
 
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       frameBorder;
-                 attribute [ConvertNullToNullString] DOMString       height;
-                 attribute [ConvertNullToNullString] DOMString       longDesc;
-                 attribute [ConvertNullToNullString] DOMString       marginHeight;
-                 attribute [ConvertNullToNullString] DOMString       marginWidth;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       scrolling;
-                 attribute [ConvertNullToNullString, CustomSetter] DOMString       src;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect=frameborder] DOMString       frameBorder;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect=longdesc] DOMString       longDesc;
+                 attribute [ConvertNullToNullString, Reflect=marginheight] DOMString       marginHeight;
+                 attribute [ConvertNullToNullString, Reflect=marginwidth] DOMString       marginWidth;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       scrolling;
+                 attribute [ConvertNullToNullString, CustomSetter, Reflect] DOMString       src;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 5173964..932e718 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -279,46 +279,11 @@ bool HTMLImageElement::isURLAttribute(Attribute* attr) const
         || (attr->name() == usemapAttr && attr->value().string()[0] != '#');
 }
 
-String HTMLImageElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLImageElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLImageElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLImageElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLImageElement::alt() const
+const AtomicString& HTMLImageElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLImageElement::setAlt(const String& value)
-{
-    setAttribute(altAttr, value);
-}
-
-String HTMLImageElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLImageElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
 bool HTMLImageElement::draggable() const
 {
     // Image elements are draggable by default.
@@ -381,16 +346,6 @@ void HTMLImageElement::setSrc(const String& value)
     setAttribute(srcAttr, value);
 }
 
-String HTMLImageElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLImageElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLImageElement::vspace() const
 {
     // ### return actual vspace
@@ -439,7 +394,8 @@ void HTMLImageElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     addSubresourceURL(urls, src());
-    addSubresourceURL(urls, document()->completeURL(useMap()));
+    // FIXME: What about when the usemap attribute begins with "#"?
+    addSubresourceURL(urls, document()->completeURL(getAttribute(usemapAttr)));
 }
 
 }
diff --git a/WebCore/html/HTMLImageElement.h b/WebCore/html/HTMLImageElement.h
index 5e82186..f58574d 100644
--- a/WebCore/html/HTMLImageElement.h
+++ b/WebCore/html/HTMLImageElement.h
@@ -69,17 +69,7 @@ public:
 
     void setLoadManually(bool loadManually) { m_imageLoader.setLoadManually(loadManually); }
 
-    String name() const;
-    void setName(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
-    String alt() const;
-    void setAlt(const String&);
-
-    String border() const;
-    void setBorder(const String&);
+    const AtomicString& alt() const;
 
     virtual bool draggable() const;
 
@@ -100,9 +90,6 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
-    String useMap() const;
-    void setUseMap(const String&);
-
     int vspace() const;
     void setVspace(int);
 
diff --git a/WebCore/html/HTMLImageLoader.cpp b/WebCore/html/HTMLImageLoader.cpp
index 2b9f09c..c6f49aa 100644
--- a/WebCore/html/HTMLImageLoader.cpp
+++ b/WebCore/html/HTMLImageLoader.cpp
@@ -25,6 +25,7 @@
 #include "CSSHelper.h"
 #include "CachedImage.h"
 #include "Element.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
@@ -45,7 +46,7 @@ void HTMLImageLoader::dispatchLoadEvent()
     bool errorOccurred = image()->errorOccurred();
     if (!errorOccurred && image()->httpStatusCodeErrorOccurred())
         errorOccurred = element()->hasTagName(HTMLNames::objectTag); // An <object> considers a 404 to be an error and should fire onerror.
-    element()->dispatchEvent(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false);
+    element()->dispatchEvent(Event::create(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false));
 }
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 59e4e2f..5689e73 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -34,14 +34,17 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "File.h"
 #include "FileList.h"
 #include "FocusController.h"
 #include "FormDataList.h"
 #include "Frame.h"
+#include "HTMLDataListElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "HTMLOptionElement.h"
 #include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
@@ -57,9 +60,13 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "TextEvent.h"
+<<<<<<< HEAD:WebCore/html/HTMLInputElement.cpp
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
 #include "WebViewCore.h"
 #endif
+=======
+#include <wtf/MathExtras.h>
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLInputElement.cpp
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -71,7 +78,7 @@ using namespace HTMLNames;
 const int maxSavedResults = 256;
 
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
+    : HTMLTextFormControlElement(tagName, doc, f)
     , m_xPos(0)
     , m_yPos(0)
     , m_maxResults(-1)
@@ -138,6 +145,8 @@ bool HTMLInputElement::valueMissing() const
             return !checked();
         case RADIO:
             return !document()->checkedRadioButtons().checkedButtonForGroup(name());
+        case COLOR:
+            return false;
         case HIDDEN:
         case RANGE:
         case SUBMIT:
@@ -166,6 +175,7 @@ bool HTMLInputElement::patternMismatch() const
         case BUTTON:
         case RANGE:
         case NUMBER:
+        case COLOR:
             return false;
         case TEXT:
         case SEARCH:
@@ -192,6 +202,98 @@ bool HTMLInputElement::patternMismatch() const
     return false;
 }
 
+bool HTMLInputElement::tooLong() const
+{
+    switch (inputType()) {
+    case EMAIL:
+    case PASSWORD:
+    case SEARCH:
+    case TELEPHONE:
+    case TEXT:
+    case URL: {
+        int max = maxLength();
+        if (max < 0)
+            return false;
+        // Return false for the default value even if it is longer than maxLength.
+        bool userEdited = !m_data.value().isNull();
+        if (!userEdited)
+            return false;
+        return value().length() > static_cast<unsigned>(max);
+    }
+    case BUTTON:
+    case CHECKBOX:
+    case COLOR:
+    case FILE:
+    case HIDDEN:
+    case IMAGE:
+    case ISINDEX:
+    case NUMBER:
+    case RADIO:
+    case RANGE:
+    case RESET:
+    case SUBMIT:
+        return false;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+bool HTMLInputElement::rangeUnderflow() const
+{
+    if (inputType() == NUMBER) {
+        double min = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(minAttr), &min) && formStringToDouble(value(), &doubleValue))
+            return doubleValue < min;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue < rangeMinimum();
+    }
+    return false;
+}
+
+bool HTMLInputElement::rangeOverflow() const
+{
+    if (inputType() == NUMBER) {
+        double max = 0.0;
+        double doubleValue = 0.0;
+        if (formStringToDouble(getAttribute(maxAttr), &max) && formStringToDouble(value(), &doubleValue))
+            return doubleValue > max;
+    } else if (inputType() == RANGE) {
+        double doubleValue;
+        if (formStringToDouble(value(), &doubleValue))
+            return doubleValue > rangeMaximum();
+    }
+    return false;
+}
+
+double HTMLInputElement::rangeMinimum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default minimum" is 0.
+    double min = 0.0;
+    formStringToDouble(getAttribute(minAttr), &min);
+    return min;
+}
+
+double HTMLInputElement::rangeMaximum() const
+{
+    ASSERT(inputType() == RANGE);
+    // The range type's "default maximum" is 100.
+    static const double defaultMaximum = 100.0;
+    double max = defaultMaximum;
+    formStringToDouble(getAttribute(maxAttr), &max);
+    const double min = rangeMinimum();
+
+    if (max < min) {
+        // A remedy for the inconsistent min/max values.
+        // Sets the maxmimum to the default (100.0) or the minimum value.
+        max = min < defaultMaximum ? defaultMaximum : min;
+    }
+    return max;
+}
+
 static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
@@ -254,20 +356,17 @@ bool HTMLInputElement::shouldUseInputMethod() const
     return m_type == TEXT || m_type == SEARCH || m_type == ISINDEX;
 }
 
-void HTMLInputElement::dispatchFocusEvent()
+void HTMLInputElement::handleFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
 
     if (isTextField())
         m_autofilled = false;
-
-    HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
-void HTMLInputElement::dispatchBlurEvent()
+void HTMLInputElement::handleBlurEvent()
 {
-    InputElement::dispatchBlurEvent(m_data, this, this);
-    HTMLFormControlElementWithState::dispatchBlurEvent();
+    InputElement::dispatchBlurEvent(this, this);
 }
 
 void HTMLInputElement::setType(const String& t)
@@ -325,6 +424,8 @@ void HTMLInputElement::setInputType(const String& t)
         newType = TELEPHONE;
     else if (equalIgnoringCase(t, "url"))
         newType = URL;
+    else if (equalIgnoringCase(t, "color"))
+        newType = COLOR;
     else
         newType = TEXT;
 
@@ -359,7 +460,7 @@ void HTMLInputElement::setInputType(const String& t)
                 m_data.setValue(String());
             }
             if (!didStoreValue && willStoreValue)
-                m_data.setValue(constrainValue(getAttribute(valueAttr)));
+                m_data.setValue(sanitizeValue(getAttribute(valueAttr)));
             else
                 InputElement::updateValueIfNeeded(m_data, this);
 
@@ -389,6 +490,7 @@ void HTMLInputElement::setInputType(const String& t)
         }
 
         InputElement::notifyFormStateChanged(this);
+        updateValidity();
     }
     m_haveType = true;
 
@@ -408,6 +510,10 @@ const AtomicString& HTMLInputElement::formControlType() const
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case COLOR: {
+            DEFINE_STATIC_LOCAL(const AtomicString, color, ("color"));
+            return color;
+        }
         case EMAIL: {
             DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
             return email;
@@ -477,6 +583,7 @@ bool HTMLInputElement::saveFormControlState(String& result) const
 
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -508,6 +615,7 @@ void HTMLInputElement::restoreFormControlState(const String& state)
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case COLOR:
         case EMAIL:
         case FILE:
         case HIDDEN:
@@ -544,63 +652,6 @@ bool HTMLInputElement::canHaveSelection() const
     return isTextField();
 }
 
-int HTMLInputElement::selectionStart() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
-        return m_data.cachedSelectionStart();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLInputElement::selectionEnd() const
-{
-    if (!isTextField())
-        return 0;
-    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
-        return m_data.cachedSelectionEnd();
-    if (!renderer())
-        return 0;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static bool isTextFieldWithRenderer(HTMLInputElement* element)
-{
-    if (!element->isTextField())
-        return false;
-
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    if (!element->renderer())
-        return false;
-
-    return true;
-}
-
-void HTMLInputElement::setSelectionStart(int start)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionStart(start);
-}
-
-void HTMLInputElement::setSelectionEnd(int end)
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->setSelectionEnd(end);
-}
-
-void HTMLInputElement::select()
-{
-    if (isTextFieldWithRenderer(this))
-        toRenderTextControl(renderer())->select();
-}
-
-void HTMLInputElement::setSelectionRange(int start, int end)
-{
-    InputElement::updateSelectionRange(this, this, start, end);
-}
-
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
 {
     switch (inputType()) {
@@ -619,6 +670,7 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
         case HIDDEN:
             // a no-op for this type
             break;
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -659,6 +711,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         checkedRadioButtons(this).removeButton(this);
         m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
+        HTMLFormControlElementWithState::parseMappedAttribute(attr);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
             m_autocomplete = Off;
@@ -678,12 +731,14 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (m_data.value().isNull())
             setNeedsStyleRecalc();
         setFormControlValueMatchesRenderer(false);
+        updateValidity();
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
+        updateValidity();
     } else if (attr->name() == maxlengthAttr)
         InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
     else if (attr->name() == sizeAttr)
@@ -715,14 +770,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
     } else if (attr->name() == heightAttr) {
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
-    } else if (attr->name() == onfocusAttr) {
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onblurAttr) {
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onselectAttr) {
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == onchangeAttr) {
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
@@ -730,7 +777,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
-        m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
+        m_maxResults = !attr->isNull() ? std::min(attr->value().toInt(), maxSavedResults) : -1;
         // FIXME: Detaching just for maxResults change is not ideal.  We should figure out the right
         // time to relayout for this change.
         if (m_maxResults != oldResults && (m_maxResults <= 0 || oldResults <= 0) && attached()) {
@@ -738,9 +785,6 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             attach();
         }
         setNeedsStyleRecalc();
-    } else if (attr->name() == placeholderAttr) {
-        if (isTextField())
-            updatePlaceholderVisibility();
     } else if (attr->name() == autosaveAttr ||
              attr->name() == incrementalAttr ||
              attr->name() == minAttr ||
@@ -748,8 +792,15 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
              attr->name() == multipleAttr ||
              attr->name() == precisionAttr)
         setNeedsStyleRecalc();
+    else if (attr->name() == patternAttr)
+        updateValidity();
+#if ENABLE(DATALIST)
+    else if (attr->name() == listAttr)
+        m_hasNonEmptyList = !attr->isEmpty();
+        // FIXME: we need to tell this change to a renderer if the attribute affects the appearance.
+#endif
     else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
@@ -757,6 +808,7 @@ bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case COLOR:
         case EMAIL:
         case FILE:
         case IMAGE:
@@ -797,6 +849,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case COLOR:
         case EMAIL:
         case ISINDEX:
         case NUMBER:
@@ -805,7 +858,7 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
         case TELEPHONE:
         case TEXT:
         case URL:
-            return new (arena) RenderTextControlSingleLine(this);
+            return new (arena) RenderTextControlSingleLine(this, placeholderShouldBeVisible());
     }
     ASSERT(false);
     return 0;
@@ -883,6 +936,7 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
         return false;
 
     switch (inputType()) {
+        case COLOR:
         case EMAIL:
         case HIDDEN:
         case ISINDEX:
@@ -990,7 +1044,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // RenderTextView), but it's not possible to do it at the moment
     // because of the way the code is structured.
     if (renderer() && AXObjectCache::accessibilityEnabled())
-        renderer()->document()->axObjectCache()->postNotification(renderer(), "AXCheckedStateChanged", true);
+        renderer()->document()->axObjectCache()->postNotification(renderer(), AXObjectCache::AXCheckedStateChanged, true);
 
     // Only send a change event for items in the document (avoid firing during
     // parsing) and don't send a change event for a radio button that's getting
@@ -1043,7 +1097,7 @@ String HTMLInputElement::value() const
 
     String value = m_data.value();
     if (value.isNull()) {
-        value = constrainValue(getAttribute(valueAttr));
+        value = sanitizeValue(getAttribute(valueAttr));
 
         // If no attribute exists, then just use "on" or "" based off the checked() state of the control.
         if (value.isNull() && (inputType() == CHECKBOX || inputType() == RADIO))
@@ -1060,6 +1114,7 @@ String HTMLInputElement::valueWithDefault() const
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case COLOR:
             case EMAIL:
             case FILE:
             case HIDDEN:
@@ -1098,9 +1153,9 @@ void HTMLInputElement::setValue(const String& value)
         if (inputType() == FILE)
             m_fileList->clear();
         else {
-            m_data.setValue(constrainValue(value));
+            m_data.setValue(sanitizeValue(value));
             if (isTextField()) {
-                InputElement::updatePlaceholderVisibility(m_data, this, this);
+                updatePlaceholderVisibility(false);
                 if (inDocument())
                     document()->updateStyleIfNeeded();
             }
@@ -1109,7 +1164,7 @@ void HTMLInputElement::setValue(const String& value)
             renderer()->updateFromElement();
         setNeedsStyleRecalc();
     } else
-        setAttribute(valueAttr, constrainValue(value));
+        setAttribute(valueAttr, sanitizeValue(value));
     
     if (isTextField()) {
         unsigned max = m_data.value().length();
@@ -1123,6 +1178,7 @@ void HTMLInputElement::setValue(const String& value)
             cacheSelection(max, max);
     }
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLInputElement::placeholder() const
@@ -1144,7 +1200,9 @@ void HTMLInputElement::setValueFromRenderer(const String& value)
 {
     // File upload controls will always use setFileListFromRenderer.
     ASSERT(inputType() != FILE);
+    updatePlaceholderVisibility(false);
     InputElement::setValueFromRenderer(m_data, this, this, value);
+    updateValidity();
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1156,6 +1214,7 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
 
     setFormControlValueMatchesRenderer(true);
     InputElement::notifyFormStateChanged(this);
+    updateValidity();
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1169,6 +1228,7 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case RESET:
         case SUBMIT:
             return false;
+        case COLOR:
         case EMAIL:
         case FILE:
         case ISINDEX:
@@ -1344,6 +1404,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1472,6 +1533,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (!checked())
                         clickElement = true;
                     break;
+                case COLOR:
                 case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
@@ -1516,7 +1578,7 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
@@ -1603,9 +1665,12 @@ int HTMLInputElement::maxLength() const
     return m_data.maxLength();
 }
 
-void HTMLInputElement::setMaxLength(int _maxLength)
+void HTMLInputElement::setMaxLength(int maxLength, ExceptionCode& ec)
 {
-    setAttribute(maxlengthAttr, String::number(_maxLength));
+    if (maxLength < 0)
+        ec = INDEX_SIZE_ERR;
+    else
+        setAttribute(maxlengthAttr, String::number(maxLength));
 }
 
 bool HTMLInputElement::multiple() const
@@ -1659,9 +1724,11 @@ FileList* HTMLInputElement::files()
     return m_fileList.get();
 }
 
-String HTMLInputElement::constrainValue(const String& proposedValue) const
+String HTMLInputElement::sanitizeValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    if (isTextField())
+        return InputElement::sanitizeValue(this, proposedValue);
+    return proposedValue;
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1704,6 +1771,7 @@ bool HTMLInputElement::isRequiredFormControl() const
         case IMAGE:
         case RESET:
         case BUTTON:
+        case COLOR:
         case ISINDEX:
             return false;
     }
@@ -1730,14 +1798,7 @@ void HTMLInputElement::onSearch()
     ASSERT(isSearchField());
     if (renderer())
         toRenderTextControlSingleLine(renderer())->stopSearchEventTimer();
-    dispatchEvent(eventNames().searchEvent, true, false);
-}
-
-VisibleSelection HTMLInputElement::selection() const
-{
-    if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
+    dispatchEvent(Event::create(eventNames().searchEvent, true, false));
 }
 
 void HTMLInputElement::documentDidBecomeActive()
@@ -1778,9 +1839,88 @@ bool HTMLInputElement::willValidate() const
            inputType() != BUTTON && inputType() != RESET;
 }
 
-bool HTMLInputElement::placeholderShouldBeVisible() const
+bool HTMLInputElement::formStringToDouble(const String& src, double* out)
 {
-    return m_data.placeholderShouldBeVisible();
+    // See HTML5 2.4.4.3 `Real numbers.'
+
+    if (src.isEmpty())
+        return false;
+    // String::toDouble() accepts leading + \t \n \v \f \r and SPACE, which are invalid in HTML5.
+    // So, check the first character.
+    if (src[0] != '-' && (src[0] < '0' || src[0] > '9'))
+        return false;
+
+    bool valid = false;
+    double value = src.toDouble(&valid);
+    if (!valid)
+        return false;
+    // NaN and Infinity are not valid numbers according to the standard.
+    if (isnan(value) || isinf(value))
+        return false;
+    if (out)
+        *out = value;
+    return true;
+}
+
+#if ENABLE(DATALIST)
+HTMLElement* HTMLInputElement::list() const
+{
+    return dataList();
+}
+
+HTMLDataListElement* HTMLInputElement::dataList() const
+{
+    if (!m_hasNonEmptyList)
+        return 0;
+
+    switch (inputType()) {
+    case TEXT:
+    case SEARCH:
+    case URL:
+    case TELEPHONE:
+    case EMAIL:
+    case NUMBER:
+    case RANGE:
+    case COLOR: {
+        Element* element = document()->getElementById(getAttribute(listAttr));
+        if (element && element->hasTagName(datalistTag))
+            return static_cast<HTMLDataListElement*>(element);
+        break;
+    }
+    case HIDDEN:
+    case PASSWORD:
+    case CHECKBOX:
+    case RADIO:
+    case FILE:
+    case SUBMIT:
+    case IMAGE:
+    case RESET:
+    case BUTTON:
+    case ISINDEX:
+        break;
+    }
+    return 0;
+}
+
+HTMLOptionElement* HTMLInputElement::selectedOption() const
+{
+    String currentValue = value();
+    // The empty value never matches to a datalist option because it
+    // doesn't represent a suggestion according to the standard.
+    if (currentValue.isEmpty())
+        return 0;
+
+    HTMLDataListElement* sourceElement = dataList();
+    if (!sourceElement)
+        return 0;
+    RefPtr<HTMLCollection> options = sourceElement->options();
+    for (unsigned i = 0; options && i < options->length(); ++i) {
+        HTMLOptionElement* option = static_cast<HTMLOptionElement*>(options->item(i));
+        if (!option->disabled() && currentValue == option->value())
+            return option;
+    }
+    return 0;
 }
+#endif  // ENABLE(DATALIST)
 
 } // namespace
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 4d887f3..799d92c 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -31,11 +31,13 @@
 namespace WebCore {
 
 class FileList;
+class HTMLDataListElement;
 class HTMLImageLoader;
+class HTMLOptionElement;
 class KURL;
 class VisibleSelection;
 
-class HTMLInputElement : public HTMLFormControlElementWithState, public InputElement {
+class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
     enum InputType {
         TEXT,
@@ -54,7 +56,8 @@ public:
         EMAIL,
         NUMBER,
         TELEPHONE,
-        URL
+        URL,
+        COLOR
     };
     
     enum AutoCompleteSetting {
@@ -72,8 +75,6 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return inputType() != IMAGE; }
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
@@ -92,10 +93,19 @@ public:
 
     virtual bool valueMissing() const;
     virtual bool patternMismatch() const;
+    virtual bool tooLong() const;
+    // For ValidityState
+    bool rangeUnderflow() const;
+    bool rangeOverflow() const;
+    // Returns the minimum value for type=range.  Don't call this for other types.
+    double rangeMinimum() const;
+    // Returns the maximum value for type=range.  Don't call this for other types.
+    // This always returns a value which is <= rangeMinimum().
+    double rangeMaximum() const;
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL || m_type == COLOR; }
     virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
@@ -127,12 +137,7 @@ public:
     virtual bool canStartSelection() const;
     
     bool canHaveSelection() const;
-    int selectionStart() const;
-    int selectionEnd() const;
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-    virtual void select();
-    void setSelectionRange(int start, int end);
+    virtual void select() { HTMLTextFormControlElement::select(); }
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
@@ -194,8 +199,13 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
+#if ENABLE(DATALIST)
+    HTMLElement* list() const;
+    HTMLOptionElement* selectedOption() const;
+#endif
+
     int maxLength() const;
-    void setMaxLength(int);
+    void setMaxLength(int, ExceptionCode&);
 
     bool multiple() const;
     void setMultiple(bool);
@@ -212,9 +222,7 @@ public:
     void addSearchResult();
     void onSearch();
 
-    VisibleSelection selection() const;
-
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String&) const;
 
     virtual void documentDidBecomeActive();
 
@@ -222,17 +230,15 @@ public:
     
     virtual bool willValidate() const;
 
-    virtual bool placeholderShouldBeVisible() const;
+    // Converts the specified string to a floating number.
+    // If the conversion fails, the return value is false. Take care that leading or trailing unnecessary characters make failures.  This returns false for an empty string input.
+    // The double* parameter may be 0.
+    static bool formStringToDouble(const String&, double*);
     
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
-    void updatePlaceholderVisibility()
-    {
-        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
-    }
-
 private:
     bool storesValueSeparateFromAttribute() const;
 
@@ -240,9 +246,20 @@ private:
     void registerForActivationCallbackIfNeeded();
     void unregisterForActivationCallbackIfNeeded();
 
+    virtual bool supportsPlaceholder() const { return isTextField(); }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual void handleFocusEvent();
+    virtual void handleBlurEvent();
+    virtual int cachedSelectionStart() const { return m_data.cachedSelectionStart(); }
+    virtual int cachedSelectionEnd() const { return m_data.cachedSelectionEnd(); }
+
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const;
 
+#if ENABLE(DATALIST)
+    HTMLDataListElement* dataList() const;
+#endif
+
     InputElementData m_data;
     int m_xPos;
     int m_yPos;
@@ -259,6 +276,9 @@ private:
     unsigned m_autocomplete : 2; // AutoCompleteSetting
     bool m_autofilled : 1;
     bool m_inited : 1;
+#if ENABLE(DATALIST)
+    bool m_hasNonEmptyList : 1;
+#endif
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index e15c6b5..59248f4 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -28,6 +28,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString defaultValue;
                  attribute boolean         defaultChecked;
         readonly attribute HTMLFormElement form;
+                 attribute boolean         formNoValidate;
 #if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute ValidityState   validity;
 #endif
@@ -38,7 +39,17 @@ module html {
                  attribute boolean         checked;
                  attribute boolean         disabled;
                  attribute boolean         autofocus;
-                 attribute long            maxLength;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLElement     list;
+#endif
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString max;
+#endif
+                 attribute long            maxLength
+                     setter raises(DOMException);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+                 attribute [Reflect] DOMString min;
+#endif
                  attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [Reflect] DOMString       pattern;
@@ -55,7 +66,11 @@ module html {
                  attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
+#if defined(ENABLE_DATALIST) && ENABLE_DATALIST
+        readonly attribute HTMLOptionElement selectedOption;
+#endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
         void               select();
         void               click();
diff --git a/WebCore/html/HTMLIsIndexElement.cpp b/WebCore/html/HTMLIsIndexElement.cpp
index bcfa623..31fafa6 100644
--- a/WebCore/html/HTMLIsIndexElement.cpp
+++ b/WebCore/html/HTMLIsIndexElement.cpp
@@ -44,7 +44,7 @@ void HTMLIsIndexElement::parseMappedAttribute(MappedAttribute* attr)
     if (attr->name() == promptAttr)
         setValue(attr->value());
     else if (attr->name() == placeholderAttr)
-        updatePlaceholderVisibility();
+        updatePlaceholderVisibility(true);
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/WebCore/html/HTMLKeygenElement.cpp b/WebCore/html/HTMLKeygenElement.cpp
index b1b6238..6af088f 100644
--- a/WebCore/html/HTMLKeygenElement.cpp
+++ b/WebCore/html/HTMLKeygenElement.cpp
@@ -51,7 +51,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     for (Vector<String>::const_iterator it = keys.begin(); it != end; ++it) {
         HTMLOptionElement* o = new HTMLOptionElement(optionTag, doc, form());
         addChild(o);
-        o->addChild(new Text(doc, *it));
+        o->addChild(Text::create(doc, *it));
     }
 }
 
diff --git a/WebCore/html/HTMLLegendElement.cpp b/WebCore/html/HTMLLegendElement.cpp
index d6e08c7..516ca54 100644
--- a/WebCore/html/HTMLLegendElement.cpp
+++ b/WebCore/html/HTMLLegendElement.cpp
@@ -42,9 +42,9 @@ HTMLLegendElement::~HTMLLegendElement()
 {
 }
 
-bool HTMLLegendElement::isFocusable() const
+bool HTMLLegendElement::supportsFocus() const
 {
-    return HTMLElement::isFocusable();
+    return HTMLElement::supportsFocus();
 }
 
 const AtomicString& HTMLLegendElement::formControlType() const
diff --git a/WebCore/html/HTMLLegendElement.h b/WebCore/html/HTMLLegendElement.h
index 713d73c..1b394e4 100644
--- a/WebCore/html/HTMLLegendElement.h
+++ b/WebCore/html/HTMLLegendElement.h
@@ -33,7 +33,7 @@ public:
     HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLLegendElement();
 
-    virtual bool isFocusable() const;
+    virtual bool supportsFocus() const;
     virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index f1313bb..57b0b5d 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -38,6 +38,7 @@
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -134,7 +135,9 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         process();
     } else if (attr->name() == disabledAttr) {
         setDisabledState(!attr->isNull());
-    } else {
+    } else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
         HTMLElement::parseMappedAttribute(attr);
@@ -217,11 +220,7 @@ void HTMLLinkElement::process()
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
     if (m_disabledState != 2 && (m_isStyleSheet || acceptIfTypeContainsTextCSS && type.contains("text/css")) && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        // Add ourselves as a pending sheet, but only if we aren't an alternate 
-        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-        if (!isAlternate())
-            document()->addPendingSheet();
-
+        
         String charset = getAttribute(charsetAttr);
         if (charset.isEmpty() && document()->frame())
             charset = document()->frame()->loader()->encoding();
@@ -230,14 +229,28 @@ void HTMLLinkElement::process()
             if (m_loading)
                 document()->removePendingSheet();
             m_cachedSheet->removeClient(this);
+            m_cachedSheet = 0;
         }
+
+        if (!dispatchBeforeLoadEvent(m_url))
+            return;
+        
         m_loading = true;
+        
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
         m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        
         if (m_cachedSheet)
             m_cachedSheet->addClient(this);
-        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+        else {
+            // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
-            document()->removePendingSheet();
+            if (!isAlternate())
+                document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -282,7 +295,23 @@ void HTMLLinkElement::setCSSStyleSheet(const String& url, const String& charset,
     if (enforceMIMEType && document()->page() && !document()->page()->settings()->enforceCSSMIMETypeInStrictMode())
         enforceMIMEType = false;
 
-    m_sheet->parseString(sheet->sheetText(enforceMIMEType), strictParsing);
+    String sheetText = sheet->sheetText(enforceMIMEType);
+    m_sheet->parseString(sheetText, strictParsing);
+
+    if (strictParsing && document()->settings() && document()->settings()->needsSiteSpecificQuirks()) {
+        // Work around <https://bugs.webkit.org/show_bug.cgi?id=28350>.
+        DEFINE_STATIC_LOCAL(const String, slashKHTMLFixesDotCss, ("/KHTMLFixes.css"));
+        DEFINE_STATIC_LOCAL(const String, mediaWikiKHTMLFixesStyleSheet, ("/* KHTML fix stylesheet */\n/* work around the horizontal scrollbars */\n#column-content { margin-left: 0; }\n\n"));
+        // There are two variants of KHTMLFixes.css. One is equal to mediaWikiKHTMLFixesStyleSheet,
+        // while the other lacks the second trailing newline.
+        if (url.endsWith(slashKHTMLFixesDotCss) && !sheetText.isNull() && mediaWikiKHTMLFixesStyleSheet.startsWith(sheetText)
+                && sheetText.length() >= mediaWikiKHTMLFixesStyleSheet.length() - 1) {
+            ASSERT(m_sheet->length() == 1);
+            ExceptionCode ec;
+            m_sheet->deleteRule(0, ec);
+        }
+    }
+
     m_sheet->setTitle(title());
 
     RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(m_media);
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 401d79f..e90db4a 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -28,6 +28,9 @@
 #if ENABLE(VIDEO)
 #include "HTMLMediaElement.h"
 
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -38,6 +41,8 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "FrameView.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
@@ -52,6 +57,7 @@
 #include "Page.h"
 #include "ProgressEvent.h"
 #include "RenderVideo.h"
+#include "RenderView.h"
 #include "ScriptEventListener.h"
 #include "TimeRanges.h"
 #include <limits>
@@ -110,6 +116,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_sentEndEvent(false)
     , m_pausedInternal(false)
     , m_sendProgressEvents(true)
+    , m_isFullscreen(false)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_needWidgetUpdate(false)
 #endif
@@ -178,6 +185,8 @@ void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
         setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadedmetadataAttr)
         setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadendAttr)
+        setAttributeEventListener(eventNames().loadendEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadstartAttr)
         setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
     else if (attrName == onpauseAttr)
@@ -238,6 +247,12 @@ void HTMLMediaElement::insertedIntoDocument()
         scheduleLoad();
 }
 
+void HTMLMediaElement::willRemove()
+{
+    if (m_isFullscreen)
+        exitFullscreen();
+    HTMLElement::willRemove();
+}
 void HTMLMediaElement::removedFromDocument()
 {
     if (m_networkState > NETWORK_EMPTY)
@@ -269,6 +284,15 @@ void HTMLMediaElement::recalcStyle(StyleChange change)
 
 void HTMLMediaElement::scheduleLoad()
 {
+    if (m_loadTimer.isActive())
+        return;
+    prepareForLoad();
+    m_loadTimer.startOneShot(0);
+}
+
+void HTMLMediaElement::scheduleNextSourceChild()
+{
+    // Schedule the timer to try the next <source> element WITHOUT resetting state ala prepareForLoad.
     m_loadTimer.startOneShot(0);
 }
 
@@ -408,17 +432,15 @@ void HTMLMediaElement::load(ExceptionCode& ec)
 {
     if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
         ec = INVALID_STATE_ERR;
-    else
+    else {
+        prepareForLoad();
         loadInternal();
+    }
 }
 
-void HTMLMediaElement::loadInternal()
+void HTMLMediaElement::prepareForLoad()
 {
-    // 1 - If the load() method for this element is already being invoked, then abort these steps.
-    if (m_processingLoad)
-        return;
-    m_processingLoad = true;
-    
+    // Perform the cleanup required for the resource load algorithm to run.
     stopPeriodicTimers();
     m_loadTimer.stop();
     m_sentStalledEvent = false;
@@ -430,21 +452,34 @@ void HTMLMediaElement::loadInternal()
     // 3 - If there are any tasks from the media element's media element event task source in 
     // one of the task queues, then remove those tasks.
     cancelPendingEventsAndCallbacks();
+}
+
+void HTMLMediaElement::loadInternal()
+{
+    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    if (m_processingLoad)
+        return;
+    m_processingLoad = true;
+    
+    // Steps 2 and 3 were done in prepareForLoad()
     
-    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
-    // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
-    // and fire a progress event called abort at the media element.
+    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set
+    // the error attribute to a new MediaError object whose code attribute is set to
+    // MEDIA_ERR_ABORTED, fire a progress event called abort at the media element, in the
+    // context of the fetching process that is in progress for the element, and fire a progress
+    // event called loadend at the media element, in the context of the same fetching process.
     if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        
-        // fire synchronous 'abort'
+
+        // fire synchronous 'abort' and 'loadend'
         bool totalKnown = m_player && m_player->totalBytesKnown();
         unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
         unsigned total = m_player ? m_player->totalBytes() : 0;
-        dispatchProgressEvent(eventNames().abortEvent, totalKnown, loaded, total);
+        dispatchEvent(ProgressEvent::create(eventNames().abortEvent, totalKnown, loaded, total));
+        dispatchEvent(ProgressEvent::create(eventNames().loadendEvent, totalKnown, loaded, total));
     }
-    
-    // 5 
+
+    // 5
     m_error = 0;
     m_autoplaying = true;
     m_playedTimeRanges = TimeRanges::create();
@@ -452,7 +487,7 @@ void HTMLMediaElement::loadInternal()
 
     // 6
     setPlaybackRate(defaultPlaybackRate());
-    
+
     // 7
     if (m_networkState != NETWORK_EMPTY) {
         m_networkState = NETWORK_EMPTY;
@@ -464,9 +499,9 @@ void HTMLMediaElement::loadInternal()
             m_playing = false;
             m_player->seek(0);
         }
-        dispatchEvent(eventNames().emptiedEvent, false, true);
+        dispatchEvent(Event::create(eventNames().emptiedEvent, false, true));
     }
-    
+
     selectMediaResource();
     m_processingLoad = false;
 }
@@ -530,9 +565,20 @@ void HTMLMediaElement::loadNextSourceChild()
     loadResource(mediaURL, contentType);
 }
 
-void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+void HTMLMediaElement::loadResource(const KURL& initialURL, ContentType& contentType)
 {
-    ASSERT(isSafeToLoadURL(url, Complain));
+    ASSERT(isSafeToLoadURL(initialURL, Complain));
+
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+    FrameLoader* loader = frame->loader();
+    if (!loader)
+        return;
+
+    KURL url(initialURL);
+    if (!loader->willLoadMediaElementURL(url))
+        return;
 
     // The resource fetch algorithm 
     m_networkState = NETWORK_LOADING;
@@ -570,8 +616,8 @@ bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction acti
     Frame* frame = document()->frame();
     FrameLoader* loader = frame ? frame->loader() : 0;
 
-    // don't allow remote to local urls
-    if (!loader || !loader->canLoad(url, String(), document())) {
+    // don't allow remote to local urls, and check with the frame loader client.
+    if (!loader || !SecurityOrigin::canLoad(url, String(), document())) {
         if (actionIfInvalid == Complain)
             FrameLoader::reportLocalLoadFailed(frame, url.string());
         return false;
@@ -597,22 +643,29 @@ void HTMLMediaElement::noneSupported()
     m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
-    // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
-    // resource failed to load. Set the error attribute to a new MediaError object whose 
+    // 4 - Reaching this step indicates that either the URL failed to resolve, or the media
+    // resource failed to load. Set the error attribute to a new MediaError object whose
     // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
 
-    // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    // 5 - Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
     m_networkState = NETWORK_NO_SOURCE;
 
-    // 5 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 6 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
 
-    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 7 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process that was used to try to obtain the media
+    // resource in the resource fetch algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 8 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
-    
+    // 9 -Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
+
     if (isVideo())
         static_cast<HTMLVideoElement*>(this)->updatePosterImage();
     if (renderer())
@@ -629,20 +682,24 @@ void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
     // set to MEDIA_ERR_NETWORK/MEDIA_ERR_DECODE.
     m_error = err;
 
-    // 3 - Queue a task to fire a progress event called error at the media element.
-    scheduleProgressEvent(eventNames().errorEvent); 
+    // 3 - Queue a task to fire a progress event called error at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().errorEvent);
 
-    // 3 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a 
+    // 4 - Queue a task to fire a progress event called loadend at the media element, in
+    // the context of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 5 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a
     // task to fire a simple event called emptied at the element.
     m_networkState = NETWORK_EMPTY;
     scheduleEvent(eventNames().emptiedEvent);
 
-    // 4 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
     m_delayingTheLoadEvent = false;
 
-    // 5 - Abort the overall resource selection algorithm.
+    // 7 - Abort the overall resource selection algorithm.
     m_currentSourceNode = 0;
-
 }
 
 void HTMLMediaElement::cancelPendingEventsAndCallbacks()
@@ -678,7 +735,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
             m_currentSourceNode->scheduleErrorEvent();
             if (havePotentialSourceChild())
-                scheduleLoad();
+                scheduleNextSourceChild();
             return;
         }
 
@@ -716,6 +773,10 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
             m_progressEventTimer.stop();
 
+            // Schedule one last progress event so we guarantee that at least one is fired
+            // for files that load very quickly.
+            scheduleProgressEvent(eventNames().progressEvent);
+
             // Check to see if readyState changes need to be dealt with before sending the 
             // 'load' event so we report 'canplaythrough' first. This is necessary because a
             //  media engine reports readyState and networkState changes separately
@@ -723,7 +784,8 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
             if (static_cast<ReadyState>(currentState) != m_readyState)
                 setReadyState(currentState);
 
-             scheduleProgressEvent(eventNames().loadEvent); 
+            scheduleProgressEvent(eventNames().loadEvent);
+            scheduleProgressEvent(eventNames().loadendEvent);
         }
     }
 }
@@ -748,21 +810,29 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
     if (m_readyState == oldState)
         return;
     
-    if (m_readyState >= HAVE_CURRENT_DATA)
-        m_seeking = false;
-    
     if (m_networkState == NETWORK_EMPTY)
         return;
 
-    if (m_seeking && m_readyState < HAVE_CURRENT_DATA) {
+    if (m_seeking) {
+        // 4.8.10.10, step 8
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA)
+            scheduleEvent(eventNames().waitingEvent);
+
         // 4.8.10.10, step 9
-        scheduleEvent(eventNames().seekingEvent);
-    }
+        if (m_readyState < HAVE_CURRENT_DATA) {
+            if (oldState >= HAVE_CURRENT_DATA)
+                scheduleEvent(eventNames().seekingEvent);
+        } else {
+            // 4.8.10.10 step 12 & 13.
+            finishSeek();
+        }
 
-    if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
-        // 4.8.10.9
-        scheduleTimeupdateEvent(false);
-        scheduleEvent(eventNames().waitingEvent);
+    } else {
+        if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
+            // 4.8.10.9
+            scheduleTimeupdateEvent(false);
+            scheduleEvent(eventNames().waitingEvent);
+        }
     }
 
     if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
@@ -855,6 +925,13 @@ void HTMLMediaElement::returnToRealtime()
     setCurrentTime(maxTimeSeekable(), e);
 }  
 
+void HTMLMediaElement::addPlayedRange(float start, float end)
+{
+    if (!m_playedTimeRanges)
+        m_playedTimeRanges = TimeRanges::create();
+    m_playedTimeRanges->add(start, end);
+}  
+
 bool HTMLMediaElement::supportsSave() const
 {
     return m_player ? m_player->supportsSave() : false;
@@ -890,7 +967,7 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     // 5
     if (m_playing) {
         if (m_lastSeekTime < now)
-            m_playedTimeRanges->add(m_lastSeekTime, now);
+            addPlayedRange(m_lastSeekTime, now);
     }
     m_lastSeekTime = time;
 
@@ -907,6 +984,15 @@ void HTMLMediaElement::seek(float time, ExceptionCode& ec)
     m_sentEndEvent = false;
 }
 
+void HTMLMediaElement::finishSeek()
+{
+    // 4.8.10.10 Seeking step 12
+    m_seeking = false;
+
+    // 4.8.10.10 Seeking step 13
+    scheduleEvent(eventNames().seekedEvent);
+}
+
 HTMLMediaElement::ReadyState HTMLMediaElement::readyState() const
 {
     return m_readyState;
@@ -917,6 +1003,11 @@ MediaPlayer::MovieLoadType HTMLMediaElement::movieLoadType() const
     return m_player ? m_player->movieLoadType() : MediaPlayer::Unknown;
 }
 
+bool HTMLMediaElement::hasAudio() const
+{
+    return m_player ? m_player->hasAudio() : false;
+}
+
 bool HTMLMediaElement::seeking() const
 {
     return m_seeking;
@@ -1232,7 +1323,19 @@ float HTMLMediaElement::percentLoaded() const
     if (!m_player)
         return 0;
     float duration = m_player->duration();
-    return duration ? m_player->maxTimeBuffered() / duration : 0;
+
+    if (!duration || isinf(duration))
+        return 0;
+
+    float buffered = 0;
+    RefPtr<TimeRanges> timeRanges = m_player->buffered();
+    for (unsigned i = 0; i < timeRanges->length(); ++i) {
+        ExceptionCode ignoredException;
+        float start = timeRanges->start(i, ignoredException);
+        float end = timeRanges->end(i, ignoredException);
+        buffered += end - start;
+    }
+    return buffered / duration;
 }
 
 bool HTMLMediaElement::havePotentialSourceChild()
@@ -1304,9 +1407,9 @@ void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     beginProcessingMediaPlayerCallback();
 
+    // 4.8.10.10 step 12 & 13.  Needed if no ReadyState change is associated with the seek.
     if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
-        scheduleEvent(eventNames().seekedEvent);
-        m_seeking = false;
+        finishSeek();
     }
     
     float now = currentTime();
@@ -1411,23 +1514,22 @@ GraphicsLayer* HTMLMediaElement::mediaPlayerGraphicsLayer(MediaPlayer*)
 
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
-    // FIXME real ranges support
-    if (!m_player || !m_player->maxTimeBuffered())
+    if (!m_player)
         return TimeRanges::create();
-    return TimeRanges::create(0, m_player->maxTimeBuffered());
+    return m_player->buffered();
 }
 
-PassRefPtr<TimeRanges> HTMLMediaElement::played() const
+PassRefPtr<TimeRanges> HTMLMediaElement::played()
 {
-    if (!m_playedTimeRanges) {
-        // We are not yet loaded
-        return TimeRanges::create();
-    }
     if (m_playing) {
         float time = currentTime();
-        if (m_lastSeekTime < time)
-            m_playedTimeRanges->add(m_lastSeekTime, time);
+        if (time > m_lastSeekTime)
+            addPlayedRange(m_lastSeekTime, time);
     }
+
+    if (!m_playedTimeRanges)
+        m_playedTimeRanges = TimeRanges::create();
+
     return m_playedTimeRanges->copy();
 }
 
@@ -1528,11 +1630,20 @@ void HTMLMediaElement::updatePlayState()
         m_playbackProgressTimer.stop();
         m_playing = false;
         float time = currentTime();
+<<<<<<< HEAD:WebCore/html/HTMLMediaElement.cpp
         if (m_lastSeekTime < time)
             m_playedTimeRanges->add(m_lastSeekTime, time);
+=======
+        if (time > m_lastSeekTime)
+            addPlayedRange(m_lastSeekTime, time);
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLMediaElement.cpp
     } else if (couldPlayIfEnoughData() && playerPaused)
         m_player->prepareToPlay();
+<<<<<<< HEAD:WebCore/html/HTMLMediaElement.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/html/HTMLMediaElement.cpp
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -1551,35 +1662,44 @@ void HTMLMediaElement::stopPeriodicTimers()
 
 void HTMLMediaElement::userCancelledLoad()
 {
-    if (m_networkState != NETWORK_EMPTY) {
+    if (m_networkState == NETWORK_EMPTY || m_networkState >= NETWORK_LOADED)
+        return;
 
-        // If the media data fetching process is aborted by the user:
+    // If the media data fetching process is aborted by the user:
 
-        // 1 - The user agent should cancel the fetching process.
+    // 1 - The user agent should cancel the fetching process.
 #if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-        m_player.clear();
+    m_player.clear();
 #endif
-        stopPeriodicTimers();
+    stopPeriodicTimers();
 
-        // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
-        m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
+    m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
-        // 3 - Queue a task to fire a progress event called abort at the media element.
-        scheduleProgressEvent(eventNames().abortEvent);
-
-        // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
-        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a 
-        // simple event called emptied at the element. Otherwise, set set the element's networkState 
-        // attribute to the NETWORK_IDLE value.
-        if (m_networkState >= NETWORK_LOADING) {
-            m_networkState = NETWORK_EMPTY;
-            m_readyState = HAVE_NOTHING;
-            scheduleEvent(eventNames().emptiedEvent);
-        }
+    // 3 - Queue a task to fire a progress event called abort at the media element, in the context
+    // of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().abortEvent);
 
-        // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
-        m_delayingTheLoadEvent = false;
+    // 4 - Queue a task to fire a progress event called loadend at the media element, in the context
+    // of the fetching process started by this instance of this algorithm.
+    scheduleProgressEvent(eventNames().loadendEvent);
+
+    // 5 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the
+    // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a
+    // simple event called emptied at the element. Otherwise, set set the element's networkState
+    // attribute to the NETWORK_IDLE value.
+    if (m_readyState == HAVE_NOTHING) {
+        m_networkState = NETWORK_EMPTY;
+        scheduleEvent(eventNames().emptiedEvent);
     }
+    else
+        m_networkState = NETWORK_IDLE;
+
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // 7 - Abort the overall resource selection algorithm.
+    m_currentSourceNode = 0;
 }
 
 void HTMLMediaElement::documentWillBecomeInactive()
@@ -1610,7 +1730,7 @@ void HTMLMediaElement::documentDidBecomeActive()
         ExceptionCode ec;
         load(ec);
     }
-        
+
     if (renderer())
         renderer()->updateFromElement();
 }
@@ -1620,6 +1740,14 @@ void HTMLMediaElement::mediaVolumeDidChange()
     updateVolume();
 }
 
+const IntRect HTMLMediaElement::screenRect()
+{
+    IntRect elementRect;
+    if (renderer())
+        elementRect = renderer()->view()->frameView()->contentsToScreen(renderer()->absoluteBoundingBoxRect());
+    return elementRect;
+}
+    
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -1692,6 +1820,28 @@ void HTMLMediaElement::finishParsingChildren()
 
 #endif
 
+void HTMLMediaElement::enterFullscreen()
+{
+    ASSERT(!m_isFullscreen);
+    if (!renderer())
+        return;
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->enterFullscreenForNode(this);
+    m_isFullscreen = true;
+}
+
+void HTMLMediaElement::exitFullscreen()
+{
+    ASSERT(m_isFullscreen);
+    if (document() && document()->page())
+        document()->page()->chrome()->client()->exitFullscreenForNode(this);
+    m_isFullscreen = false;
+}
+
+PlatformMedia HTMLMediaElement::platformMedia() const
+{
+    return m_player ? m_player->platformMedia() : NoPlatformMedia;
+}        
 }
 
 #endif
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index 9218ad6..0005e07 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -43,7 +43,7 @@ class HTMLSourceElement;
 class MediaError;
 class KURL;
 class TimeRanges;
-    
+
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
     HTMLMediaElement(const QualifiedName&, Document*);
@@ -57,6 +57,7 @@ public:
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual void insertedIntoDocument();
+    virtual void willRemove();
     virtual void removedFromDocument();
     virtual void attach();
     virtual void recalcStyle(StyleChange);
@@ -65,6 +66,7 @@ public:
     
     virtual bool isVideo() const { return false; }
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const;
 
     void rewind(float timeDelta);
     void returnToRealtime();
@@ -72,6 +74,8 @@ public:
     // Eventually overloaded in HTMLVideoElement
     virtual bool supportsFullscreen() const { return false; };
     virtual bool supportsSave() const;
+    
+    PlatformMedia platformMedia() const;
 
     void scheduleLoad();
     
@@ -119,7 +123,7 @@ public:
     void setPlaybackRate(float);
     bool webkitPreservesPitch() const;
     void setWebkitPreservesPitch(bool);
-    PassRefPtr<TimeRanges> played() const;
+    PassRefPtr<TimeRanges> played();
     PassRefPtr<TimeRanges> seekable() const;
     bool ended() const;
     bool autoplay() const;    
@@ -140,6 +144,8 @@ public:
     void beginScrubbing();
     void endScrubbing();
 
+    const IntRect screenRect();
+
     bool canPlay() const;
 
     float percentLoaded() const;
@@ -153,6 +159,9 @@ public:
 #endif
 
     bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
+    
+    void enterFullscreen();
+    void exitFullscreen();
 
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
@@ -190,7 +199,9 @@ private:
     void stopPeriodicTimers();
 
     void seek(float time, ExceptionCode&);
+    void finishSeek();
     void checkIfSeekNeeded();
+    void addPlayedRange(float start, float end);
     
     void scheduleTimeupdateEvent(bool periodicEvent);
     void scheduleProgressEvent(const AtomicString& eventName);
@@ -200,6 +211,7 @@ private:
     // loading
     void selectMediaResource();
     void loadResource(const KURL&, ContentType&);
+    void scheduleNextSourceChild();
     void loadNextSourceChild();
     void userCancelledLoad();
     bool havePotentialSourceChild();
@@ -215,6 +227,8 @@ private:
     void loadInternal();
     void playInternal();
     void pauseInternal();
+
+    void prepareForLoad();
     
     bool processingUserGesture() const;
     bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
@@ -305,6 +319,8 @@ protected:
     // support progress events so setting m_sendProgressEvents disables them 
     bool m_sendProgressEvents : 1;
 
+    bool m_isFullscreen : 1;
+
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool m_needWidgetUpdate : 1;
 #endif
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index 76a9c5a..d3ccfa4 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -45,8 +45,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc, bool createdByParser) 
-    : HTMLPlugInImageElement(tagName, doc)
+inline HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* document, bool createdByParser) 
+    : HTMLPlugInImageElement(tagName, document)
     , m_docNamedItem(true)
     , m_needWidgetUpdate(!createdByParser)
     , m_useFallbackContent(false)
@@ -54,8 +54,9 @@ HTMLObjectElement::HTMLObjectElement(const QualifiedName& tagName, Document* doc
     ASSERT(hasTagName(objectTag));
 }
 
-HTMLObjectElement::~HTMLObjectElement()
+PassRefPtr<HTMLObjectElement> HTMLObjectElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
 {
+    return adoptRef(new HTMLObjectElement(tagName, document, createdByParser));
 }
 
 RenderWidget* HTMLObjectElement::renderWidgetForJSBindings() const
@@ -94,9 +95,11 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         m_classId = val;
         if (renderer())
           m_needWidgetUpdate = true;
-    } else if (attr->name() == onloadAttr) {
+    } else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
-    } else if (attr->name() == nameAttr) {
+    else if (attr->name() == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
             HTMLDocument* document = static_cast<HTMLDocument*>(this->document());
@@ -297,66 +300,6 @@ void HTMLObjectElement::updateDocNamedItem()
     m_docNamedItem = isNamedItem;
 }
 
-String HTMLObjectElement::code() const
-{
-    return getAttribute(codeAttr);
-}
-
-void HTMLObjectElement::setCode(const String& value)
-{
-    setAttribute(codeAttr, value);
-}
-
-String HTMLObjectElement::archive() const
-{
-    return getAttribute(archiveAttr);
-}
-
-void HTMLObjectElement::setArchive(const String& value)
-{
-    setAttribute(archiveAttr, value);
-}
-
-String HTMLObjectElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLObjectElement::setBorder(const String& value)
-{
-    setAttribute(borderAttr, value);
-}
-
-String HTMLObjectElement::codeBase() const
-{
-    return getAttribute(codebaseAttr);
-}
-
-void HTMLObjectElement::setCodeBase(const String& value)
-{
-    setAttribute(codebaseAttr, value);
-}
-
-String HTMLObjectElement::codeType() const
-{
-    return getAttribute(codetypeAttr);
-}
-
-void HTMLObjectElement::setCodeType(const String& value)
-{
-    setAttribute(codetypeAttr, value);
-}
-
-KURL HTMLObjectElement::data() const
-{
-    return document()->completeURL(getAttribute(dataAttr));
-}
-
-void HTMLObjectElement::setData(const String& value)
-{
-    setAttribute(dataAttr, value);
-}
-
 bool HTMLObjectElement::declare() const
 {
     return !getAttribute(declareAttr).isNull();
@@ -377,36 +320,6 @@ void HTMLObjectElement::setHspace(int value)
     setAttribute(hspaceAttr, String::number(value));
 }
 
-String HTMLObjectElement::standby() const
-{
-    return getAttribute(standbyAttr);
-}
-
-void HTMLObjectElement::setStandby(const String& value)
-{
-    setAttribute(standbyAttr, value);
-}
-
-String HTMLObjectElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLObjectElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
-String HTMLObjectElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLObjectElement::setUseMap(const String& value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 int HTMLObjectElement::vspace() const
 {
     return getAttribute(vspaceAttr).toInt();
@@ -419,21 +332,19 @@ void HTMLObjectElement::setVspace(int value)
 
 bool HTMLObjectElement::containsJavaApplet() const
 {
-    if (MIMETypeRegistry::isJavaAppletMIMEType(type()))
+    if (MIMETypeRegistry::isJavaAppletMIMEType(getAttribute(typeAttr)))
         return true;
         
-    Node* child = firstChild();
-    while (child) {
-        if (child->isElementNode()) {
-            Element* e = static_cast<Element*>(child);
-            if (e->hasTagName(paramTag) && equalIgnoringCase(e->getAttribute(nameAttr), "type") && MIMETypeRegistry::isJavaAppletMIMEType(e->getAttribute(valueAttr).string()))
-                return true;
-            else if (e->hasTagName(objectTag) && static_cast<HTMLObjectElement*>(e)->containsJavaApplet())
-                return true;
-            else if (e->hasTagName(appletTag))
-                return true;
-        }
-        child = child->nextSibling();
+    for (Element* child = firstElementChild(); child; child = child->nextElementSibling()) {
+        if (child->hasTagName(paramTag)
+                && equalIgnoringCase(child->getAttribute(nameAttr), "type")
+                && MIMETypeRegistry::isJavaAppletMIMEType(child->getAttribute(valueAttr).string()))
+            return true;
+        if (child->hasTagName(objectTag)
+                && static_cast<HTMLObjectElement*>(child)->containsJavaApplet())
+            return true;
+        if (child->hasTagName(appletTag))
+            return true;
     }
     
     return false;
@@ -443,9 +354,13 @@ void HTMLObjectElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) con
 {
     HTMLPlugInImageElement::addSubresourceAttributeURLs(urls);
 
-    addSubresourceURL(urls, data());
-    if (useMap().startsWith("#"))
-        addSubresourceURL(urls, document()->completeURL(useMap()));
+    addSubresourceURL(urls, document()->completeURL(getAttribute(dataAttr)));
+
+    // FIXME: Passing a string that starts with "#" to the completeURL function does
+    // not seem like it would work. The image element has similar but not identical code.
+    const AtomicString& useMap = getAttribute(usemapAttr);
+    if (useMap.startsWith("#"))
+        addSubresourceURL(urls, document()->completeURL(useMap));
 }
 
 }
diff --git a/WebCore/html/HTMLObjectElement.h b/WebCore/html/HTMLObjectElement.h
index 8f31bda..ec1132f 100644
--- a/WebCore/html/HTMLObjectElement.h
+++ b/WebCore/html/HTMLObjectElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,12 +27,31 @@
 
 namespace WebCore {
 
-class KURL;
-
 class HTMLObjectElement : public HTMLPlugInImageElement {
 public:
+    static PassRefPtr<HTMLObjectElement> create(const QualifiedName&, Document*, bool createdByParser);
+
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+
+    void renderFallbackContent();
+
+    bool declare() const;
+    void setDeclare(bool);
+
+    int hspace() const;
+    void setHspace(int);
+
+    int vspace() const;
+    void setVspace(int);
+
+    bool isDocNamedItem() const { return m_docNamedItem; }
+
+    const String& classId() const { return m_classId; }
+
+    bool containsJavaApplet() const;
+
+private:
     HTMLObjectElement(const QualifiedName&, Document*, bool createdByParser);
-    ~HTMLObjectElement();
 
     virtual int tagPriority() const { return 5; }
 
@@ -54,57 +73,11 @@ public:
     virtual const QualifiedName& imageSourceAttributeName() const;
 
     virtual void updateWidget();
-    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
-
-    void renderFallbackContent();
 
     virtual RenderWidget* renderWidgetForJSBindings() const;
 
-    String archive() const;
-    void setArchive(const String&);
-
-    String border() const;
-    void setBorder(const String&);
-
-    String code() const;
-    void setCode(const String&);
-    
-    String codeBase() const;
-    void setCodeBase(const String&);
-
-    String codeType() const;
-    void setCodeType(const String&);
-    
-    KURL data() const;
-    void setData(const String&);
-
-    bool declare() const;
-    void setDeclare(bool);
-
-    int hspace() const;
-    void setHspace(int);
-
-    String standby() const;
-    void setStandby(const String&);
-
-    String type() const;
-    void setType(const String&);
-
-    String useMap() const;
-    void setUseMap(const String&);
-
-    int vspace() const;
-    void setVspace(int);
-
-    bool isDocNamedItem() const { return m_docNamedItem; }
-
-    const String& classId() const { return m_classId; }
-
-    bool containsJavaApplet() const;
-
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-private:
     void updateDocNamedItem();
 
     AtomicString m_id;
diff --git a/WebCore/html/HTMLObjectElement.idl b/WebCore/html/HTMLObjectElement.idl
index 1880836..b51c568 100644
--- a/WebCore/html/HTMLObjectElement.idl
+++ b/WebCore/html/HTMLObjectElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,22 +30,23 @@ module html {
         ImplementationUUID=2dd24554-6784-4ef9-9713-179f3d37b2f9
     ] HTMLObjectElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-                 attribute [ConvertNullToNullString] DOMString       code;
-                 attribute [ConvertNullToNullString] DOMString       align;
-                 attribute [ConvertNullToNullString] DOMString       archive;
-                 attribute [ConvertNullToNullString] DOMString       border;
-                 attribute [ConvertNullToNullString] DOMString       codeBase;
-                 attribute [ConvertNullToNullString] DOMString       codeType;
-                 attribute [ConvertNullToNullString] DOMString       data;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       code;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       archive;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       border;
+                 attribute [ConvertNullToNullString, Reflect=codebase] DOMString       codeBase;
+                 attribute [ConvertNullToNullString, Reflect=codetype] DOMString       codeType;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString       data;
                  attribute boolean         declare;
-                 attribute [ConvertNullToNullString] DOMString       height;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       height;
                  attribute long            hspace;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute [ConvertNullToNullString] DOMString       standby;
-                 attribute [ConvertNullToNullString] DOMString       type;
-                 attribute [ConvertNullToNullString] DOMString       useMap;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       standby;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       type;
+                 attribute [ConvertNullToNullString, Reflect=usemap] DOMString       useMap;
                  attribute long            vspace;
-                 attribute [ConvertNullToNullString] DOMString       width;
+                 attribute [ConvertNullToNullString, Reflect] DOMString       width;
+        readonly attribute boolean         willValidate;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
diff --git a/WebCore/html/HTMLOptGroupElement.cpp b/WebCore/html/HTMLOptGroupElement.cpp
index af81b07..90156da 100644
--- a/WebCore/html/HTMLOptGroupElement.cpp
+++ b/WebCore/html/HTMLOptGroupElement.cpp
@@ -44,9 +44,15 @@ HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document*
     ASSERT(hasTagName(optgroupTag));
 }
 
+bool HTMLOptGroupElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptGroupElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Optgroup elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptGroupElement::formControlType() const
diff --git a/WebCore/html/HTMLOptGroupElement.h b/WebCore/html/HTMLOptGroupElement.h
index 13e92ca..6e5b043 100644
--- a/WebCore/html/HTMLOptGroupElement.h
+++ b/WebCore/html/HTMLOptGroupElement.h
@@ -37,6 +37,7 @@ public:
 
     virtual bool checkDTD(const Node*);
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 009db47..501615f 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -66,9 +66,15 @@ void HTMLOptionElement::detach()
     HTMLFormControlElement::detach();
 }
 
+bool HTMLOptionElement::supportsFocus() const
+{
+    return HTMLElement::supportsFocus();
+}
+
 bool HTMLOptionElement::isFocusable() const
 {
-    return HTMLElement::isFocusable();
+    // Option elements do not have a renderer so we check the renderStyle instead.
+    return supportsFocus() && renderStyle() && renderStyle()->display() != NONE;
 }
 
 const AtomicString& HTMLOptionElement::formControlType() const
@@ -92,7 +98,7 @@ void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
     }
 
     removeChildren();
-    appendChild(new Text(document(), text), ec);
+    appendChild(Text::create(document(), text), ec);
 }
 
 void HTMLOptionElement::accessKeyAction(bool)
diff --git a/WebCore/html/HTMLOptionElement.h b/WebCore/html/HTMLOptionElement.h
index f13a802..843608f 100644
--- a/WebCore/html/HTMLOptionElement.h
+++ b/WebCore/html/HTMLOptionElement.h
@@ -42,6 +42,7 @@ public:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusOptional; }
     virtual int tagPriority() const { return 2; }
     virtual bool checkDTD(const Node* newChild);
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
     virtual void attach();
diff --git a/WebCore/html/HTMLParser.cpp b/WebCore/html/HTMLParser.cpp
index 722f4e2..1cb47ae 100644
--- a/WebCore/html/HTMLParser.cpp
+++ b/WebCore/html/HTMLParser.cpp
@@ -692,13 +692,13 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(m_document, t->text.get());
+    result = Text::create(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(m_document, t->text.get());
+    result = Comment::create(m_document, t->text.get());
     return false;
 }
 
@@ -921,6 +921,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(listingTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(mapTag.localName().impl(), &HTMLParser::mapCreateErrorCheck);
         gFunctionMap.set(menuTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
+        gFunctionMap.set(navTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
@@ -1093,6 +1094,7 @@ bool HTMLParser::isAffectedByResidualStyle(const AtomicString& tagName)
         unaffectedTags.add(selectTag.localName().impl());
         unaffectedTags.add(objectTag.localName().impl());
         unaffectedTags.add(datagridTag.localName().impl());
+        unaffectedTags.add(datalistTag.localName().impl());
     }
     
     return !unaffectedTags.contains(tagName.impl());
@@ -1598,7 +1600,7 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
     }
 
     n->addChild(new HTMLHRElement(hrTag, m_document));
-    n->addChild(new Text(m_document, text));
+    n->addChild(Text::create(m_document, text));
     n->addChild(isIndex.release());
     n->addChild(new HTMLHRElement(hrTag, m_document));
 
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 7aa6083..2f429b4 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -91,16 +91,6 @@ PassScriptInstance HTMLPlugInElement::getInstance() const
     return m_instance;
 }
 
-String HTMLPlugInElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLPlugInElement::setAlign(const String& value)
-{
-    setAttribute(alignAttr, value);
-}
-
 String HTMLPlugInElement::height() const
 {
     return getAttribute(heightAttr);
@@ -111,16 +101,6 @@ void HTMLPlugInElement::setHeight(const String& value)
     setAttribute(heightAttr, value);
 }
 
-String HTMLPlugInElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLPlugInElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
 String HTMLPlugInElement::width() const
 {
     return getAttribute(widthAttr);
diff --git a/WebCore/html/HTMLPlugInElement.h b/WebCore/html/HTMLPlugInElement.h
index a9cbcc9..9d3dc6d 100644
--- a/WebCore/html/HTMLPlugInElement.h
+++ b/WebCore/html/HTMLPlugInElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -36,43 +36,44 @@ class RenderWidget;
 
 class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
-    HTMLPlugInElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInElement();
 
-    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual void updateWidget() { }
-
-    String align() const;
-    void setAlign(const String&);
-    
     String height() const;
     void setHeight(const String&);
     
-    String name() const;
-    void setName(const String&);
-    
     String width() const;
     void setWidth(const String&);
 
-    virtual void defaultEventHandler(Event*);
-
-    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
-    virtual void detach();
     PassScriptInstance getInstance() const;
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
-    virtual NPObject* getNPObject();
+    NPObject* getNPObject();
 #endif
 
 protected:
+    HTMLPlugInElement(const QualifiedName& tagName, Document*);
+
+    virtual void detach();
+
     static void updateWidgetCallback(Node*);
 
+    virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+private:
+    virtual void defaultEventHandler(Event*);
+
+    virtual RenderWidget* renderWidgetForJSBindings() const = 0;
+
+    virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual void updateWidget() { }
+
+protected:
     AtomicString m_name;
+
+private:
     mutable ScriptInstance m_instance;
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* m_NPObject;
diff --git a/WebCore/html/HTMLPlugInImageElement.h b/WebCore/html/HTMLPlugInImageElement.h
index ec3b258..7725a5a 100644
--- a/WebCore/html/HTMLPlugInImageElement.h
+++ b/WebCore/html/HTMLPlugInImageElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,15 +30,16 @@ class HTMLImageLoader;
 
 class HTMLPlugInImageElement : public HTMLPlugInElement {
 public:
-    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
     virtual ~HTMLPlugInImageElement();
 
-    bool isImageType();
-
     const String& serviceType() const { return m_serviceType; }
     const String& url() const { return m_url; }
 
 protected:
+    HTMLPlugInImageElement(const QualifiedName& tagName, Document*);
+
+    bool isImageType();
+
     OwnPtr<HTMLImageLoader> m_imageLoader;
     String m_serviceType;
     String m_url;
diff --git a/WebCore/html/HTMLScriptElement.cpp b/WebCore/html/HTMLScriptElement.cpp
index 86cc3a2..636c579 100644
--- a/WebCore/html/HTMLScriptElement.cpp
+++ b/WebCore/html/HTMLScriptElement.cpp
@@ -24,6 +24,7 @@
 #include "HTMLScriptElement.h"
 
 #include "Document.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "MappedAttribute.h"
@@ -70,6 +71,8 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeloadAttr)
+        setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -216,18 +219,18 @@ String HTMLScriptElement::forAttributeValue() const
 {
     return getAttribute(forAttr).string();
 }
- 
+
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
     m_data.setHaveFiredLoadEvent(true);
 
-    dispatchEvent(eventNames().loadEvent, false, false);
+    dispatchEvent(Event::create(eventNames().loadEvent, false, false));
 }
 
 void HTMLScriptElement::dispatchErrorEvent()
 {
-    dispatchEvent(eventNames().errorEvent, true, false);
+    dispatchEvent(Event::create(eventNames().errorEvent, true, false));
 }
 
 }
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index 177895e..53fe848 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -45,6 +45,7 @@ module html {
         readonly attribute ValidityState   validity;
 #endif
         readonly attribute boolean         willValidate;
+        boolean            checkValidity();
         void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
         // Modified in DOM Level 2:
diff --git a/WebCore/html/HTMLSourceElement.cpp b/WebCore/html/HTMLSourceElement.cpp
index 2f09997..4b9401d 100644
--- a/WebCore/html/HTMLSourceElement.cpp
+++ b/WebCore/html/HTMLSourceElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLSourceElement.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
@@ -105,7 +106,7 @@ void HTMLSourceElement::cancelPendingErrorEvent()
 
 void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
 {
-    dispatchEvent(eventNames().errorEvent, false, true);
+    dispatchEvent(Event::create(eventNames().errorEvent, false, true));
 }
 
 }
diff --git a/WebCore/html/HTMLTagNames.in b/WebCore/html/HTMLTagNames.in
index c066e3c..8842b23 100644
--- a/WebCore/html/HTMLTagNames.in
+++ b/WebCore/html/HTMLTagNames.in
@@ -8,115 +8,118 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
-audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+audio wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 b interfaceName=HTMLElement
-base
-basefont interfaceName=HTMLBaseFontElement
+base createWithNew
+basefont interfaceName=HTMLBaseFontElement, createWithNew
 bdo interfaceName=HTMLElement
 big interfaceName=HTMLElement
-blockquote
-body
-br interfaceName=HTMLBRElement
-button constructorNeedsFormElement
-canvas
-caption interfaceName=HTMLTableCaptionElement
+blockquote createWithNew
+body createWithNew
+br interfaceName=HTMLBRElement, createWithNew
+button constructorNeedsFormElement, createWithNew
+canvas createWithNew
+caption interfaceName=HTMLTableCaptionElement, createWithNew
 center interfaceName=HTMLElement
 cite interfaceName=HTMLElement
 code interfaceName=HTMLElement
-col interfaceName=HTMLTableColElement
-colgroup interfaceName=HTMLTableColElement
-datagrid interfaceName=HTMLDataGridElement,conditional=DATAGRID
-dcell interfaceName=HTMLDataGridCellElement,conditional=DATAGRID
-dcol interfaceName=HTMLDataGridColElement,conditional=DATAGRID
-drow interfaceName=HTMLDataGridRowElement,conditional=DATAGRID
+col interfaceName=HTMLTableColElement, createWithNew
+colgroup interfaceName=HTMLTableColElement, createWithNew
+datagrid interfaceName=HTMLDataGridElement, conditional=DATAGRID, createWithNew
+datalist interfaceName=HTMLDataListElement, conditional=DATALIST, createWithNew
+dcell interfaceName=HTMLDataGridCellElement, conditional=DATAGRID, createWithNew
+dcol interfaceName=HTMLDataGridColElement, conditional=DATAGRID, createWithNew
+drow interfaceName=HTMLDataGridRowElement, conditional=DATAGRID, createWithNew
 dd interfaceName=HTMLElement
-del interfaceName=HTMLModElement
+del interfaceName=HTMLModElement, createWithNew
 dfn interfaceName=HTMLElement
-dir interfaceName=HTMLDirectoryElement
-div
-dl interfaceName=HTMLDListElement
+dir interfaceName=HTMLDirectoryElement, createWithNew
+div createWithNew
+dl interfaceName=HTMLDListElement, createWithNew, createWithNew
 dt interfaceName=HTMLElement
 em interfaceName=HTMLElement
 embed
-fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
-font
-form
+fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement, createWithNew
+font createWithNew
+form createWithNew
 frame
-frameset interfaceName=HTMLFrameSetElement
-head
-h1 interfaceName=HTMLHeadingElement
-h2 interfaceName=HTMLHeadingElement
-h3 interfaceName=HTMLHeadingElement
-h4 interfaceName=HTMLHeadingElement
-h5 interfaceName=HTMLHeadingElement
-h6 interfaceName=HTMLHeadingElement
-hr interfaceName=HTMLHRElement
-html
+frameset interfaceName=HTMLFrameSetElement, createWithNew
+h1 interfaceName=HTMLHeadingElement, createWithNew
+h2 interfaceName=HTMLHeadingElement, createWithNew
+h3 interfaceName=HTMLHeadingElement, createWithNew
+h4 interfaceName=HTMLHeadingElement, createWithNew
+h5 interfaceName=HTMLHeadingElement, createWithNew
+h6 interfaceName=HTMLHeadingElement, createWithNew
+head createWithNew
+hr interfaceName=HTMLHRElement, createWithNew
+html createWithNew
 i interfaceName=HTMLElement
 iframe interfaceName=HTMLIFrameElement
-image mapToTagName=img
-img interfaceName=HTMLImageElement, constructorNeedsFormElement
-input constructorNeedsFormElement
-ins interfaceName=HTMLModElement
-isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
+image mapToTagName=img, createWithNew
+img interfaceName=HTMLImageElement, constructorNeedsFormElement, createWithNew
+input constructorNeedsFormElement, createWithNew
+ins interfaceName=HTMLModElement, createWithNew
+isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement, createWithNew
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
-label
+keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement, createWithNew
+label createWithNew
 layer interfaceName=HTMLElement
-legend constructorNeedsFormElement
-li interfaceName=HTMLLIElement
-link constructorNeedsCreatedByParser
-listing interfaceName=HTMLPreElement
-map
-marquee
-menu
-meta
+legend constructorNeedsFormElement, createWithNew
+li interfaceName=HTMLLIElement, createWithNew
+link constructorNeedsCreatedByParser, createWithNew
+listing interfaceName=HTMLPreElement, createWithNew
+map createWithNew
+marquee createWithNew
+menu createWithNew
+meta createWithNew
+nav interfaceName=HTMLElement
 nobr interfaceName=HTMLElement
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
-#if ENABLE_XHTMLMP
-noscript interfaceName=HTMLNoScriptElement
-#else
-noscript interfaceName=HTMLElement
-#endif
 object constructorNeedsCreatedByParser
-ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
-option constructorNeedsFormElement
-p interfaceName=HTMLParagraphElement
-param
+ol interfaceName=HTMLOListElement, createWithNew
+optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement, createWithNew
+option constructorNeedsFormElement, createWithNew
+p interfaceName=HTMLParagraphElement, createWithNew
+param createWithNew
 plaintext interfaceName=HTMLElement
-pre
-q interfaceName=HTMLQuoteElement
+pre createWithNew
+q interfaceName=HTMLQuoteElement, createWithNew
 rp interfaceName=HTMLElement
 rt interfaceName=HTMLElement
 ruby interfaceName=HTMLElement
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
-script constructorNeedsCreatedByParser
-select constructorNeedsFormElement
+script constructorNeedsCreatedByParser, createWithNew
+select constructorNeedsFormElement, createWithNew
 small interfaceName=HTMLElement
-source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+source wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
-style constructorNeedsCreatedByParser
+style constructorNeedsCreatedByParser, createWithNew
 sub interfaceName=HTMLElement
 sup interfaceName=HTMLElement
-table
-tbody interfaceName=HTMLTableSectionElement
-td interfaceName=HTMLTableCellElement
-textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement
-tfoot interfaceName=HTMLTableSectionElement
-th interfaceName=HTMLTableCellElement
-thead interfaceName=HTMLTableSectionElement
-title
-tr interfaceName=HTMLTableRowElement
+table createWithNew
+tbody interfaceName=HTMLTableSectionElement, createWithNew
+td interfaceName=HTMLTableCellElement, createWithNew
+textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement, createWithNew
+tfoot interfaceName=HTMLTableSectionElement, createWithNew
+th interfaceName=HTMLTableCellElement, createWithNew
+thead interfaceName=HTMLTableSectionElement, createWithNew
+title createWithNew
+tr interfaceName=HTMLTableRowElement, createWithNew
 tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
-ul interfaceName=HTMLUListElement
+ul interfaceName=HTMLUListElement, createWithNew
 var interfaceName=HTMLElement
-video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
+video wrapperOnlyIfMediaIsAvailable, conditional=VIDEO, createWithNew
 wbr interfaceName=HTMLElement
-xmp interfaceName=HTMLPreElement
+xmp interfaceName=HTMLPreElement, createWithNew
+
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement, createWithNew
+#else
+noscript interfaceName=HTMLElement
+#endif
diff --git a/WebCore/html/HTMLTextAreaElement.cpp b/WebCore/html/HTMLTextAreaElement.cpp
index 884cf3f..8d8208d 100644
--- a/WebCore/html/HTMLTextAreaElement.cpp
+++ b/WebCore/html/HTMLTextAreaElement.cpp
@@ -26,21 +26,25 @@
 #include "config.h"
 #include "HTMLTextAreaElement.h"
 
+#include "BeforeTextInsertedEvent.h"
 #include "ChromeClient.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "FocusController.h"
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "InputElement.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderTextControlMultiLine.h"
 #include "ScriptEventListener.h"
 #include "Text.h"
+#include "TextIterator.h"
 #include "VisibleSelection.h"
 #include <wtf/StdLibExtras.h>
 
@@ -64,12 +68,13 @@ static inline void notifyFormStateChanged(const HTMLTextAreaElement* element)
 }
 
 HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElementWithState(tagName, document, form)
+    : HTMLTextFormControlElement(tagName, document, form)
     , m_rows(defaultRows)
     , m_cols(defaultCols)
     , m_wrap(SoftWrap)
     , m_cachedSelectionStart(-1)
     , m_cachedSelectionEnd(-1)
+    , m_isDirty(false)
 {
     ASSERT(hasTagName(textareaTag));
     setFormControlValueMatchesRenderer(true);
@@ -93,54 +98,6 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
     setDefaultValue(state);
 }
 
-int HTMLTextAreaElement::selectionStart()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
-        return m_cachedSelectionStart;
-    return toRenderTextControl(renderer())->selectionStart();
-}
-
-int HTMLTextAreaElement::selectionEnd()
-{
-    if (!renderer())
-        return 0;
-    if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
-        return m_cachedSelectionEnd;
-    return toRenderTextControl(renderer())->selectionEnd();
-}
-
-static RenderTextControl* rendererAfterUpdateLayout(HTMLTextAreaElement* element)
-{
-    element->document()->updateLayoutIgnorePendingStylesheets();
-    return toRenderTextControl(element->renderer());
-}
-
-void HTMLTextAreaElement::setSelectionStart(int start)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionStart(start);
-}
-
-void HTMLTextAreaElement::setSelectionEnd(int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionEnd(end);
-}
-
-void HTMLTextAreaElement::select()
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->select();
-}
-
-void HTMLTextAreaElement::setSelectionRange(int start, int end)
-{
-    if (RenderTextControl* renderer = rendererAfterUpdateLayout(this))
-        renderer->setSelectionRange(start, end);
-}
-
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     setValue(defaultValue());
@@ -196,21 +153,13 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
-    } else if (attr->name() == onfocusAttr)
-        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onblurAttr)
-        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onselectAttr)
-        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
-    else if (attr->name() == onchangeAttr)
-        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
-    else
-        HTMLFormControlElementWithState::parseMappedAttribute(attr);
+    } else
+        HTMLTextFormControlElement::parseMappedAttribute(attr);
 }
 
 RenderObject* HTMLTextAreaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlMultiLine(this);
+    return new (arena) RenderTextControlMultiLine(this, placeholderShouldBeVisible());
 }
 
 bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
@@ -229,6 +178,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 void HTMLTextAreaElement::reset()
 {
     setValue(defaultValue());
+    m_isDirty = false;
 }
 
 bool HTMLTextAreaElement::isKeyboardFocusable(KeyboardEvent*) const
@@ -272,10 +222,34 @@ void HTMLTextAreaElement::defaultEventHandler(Event* event)
 {
     if (renderer() && (event->isMouseEvent() || event->isDragEvent() || event->isWheelEvent() || event->type() == eventNames().blurEvent))
         toRenderTextControlMultiLine(renderer())->forwardEvent(event);
+    else if (renderer() && event->isBeforeTextInsertedEvent())
+        handleBeforeTextInsertedEvent(static_cast<BeforeTextInsertedEvent*>(event));
 
     HTMLFormControlElementWithState::defaultEventHandler(event);
 }
 
+void HTMLTextAreaElement::handleBeforeTextInsertedEvent(BeforeTextInsertedEvent* event) const
+{
+    ASSERT(event);
+    ASSERT(renderer());
+    int signedMaxLength = maxLength();
+    if (signedMaxLength < 0)
+        return;
+    unsigned unsignedMaxLength = static_cast<unsigned>(signedMaxLength);
+
+    unsigned currentLength = toRenderTextControl(renderer())->text().numGraphemeClusters();
+    unsigned selectionLength = plainText(document()->frame()->selection()->selection().toNormalizedRange().get()).numGraphemeClusters();
+    ASSERT(currentLength >= selectionLength);
+    unsigned baseLength = currentLength - selectionLength;
+    unsigned appendableLength = unsignedMaxLength > baseLength ? unsignedMaxLength - baseLength : 0;
+    event->setText(sanitizeUserInputValue(event->text(), appendableLength));
+}
+
+String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue, unsigned maxLength)
+{
+    return proposedValue.left(proposedValue.numCharactersInGraphemeClusters(maxLength));
+}
+
 void HTMLTextAreaElement::rendererWillBeDestroyed()
 {
     updateValue();
@@ -290,6 +264,7 @@ void HTMLTextAreaElement::updateValue() const
     m_value = toRenderTextControl(renderer())->text();
     const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
+    m_isDirty = true;
 }
 
 String HTMLTextAreaElement::value() const
@@ -313,6 +288,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     m_value = normalizedValue;
     setFormControlValueMatchesRenderer(true);
+    updatePlaceholderVisibility(false);
     if (inDocument())
         document()->updateStyleIfNeeded();
     if (renderer())
@@ -330,6 +306,7 @@ void HTMLTextAreaElement::setValue(const String& value)
 
     setNeedsStyleRecalc();
     notifyFormStateChanged(this);
+    updateValidity();
 }
 
 String HTMLTextAreaElement::defaultValue() const
@@ -379,6 +356,33 @@ void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
     setValue(value);
 }
 
+int HTMLTextAreaElement::maxLength() const
+{
+    bool ok;
+    int value = getAttribute(maxlengthAttr).string().toInt(&ok);
+    return ok && value >= 0 ? value : -1;
+}
+
+void HTMLTextAreaElement::setMaxLength(int newValue, ExceptionCode& ec)
+{
+    if (newValue < 0)
+        ec = INDEX_SIZE_ERR;
+    else
+        setAttribute(maxlengthAttr, String::number(newValue));
+}
+
+bool HTMLTextAreaElement::tooLong() const
+{
+    // Return false for the default value even if it is longer than maxLength.
+    if (!m_isDirty)
+        return false;
+
+    int max = maxLength();
+    if (max < 0)
+        return false;
+    return value().length() > static_cast<unsigned>(max);
+}
+
 void HTMLTextAreaElement::accessKeyAction(bool)
 {
     focus();
@@ -404,13 +408,6 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-VisibleSelection HTMLTextAreaElement::selection() const
-{
-    if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return VisibleSelection();
-    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
-}
-
 bool HTMLTextAreaElement::shouldUseInputMethod() const
 {
     return true;
diff --git a/WebCore/html/HTMLTextAreaElement.h b/WebCore/html/HTMLTextAreaElement.h
index 5ef8e55..23f61d3 100644
--- a/WebCore/html/HTMLTextAreaElement.h
+++ b/WebCore/html/HTMLTextAreaElement.h
@@ -28,9 +28,10 @@
 
 namespace WebCore {
 
+class BeforeTextInsertedEvent;
 class VisibleSelection;
 
-class HTMLTextAreaElement : public HTMLFormControlElementWithState {
+class HTMLTextAreaElement : public HTMLTextFormControlElement {
 public:
     HTMLTextAreaElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
@@ -54,15 +55,6 @@ public:
 
     virtual bool valueMissing() const { return isRequiredFormControl() && !disabled() && !readOnly() && value().isEmpty(); }
 
-    int selectionStart();
-    int selectionEnd();
-
-    void setSelectionStart(int);
-    void setSelectionEnd(int);
-
-    void select();
-    void setSelectionRange(int, int);
-
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -77,6 +69,10 @@ public:
     void setValue(const String&);
     String defaultValue() const;
     void setDefaultValue(const String&);
+    int textLength() const { return value().length(); }
+    int maxLength() const;
+    void setMaxLength(int, ExceptionCode&);
+    virtual bool tooLong() const;
     
     void rendererWillBeDestroyed();
     
@@ -89,15 +85,21 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
 private:
     enum WrapMethod { NoWrap, SoftWrap, HardWrap };
 
+    void handleBeforeTextInsertedEvent(BeforeTextInsertedEvent*) const;
+    static String sanitizeUserInputValue(const String&, unsigned maxLength);
     void updateValue() const;
 
+    virtual bool supportsPlaceholder() const { return true; }
+    virtual bool isEmptyValue() const { return value().isEmpty(); }
+    virtual int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    virtual int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
+
     virtual bool isOptionalFormControl() const { return !isRequiredFormControl(); }
     virtual bool isRequiredFormControl() const { return required(); }
 
@@ -107,6 +109,7 @@ private:
     mutable String m_value;
     int m_cachedSelectionStart;
     int m_cachedSelectionEnd;
+    mutable bool m_isDirty;
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLTextAreaElement.idl b/WebCore/html/HTMLTextAreaElement.idl
index 5d2853e..db5154e 100644
--- a/WebCore/html/HTMLTextAreaElement.idl
+++ b/WebCore/html/HTMLTextAreaElement.idl
@@ -34,16 +34,21 @@ module html {
                  attribute  long                 cols;
                  attribute  boolean              disabled;
                  attribute  boolean              autofocus;
+                 attribute  long                 maxLength
+                     setter raises(DOMException);
                  attribute  [ConvertNullToNullString] DOMString            name;
+                 attribute  [ConvertNullToNullString, Reflect] DOMString   placeholder;
                  attribute  boolean              readOnly;
                  attribute  boolean              required;
                  attribute  long                 rows;
         readonly attribute  DOMString            type;
                  attribute  [ConvertNullToNullString] DOMString            value;
+        readonly attribute  unsigned long        textLength;
         
         void     select();
 
         readonly attribute boolean         willValidate;
+        boolean  checkValidity();
         void     setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
        // WinIE & FireFox extension:
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index 2850aec..9215dc3 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -32,6 +32,7 @@
 #include "CachedScript.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -41,6 +42,7 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "InspectorTimelineAgent.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
@@ -442,7 +444,8 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
 #endif
                 // The parser might have been stopped by for example a window.close call in an earlier script.
                 // If so, we don't want to load scripts.
-                if (!m_parserStopped && (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
+                if (!m_parserStopped && m_scriptNode->dispatchBeforeLoadEvent(m_scriptTagSrcAttrValue) &&
+                    (cs = m_doc->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))
                     m_pendingScripts.append(cs);
                 else
                     m_scriptNode = 0;
@@ -1670,18 +1673,24 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Beginning write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
     int processedCount = 0;
     double startTime = currentTime();
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::ParsingTimeCounter);
 #endif
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = m_doc->inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willWriteHTML();
+#endif
+  
     Frame* frame = m_doc->frame();
 
     State state = m_state;
 
-    while (!m_src.isEmpty() && (!frame || !frame->loader()->isScheduledLocationChangePending())) {
+    while (!m_src.isEmpty() && (!frame || !frame->redirectScheduler()->locationChangePending())) {
         if (!continueProcessing(processedCount, startTime, state))
             break;
 
@@ -1797,7 +1806,12 @@ void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
     if (!m_doc->ownerElement())
         printf("Ending write at time %d\n", m_doc->elapsedTime());
 #endif
-    
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didWriteHTML();
+#endif
+
     m_inWrite = wasInWrite;
 
     m_state = state;
@@ -2041,7 +2055,7 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
 #endif
 
         if (errorOccurred)
-            n->dispatchEvent(eventNames().errorEvent, true, false);
+            n->dispatchEvent(Event::create(eventNames().errorEvent, true, false));
         else {
             if (static_cast<HTMLScriptElement*>(n.get())->shouldExecuteAsJavaScript())
                 m_state = scriptExecution(sourceCode, m_state);
@@ -2049,7 +2063,7 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
             else
                 m_doc->setShouldProcessNoscriptElement(true);
 #endif
-            n->dispatchEvent(eventNames().loadEvent, false, false);
+            n->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
         }
 
         // The state of m_pendingScripts.isEmpty() can change inside the scriptExecution()
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index ecd74e7..5bbc167 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLVideoElement.h"
 
+#include "ChromeClient.h"
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
@@ -112,6 +113,18 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
         HTMLMediaElement::parseMappedAttribute(attr);
 }
 
+bool HTMLVideoElement::supportsFullscreen() const
+{
+    Page* page = document() ? document()->page() : 0;
+    if (!page) 
+        return false;
+
+    if (!m_player || !m_player->supportsFullscreen())
+        return false;
+    
+    return page->chrome()->client()->supportsFullscreenForNode(this);
+}
+
 unsigned HTMLVideoElement::videoWidth() const
 {
     if (!m_player)
diff --git a/WebCore/html/HTMLVideoElement.h b/WebCore/html/HTMLVideoElement.h
index dc9714a..096eb53 100644
--- a/WebCore/html/HTMLVideoElement.h
+++ b/WebCore/html/HTMLVideoElement.h
@@ -49,7 +49,7 @@ public:
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
-    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
+    virtual bool supportsFullscreen() const;
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
diff --git a/WebCore/html/HTMLViewSourceDocument.cpp b/WebCore/html/HTMLViewSourceDocument.cpp
index 13404cc..ba718d1 100644
--- a/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/WebCore/html/HTMLViewSourceDocument.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,9 +47,6 @@ using namespace HTMLNames;
 HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeType)
     : HTMLDocument(frame)
     , m_type(mimeType)
-    , m_current(0)
-    , m_tbody(0)
-    , m_td(0)
 {
     setUsesBeforeAfterRules(true);
 }
@@ -70,23 +67,23 @@ Tokenizer* HTMLViewSourceDocument::createTokenizer()
 
 void HTMLViewSourceDocument::createContainingTable()
 {
-    RefPtr<Element> html = new HTMLHtmlElement(htmlTag, this);
+    RefPtr<HTMLHtmlElement> html = new HTMLHtmlElement(htmlTag, this);
     addChild(html);
     html->attach();
-    RefPtr<Element> body = new HTMLBodyElement(bodyTag, this);
+    RefPtr<HTMLBodyElement> body = new HTMLBodyElement(bodyTag, this);
     html->addChild(body);
     body->attach();
     
     // Create a line gutter div that can be used to make sure the gutter extends down the height of the whole
     // document.
-    RefPtr<Element> div = new HTMLDivElement(divTag, this);
+    RefPtr<HTMLDivElement> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
 
-    RefPtr<Element> table = new HTMLTableElement(tableTag, this);
+    RefPtr<HTMLTableElement> table = new HTMLTableElement(tableTag, this);
     body->addChild(table);
     table->attach();
     m_tbody = new HTMLTableSectionElement(tbodyTag, this);
@@ -205,31 +202,31 @@ void HTMLViewSourceDocument::addViewSourceDoctypeToken(DoctypeToken* doctypeToke
     addText(text, "webkit-html-doctype");
 }
 
-Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
+PassRefPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 {
     if (m_current == m_tbody) {
         addLine(className);
         return m_current;
     }
 
-    Element* span = new HTMLElement(spanTag, this);
+    RefPtr<HTMLElement> span = HTMLElement::create(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
-    return span;
+    return span.release();
 }
 
 void HTMLViewSourceDocument::addLine(const String& className)
 {
     // Create a table row.
-    RefPtr<Element> trow = new HTMLTableRowElement(trTag, this);
+    RefPtr<HTMLTableRowElement> trow = new HTMLTableRowElement(trTag, this);
     m_tbody->addChild(trow);
     trow->attach();
     
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
-    Element* td = new HTMLTableCellElement(tdTag, this);
+    RefPtr<HTMLTableCellElement> td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
@@ -246,7 +243,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     m_current = m_td = td;
 
 #ifdef DEBUG_LINE_NUMBERS
-    RefPtr<Text> lineNumberText = new Text(this, String::number(tokenizer()->lineNumber() + 1) + " ");
+    RefPtr<Text> lineNumberText = Text::create(this, String::number(tokenizer()->lineNumber() + 1) + " ");
     td->addChild(lineNumberText);
     lineNumberText->attach();
 #endif
@@ -277,7 +274,7 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         }
         if (m_current == m_tbody)
             addLine(className);
-        RefPtr<Text> t = new Text(this, substring);
+        RefPtr<Text> t = Text::create(this, substring);
         m_current->addChild(t);
         t->attach();
         if (i < size - 1)
@@ -289,13 +286,13 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         m_current = m_tbody;
 }
 
-Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
+PassRefPtr<Element> HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
 {
     if (m_current == m_tbody)
         addLine("webkit-html-tag");
     
     // Now create a link for the attribute value instead of a span.
-    Element* anchor = new HTMLAnchorElement(aTag, this);
+    RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
     const char* classValue;
     if (isAnchor)
@@ -308,7 +305,7 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
-    return anchor;
+    return anchor.release();
 }
 
 }
diff --git a/WebCore/html/HTMLViewSourceDocument.h b/WebCore/html/HTMLViewSourceDocument.h
index 57a8f21..e4eadb0 100644
--- a/WebCore/html/HTMLViewSourceDocument.h
+++ b/WebCore/html/HTMLViewSourceDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,18 +30,18 @@
 namespace WebCore {
 
 class DoctypeToken;
+class HTMLTableCellElement;
+class HTMLTableSectionElement;
+
 struct Token;
 
 class HTMLViewSourceDocument : public HTMLDocument {
 public:
     static PassRefPtr<HTMLViewSourceDocument> create(Frame* frame, const String& mimeType)
     {
-        return new HTMLViewSourceDocument(frame, mimeType);
+        return adoptRef(new HTMLViewSourceDocument(frame, mimeType));
     }
 
-    // Returns HTMLTokenizer or TextTokenizer based on m_type.
-    virtual Tokenizer* createTokenizer();
-
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
@@ -49,16 +49,19 @@ public:
 private:
     HTMLViewSourceDocument(Frame*, const String& mimeType);
 
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
+    virtual Tokenizer* createTokenizer();
+
     void createContainingTable();
-    Element* addSpanWithClassName(const String&);
+    PassRefPtr<Element> addSpanWithClassName(const String&);
     void addLine(const String& className);
     void addText(const String& text, const String& className);
-    Element* addLink(const String& url, bool isAnchor);
+    PassRefPtr<Element> addLink(const String& url, bool isAnchor);
 
     String m_type;
-    Element* m_current;
-    Element* m_tbody;
-    Element* m_td;
+    RefPtr<Element> m_current;
+    RefPtr<HTMLTableSectionElement> m_tbody;
+    RefPtr<HTMLTableCellElement> m_td;
 };
 
 }
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index 86227d4..5bf8382 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -23,14 +23,57 @@
 #include "config.h"
 #include "ValidityState.h"
 
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+
 namespace WebCore {
 
+using namespace HTMLNames;
+
 ValidityState::ValidityState(HTMLFormControlElement* parent)
     : m_control(parent)
 {
     ASSERT(parent);
 }
 
+bool ValidityState::typeMismatch()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(control());
+    String value = input->value();
+
+    if (value.isEmpty())
+        return false;
+
+    switch (input->inputType()) {
+    case HTMLInputElement::COLOR:
+        return !isValidColorString(value);
+    case HTMLInputElement::NUMBER:
+        return !HTMLInputElement::formStringToDouble(value, 0);
+    case HTMLInputElement::URL:
+        return !KURL(KURL(), value).isValid();
+    default:
+        return false;
+    }
+}
+
+bool ValidityState::rangeUnderflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeUnderflow();
+}
+
+bool ValidityState::rangeOverflow()
+{
+    if (!control()->hasTagName(inputTag))
+        return false;
+    return static_cast<HTMLInputElement*>(control())->rangeOverflow();
+}
+
 bool ValidityState::valid()
 {
     bool someError = typeMismatch() || stepMismatch() || rangeUnderflow() || rangeOverflow() ||
@@ -39,4 +82,17 @@ bool ValidityState::valid()
     return !someError;
 }
 
+bool ValidityState::isValidColorString(const String& value)
+{
+    if (value.isEmpty())
+        return false;
+    if (value[0] == '#') {
+        // We don't accept #rgb and #aarrggbb formats.
+        if (value.length() != 7)
+            return false;
+    }
+    Color color(value);  // This accepts named colors such as "white".
+    return color.isValid() && !color.hasAlpha();
+}
+
 } // namespace
diff --git a/WebCore/html/ValidityState.h b/WebCore/html/ValidityState.h
index 794822a..67afa53 100644
--- a/WebCore/html/ValidityState.h
+++ b/WebCore/html/ValidityState.h
@@ -41,11 +41,11 @@ namespace WebCore {
         void setCustomErrorMessage(const String& message) { m_customErrorMessage = message; }
 
         bool valueMissing() { return control()->valueMissing(); }
-        bool typeMismatch() { return false; }
+        bool typeMismatch();
         bool patternMismatch() { return control()->patternMismatch(); }
-        bool tooLong() { return false; }
-        bool rangeUnderflow() { return false; }
-        bool rangeOverflow() { return false; }
+        bool tooLong() { return control()->tooLong(); }
+        bool rangeUnderflow();
+        bool rangeOverflow();
         bool stepMismatch() { return false; }
         bool customError() { return !m_customErrorMessage.isEmpty(); }
         bool valid();
@@ -54,6 +54,8 @@ namespace WebCore {
         ValidityState(HTMLFormControlElement*);
         HTMLFormControlElement* m_control;
         String m_customErrorMessage;
+
+        static bool isValidColorString(const String&);
     };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasArray.cpp b/WebCore/html/canvas/CanvasArray.cpp
new file mode 100644
index 0000000..6b5688a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArray.h"
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    CanvasArray::CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                             unsigned offset)
+        : m_offset(offset)
+        , m_buffer(buffer)
+    {
+        m_baseAddress = m_buffer ? (static_cast<char*>(m_buffer->data()) + m_offset) : 0;
+    }
+
+    CanvasArray::~CanvasArray()
+    {
+    }
+
+    unsigned CanvasArray::alignedSizeInBytes() const {
+        // Assume we only need to round up to 4-byte boundaries for alignment.
+        return ((sizeInBytes() + 3) / 4) * 4;
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArray.h b/WebCore/html/canvas/CanvasArray.h
new file mode 100644
index 0000000..e34ad8c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArray_h
+#define CanvasArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    class CanvasArray : public RefCounted<CanvasArray> {
+    public:
+        PassRefPtr<CanvasArrayBuffer> buffer() {
+            return m_buffer;
+        }
+
+        void* baseAddress() {
+            return m_baseAddress;
+        }
+
+        unsigned offset() const {
+            return m_offset;
+        }
+
+        virtual unsigned length() const = 0;
+        virtual unsigned sizeInBytes() const = 0;
+        virtual unsigned alignedSizeInBytes() const;
+        virtual ~CanvasArray();
+
+    protected:
+        CanvasArray(PassRefPtr<CanvasArrayBuffer> buffer, unsigned offset);
+
+        // This is the address of the CanvasArrayBuffer's storage, plus the offset.
+        void* m_baseAddress;
+        unsigned m_offset;
+        
+    private:
+        RefPtr<CanvasArrayBuffer> m_buffer;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArray_h
diff --git a/WebCore/html/canvas/CanvasArray.idl b/WebCore/html/canvas/CanvasArray.idl
new file mode 100644
index 0000000..01bb37e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArray.idl
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArray {
+        readonly attribute long length;
+        int sizeInBytes();
+        int alignedSizeInBytes();
+    };
+}
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.cpp b/WebCore/html/canvas/CanvasArrayBuffer.cpp
new file mode 100644
index 0000000..c8a1397
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasArrayBuffer> CanvasArrayBuffer::create(unsigned sizeInBytes)
+    {
+        return adoptRef(new CanvasArrayBuffer(sizeInBytes));
+    }
+    
+    CanvasArrayBuffer::CanvasArrayBuffer(unsigned sizeInBytes) {
+        m_sizeInBytes = sizeInBytes;
+        m_data = WTF::fastZeroedMalloc(sizeInBytes);
+    }
+    
+    void* CanvasArrayBuffer::data() {
+        return m_data;
+    }
+
+    unsigned CanvasArrayBuffer::byteLength() const {
+        return m_sizeInBytes;
+    }
+
+    CanvasArrayBuffer::~CanvasArrayBuffer() {
+        WTF::fastFree(m_data);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.h b/WebCore/html/canvas/CanvasArrayBuffer.h
new file mode 100644
index 0000000..e3ff2b0
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasArrayBuffer_h
+#define CanvasArrayBuffer_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer : public RefCounted<CanvasArrayBuffer> {
+    public:
+        static PassRefPtr<CanvasArrayBuffer> create(unsigned sizeInBytes);
+
+        void* data();
+        unsigned byteLength() const;
+
+        ~CanvasArrayBuffer();
+
+    private:
+        CanvasArrayBuffer(unsigned sizeInBytes);
+        unsigned m_sizeInBytes;
+        void* m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasArrayBuffer_h
diff --git a/WebCore/html/canvas/CanvasArrayBuffer.idl b/WebCore/html/canvas/CanvasArrayBuffer.idl
new file mode 100644
index 0000000..5dc0f7f
--- /dev/null
+++ b/WebCore/html/canvas/CanvasArrayBuffer.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasArrayBuffer {
+        readonly attribute int byteLength;
+    };
+}
diff --git a/WebCore/html/canvas/CanvasBuffer.cpp b/WebCore/html/canvas/CanvasBuffer.cpp
new file mode 100644
index 0000000..009f8ad
--- /dev/null
+++ b/WebCore/html/canvas/CanvasBuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasBuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasBuffer> CanvasBuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasBuffer(ctx));
+}
+
+CanvasBuffer::CanvasBuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createBuffer());
+}
+
+void CanvasBuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteBuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasBuffer.h b/WebCore/html/canvas/CanvasBuffer.h
new file mode 100644
index 0000000..8fdab82
--- /dev/null
+++ b/WebCore/html/canvas/CanvasBuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasBuffer_h
+#define CanvasBuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasBuffer : public CanvasObject {
+    public:
+        virtual ~CanvasBuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasBuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasBuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject o);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasBuffer_h
diff --git a/WebCore/svg/SVGDefinitionSrcElement.idl b/WebCore/html/canvas/CanvasBuffer.idl
index f221895..9bca42b 100644
--- a/WebCore/svg/SVGDefinitionSrcElement.idl
+++ b/WebCore/html/canvas/CanvasBuffer.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,9 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-module svg {
-
-    interface [Conditional=SVG&SVG_FONTS] SVGDefinitionSrcElement : SVGElement {
+module html {
+    interface [Conditional=3D_CANVAS] CanvasBuffer {
     };
-
 }
diff --git a/WebCore/html/canvas/CanvasByteArray.cpp b/WebCore/html/canvas/CanvasByteArray.cpp
new file mode 100644
index 0000000..0f72ccf
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasByteArray.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(unsigned length)
+{
+    RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(signed char));
+    return create(buffer, 0, length);
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(signed char* array, unsigned length)
+{
+    RefPtr<CanvasByteArray> a = CanvasByteArray::create(length);
+    for (unsigned i = 0; i < length; ++i)
+        a->set(i, array[i]);
+    return a;
+}
+
+PassRefPtr<CanvasByteArray> CanvasByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+{
+    if (buffer) {
+        // Check to make sure we are talking about a valid region of
+        // the given CanvasArrayBuffer's storage.
+        if ((offset + (length * sizeof(signed char))) > buffer->byteLength())
+            return NULL;
+    }
+    
+    return adoptRef(new CanvasByteArray(buffer, offset, length));
+}
+
+CanvasByteArray::CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    : CanvasArray(buffer, offset)
+    , m_size(length)
+{
+}
+
+unsigned CanvasByteArray::length() const {
+    return m_size;
+}
+    
+unsigned CanvasByteArray::sizeInBytes() const {
+    return length() * sizeof(signed char);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasByteArray.h b/WebCore/html/canvas/CanvasByteArray.h
new file mode 100644
index 0000000..329f396
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasByteArray_h
+#define CanvasByteArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasArrayBuffer;
+
+    class CanvasByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasByteArray> create(unsigned length);
+        static PassRefPtr<CanvasByteArray> create(signed char* array, unsigned length);
+        static PassRefPtr<CanvasByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        char* data() { return static_cast<char*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<signed char>::min())
+                value = std::numeric_limits<signed char>::min();
+            else if (value > std::numeric_limits<signed char>::max())
+                value = std::numeric_limits<signed char>::max();
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            storage[index] = static_cast<signed char>(value);
+        }
+        
+        bool get(unsigned index, signed char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+
+        signed char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            signed char* storage = static_cast<signed char*>(m_baseAddress);
+            return storage[index];
+        }
+    private:
+        CanvasByteArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                        int offset,
+                        unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasByteArray_h
diff --git a/WebCore/html/canvas/CanvasByteArray.idl b/WebCore/html/canvas/CanvasByteArray.idl
new file mode 100644
index 0000000..ccf49ad
--- /dev/null
+++ b/WebCore/html/canvas/CanvasByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasByteArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasFloatArray.cpp b/WebCore/html/canvas/CanvasFloatArray.cpp
new file mode 100644
index 0000000..09561cb
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFloatArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(float));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(float* array, unsigned length)
+    {
+        RefPtr<CanvasFloatArray> a = CanvasFloatArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasFloatArray> CanvasFloatArray::create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(float)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(float))) > buffer->byteLength())
+                return NULL;
+        }
+        return adoptRef(new CanvasFloatArray(buffer, offset, length));
+    }
+    
+    CanvasFloatArray::CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasFloatArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasFloatArray::sizeInBytes() const {
+        return length() * sizeof(float);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFloatArray.h b/WebCore/html/canvas/CanvasFloatArray.h
new file mode 100644
index 0000000..49bd897
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFloatArray_h
+#define CanvasFloatArray_h
+
+#include "CanvasArray.h"
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFloatArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasFloatArray> create(unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(float* array, unsigned length);
+        static PassRefPtr<CanvasFloatArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        float* data() { return static_cast<float*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            float* storage = static_cast<float*>(m_baseAddress);
+            storage[index] = static_cast<float>(value);
+        }
+        
+        bool get(unsigned index, float& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        float item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            float* storage = static_cast<float*>(m_baseAddress);
+            float result = storage[index];
+            if (isnan(result)) {
+                // Clamp NaN to 0
+                result = 0;
+            }
+            return result;
+        }
+    private:
+        CanvasFloatArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFloatArray_h
diff --git a/WebCore/html/canvas/CanvasFloatArray.idl b/WebCore/html/canvas/CanvasFloatArray.idl
new file mode 100644
index 0000000..bb236b9
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFloatArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasFloatArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasFramebuffer.cpp b/WebCore/html/canvas/CanvasFramebuffer.cpp
new file mode 100644
index 0000000..9700354
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasFramebuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasFramebuffer> CanvasFramebuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasFramebuffer(ctx));
+}
+
+CanvasFramebuffer::CanvasFramebuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createFramebuffer());
+}
+
+void CanvasFramebuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteFramebuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasFramebuffer.h b/WebCore/html/canvas/CanvasFramebuffer.h
new file mode 100644
index 0000000..ec3cb97
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasFramebuffer_h
+#define CanvasFramebuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasFramebuffer : public CanvasObject {
+    public:
+        virtual ~CanvasFramebuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasFramebuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasFramebuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasFramebuffer_h
diff --git a/WebCore/html/canvas/CanvasFramebuffer.idl b/WebCore/html/canvas/CanvasFramebuffer.idl
new file mode 100644
index 0000000..0a9b668
--- /dev/null
+++ b/WebCore/html/canvas/CanvasFramebuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasFramebuffer {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasIntArray.cpp b/WebCore/html/canvas/CanvasIntArray.cpp
new file mode 100644
index 0000000..4716d7b
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(int* array, unsigned length)
+    {
+        RefPtr<CanvasIntArray> a = CanvasIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasIntArray> CanvasIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                      int offset,
+                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(int)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(int))) > buffer->byteLength())
+                return NULL;
+        }
+        
+        return adoptRef(new CanvasIntArray(buffer, offset, length));
+    }
+    
+    CanvasIntArray::CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasIntArray::sizeInBytes() const {
+        return length() * sizeof(int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasIntArray.h b/WebCore/html/canvas/CanvasIntArray.h
new file mode 100644
index 0000000..8846be7
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasIntArray_h
+#define CanvasIntArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasIntArray> create(unsigned length);
+        static PassRefPtr<CanvasIntArray> create(int* array, unsigned length);
+        static PassRefPtr<CanvasIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        int* data() { return static_cast<int*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<int>::min())
+                value = std::numeric_limits<int>::min();
+            else if (value > std::numeric_limits<int>::max())
+                value = std::numeric_limits<int>::max();
+            int* storage = static_cast<int*>(m_baseAddress);
+            storage[index] = static_cast<int>(value);
+        }
+        
+        bool get(unsigned index, int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            int* storage = static_cast<int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasIntArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                       int offset,
+                       unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasIntArray_h
diff --git a/WebCore/html/canvas/CanvasIntArray.idl b/WebCore/html/canvas/CanvasIntArray.idl
new file mode 100644
index 0000000..2c81b87
--- /dev/null
+++ b/WebCore/html/canvas/CanvasIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasIntArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasNumberArray.cpp b/WebCore/html/canvas/CanvasNumberArray.cpp
new file mode 100644
index 0000000..6cbdfff
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.cpp
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasNumberArray.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasNumberArray> CanvasNumberArray::create(unsigned length)
+{
+    return adoptRef(new CanvasNumberArray(length));
+}
+
+CanvasNumberArray::CanvasNumberArray(unsigned length)
+    : m_data(length)
+{
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasNumberArray.h b/WebCore/html/canvas/CanvasNumberArray.h
new file mode 100644
index 0000000..eb79866
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasNumberArray_h
+#define CanvasNumberArray_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+#include <limits>
+
+namespace WebCore {
+
+    class String;
+    
+    class CanvasNumberArray : public RefCounted<CanvasNumberArray> {
+    public:
+        static PassRefPtr<CanvasNumberArray> create(unsigned length);
+        
+        Vector<float>& data() { return m_data; }
+        const Vector<float>& data() const { return m_data; }
+
+        unsigned length() const { return m_data.size(); }
+        float item(unsigned index) const { return (index >= m_data.size()) ? 0 : m_data[index]; }
+
+    private:
+        CanvasNumberArray(unsigned length);
+        Vector<float> m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasNumberArray_h
diff --git a/WebCore/html/canvas/CanvasNumberArray.idl b/WebCore/html/canvas/CanvasNumberArray.idl
new file mode 100644
index 0000000..56e807e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasNumberArray.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        HasCustomIndexGetter
+    ] CanvasNumberArray {
+        readonly attribute unsigned long length;
+    };
+}
diff --git a/WebCore/html/canvas/CanvasObject.cpp b/WebCore/html/canvas/CanvasObject.cpp
new file mode 100644
index 0000000..8a71a45
--- /dev/null
+++ b/WebCore/html/canvas/CanvasObject.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasObject.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+CanvasObject::CanvasObject(CanvasRenderingContext3D* context)
+    : m_object(0)
+    , m_context(context)
+{
+}
+
+CanvasObject::~CanvasObject()
+{
+    if (m_context)
+        m_context->removeObject(this);
+}
+
+void CanvasObject::setObject(Platform3DObject object)
+{
+    if (object == m_object)
+        return;
+        
+    deleteObject();
+    m_object = object;
+}
+
+void CanvasObject::deleteObject()
+{
+    if (m_object) {
+        if (m_context) {
+            m_context->graphicsContext3D()->makeContextCurrent();
+            _deleteObject(m_object);
+        }
+        m_object = 0;
+    }
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasObject.h b/WebCore/html/canvas/CanvasObject.h
new file mode 100644
index 0000000..413da71
--- /dev/null
+++ b/WebCore/html/canvas/CanvasObject.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasObject_h
+#define CanvasObject_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+#include "GraphicsContext3D.h"
+
+namespace WebCore {
+
+    class CanvasRenderingContext3D;
+    
+    class CanvasObject : public RefCounted<CanvasObject> {
+    public:
+        virtual ~CanvasObject();
+        
+        Platform3DObject object() const { return m_object; }
+        void setObject(Platform3DObject);
+        void deleteObject();
+        
+        void detachContext()
+        {
+            deleteObject();
+            m_context = 0;
+        }
+        
+    protected:
+        CanvasObject(CanvasRenderingContext3D*);
+        virtual void _deleteObject(Platform3DObject) = 0;
+        
+        CanvasRenderingContext3D* context() const { return m_context; }
+    
+    private:
+        Platform3DObject m_object;
+        CanvasRenderingContext3D* m_context;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasObject_h
diff --git a/WebCore/html/canvas/CanvasPixelArray.h b/WebCore/html/canvas/CanvasPixelArray.h
index b91a642..8ac5163 100644
--- a/WebCore/html/canvas/CanvasPixelArray.h
+++ b/WebCore/html/canvas/CanvasPixelArray.h
@@ -48,12 +48,22 @@ namespace WebCore {
         {
             m_data->set(index, value);
         }
+
+        void set(unsigned index, unsigned char value)
+        {
+            m_data->set(index, value);
+        }
         
         bool get(unsigned index, unsigned char& result) const
         {
             return m_data->get(index, result);
         }
 
+        unsigned char get(unsigned index) const
+        {
+            return m_data->get(index);
+        }
+
     private:
         CanvasPixelArray(unsigned length);
         RefPtr<WTF::ByteArray> m_data;
diff --git a/WebCore/html/canvas/CanvasPixelArray.idl b/WebCore/html/canvas/CanvasPixelArray.idl
index c815788..2295af6 100644
--- a/WebCore/html/canvas/CanvasPixelArray.idl
+++ b/WebCore/html/canvas/CanvasPixelArray.idl
@@ -30,7 +30,7 @@ module html {
 #if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
     interface [
         CustomHeader,
-        HasCustomIndexGetter,
+        HasNumericIndexGetter,
         HasCustomIndexSetter
     ] CanvasPixelArray {
         readonly attribute long length;
diff --git a/WebCore/html/canvas/CanvasProgram.cpp b/WebCore/html/canvas/CanvasProgram.cpp
new file mode 100644
index 0000000..83da270
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasProgram.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasProgram> CanvasProgram::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasProgram(ctx));
+}
+
+CanvasProgram::CanvasProgram(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createProgram());
+}
+
+void CanvasProgram::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteProgram(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasProgram.h b/WebCore/html/canvas/CanvasProgram.h
new file mode 100644
index 0000000..af817c8
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasProgram_h
+#define CanvasProgram_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasProgram : public CanvasObject {
+    public:
+        virtual ~CanvasProgram() { deleteObject(); }
+        
+        static PassRefPtr<CanvasProgram> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasProgram(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasProgram_h
diff --git a/WebCore/html/canvas/CanvasProgram.idl b/WebCore/html/canvas/CanvasProgram.idl
new file mode 100644
index 0000000..46daaf2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasProgram.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasProgram {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.cpp b/WebCore/html/canvas/CanvasRenderbuffer.cpp
new file mode 100644
index 0000000..51054cd
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderbuffer.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasRenderbuffer> CanvasRenderbuffer::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasRenderbuffer(ctx));
+}
+
+CanvasRenderbuffer::CanvasRenderbuffer(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createRenderbuffer());
+}
+
+void CanvasRenderbuffer::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteRenderbuffer(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.h b/WebCore/html/canvas/CanvasRenderbuffer.h
new file mode 100644
index 0000000..3fb99e9
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderbuffer_h
+#define CanvasRenderbuffer_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasRenderbuffer : public CanvasObject {
+    public:
+        virtual ~CanvasRenderbuffer() { deleteObject(); }
+        
+        static PassRefPtr<CanvasRenderbuffer> create(CanvasRenderingContext3D*);
+        
+    protected:
+        CanvasRenderbuffer(CanvasRenderingContext3D*);
+        
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasRenderbuffer_h
diff --git a/WebCore/html/canvas/CanvasRenderbuffer.idl b/WebCore/html/canvas/CanvasRenderbuffer.idl
new file mode 100644
index 0000000..5e47cc3
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderbuffer.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasRenderbuffer {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasRenderingContext.cpp b/WebCore/html/canvas/CanvasRenderingContext.cpp
new file mode 100644
index 0000000..fed8cb2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CanvasRenderingContext.h"
+
+#include "HTMLCanvasElement.h"
+
+namespace WebCore {
+
+CanvasRenderingContext::CanvasRenderingContext(HTMLCanvasElement* canvas)
+    : m_canvas(canvas)
+{
+}
+
+void CanvasRenderingContext::ref()
+{
+    m_canvas->ref();
+}
+
+void CanvasRenderingContext::deref()
+{
+    m_canvas->deref(); 
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/canvas/CanvasRenderingContext.h b/WebCore/html/canvas/CanvasRenderingContext.h
new file mode 100644
index 0000000..9ac9e57
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext_h
+#define CanvasRenderingContext_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class CanvasObject;
+    class HTMLCanvasElement;
+
+    class CanvasRenderingContext : public Noncopyable {
+    public:
+        CanvasRenderingContext(HTMLCanvasElement*);
+        virtual ~CanvasRenderingContext() { }
+        
+        void ref();
+        void deref();
+        
+        HTMLCanvasElement* canvas() const { return m_canvas; }
+        
+        virtual bool is2d() const { return false; }
+        virtual bool is3d() const { return false; }
+
+    protected:
+        HTMLCanvasElement* m_canvas;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext.idl b/WebCore/html/canvas/CanvasRenderingContext.idl
new file mode 100644
index 0000000..8701c80
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        CustomToJS,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext {
+
+        readonly attribute HTMLCanvasElement canvas;
+    };
+
+}
+
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 20718e9..ed462fc 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -94,7 +94,7 @@ private:
 
 
 CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
-    : m_canvas(canvas)
+    : CanvasRenderingContext(canvas)
     , m_stateStack(1)
 {
     // Make sure that even if the drawingContext() has a different default
@@ -102,14 +102,8 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
     setLineWidth(lineWidth());
 }
 
-void CanvasRenderingContext2D::ref()
+CanvasRenderingContext2D::~CanvasRenderingContext2D()
 {
-    m_canvas->ref();
-}
-
-void CanvasRenderingContext2D::deref()
-{
-    m_canvas->deref(); 
 }
 
 void CanvasRenderingContext2D::reset()
@@ -941,16 +935,13 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
 
 void CanvasRenderingContext2D::checkOrigin(const KURL& url)
 {
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
-    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+    if (m_canvas->document()->securityOrigin()->taintsCanvas(url))
         m_canvas->setOriginTainted();
 }
 
 void CanvasRenderingContext2D::checkOrigin(const String& url)
 {
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
-    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
-        m_canvas->setOriginTainted();
+    checkOrigin(KURL(KURL(), url));
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y)
@@ -1214,8 +1205,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(cachedImage->url());
-    bool originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get());
+    bool originClean = !m_canvas->document()->securityOrigin()->taintsCanvas(KURL(KURL(), cachedImage->url()));
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
 
@@ -1278,8 +1268,13 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
     return data.get();
 }
 
-PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
+PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionCode& ec) const
 {
+    ec = 0;
+    if (!isfinite(sw) || !isfinite(sh)) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
     FloatSize unscaledSize(sw, sh);
     IntSize scaledSize = m_canvas->convertLogicalToDevice(unscaledSize);
     if (scaledSize.width() < 1)
@@ -1306,7 +1301,7 @@ PassRefPtr<ImageData> CanvasRenderingContext2D::getImageData(float sx, float sy,
     ImageBuffer* buffer = m_canvas ? m_canvas->buffer() : 0;
     if (!buffer)
         return createEmptyImageData(scaledRect.size());
-    return buffer->getImageData(scaledRect);
+    return buffer->getUnmultipliedImageData(scaledRect);
 }
 
 void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy, ExceptionCode& ec)
@@ -1357,7 +1352,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     sourceRect.move(-destOffset);
     IntPoint destPoint(destOffset.width(), destOffset.height());
     
-    buffer->putImageData(data, sourceRect, destPoint);
+    buffer->putUnmultipliedImageData(data, sourceRect, destPoint);
 }
 
 String CanvasRenderingContext2D::font() const
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index 9648ffc..283f92c 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -26,6 +26,7 @@
 #ifndef CanvasRenderingContext2D_h
 #define CanvasRenderingContext2D_h
 
+#include "CanvasRenderingContext.h"
 #include "TransformationMatrix.h"
 #include "FloatSize.h"
 #include "Font.h"
@@ -54,14 +55,13 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class CanvasRenderingContext2D : public Noncopyable {
+    class CanvasRenderingContext2D : public CanvasRenderingContext {
     public:
         CanvasRenderingContext2D(HTMLCanvasElement*);
+
+        virtual ~CanvasRenderingContext2D();
         
-        void ref();
-        void deref();
-        
-        HTMLCanvasElement* canvas() const { return m_canvas; }
+        virtual bool is2d() const { return true; }
 
         CanvasStyle* strokeStyle() const;
         void setStrokeStyle(PassRefPtr<CanvasStyle>);
@@ -178,7 +178,7 @@ namespace WebCore {
         PassRefPtr<CanvasPattern> createPattern(HTMLImageElement*, const String& repetitionType, ExceptionCode&);
         PassRefPtr<CanvasPattern> createPattern(HTMLCanvasElement*, const String& repetitionType, ExceptionCode&);
         
-        PassRefPtr<ImageData> createImageData(float width, float height) const;
+        PassRefPtr<ImageData> createImageData(float width, float height, ExceptionCode&) const;
         PassRefPtr<ImageData> getImageData(float sx, float sy, float sw, float sh, ExceptionCode&) const;
         void putImageData(ImageData*, float dx, float dy, ExceptionCode&);
         void putImageData(ImageData*, float dx, float dy, float dirtyX, float dirtyY, float dirtyWidth, float dirtyHeight, ExceptionCode&);
@@ -262,7 +262,6 @@ namespace WebCore {
         void checkOrigin(const KURL&);
         void checkOrigin(const String&);
 
-        HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
     };
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.idl b/WebCore/html/canvas/CanvasRenderingContext2D.idl
index a86b47d..ef66d1a 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.idl
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.idl
@@ -29,12 +29,10 @@ module html {
         GenerateConstructor,
         InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
         ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
-    ] CanvasRenderingContext2D {
+    ] CanvasRenderingContext2D : CanvasRenderingContext {
 
         // Web Applications 1.0 draft
 
-        readonly attribute HTMLCanvasElement canvas;
-
         void save();
         void restore();
 
@@ -113,7 +111,8 @@ module html {
         attribute [Custom] custom fillStyle;
         
         // pixel manipulation
-        ImageData createImageData(in float sw, in float sh);
+        ImageData createImageData(in float sw, in float sh)
+            raises (DOMException);
         ImageData getImageData(in float sx, in float sy, in float sw, in float sh)
             raises(DOMException);
         [Custom] void putImageData(/* in ImageData imagedata, in float dx, in float dy [, in float dirtyX, in float dirtyY, in float dirtyWidth, in float dirtyHeight] */);
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.cpp b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
new file mode 100644
index 0000000..b810500
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.cpp
@@ -0,0 +1,1401 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasRenderingContext3D.h"
+#include "CanvasBuffer.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasTexture.h"
+#include "CanvasShader.h"
+#include "HTMLCanvasElement.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
+
+namespace WebCore {
+
+CanvasRenderingContext3D::CanvasRenderingContext3D(HTMLCanvasElement* canvas)
+    : CanvasRenderingContext(canvas)
+    , m_needsUpdate(true)
+    , m_markedCanvasDirty(false)
+{
+    m_context.reshape(m_canvas->width(), m_canvas->height());
+}
+
+CanvasRenderingContext3D::~CanvasRenderingContext3D()
+{
+    detachAndRemoveAllObjects();
+}
+
+void CanvasRenderingContext3D::markContextChanged()
+{
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer()) {
+        m_canvas->renderBox()->layer()->rendererContentChanged();
+    } else {
+#endif
+        if (!m_markedCanvasDirty) {
+            // Make sure the canvas's image buffer is allocated.
+            m_canvas->buffer();
+            m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
+            m_markedCanvasDirty = true;
+        }
+#if USE(ACCELERATED_COMPOSITING)
+    }
+#endif
+}
+
+void CanvasRenderingContext3D::beginPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_context.beginPaint(this);
+    }
+}
+
+void CanvasRenderingContext3D::endPaint()
+{
+    if (m_markedCanvasDirty) {
+        m_markedCanvasDirty = false;
+        m_context.endPaint();
+    }
+}
+
+void CanvasRenderingContext3D::reshape(int width, int height)
+{
+    if (m_needsUpdate) {
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_canvas->renderBox() && m_canvas->renderBox()->hasLayer())
+            m_canvas->renderBox()->layer()->rendererContentChanged();
+#endif
+        m_needsUpdate = false;
+    }
+    
+    m_context.reshape(width, height);
+}
+
+int CanvasRenderingContext3D::sizeInBytes(int type, ExceptionCode& ec)
+{
+    int result = m_context.sizeInBytes(type);
+    if (result <= 0) {
+        ec = SYNTAX_ERR;
+    }
+    return result;
+}
+
+void CanvasRenderingContext3D::activeTexture(unsigned long texture)
+{
+    m_context.activeTexture(texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    m_context.attachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+{
+    if (!program)
+        return;
+    m_context.bindAttribLocation(program, index, name);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+{
+    m_context.bindBuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+{
+    m_context.bindFramebuffer(target, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+{
+    m_context.bindRenderbuffer(target, renderbuffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+{
+    m_context.bindTexture(target, texture);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    m_context.blendColor(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquation( unsigned long mode )
+{
+    m_context.blendEquation(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    m_context.blendEquationSeparate(modeRGB, modeAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    m_context.blendFunc(sfactor, dfactor);
+    cleanupAfterGraphicsCall(false);
+}       
+
+void CanvasRenderingContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    m_context.blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    m_context.bufferData(target, size, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferData(unsigned long target, CanvasArray* data, unsigned long usage)
+{
+    m_context.bufferData(target, data, usage);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* data)
+{
+    m_context.bufferSubData(target, offset, data);
+    cleanupAfterGraphicsCall(false);
+}
+
+unsigned long CanvasRenderingContext3D::checkFramebufferStatus(unsigned long target)
+{
+    return m_context.checkFramebufferStatus(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clear(unsigned long mask)
+{
+    m_context.clear(mask);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::clearColor(double r, double g, double b, double a)
+{
+    if (isnan(r))
+        r = 0;
+    if (isnan(g))
+        g = 0;
+    if (isnan(b))
+        b = 0;
+    if (isnan(a))
+        a = 1;
+    m_context.clearColor(r, g, b, a);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearDepth(double depth)
+{
+    m_context.clearDepth(depth);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::clearStencil(long s)
+{
+    m_context.clearStencil(s);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    m_context.colorMask(red, green, blue, alpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::compileShader(CanvasShader* shader)
+{
+    m_context.compileShader(shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    m_context.copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.copyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+PassRefPtr<CanvasBuffer> CanvasRenderingContext3D::createBuffer()
+{
+    RefPtr<CanvasBuffer> o = CanvasBuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+        
+PassRefPtr<CanvasFramebuffer> CanvasRenderingContext3D::createFramebuffer()
+{
+    RefPtr<CanvasFramebuffer> o = CanvasFramebuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasTexture> CanvasRenderingContext3D::createTexture()
+{
+    RefPtr<CanvasTexture> o = CanvasTexture::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasProgram> CanvasRenderingContext3D::createProgram()
+{
+    RefPtr<CanvasProgram> o = CanvasProgram::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasRenderbuffer> CanvasRenderingContext3D::createRenderbuffer()
+{
+    RefPtr<CanvasRenderbuffer> o = CanvasRenderbuffer::create(this);
+    addObject(o.get());
+    return o;
+}
+
+PassRefPtr<CanvasShader> CanvasRenderingContext3D::createShader(unsigned long type)
+{
+    // FIXME: Need to include GL_ constants for internal use
+    // FIXME: Need to do param checking and throw exception if an illegal value is passed in
+    GraphicsContext3D::ShaderType shaderType = GraphicsContext3D::VERTEX_SHADER;
+    if (type == 0x8B30) // GL_FRAGMENT_SHADER
+        shaderType = GraphicsContext3D::FRAGMENT_SHADER;
+        
+    RefPtr<CanvasShader> o = CanvasShader::create(this, shaderType);
+    addObject(o.get());
+    return o;
+}
+
+void CanvasRenderingContext3D::cullFace(unsigned long mode)
+{
+    m_context.cullFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::deleteBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    buffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return;
+    
+    framebuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    program->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return;
+    
+    renderbuffer->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteShader(CanvasShader* shader)
+{
+    if (!shader)
+        return;
+    
+    shader->deleteObject();
+}
+
+void CanvasRenderingContext3D::deleteTexture(CanvasTexture* texture)
+{
+    if (!texture)
+        return;
+    
+    texture->deleteObject();
+}
+
+void CanvasRenderingContext3D::depthFunc(unsigned long func)
+{
+    m_context.depthFunc(func);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthMask(bool flag)
+{
+    m_context.depthMask(flag);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::depthRange(double zNear, double zFar)
+{
+    m_context.depthRange(zNear, zFar);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+
+    m_context.detachShader(program, shader);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::disable(unsigned long cap)
+{
+    m_context.disable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::disableVertexAttribArray(unsigned long index)
+{
+    m_context.disableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+
+void CanvasRenderingContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    m_context.drawArrays(mode, first, count);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    m_context.drawElements(mode, count, type, offset);
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::enable(unsigned long cap)
+{
+    m_context.enable(cap);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::enableVertexAttribArray(unsigned long index)
+{
+    m_context.enableVertexAttribArray(index);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::finish()
+{
+    m_context.finish();
+    cleanupAfterGraphicsCall(true);
+}
+
+
+void CanvasRenderingContext3D::flush()
+{
+    m_context.flush();
+    cleanupAfterGraphicsCall(true);
+}
+
+void CanvasRenderingContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+{
+    if (!buffer)
+        return;
+        
+    m_context.framebufferRenderbuffer(target, attachment, renderbuffertarget, buffer);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+{
+    if (!texture)
+        return;
+        
+    m_context.framebufferTexture2D(target, attachment, textarget, texture, level);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::frontFace(unsigned long mode)
+{
+    m_context.frontFace(mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::generateMipmap(unsigned long target)
+{
+    m_context.generateMipmap(target);
+    cleanupAfterGraphicsCall(false);
+}
+
+int CanvasRenderingContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getAttribLocation(program, name);
+}
+
+bool CanvasRenderingContext3D::getBoolean(unsigned long pname)
+{
+    bool result = m_context.getBoolean(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasUnsignedByteArray> CanvasRenderingContext3D::getBooleanv(unsigned long pname)
+{
+    RefPtr<CanvasUnsignedByteArray> array = m_context.getBooleanv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getBufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getBufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+unsigned long CanvasRenderingContext3D::getError()
+{
+    return m_context.getError();
+}
+
+float CanvasRenderingContext3D::getFloat(unsigned long pname)
+{
+    float result = m_context.getFloat(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getFloatv(unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getFloatv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    int result = m_context.getFramebufferAttachmentParameteri(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getFramebufferAttachmentParameteriv(target, attachment, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getInteger(unsigned long pname)
+{
+    float result = m_context.getInteger(pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getIntegerv(unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getIntegerv(pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
+{
+    int result = m_context.getProgrami(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getProgramiv(program, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getProgramInfoLog(CanvasProgram* program)
+{
+    String s = m_context.getProgramInfoLog(program);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+int CanvasRenderingContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getRenderbufferParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getRenderbufferParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+{
+    int result = m_context.getShaderi(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getShaderiv(shader, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+String CanvasRenderingContext3D::getShaderInfoLog(CanvasShader* shader)
+{
+    String s = m_context.getShaderInfoLog(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getShaderSource(CanvasShader* shader)
+{
+    String s = m_context.getShaderSource(shader);
+    cleanupAfterGraphicsCall(false);
+    return s;
+}
+
+String CanvasRenderingContext3D::getString(unsigned long name)
+{
+    return m_context.getString(name);
+}
+
+float CanvasRenderingContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+{
+    float result = m_context.getTexParameterf(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getTexParameterfv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+int CanvasRenderingContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+{
+    int result = m_context.getTexParameteri(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getTexParameteriv(target, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+float CanvasRenderingContext3D::getUniformf(CanvasProgram* program, long location)
+{
+    float result = m_context.getUniformf(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getUniformfv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getUniformfv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformi(CanvasProgram* program, long location)
+{
+    long result = m_context.getUniformi(program, location);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getUniformiv(CanvasProgram* program, long location)
+{
+    RefPtr<CanvasIntArray> array = m_context.getUniformiv(program, location);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getUniformLocation(CanvasProgram* program, const String& name)
+{
+    return m_context.getUniformLocation(program, name);
+}
+
+float CanvasRenderingContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
+{
+    float result = m_context.getVertexAttribf(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasFloatArray> CanvasRenderingContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasFloatArray> array = m_context.getVertexAttribfv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribi(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+PassRefPtr<CanvasIntArray> CanvasRenderingContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+{
+    RefPtr<CanvasIntArray> array = m_context.getVertexAttribiv(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return array;
+}
+
+long CanvasRenderingContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    long result = m_context.getVertexAttribOffset(index, pname);
+    cleanupAfterGraphicsCall(false);
+    return result;
+}
+
+void CanvasRenderingContext3D::hint(unsigned long target, unsigned long mode)
+{
+    m_context.hint(target, mode);
+    cleanupAfterGraphicsCall(false);
+}
+
+bool CanvasRenderingContext3D::isBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+        
+    return m_context.isBuffer(buffer);
+}
+
+bool CanvasRenderingContext3D::isEnabled(unsigned long cap)
+{
+    return m_context.isEnabled(cap);
+}
+
+bool CanvasRenderingContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    return m_context.isFramebuffer(framebuffer);
+}
+
+bool CanvasRenderingContext3D::isProgram(CanvasProgram* program)
+{
+    return m_context.isProgram(program);
+}
+
+bool CanvasRenderingContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    return m_context.isRenderbuffer(renderbuffer);
+}
+
+bool CanvasRenderingContext3D::isShader(CanvasShader* shader)
+{
+    return m_context.isShader(shader);
+}
+
+bool CanvasRenderingContext3D::isTexture(CanvasTexture* texture)
+{
+    return m_context.isTexture(texture);
+}
+
+void CanvasRenderingContext3D::lineWidth(double width)
+{
+    m_context.lineWidth((float) width);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::linkProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+        
+    m_context.linkProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::pixelStorei(unsigned long pname, long param)
+{
+    m_context.pixelStorei(pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::polygonOffset(double factor, double units)
+{
+    m_context.polygonOffset((float) factor, (float) units);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::releaseShaderCompiler()
+{
+    m_context.releaseShaderCompiler();
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    m_context.renderbufferStorage(target, internalformat, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::sampleCoverage(double value, bool invert)
+{
+    m_context.sampleCoverage((float) value, invert);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    m_context.scissor(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::shaderSource(CanvasShader* shader, const String& string)
+{
+    m_context.shaderSource(shader, string);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFunc(func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    m_context.stencilFuncSeparate(face, func, ref, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMask(unsigned long mask)
+{
+    m_context.stencilMask(mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    m_context.stencilMaskSeparate(face, mask);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOp(fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    m_context.stencilOpSeparate(face, fail, zfail, zpass);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                                          unsigned width, unsigned height, unsigned border,
+                                          unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, internalformat, width, height,
+                         border, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                                          bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texImage2D(target, level, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameterf(unsigned target, unsigned pname, float param)
+{
+    m_context.texParameterf(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texParameteri(unsigned target, unsigned pname, int param)
+{
+    m_context.texParameteri(target, pname, param);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height,
+                                             unsigned format, unsigned type, ImageData* pixels, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, format, type, pixels);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLImageElement* image,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, image, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, canvas, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                                             unsigned width, unsigned height, HTMLVideoElement* video,
+                                             bool flipY, bool premultiplyAlpha, ExceptionCode& ec)
+{
+    // FIXME: For now we ignore any errors returned
+    ec = 0;
+    m_context.texSubImage2D(target, level, xoffset, yoffset, width, height, video, flipY, premultiplyAlpha);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1f(long location, float x)
+{
+    m_context.uniform1f(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1fv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1i(long location, int x)
+{
+    m_context.uniform1i(location, x);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v->data(), v->length());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform1iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    m_context.uniform1iv(location, v, size);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2f(long location, float x, float y)
+{
+    m_context.uniform2f(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2fv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2i(long location, int x, int y)
+{
+    m_context.uniform2i(location, x, y);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v->data(), v->length() / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform2iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 2
+    m_context.uniform2iv(location, v, size / 2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3f(long location, float x, float y, float z)
+{
+    m_context.uniform3f(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3fv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3i(long location, int x, int y, int z)
+{
+    m_context.uniform3i(location, x, y, z);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v->data(), v->length() / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform3iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 3
+    m_context.uniform3iv(location, v, size / 3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4f(long location, float x, float y, float z, float w)
+{
+    m_context.uniform4f(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4fv(long location, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4fv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4i(long location, int x, int y, int z, int w)
+{
+    m_context.uniform4i(location, x, y, z, w);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, CanvasIntArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniform4iv(long location, int* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniform4iv(location, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v->data(), v->length() / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix2fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 4
+    m_context.uniformMatrix2fv(location, transpose, v, size / 4);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v->data(), v->length() / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix3fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 9
+    m_context.uniformMatrix3fv(location, transpose, v, size / 9);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* v)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v->data(), v->length() / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::uniformMatrix4fv(long location, bool transpose, float* v, int size)
+{
+    // FIXME: we need to throw if no array passed in
+    if (!v)
+        return;
+        
+    // FIXME: length needs to be a multiple of 16
+    m_context.uniformMatrix4fv(location, transpose, v, size / 16);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::useProgram(CanvasProgram* program)
+{
+    m_context.useProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::validateProgram(CanvasProgram* program)
+{
+    m_context.validateProgram(program);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    m_context.vertexAttrib1f(indx, v0);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib1fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib1fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib1fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    m_context.vertexAttrib2f(indx, v0, v1);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib2fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib2fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib2fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    m_context.vertexAttrib3f(indx, v0, v1, v2);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib3fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib3fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib3fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    m_context.vertexAttrib4f(indx, v0, v1, v2, v3);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, CanvasFloatArray* v)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    m_context.vertexAttrib4fv(indx, v->data());
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttrib4fv(unsigned long indx, float* v, int size)
+{
+    // FIXME: Need to make sure array is big enough for attribute being set
+    UNUSED_PARAM(size);
+    
+    m_context.vertexAttrib4fv(indx, v);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    m_context.vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(width))
+        width = 100;
+    if (isnan(height))
+        height = 100;
+    m_context.viewport(x, y, width, height);
+    cleanupAfterGraphicsCall(false);
+}
+
+void CanvasRenderingContext3D::removeObject(CanvasObject* object)
+{
+    m_canvasObjects.remove(object);
+}
+
+void CanvasRenderingContext3D::addObject(CanvasObject* object)
+{
+    removeObject(object);
+    m_canvasObjects.add(object);
+}
+
+void CanvasRenderingContext3D::detachAndRemoveAllObjects()
+{
+    HashSet<CanvasObject*>::iterator pend = m_canvasObjects.end();
+    for (HashSet<CanvasObject*>::iterator it = m_canvasObjects.begin(); it != pend; ++it)
+        (*it)->detachContext();
+        
+    m_canvasObjects.clear();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
+
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.h b/WebCore/html/canvas/CanvasRenderingContext3D.h
new file mode 100644
index 0000000..a4a68fc
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.h
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasRenderingContext3D_h
+#define CanvasRenderingContext3D_h
+
+#include "CanvasRenderingContext.h"
+#include "ExceptionCode.h"
+#include "CanvasFloatArray.h"
+#include "CanvasIntArray.h"
+#include "CanvasUnsignedByteArray.h"
+#include "GraphicsContext3D.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class CanvasBuffer;
+class CanvasFramebuffer;
+class CanvasObject;
+class CanvasProgram;
+class CanvasRenderbuffer;
+class CanvasShader;
+class CanvasTexture;
+class HTMLImageElement;
+class HTMLVideoElement;
+class ImageData;
+class WebKitCSSMatrix;
+
+    class CanvasRenderingContext3D : public CanvasRenderingContext {
+    public:
+        CanvasRenderingContext3D(HTMLCanvasElement*);
+        ~CanvasRenderingContext3D();
+
+        virtual bool is3d() const { return true; }
+
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type, ExceptionCode& ec);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram*, CanvasShader*);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture*);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double);
+        void clearStencil(long);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+
+        PassRefPtr<CanvasBuffer> createBuffer();
+        PassRefPtr<CanvasFramebuffer> createFramebuffer();
+        PassRefPtr<CanvasProgram> createProgram();
+        PassRefPtr<CanvasRenderbuffer> createRenderbuffer();
+        PassRefPtr<CanvasShader> createShader(unsigned long type);
+        PassRefPtr<CanvasTexture> createTexture();
+
+        void cullFace(unsigned long mode);
+
+        void deleteBuffer(CanvasBuffer*);
+        void deleteFramebuffer(CanvasFramebuffer*);
+        void deleteProgram(CanvasProgram*);
+        void deleteRenderbuffer(CanvasRenderbuffer*);
+        void deleteShader(CanvasShader*);
+        void deleteTexture(CanvasTexture*);
+        
+        void depthFunc(unsigned long);
+        void depthMask(bool);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+        
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        long getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        long getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String&);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                        unsigned width, unsigned height, unsigned border,
+                        unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                        bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, CanvasArray* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height,
+                           unsigned format, unsigned type, ImageData* pixels, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLImageElement* image,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+        void texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                           unsigned width, unsigned height, HTMLVideoElement* video,
+                           bool flipY, bool premultiplyAlpha, ExceptionCode&);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, CanvasFloatArray* v);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, CanvasIntArray* v);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, CanvasFloatArray* v);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, CanvasIntArray* v);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, CanvasFloatArray* v);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, CanvasIntArray* v);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, CanvasFloatArray* v);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, CanvasIntArray* v);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, CanvasFloatArray* value);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib1fv(unsigned long indx, float* values, int size);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib2fv(unsigned long indx, float* values, int size);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib3fv(unsigned long indx, float* values, int size);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, CanvasFloatArray* values);
+        void vertexAttrib4fv(unsigned long indx, float* values, int size);
+        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        GraphicsContext3D* graphicsContext3D() { return &m_context; }
+    
+        void reshape(int width, int height);
+
+        // Helpers for notification about paint events.
+        void beginPaint();
+        void endPaint();
+        
+        void removeObject(CanvasObject*);
+        
+    private:
+        friend class CanvasObject;
+        void addObject(CanvasObject*);
+        void detachAndRemoveAllObjects();
+
+        void markContextChanged();
+        void cleanupAfterGraphicsCall(bool changed)
+        {
+            m_context.checkError();
+            if (changed)
+                markContextChanged();
+        }
+        
+        GraphicsContext3D m_context;
+        bool m_needsUpdate;
+        bool m_markedCanvasDirty;
+        // FIXME: I think this is broken -- it does not increment any
+        // reference counts, so may refer to destroyed objects.
+        HashSet<CanvasObject*> m_canvasObjects;
+    };
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/html/canvas/CanvasRenderingContext3D.idl b/WebCore/html/canvas/CanvasRenderingContext3D.idl
new file mode 100644
index 0000000..4b9a889
--- /dev/null
+++ b/WebCore/html/canvas/CanvasRenderingContext3D.idl
@@ -0,0 +1,687 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        Conditional=3D_CANVAS,
+        GenerateConstructor,
+        InterfaceUUID=98fb48ae-7216-489c-862b-8e1217fc4443,
+        ImplementationUUID=ab4f0781-152f-450e-9546-5b3987491a54
+    ] CanvasRenderingContext3D : CanvasRenderingContext {
+
+        /* ClearBufferMask */
+        const unsigned int DEPTH_BUFFER_BIT               = 0x00000100;
+        const unsigned int STENCIL_BUFFER_BIT             = 0x00000400;
+        const unsigned int COLOR_BUFFER_BIT               = 0x00004000;
+
+        /* Boolean */
+        const unsigned int FALSE                          = 0;
+        const unsigned int TRUE                           = 1;
+
+        /* BeginMode */
+        const unsigned int POINTS                         = 0x0000;
+        const unsigned int LINES                          = 0x0001;
+        const unsigned int LINE_LOOP                      = 0x0002;
+        const unsigned int LINE_STRIP                     = 0x0003;
+        const unsigned int TRIANGLES                      = 0x0004;
+        const unsigned int TRIANGLE_STRIP                 = 0x0005;
+        const unsigned int TRIANGLE_FAN                   = 0x0006;
+
+        /* AlphaFunction (not supported in ES20) */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* BlendingFactorDest */
+        const unsigned int ZERO                           = 0;
+        const unsigned int ONE                            = 1;
+        const unsigned int SRC_COLOR                      = 0x0300;
+        const unsigned int ONE_MINUS_SRC_COLOR            = 0x0301;
+        const unsigned int SRC_ALPHA                      = 0x0302;
+        const unsigned int ONE_MINUS_SRC_ALPHA            = 0x0303;
+        const unsigned int DST_ALPHA                      = 0x0304;
+        const unsigned int ONE_MINUS_DST_ALPHA            = 0x0305;
+
+        /* BlendingFactorSrc */
+        /*      ZERO */
+        /*      ONE */
+        const unsigned int DST_COLOR                      = 0x0306;
+        const unsigned int ONE_MINUS_DST_COLOR            = 0x0307;
+        const unsigned int SRC_ALPHA_SATURATE             = 0x0308;
+        /*      SRC_ALPHA */
+        /*      ONE_MINUS_SRC_ALPHA */
+        /*      DST_ALPHA */
+        /*      ONE_MINUS_DST_ALPHA */
+
+        /* BlendEquationSeparate */
+        const unsigned int FUNC_ADD                       = 0x8006;
+        const unsigned int BLEND_EQUATION                 = 0x8009;
+        const unsigned int BLEND_EQUATION_RGB             = 0x8009;   /* same as BLEND_EQUATION */
+        const unsigned int BLEND_EQUATION_ALPHA           = 0x883D;
+
+        /* BlendSubtract */
+        const unsigned int FUNC_SUBTRACT                  = 0x800A;
+        const unsigned int FUNC_REVERSE_SUBTRACT          = 0x800B;
+
+        /* Separate Blend Functions */
+        const unsigned int BLEND_DST_RGB                  = 0x80C8;
+        const unsigned int BLEND_SRC_RGB                  = 0x80C9;
+        const unsigned int BLEND_DST_ALPHA                = 0x80CA;
+        const unsigned int BLEND_SRC_ALPHA                = 0x80CB;
+        const unsigned int CONSTANT_COLOR                 = 0x8001;
+        const unsigned int ONE_MINUS_CONSTANT_COLOR       = 0x8002;
+        const unsigned int CONSTANT_ALPHA                 = 0x8003;
+        const unsigned int ONE_MINUS_CONSTANT_ALPHA       = 0x8004;
+        const unsigned int BLEND_COLOR                    = 0x8005;
+
+        /* Buffer Objects */
+        const unsigned int ARRAY_BUFFER                   = 0x8892;
+        const unsigned int ELEMENT_ARRAY_BUFFER           = 0x8893;
+        const unsigned int ARRAY_BUFFER_BINDING           = 0x8894;
+        const unsigned int ELEMENT_ARRAY_BUFFER_BINDING   = 0x8895;
+
+        const unsigned int STREAM_DRAW                    = 0x88E0;
+        const unsigned int STATIC_DRAW                    = 0x88E4;
+        const unsigned int DYNAMIC_DRAW                   = 0x88E8;
+
+        const unsigned int BUFFER_SIZE                    = 0x8764;
+        const unsigned int BUFFER_USAGE                   = 0x8765;
+
+        const unsigned int CURRENT_VERTEX_ATTRIB          = 0x8626;
+
+        /* CullFaceMode */
+        const unsigned int FRONT                          = 0x0404;
+        const unsigned int BACK                           = 0x0405;
+        const unsigned int FRONT_AND_BACK                 = 0x0408;
+
+        /* DepthFunction */
+        /*      NEVER */
+        /*      LESS */
+        /*      EQUAL */
+        /*      LEQUAL */
+        /*      GREATER */
+        /*      NOTEQUAL */
+        /*      GEQUAL */
+        /*      ALWAYS */
+
+        /* EnableCap */
+        const unsigned int TEXTURE_2D                     = 0x0DE1;
+        const unsigned int CULL_FACE                      = 0x0B44;
+        const unsigned int BLEND                          = 0x0BE2;
+        const unsigned int DITHER                         = 0x0BD0;
+        const unsigned int STENCIL_TEST                   = 0x0B90;
+        const unsigned int DEPTH_TEST                     = 0x0B71;
+        const unsigned int SCISSOR_TEST                   = 0x0C11;
+        const unsigned int POLYGON_OFFSET_FILL            = 0x8037;
+        const unsigned int SAMPLE_ALPHA_TO_COVERAGE       = 0x809E;
+        const unsigned int SAMPLE_COVERAGE                = 0x80A0;
+
+        /* ErrorCode */
+        const unsigned int NO_ERROR                       = 0;
+        const unsigned int INVALID_ENUM                   = 0x0500;
+        const unsigned int INVALID_VALUE                  = 0x0501;
+        const unsigned int INVALID_OPERATION              = 0x0502;
+        const unsigned int OUT_OF_MEMORY                  = 0x0505;
+
+        /* FrontFaceDirection */
+        const unsigned int CW                             = 0x0900;
+        const unsigned int CCW                            = 0x0901;
+
+        /* GetPName */
+        const unsigned int LINE_WIDTH                     = 0x0B21;
+        const unsigned int ALIASED_POINT_SIZE_RANGE       = 0x846D;
+        const unsigned int ALIASED_LINE_WIDTH_RANGE       = 0x846E;
+        const unsigned int CULL_FACE_MODE                 = 0x0B45;
+        const unsigned int FRONT_FACE                     = 0x0B46;
+        const unsigned int DEPTH_RANGE                    = 0x0B70;
+        const unsigned int DEPTH_WRITEMASK                = 0x0B72;
+        const unsigned int DEPTH_CLEAR_VALUE              = 0x0B73;
+        const unsigned int DEPTH_FUNC                     = 0x0B74;
+        const unsigned int STENCIL_CLEAR_VALUE            = 0x0B91;
+        const unsigned int STENCIL_FUNC                   = 0x0B92;
+        const unsigned int STENCIL_FAIL                   = 0x0B94;
+        const unsigned int STENCIL_PASS_DEPTH_FAIL        = 0x0B95;
+        const unsigned int STENCIL_PASS_DEPTH_PASS        = 0x0B96;
+        const unsigned int STENCIL_REF                    = 0x0B97;
+        const unsigned int STENCIL_VALUE_MASK             = 0x0B93;
+        const unsigned int STENCIL_WRITEMASK              = 0x0B98;
+        const unsigned int STENCIL_BACK_FUNC              = 0x8800;
+        const unsigned int STENCIL_BACK_FAIL              = 0x8801;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_FAIL   = 0x8802;
+        const unsigned int STENCIL_BACK_PASS_DEPTH_PASS   = 0x8803;
+        const unsigned int STENCIL_BACK_REF               = 0x8CA3;
+        const unsigned int STENCIL_BACK_VALUE_MASK        = 0x8CA4;
+        const unsigned int STENCIL_BACK_WRITEMASK         = 0x8CA5;
+        const unsigned int VIEWPORT                       = 0x0BA2;
+        const unsigned int SCISSOR_BOX                    = 0x0C10;
+        /*      SCISSOR_TEST */
+        const unsigned int COLOR_CLEAR_VALUE              = 0x0C22;
+        const unsigned int COLOR_WRITEMASK                = 0x0C23;
+        const unsigned int UNPACK_ALIGNMENT               = 0x0CF5;
+        const unsigned int PACK_ALIGNMENT                 = 0x0D05;
+        const unsigned int MAX_TEXTURE_SIZE               = 0x0D33;
+        const unsigned int MAX_VIEWPORT_DIMS              = 0x0D3A;
+        const unsigned int SUBPIXEL_BITS                  = 0x0D50;
+        const unsigned int RED_BITS                       = 0x0D52;
+        const unsigned int GREEN_BITS                     = 0x0D53;
+        const unsigned int BLUE_BITS                      = 0x0D54;
+        const unsigned int ALPHA_BITS                     = 0x0D55;
+        const unsigned int DEPTH_BITS                     = 0x0D56;
+        const unsigned int STENCIL_BITS                   = 0x0D57;
+        const unsigned int POLYGON_OFFSET_UNITS           = 0x2A00;
+        /*      POLYGON_OFFSET_FILL */
+        const unsigned int POLYGON_OFFSET_FACTOR          = 0x8038;
+        const unsigned int TEXTURE_BINDING_2D             = 0x8069;
+        const unsigned int SAMPLE_BUFFERS                 = 0x80A8;
+        const unsigned int SAMPLES                        = 0x80A9;
+        const unsigned int SAMPLE_COVERAGE_VALUE          = 0x80AA;
+        const unsigned int SAMPLE_COVERAGE_INVERT         = 0x80AB;
+
+        /* GetTextureParameter */
+        /*      TEXTURE_MAG_FILTER */
+        /*      TEXTURE_MIN_FILTER */
+        /*      TEXTURE_WRAP_S */
+        /*      TEXTURE_WRAP_T */
+
+        const unsigned int NUM_COMPRESSED_TEXTURE_FORMATS = 0x86A2;
+        const unsigned int COMPRESSED_TEXTURE_FORMATS     = 0x86A3;
+
+        /* HintMode */
+        const unsigned int DONT_CARE                      = 0x1100;
+        const unsigned int FASTEST                        = 0x1101;
+        const unsigned int NICEST                         = 0x1102;
+
+        /* HintTarget */
+        const unsigned int GENERATE_MIPMAP_HINT            = 0x8192;
+
+        /* DataType */
+        const unsigned int BYTE                           = 0x1400;
+        const unsigned int UNSIGNED_BYTE                  = 0x1401;
+        const unsigned int SHORT                          = 0x1402;
+        const unsigned int UNSIGNED_SHORT                 = 0x1403;
+        const unsigned int INT                            = 0x1404;
+        const unsigned int UNSIGNED_INT                   = 0x1405;
+        const unsigned int FLOAT                          = 0x1406;
+        const unsigned int FIXED                          = 0x140C;
+
+        /* PixelFormat */
+        const unsigned int DEPTH_COMPONENT                = 0x1902;
+        const unsigned int ALPHA                          = 0x1906;
+        const unsigned int RGB                            = 0x1907;
+        const unsigned int RGBA                           = 0x1908;
+        const unsigned int LUMINANCE                      = 0x1909;
+        const unsigned int LUMINANCE_ALPHA                = 0x190A;
+
+        /* PixelType */
+        /*      UNSIGNED_BYTE */
+        const unsigned int UNSIGNED_SHORT_4_4_4_4         = 0x8033;
+        const unsigned int UNSIGNED_SHORT_5_5_5_1         = 0x8034;
+        const unsigned int UNSIGNED_SHORT_5_6_5           = 0x8363;
+
+        /* Shaders */
+        const unsigned int FRAGMENT_SHADER                  = 0x8B30;
+        const unsigned int VERTEX_SHADER                    = 0x8B31;
+        const unsigned int MAX_VERTEX_ATTRIBS               = 0x8869;
+        const unsigned int MAX_VERTEX_UNIFORM_VECTORS       = 0x8DFB;
+        const unsigned int MAX_VARYING_VECTORS              = 0x8DFC;
+        const unsigned int MAX_COMBINED_TEXTURE_IMAGE_UNITS = 0x8B4D;
+        const unsigned int MAX_VERTEX_TEXTURE_IMAGE_UNITS   = 0x8B4C;
+        const unsigned int MAX_TEXTURE_IMAGE_UNITS          = 0x8872;
+        const unsigned int MAX_FRAGMENT_UNIFORM_VECTORS     = 0x8DFD;
+        const unsigned int SHADER_TYPE                      = 0x8B4F;
+        const unsigned int DELETE_STATUS                    = 0x8B80;
+        const unsigned int LINK_STATUS                      = 0x8B82;
+        const unsigned int VALIDATE_STATUS                  = 0x8B83;
+        const unsigned int ATTACHED_SHADERS                 = 0x8B85;
+        const unsigned int ACTIVE_UNIFORMS                  = 0x8B86;
+        const unsigned int ACTIVE_UNIFORM_MAX_LENGTH        = 0x8B87;
+        const unsigned int ACTIVE_ATTRIBUTES                = 0x8B89;
+        const unsigned int ACTIVE_ATTRIBUTE_MAX_LENGTH      = 0x8B8A;
+        const unsigned int SHADING_LANGUAGE_VERSION         = 0x8B8C;
+        const unsigned int CURRENT_PROGRAM                  = 0x8B8D;
+
+        /* StencilFunction */
+        const unsigned int NEVER                          = 0x0200;
+        const unsigned int LESS                           = 0x0201;
+        const unsigned int EQUAL                          = 0x0202;
+        const unsigned int LEQUAL                         = 0x0203;
+        const unsigned int GREATER                        = 0x0204;
+        const unsigned int NOTEQUAL                       = 0x0205;
+        const unsigned int GEQUAL                         = 0x0206;
+        const unsigned int ALWAYS                         = 0x0207;
+
+        /* StencilOp */
+        /*      ZERO */
+        const unsigned int KEEP                           = 0x1E00;
+        const unsigned int REPLACE                        = 0x1E01;
+        const unsigned int INCR                           = 0x1E02;
+        const unsigned int DECR                           = 0x1E03;
+        const unsigned int INVERT                         = 0x150A;
+        const unsigned int INCR_WRAP                      = 0x8507;
+        const unsigned int DECR_WRAP                      = 0x8508;
+
+        /* StringName */
+        const unsigned int VENDOR                         = 0x1F00;
+        const unsigned int RENDERER                       = 0x1F01;
+        const unsigned int VERSION                        = 0x1F02;
+        const unsigned int EXTENSIONS                     = 0x1F03;
+
+        /* TextureMagFilter */
+        const unsigned int NEAREST                        = 0x2600;
+        const unsigned int LINEAR                         = 0x2601;
+
+        /* TextureMinFilter */
+        /*      NEAREST */
+        /*      LINEAR */
+        const unsigned int NEAREST_MIPMAP_NEAREST         = 0x2700;
+        const unsigned int LINEAR_MIPMAP_NEAREST          = 0x2701;
+        const unsigned int NEAREST_MIPMAP_LINEAR          = 0x2702;
+        const unsigned int LINEAR_MIPMAP_LINEAR           = 0x2703;
+
+        /* TextureParameterName */
+        const unsigned int TEXTURE_MAG_FILTER             = 0x2800;
+        const unsigned int TEXTURE_MIN_FILTER             = 0x2801;
+        const unsigned int TEXTURE_WRAP_S                 = 0x2802;
+        const unsigned int TEXTURE_WRAP_T                 = 0x2803;
+
+        /* TextureTarget */
+        /*      TEXTURE_2D */
+        const unsigned int TEXTURE                        = 0x1702;
+
+        const unsigned int TEXTURE_CUBE_MAP               = 0x8513;
+        const unsigned int TEXTURE_BINDING_CUBE_MAP       = 0x8514;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_X    = 0x8515;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_X    = 0x8516;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Y    = 0x8517;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Y    = 0x8518;
+        const unsigned int TEXTURE_CUBE_MAP_POSITIVE_Z    = 0x8519;
+        const unsigned int TEXTURE_CUBE_MAP_NEGATIVE_Z    = 0x851A;
+        const unsigned int MAX_CUBE_MAP_TEXTURE_SIZE      = 0x851C;
+
+        /* TextureUnit */
+        const unsigned int TEXTURE0                       = 0x84C0;
+        const unsigned int TEXTURE1                       = 0x84C1;
+        const unsigned int TEXTURE2                       = 0x84C2;
+        const unsigned int TEXTURE3                       = 0x84C3;
+        const unsigned int TEXTURE4                       = 0x84C4;
+        const unsigned int TEXTURE5                       = 0x84C5;
+        const unsigned int TEXTURE6                       = 0x84C6;
+        const unsigned int TEXTURE7                       = 0x84C7;
+        const unsigned int TEXTURE8                       = 0x84C8;
+        const unsigned int TEXTURE9                       = 0x84C9;
+        const unsigned int TEXTURE10                      = 0x84CA;
+        const unsigned int TEXTURE11                      = 0x84CB;
+        const unsigned int TEXTURE12                      = 0x84CC;
+        const unsigned int TEXTURE13                      = 0x84CD;
+        const unsigned int TEXTURE14                      = 0x84CE;
+        const unsigned int TEXTURE15                      = 0x84CF;
+        const unsigned int TEXTURE16                      = 0x84D0;
+        const unsigned int TEXTURE17                      = 0x84D1;
+        const unsigned int TEXTURE18                      = 0x84D2;
+        const unsigned int TEXTURE19                      = 0x84D3;
+        const unsigned int TEXTURE20                      = 0x84D4;
+        const unsigned int TEXTURE21                      = 0x84D5;
+        const unsigned int TEXTURE22                      = 0x84D6;
+        const unsigned int TEXTURE23                      = 0x84D7;
+        const unsigned int TEXTURE24                      = 0x84D8;
+        const unsigned int TEXTURE25                      = 0x84D9;
+        const unsigned int TEXTURE26                      = 0x84DA;
+        const unsigned int TEXTURE27                      = 0x84DB;
+        const unsigned int TEXTURE28                      = 0x84DC;
+        const unsigned int TEXTURE29                      = 0x84DD;
+        const unsigned int TEXTURE30                      = 0x84DE;
+        const unsigned int TEXTURE31                      = 0x84DF;
+        const unsigned int ACTIVE_TEXTURE                 = 0x84E0;
+
+        /* TextureWrapMode */
+        const unsigned int REPEAT                         = 0x2901;
+        const unsigned int CLAMP_TO_EDGE                  = 0x812F;
+        const unsigned int MIRRORED_REPEAT                = 0x8370;
+
+        /* Uniform Types */
+        const unsigned int FLOAT_VEC2                     = 0x8B50;
+        const unsigned int FLOAT_VEC3                     = 0x8B51;
+        const unsigned int FLOAT_VEC4                     = 0x8B52;
+        const unsigned int INT_VEC2                       = 0x8B53;
+        const unsigned int INT_VEC3                       = 0x8B54;
+        const unsigned int INT_VEC4                       = 0x8B55;
+        const unsigned int BOOL                           = 0x8B56;
+        const unsigned int BOOL_VEC2                      = 0x8B57;
+        const unsigned int BOOL_VEC3                      = 0x8B58;
+        const unsigned int BOOL_VEC4                      = 0x8B59;
+        const unsigned int FLOAT_MAT2                     = 0x8B5A;
+        const unsigned int FLOAT_MAT3                     = 0x8B5B;
+        const unsigned int FLOAT_MAT4                     = 0x8B5C;
+        const unsigned int SAMPLER_2D                     = 0x8B5E;
+        const unsigned int SAMPLER_CUBE                   = 0x8B60;
+
+        /* Vertex Arrays */
+        const unsigned int VERTEX_ATTRIB_ARRAY_ENABLED        = 0x8622;
+        const unsigned int VERTEX_ATTRIB_ARRAY_SIZE           = 0x8623;
+        const unsigned int VERTEX_ATTRIB_ARRAY_STRIDE         = 0x8624;
+        const unsigned int VERTEX_ATTRIB_ARRAY_TYPE           = 0x8625;
+        const unsigned int VERTEX_ATTRIB_ARRAY_NORMALIZED     = 0x886A;
+        const unsigned int VERTEX_ATTRIB_ARRAY_POINTER        = 0x8645;
+        const unsigned int VERTEX_ATTRIB_ARRAY_BUFFER_BINDING = 0x889F;
+
+        /* Read Format */
+        const unsigned int IMPLEMENTATION_COLOR_READ_TYPE   = 0x8B9A;
+        const unsigned int IMPLEMENTATION_COLOR_READ_FORMAT = 0x8B9B;
+
+        /* Shader Source */
+        const unsigned int COMPILE_STATUS                 = 0x8B81;
+        const unsigned int INFO_LOG_LENGTH                = 0x8B84;
+        const unsigned int SHADER_SOURCE_LENGTH           = 0x8B88;
+        const unsigned int SHADER_COMPILER                = 0x8DFA;
+
+        /* Shader Binary */
+        const unsigned int SHADER_BINARY_FORMATS          = 0x8DF8;
+        const unsigned int NUM_SHADER_BINARY_FORMATS      = 0x8DF9;
+
+        /* Shader Precision-Specified Types */
+        const unsigned int LOW_FLOAT                      = 0x8DF0;
+        const unsigned int MEDIUM_FLOAT                   = 0x8DF1;
+        const unsigned int HIGH_FLOAT                     = 0x8DF2;
+        const unsigned int LOW_INT                        = 0x8DF3;
+        const unsigned int MEDIUM_INT                     = 0x8DF4;
+        const unsigned int HIGH_INT                       = 0x8DF5;
+
+        /* Framebuffer Object. */
+        const unsigned int FRAMEBUFFER                    = 0x8D40;
+        const unsigned int RENDERBUFFER                   = 0x8D41;
+
+        const unsigned int RGBA4                          = 0x8056;
+        const unsigned int RGB5_A1                        = 0x8057;
+        const unsigned int RGB565                         = 0x8D62;
+        const unsigned int DEPTH_COMPONENT16              = 0x81A5;
+        const unsigned int STENCIL_INDEX                  = 0x1901;
+        const unsigned int STENCIL_INDEX8                 = 0x8D48;
+
+        const unsigned int RENDERBUFFER_WIDTH             = 0x8D42;
+        const unsigned int RENDERBUFFER_HEIGHT            = 0x8D43;
+        const unsigned int RENDERBUFFER_INTERNAL_FORMAT   = 0x8D44;
+        const unsigned int RENDERBUFFER_RED_SIZE          = 0x8D50;
+        const unsigned int RENDERBUFFER_GREEN_SIZE        = 0x8D51;
+        const unsigned int RENDERBUFFER_BLUE_SIZE         = 0x8D52;
+        const unsigned int RENDERBUFFER_ALPHA_SIZE        = 0x8D53;
+        const unsigned int RENDERBUFFER_DEPTH_SIZE        = 0x8D54;
+        const unsigned int RENDERBUFFER_STENCIL_SIZE      = 0x8D55;
+
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE           = 0x8CD0;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_OBJECT_NAME           = 0x8CD1;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_LEVEL         = 0x8CD2;
+        const unsigned int FRAMEBUFFER_ATTACHMENT_TEXTURE_CUBE_MAP_FACE = 0x8CD3;
+
+        const unsigned int COLOR_ATTACHMENT0              = 0x8CE0;
+        const unsigned int DEPTH_ATTACHMENT               = 0x8D00;
+        const unsigned int STENCIL_ATTACHMENT             = 0x8D20;
+
+        const unsigned int NONE                           = 0;
+
+        const unsigned int FRAMEBUFFER_COMPLETE                      = 0x8CD5;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_ATTACHMENT         = 0x8CD6;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_MISSING_ATTACHMENT = 0x8CD7;
+        const unsigned int FRAMEBUFFER_INCOMPLETE_DIMENSIONS         = 0x8CD9;
+        const unsigned int FRAMEBUFFER_UNSUPPORTED                   = 0x8CDD;
+
+        const unsigned int FRAMEBUFFER_BINDING            = 0x8CA6;
+        const unsigned int RENDERBUFFER_BINDING           = 0x8CA7;
+        const unsigned int MAX_RENDERBUFFER_SIZE          = 0x84E8;
+
+        const unsigned int INVALID_FRAMEBUFFER_OPERATION  = 0x0506;
+
+        long sizeInBytes(in unsigned long type) raises(DOMException);
+
+        void         activeTexture(in unsigned long texture);
+        void         attachShader(in CanvasProgram program, in CanvasShader shader);
+        void         bindAttribLocation(in CanvasProgram program, in unsigned long index, in DOMString name);
+        void         bindBuffer(in unsigned long target, in CanvasBuffer buffer);
+        void         bindFramebuffer(in unsigned long target, in CanvasFramebuffer framebuffer);
+        void         bindRenderbuffer(in unsigned long target, in CanvasRenderbuffer renderbuffer);
+        void         bindTexture(in unsigned long target, in CanvasTexture texture);
+        void         blendColor(in double red, in double green, in double blue, in double alpha);
+        void         blendEquation( in unsigned long mode );
+        void         blendEquationSeparate(in unsigned long modeRGB, in unsigned long modeAlpha);
+        void         blendFunc(in unsigned long sfactor, in unsigned long dfactor);
+        void         blendFuncSeparate(in unsigned long srcRGB, in unsigned long dstRGB, in unsigned long srcAlpha, in unsigned long dstAlpha);
+        // Supported forms:
+        //   void bufferData (in GLenum target, in GLsizei size, in GLenum usage);
+        //   void bufferData (in GLenum target, in CanvasArray data, in GLenum usage);
+        [Custom] void bufferData();
+        // Supported forms:
+        //   void bufferSubData (in GLenum target, in GLsizeiptr offset, in CanvasArray data);
+        [Custom] void bufferSubData();
+
+        unsigned long checkFramebufferStatus(in unsigned long target);
+        void         clear(in unsigned long mask);
+        void         clearColor(in double red, in double green, in double blue, in double alpha);
+        void         clearDepth(in double depth);
+        void         clearStencil(in long s);
+        void         colorMask(in boolean red, in boolean green, in boolean blue, in boolean alpha);
+        void         compileShader(in CanvasShader shader);
+        
+        //void         compressedTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in unsigned long width, in unsigned long height, in long border, in unsigned long imageSize, const void* data);
+        //void         compressedTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long imageSize, const void* data);
+        
+        void         copyTexImage2D(in unsigned long target, in long level, in unsigned long internalformat, in long x, in long y, in unsigned long width, in unsigned long height, in long border);
+        void         copyTexSubImage2D(in unsigned long target, in long level, in long xoffset, in long yoffset, in long x, in long y, in unsigned long width, in unsigned long height);
+
+        CanvasBuffer createBuffer();
+        CanvasFramebuffer createFramebuffer();
+        CanvasProgram createProgram();
+        CanvasRenderbuffer createRenderbuffer();
+        CanvasShader createShader(in unsigned long type);
+        CanvasTexture createTexture();
+
+        void         cullFace(in unsigned long mode);
+
+        void         deleteBuffer(in CanvasBuffer buffer);
+        void         deleteFramebuffer(in CanvasFramebuffer framebuffer);
+        void         deleteProgram(in CanvasProgram program);
+        void         deleteRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        void         deleteShader(in CanvasShader shader);
+        void         deleteTexture(in CanvasTexture texture);
+
+        void         depthFunc(in unsigned long func);
+        void         depthMask(in boolean flag);
+        // FIXME: this differs from the current WebGL spec (depthRangef)
+        void         depthRange(in double zNear, in double zFar);
+        void         detachShader(in CanvasProgram program, in CanvasShader shader);
+        void         disable(in unsigned long cap);
+        void         disableVertexAttribArray(in unsigned long index);
+        void         drawArrays(in unsigned long mode, in long first, in unsigned long count);
+        void         drawElements (in unsigned long mode, in long count, in unsigned long type, in unsigned long offset);
+
+        void         enable(in unsigned long cap);
+        void         enableVertexAttribArray(in unsigned long index);
+        void         finish();
+        void         flush();
+        void         framebufferRenderbuffer(in unsigned long target, in unsigned long attachment, in unsigned long renderbuffertarget, in CanvasRenderbuffer renderbuffer);
+        void         framebufferTexture2D(in unsigned long target, in unsigned long attachment, in unsigned long textarget, in CanvasTexture texture, in long level);
+        void         frontFace(in unsigned long mode);
+        void         generateMipmap(in unsigned long target);
+        
+        // FIXME: these need to be added per the WebGL spec
+        // CanvasActiveInfo getActiveAttrib(GLuint program, GLuint index);
+        // CanvasActiveInfo getActiveUniform(GLuint program, GLuint index);
+        // CanvasShaderArray glGetAttachedShaders(GLuint program);
+
+        int          getAttribLocation(in CanvasProgram program, in DOMString name);
+
+        boolean getBoolean(in unsigned long pname);
+        CanvasUnsignedByteArray getBooleanv(in unsigned long pname);
+        long getBufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getBufferParameteriv(in unsigned long target, in unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(in unsigned long pname);
+        CanvasFloatArray getFloatv(in unsigned long pname);
+        long getFramebufferAttachmentParameteri(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        CanvasIntArray getFramebufferAttachmentParameteriv(in unsigned long target, in unsigned long attachment, in unsigned long pname);
+        long getInteger(in unsigned long pname);
+        CanvasIntArray getIntegerv(in unsigned long pname);
+        long getProgrami(in CanvasProgram program, in unsigned long pname);
+        CanvasIntArray getProgramiv(in CanvasProgram program, in unsigned long pname);
+        DOMString getProgramInfoLog(in CanvasProgram program);
+        long getRenderbufferParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getRenderbufferParameteriv(in unsigned long target, in unsigned long pname);
+        long getShaderi(in CanvasShader shader, in unsigned long pname);
+        CanvasIntArray getShaderiv(in CanvasShader shader, in unsigned long pname);
+
+        DOMString    getShaderInfoLog(in CanvasShader shader);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        DOMString    getShaderSource(in CanvasShader shader);
+        DOMString    getString(in unsigned long name);
+
+        float getTexParameterf(in unsigned long target, in unsigned long pname);
+        CanvasFloatArray getTexParameterfv(in unsigned long target, in unsigned long pname);
+        long getTexParameteri(in unsigned long target, in unsigned long pname);
+        CanvasIntArray getTexParameteriv(in unsigned long target, in unsigned long pname);
+
+        float getUniformf(in CanvasProgram program, in long location);
+        CanvasFloatArray getUniformfv(in CanvasProgram program, in long location);
+        long getUniformi(in CanvasProgram program, in long location);
+        CanvasIntArray getUniformiv(in CanvasProgram program, in long location);
+        
+        long getUniformLocation(in CanvasProgram program, in DOMString name);
+
+        float getVertexAttribf(in unsigned long index, in unsigned long pname);
+        CanvasFloatArray getVertexAttribfv(in unsigned long index, in unsigned long pname);
+        long getVertexAttribi(in unsigned long index, in unsigned long pname);
+        CanvasIntArray getVertexAttribiv(in unsigned long index, in unsigned long pname);
+
+        long getVertexAttribOffset(in unsigned long index, in unsigned long pname);
+
+        void         hint(in unsigned long target, in unsigned long mode);
+        boolean      isBuffer(in CanvasBuffer buffer);
+        boolean      isEnabled(in unsigned long cap);
+        boolean      isFramebuffer(in CanvasFramebuffer framebuffer);
+        boolean      isProgram(in CanvasProgram program);
+        boolean      isRenderbuffer(in CanvasRenderbuffer renderbuffer);
+        boolean      isShader(in CanvasShader shader);
+        boolean      isTexture(in CanvasTexture texture);
+        void         lineWidth(in double width);
+        void         linkProgram(in CanvasProgram program);
+        void         pixelStorei(in unsigned long pname, in long param);
+        void         polygonOffset(in double factor, in double units);
+        
+        // FIXME
+        //void         readPixels(in long x, in long y, in unsigned long width, in unsigned long height, in unsigned long format, in unsigned long type, void* pixels);
+        
+        void         releaseShaderCompiler();
+        void         renderbufferStorage(in unsigned long target, in unsigned long internalformat, in unsigned long width, in unsigned long height);
+        void         sampleCoverage(in double value, in boolean invert);
+        void         scissor(in long x, in long y, in unsigned long width, in unsigned long height);
+        void         shaderSource(in CanvasShader shader, in DOMString string);
+        void         stencilFunc(in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilFuncSeparate(in unsigned long face, in unsigned long func, in long ref, in unsigned long mask);
+        void         stencilMask(in unsigned long mask);
+        void         stencilMaskSeparate(in unsigned long face, in unsigned long mask);
+        void         stencilOp(in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+        void         stencilOpSeparate(in unsigned long face, in unsigned long fail, in unsigned long zfail, in unsigned long zpass);
+
+        void         texParameterf(in unsigned long target, in unsigned long pname, in float param);
+        void         texParameteri(in unsigned long target, in unsigned long pname, in long param);
+
+        // Supported forms:
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in GLenum internalformat, in GLsizei width, in GLsizei height, 
+        //                   in GLint border, in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLImageElement image,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLCanvasElement canvas,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texImage2D(in GLenum target, in GLint level, in HTMLVideoElement video,
+        //                   [Optional] in GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texImage2D();
+
+        // Supported forms:
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in CanvasArray pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, 
+        //                      in GLenum format, in GLenum type, in ImageData pixels);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLImageElement image,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLCanvasElement canvas,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        //   void texSubImage2D(in GLenum target, in GLint level, in GLint xoffset, in GLint yoffset, 
+        //                      in GLsizei width, in GLsizei height, in HTMLVideoElement video,
+        //                      [Optional] GLboolean flipY, [Optional] in premultiplyAlpha);
+        [Custom] void texSubImage2D();
+
+        void uniform1f(in long location, in float x);
+        [Custom] void uniform1fv(in long location, in CanvasFloatArray v);
+        void uniform1i(in long location, in long x);
+        [Custom] void uniform1iv(in long location, in CanvasIntArray v);
+        void uniform2f(in long location, in float x, in float y);
+        [Custom] void uniform2fv(in long location, in CanvasFloatArray v);
+        void uniform2i(in long location, in long x, in long y);
+        [Custom] void uniform2iv(in long location, in CanvasIntArray v);
+        void uniform3f(in long location, in float x, in float y, in float z);
+        [Custom] void uniform3fv(in long location, in CanvasFloatArray v);
+        void uniform3i(in long location, in long x, in long y, in long z);
+        [Custom] void uniform3iv(in long location, in CanvasIntArray v);
+        void uniform4f(in long location, in float x, in float y, in float z, in float w);
+        [Custom] void uniform4fv(in long location, in CanvasFloatArray v);
+        void uniform4i(in long location, in long x, in long y, in long z, in long w);
+        [Custom] void uniform4iv(in long location, in CanvasIntArray v);
+
+        [Custom] void uniformMatrix2fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix3fv(in long location, in boolean transpose, in CanvasFloatArray array);
+        [Custom] void uniformMatrix4fv(in long location, in boolean transpose, in CanvasFloatArray array);
+
+        void         useProgram(in CanvasProgram program);
+        void         validateProgram(in CanvasProgram program);
+
+        void         vertexAttrib1f(in unsigned long indx, in float x);
+        [Custom] void         vertexAttrib1fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib2f(in unsigned long indx, in float x, in float y);
+        [Custom] void         vertexAttrib2fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib3f(in unsigned long indx, in float x, in float y, in float z);
+        [Custom] void         vertexAttrib3fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttrib4f(in unsigned long indx, in float x, in float y, in float z, in float w);
+        [Custom] void         vertexAttrib4fv(in unsigned long indx, in CanvasFloatArray values);
+        void         vertexAttribPointer(in unsigned long indx, in long size, in unsigned long type, in boolean normalized, 
+                                         in long stride, in unsigned long offset);
+
+        void         viewport(in long x, in long y, in unsigned long width, in unsigned long height);
+    };
+}
+
diff --git a/WebCore/html/canvas/CanvasShader.cpp b/WebCore/html/canvas/CanvasShader.cpp
new file mode 100644
index 0000000..7f134fa
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasShader.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasShader> CanvasShader::create(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+{
+    return adoptRef(new CanvasShader(ctx, type));
+}
+
+CanvasShader::CanvasShader(CanvasRenderingContext3D* ctx, GraphicsContext3D::ShaderType type)
+    : CanvasObject(ctx)
+{
+    setObject(context()->graphicsContext3D()->createShader(type));
+}
+
+void CanvasShader::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteShader(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShader.h b/WebCore/html/canvas/CanvasShader.h
new file mode 100644
index 0000000..bb7980e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShader_h
+#define CanvasShader_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShader : public CanvasObject {
+    public:
+        virtual ~CanvasShader() { deleteObject(); }
+        
+        static PassRefPtr<CanvasShader> create(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+        
+    private:
+        CanvasShader(CanvasRenderingContext3D*, GraphicsContext3D::ShaderType);
+
+        virtual void _deleteObject(Platform3DObject);
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShader_h
diff --git a/WebCore/html/canvas/CanvasShader.idl b/WebCore/html/canvas/CanvasShader.idl
new file mode 100644
index 0000000..7474c3a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShader.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasShader {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasShortArray.cpp b/WebCore/html/canvas/CanvasShortArray.cpp
new file mode 100644
index 0000000..d0cf135
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(short* array, unsigned length)
+    {
+        RefPtr<CanvasShortArray> a = CanvasShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasShortArray> CanvasShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                          int offset,
+                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(short)) != 0)
+            return NULL;
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(short))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasShortArray(buffer, offset, length));
+    }
+    
+    CanvasShortArray::CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasShortArray::sizeInBytes() const {
+        return length() * sizeof(short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasShortArray.h b/WebCore/html/canvas/CanvasShortArray.h
new file mode 100644
index 0000000..00a170f
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasShortArray_h
+#define CanvasShortArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasShortArray> create(unsigned length);
+        static PassRefPtr<CanvasShortArray> create(short* array, unsigned length);
+        static PassRefPtr<CanvasShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        short* data() { return static_cast<short*>(baseAddress()); }
+
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<short>::min())
+                value = std::numeric_limits<short>::min();
+            else if (value > std::numeric_limits<short>::max())
+                value = std::numeric_limits<short>::max();
+            short* storage = static_cast<short*>(m_baseAddress);
+            storage[index] = static_cast<short>(value);
+        }
+        
+        bool get(unsigned index, short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            short* storage = static_cast<short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasShortArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasShortArray_h
diff --git a/WebCore/html/canvas/CanvasShortArray.idl b/WebCore/html/canvas/CanvasShortArray.idl
new file mode 100644
index 0000000..6d64e1c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasShortArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasTexture.cpp b/WebCore/html/canvas/CanvasTexture.cpp
new file mode 100644
index 0000000..624c275
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasTexture.h"
+#include "CanvasRenderingContext3D.h"
+
+namespace WebCore {
+    
+PassRefPtr<CanvasTexture> CanvasTexture::create(CanvasRenderingContext3D* ctx)
+{
+    return adoptRef(new CanvasTexture(ctx));
+}
+
+CanvasTexture::CanvasTexture(CanvasRenderingContext3D* ctx)
+    : CanvasObject(ctx)
+    , cubeMapRWrapModeInitialized(false)
+{
+    setObject(context()->graphicsContext3D()->createTexture());
+}
+
+void CanvasTexture::_deleteObject(Platform3DObject object)
+{
+    context()->graphicsContext3D()->deleteTexture(object);
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasTexture.h b/WebCore/html/canvas/CanvasTexture.h
new file mode 100644
index 0000000..32a669a
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasTexture_h
+#define CanvasTexture_h
+
+#include "CanvasObject.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasTexture : public CanvasObject {
+    public:
+        virtual ~CanvasTexture() { deleteObject(); }
+        
+        static PassRefPtr<CanvasTexture> create(CanvasRenderingContext3D*);
+    
+        bool isCubeMapRWrapModeInitialized() {
+            return cubeMapRWrapModeInitialized;
+        }
+
+        void setCubeMapRWrapModeInitialized(bool initialized) {
+            cubeMapRWrapModeInitialized = initialized;
+        }
+
+    protected:
+        CanvasTexture(CanvasRenderingContext3D*);
+
+        virtual void _deleteObject(Platform3DObject);
+
+    private:
+        bool cubeMapRWrapModeInitialized;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasTexture_h
diff --git a/WebCore/html/canvas/CanvasTexture.idl b/WebCore/html/canvas/CanvasTexture.idl
new file mode 100644
index 0000000..77eedd7
--- /dev/null
+++ b/WebCore/html/canvas/CanvasTexture.idl
@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS] CanvasTexture {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.cpp b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
new file mode 100644
index 0000000..a75066c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedByteArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned char));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(unsigned char* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedByteArray> a = CanvasUnsignedByteArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedByteArray> CanvasUnsignedByteArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                        int offset,
+                                                                        unsigned length)
+    {
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned char))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedByteArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedByteArray::CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedByteArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedByteArray::sizeInBytes() const {
+        return length() * sizeof(unsigned char);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.h b/WebCore/html/canvas/CanvasUnsignedByteArray.h
new file mode 100644
index 0000000..6293034
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedByteArray_h
+#define CanvasUnsignedByteArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedByteArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(unsigned char* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedByteArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned char* data() { return static_cast<unsigned char*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned char>::min())
+                value = std::numeric_limits<unsigned char>::min();
+            else if (value > std::numeric_limits<unsigned char>::max())
+                value = std::numeric_limits<unsigned char>::max();
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            storage[index] = static_cast<unsigned char>(value);
+        }
+        
+        bool get(unsigned index, unsigned char& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned char item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned char* storage = static_cast<unsigned char*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedByteArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedByteArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedByteArray.idl b/WebCore/html/canvas/CanvasUnsignedByteArray.idl
new file mode 100644
index 0000000..d46f708
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedByteArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedByteArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.cpp b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
new file mode 100644
index 0000000..bd26343
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedIntArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned int));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(unsigned int* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedIntArray> a = CanvasUnsignedIntArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedIntArray> CanvasUnsignedIntArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                      int offset,
+                                                                      unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned int)) != 0) {
+            return NULL;
+        }
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned int))) > buffer->byteLength())
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedIntArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedIntArray::CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedIntArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedIntArray::sizeInBytes() const {
+        return length() * sizeof(unsigned int);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.h b/WebCore/html/canvas/CanvasUnsignedIntArray.h
new file mode 100644
index 0000000..5b5994c
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedIntArray_h
+#define CanvasUnsignedIntArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedIntArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(unsigned int* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedIntArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned int* data() { return static_cast<unsigned int*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned int>::min())
+                value = std::numeric_limits<unsigned int>::min();
+            else if (value > std::numeric_limits<unsigned int>::max())
+                value = std::numeric_limits<unsigned int>::max();
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            storage[index] = static_cast<unsigned int>(value);
+        }
+        
+        bool get(unsigned index, unsigned int& result) const
+        {
+            if (index >= m_size)
+                return false;
+            result = item(index);
+            return true;
+        }
+        
+        unsigned int item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned int* storage = static_cast<unsigned int*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedIntArray(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedIntArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedIntArray.idl b/WebCore/html/canvas/CanvasUnsignedIntArray.idl
new file mode 100644
index 0000000..3ab60d6
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedIntArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedIntArray : CanvasArray {
+    };
+}
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.cpp b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
new file mode 100644
index 0000000..45d827b
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "CanvasArrayBuffer.h"
+#include "CanvasUnsignedShortArray.h"
+
+namespace WebCore {
+    
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned length)
+    {
+        RefPtr<CanvasArrayBuffer> buffer = CanvasArrayBuffer::create(length * sizeof(unsigned short));
+        return create(buffer, 0, length);
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(unsigned short* array, unsigned length)
+    {
+        RefPtr<CanvasUnsignedShortArray> a = CanvasUnsignedShortArray::create(length);
+        for (unsigned i = 0; i < length; ++i)
+            a->set(i, array[i]);
+        return a;
+    }
+
+    PassRefPtr<CanvasUnsignedShortArray> CanvasUnsignedShortArray::create(PassRefPtr<CanvasArrayBuffer> buffer,
+                                                                          int offset,
+                                                                          unsigned length)
+    {
+        // Make sure the offset results in valid alignment.
+        if ((offset % sizeof(unsigned short)) != 0) {
+            return NULL;
+        }
+
+        if (buffer) {
+            // Check to make sure we are talking about a valid region of
+            // the given CanvasArrayBuffer's storage.
+            if ((offset + (length * sizeof(unsigned short))) > buffer->byteLength()) 
+                return NULL;
+        }
+
+        return adoptRef(new CanvasUnsignedShortArray(buffer, offset, length));
+    }
+    
+    CanvasUnsignedShortArray::CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,
+                                         int offset,
+                                         unsigned length)
+        : CanvasArray(buffer, offset)
+        , m_size(length)
+    {
+    }
+    
+    unsigned CanvasUnsignedShortArray::length() const {
+        return m_size;
+    }
+        
+    unsigned CanvasUnsignedShortArray::sizeInBytes() const {
+        return length() * sizeof(unsigned short);
+    }
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.h b/WebCore/html/canvas/CanvasUnsignedShortArray.h
new file mode 100644
index 0000000..1f6252e
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CanvasUnsignedShortArray_h
+#define CanvasUnsignedShortArray_h
+
+#include "CanvasArray.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+    
+    class CanvasUnsignedShortArray : public CanvasArray {
+    public:
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(unsigned short* array, unsigned length);
+        static PassRefPtr<CanvasUnsignedShortArray> create(PassRefPtr<CanvasArrayBuffer> buffer, int offset, unsigned length);
+
+        unsigned short* data() { return static_cast<unsigned short*>(baseAddress()); }
+        
+        virtual unsigned length() const;
+        virtual unsigned sizeInBytes() const;
+
+        void set(unsigned index, double value)
+        {
+            if (index >= m_size)
+                return;
+            if (isnan(value)) // Clamp NaN to 0
+                value = 0;
+            if (value < std::numeric_limits<unsigned short>::min())
+                value = std::numeric_limits<unsigned short>::min();
+            else if (value > std::numeric_limits<unsigned short>::max())
+                value = std::numeric_limits<unsigned short>::max();
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            storage[index] = static_cast<unsigned short>(value);
+        }
+        
+        bool get(unsigned index, unsigned short& result) const
+        {
+            if (index >= m_size)
+                return false;
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            result = storage[index];
+            return true;
+        }
+        
+        unsigned short item(unsigned index) const
+        {
+            ASSERT(index < m_size);
+            unsigned short* storage = static_cast<unsigned short*>(m_baseAddress);
+            return storage[index];
+        }
+
+    private:
+        CanvasUnsignedShortArray(PassRefPtr<CanvasArrayBuffer> buffer,int offset,unsigned length);
+        unsigned m_size;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasUnsignedShortArray_h
diff --git a/WebCore/html/canvas/CanvasUnsignedShortArray.idl b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
new file mode 100644
index 0000000..99fc6a2
--- /dev/null
+++ b/WebCore/html/canvas/CanvasUnsignedShortArray.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+    interface [
+        Conditional=3D_CANVAS,
+        HasNumericIndexGetter,
+        HasCustomIndexSetter,
+        GenerateNativeConverter,
+        GenerateCustomConstructor,
+        CustomToJS
+    ] CanvasUnsignedShortArray : CanvasArray {
+    };
+}
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index f9d8708..6cfb75e 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -54,7 +54,9 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
     : m_source(s)
     , m_type(t)
     , m_level(l)
+#if ENABLE(INSPECTOR)
     , m_wrappedArguments(callStack->at(0).argumentCount())
+#endif
     , m_frames(storeTrace ? callStack->size() : 0)
     , m_groupLevel(g)
     , m_repeatCount(1)
@@ -71,10 +73,13 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, S
             m_frames[i] = callStack->at(i).functionName();
     }
 
+#if ENABLE(INSPECTOR)
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
         m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+#endif
 }
 
+#if ENABLE(INSPECTOR)
 void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
 {
     ScriptObject jsonObj = frontend->newScriptObject();
@@ -87,9 +92,11 @@ void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
     jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
     frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
 }
+#endif // ENABLE(INSPECTOR)
 
 bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
 {
+#if ENABLE(INSPECTOR)
     if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
         return false;
     if (!state && msg->m_wrappedArguments.size())
@@ -101,6 +108,9 @@ bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
         if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
             return false;
     }
+#else
+    UNUSED_PARAM(state);
+#endif // ENABLE(INSPECTOR)
 
     size_t frameCount = msg->m_frames.size();
     if (frameCount != m_frames.size())
diff --git a/WebCore/inspector/ConsoleMessage.h b/WebCore/inspector/ConsoleMessage.h
index 910a007..d03f2b7 100644
--- a/WebCore/inspector/ConsoleMessage.h
+++ b/WebCore/inspector/ConsoleMessage.h
@@ -47,7 +47,9 @@ namespace WebCore {
         ConsoleMessage(MessageSource, MessageType, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
         ConsoleMessage(MessageSource, MessageType, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
 
+#if ENABLE(INSPECTOR)
         void addToConsole(InspectorFrontend* frontend);
+#endif
         void incrementCount() { ++m_repeatCount; };
         bool isEqual(ScriptState*, ConsoleMessage* msg) const;
 
@@ -59,7 +61,9 @@ namespace WebCore {
         MessageType m_type;
         MessageLevel m_level;
         String m_message;
+#if ENABLE(INSPECTOR)
         Vector<ScriptValue> m_wrappedArguments;
+#endif
         Vector<ScriptString> m_frames;
         unsigned m_line;
         String m_url;
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.cpp b/WebCore/inspector/DOMDispatchTimelineItem.cpp
new file mode 100644
index 0000000..acff513
--- /dev/null
+++ b/WebCore/inspector/DOMDispatchTimelineItem.cpp
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "DOMDispatchTimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Event.h"
+#include "InspectorFrontend.h"
+
+namespace WebCore {
+
+DOMDispatchTimelineItem::DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event& event)
+    : TimelineItem(previous, startTime, DOMDispatchTimelineItemType)
+    , m_eventType(event.type().string())
+{
+}
+
+ScriptObject DOMDispatchTimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = TimelineItem::convertToScriptObject(frontend);
+    ScriptObject dataObj = frontend->newScriptObject();
+    dataObj.set("type", m_eventType);
+    selfObj.set("data", dataObj);
+    return selfObj;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/DOMDispatchTimelineItem.h b/WebCore/inspector/DOMDispatchTimelineItem.h
new file mode 100644
index 0000000..384ce25
--- /dev/null
+++ b/WebCore/inspector/DOMDispatchTimelineItem.h
@@ -0,0 +1,58 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef DOMDispatchTimelineItem_h
+#define DOMDispatchTimelineItem_h
+
+#include "TimelineItem.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Event;
+    class InspectorFrontend;
+
+    class DOMDispatchTimelineItem : public TimelineItem {
+    public:
+        DOMDispatchTimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, const Event&);
+
+        virtual ~DOMDispatchTimelineItem() { }
+
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+    private:
+        String m_eventType;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(DOMDispatchTimelineItem_h)
+
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 1eb10e8..1273512 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -30,6 +30,12 @@
 #include "config.h"
 #include "InspectorBackend.h"
 
+#if ENABLE(INSPECTOR)
+
+#if ENABLE(DATABASE)
+#include "Database.h"
+#endif
+
 #include "Element.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -37,7 +43,15 @@
 #include "InspectorClient.h"
 #include "InspectorController.h"
 #include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
 #include "InspectorResource.h"
+#include "Pasteboard.h"
+#include "ScriptArray.h"
+#include "ScriptFunctionCall.h"
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
@@ -45,6 +59,8 @@
 using namespace JSC;
 #endif
 
+#include "markup.h"
+
 #include <wtf/RefPtr.h>
 #include <wtf/StdLibExtras.h>
 
@@ -139,10 +155,10 @@ bool InspectorBackend::addSourceToFrame(const String& mimeType, const String& so
     return true;
 }
 
-void InspectorBackend::clearMessages()
+void InspectorBackend::clearMessages(bool clearUI)
 {
     if (m_inspectorController)
-        m_inspectorController->clearConsoleMessages();
+        m_inspectorController->clearConsoleMessages(clearUI);
 }
 
 void InspectorBackend::toggleNodeSearch()
@@ -182,10 +198,10 @@ bool InspectorBackend::searchingForNode()
     return false;
 }
 
-void InspectorBackend::loaded(bool enableDOMAgent)
+void InspectorBackend::loaded()
 {
     if (m_inspectorController)
-        m_inspectorController->scriptObjectReady(enableDOMAgent);
+        m_inspectorController->scriptObjectReady();
 }
 
 void InspectorBackend::enableResourceTracking(bool always)
@@ -242,9 +258,28 @@ const String& InspectorBackend::platform() const
     return platform;
 }
 
+void InspectorBackend::enableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->enableTimeline(always);
+}
+
+void InspectorBackend::disableTimeline(bool always)
+{
+    if (m_inspectorController)
+        m_inspectorController->disableTimeline(always);
+}
+
+bool InspectorBackend::timelineEnabled() const
+{
+    if (m_inspectorController)
+        return m_inspectorController->timelineEnabled();
+    return false;
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 const ProfilesArray& InspectorBackend::profiles() const
-{    
+{
     if (m_inspectorController)
         return m_inspectorController->profiles();
     return m_emptyProfiles;
@@ -305,10 +340,16 @@ JavaScriptCallFrame* InspectorBackend::currentCallFrame() const
     return JavaScriptDebugServer::shared().currentCallFrame();
 }
 
-void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber)
+void InspectorBackend::addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
+{
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber, condition);
+}
+
+void InspectorBackend::updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
-    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber);
+    JavaScriptDebugServer::shared().updateBreakpoint(sourceIDValue, lineNumber, condition);
 }
 
 void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
@@ -355,34 +396,213 @@ void InspectorBackend::stepOutOfFunctionInDebugger()
 
 #endif
 
-void InspectorBackend::getChildNodes(long callId, long elementId)
+void InspectorBackend::dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async)
 {
-    if (m_inspectorController)
-        m_inspectorController->domAgent()->getChildNodes(callId, elementId);
+    InspectorFrontend* frontend = inspectorFrontend();
+    if (!frontend)
+        return;
+
+    ScriptFunctionCall function(m_inspectorController->m_scriptState, m_inspectorController->m_injectedScriptObj, "dispatch");
+    function.appendArgument(methodName);
+    function.appendArgument(arguments);
+    if (async)
+        function.appendArgument(static_cast<int>(callId));
+    bool hadException = false;
+    ScriptValue result = function.call(hadException);
+    if (async)
+        return;  // InjectedScript will return result asynchronously by means of ::reportDidDispatchOnInjectedScript.
+    if (hadException)
+        frontend->didDispatchOnInjectedScript(callId, "", true);
+    else
+        frontend->didDispatchOnInjectedScript(callId, result.toString(m_inspectorController->m_scriptState), false);
+}
+
+void InspectorBackend::getChildNodes(long callId, long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getChildNodes(callId, nodeId);
 }
 
 void InspectorBackend::setAttribute(long callId, long elementId, const String& name, const String& value)
 {
-    if (m_inspectorController)
-        m_inspectorController->domAgent()->setAttribute(callId, elementId, name, value);
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setAttribute(callId, elementId, name, value);
 }
 
 void InspectorBackend::removeAttribute(long callId, long elementId, const String& name)
 {
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->removeAttribute(callId, elementId, name);
+}
+
+void InspectorBackend::setTextNodeValue(long callId, long nodeId, const String& value)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->setTextNodeValue(callId, nodeId, value);
+}
+
+void InspectorBackend::getEventListenersForNode(long callId, long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        domAgent->getEventListenersForNode(callId, nodeId);
+}
+
+void InspectorBackend::copyNode(long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    if (!node)
+        return;
+    String markup = createMarkup(node);
+    Pasteboard::generalPasteboard()->writePlainText(markup);
+}
+
+void InspectorBackend::getCookies(long callId, const String& domain)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->getCookies(callId, domain);
+}
+
+void InspectorBackend::deleteCookie(const String& cookieName, const String& domain)
+{
+    if (!m_inspectorController)
+        return;
+    m_inspectorController->deleteCookie(cookieName, domain);
+}
+
+void InspectorBackend::highlight(long nodeId)
+{
+    if (Node* node = nodeForId(nodeId))
+        m_inspectorController->highlight(node);
+}
+
+Node* InspectorBackend::nodeForId(long nodeId)
+{
+    if (InspectorDOMAgent* domAgent = inspectorDOMAgent())
+        return domAgent->nodeForId(nodeId);
+    return 0;
+}
+
+ScriptValue InspectorBackend::wrapObject(const ScriptValue& object, const String& objectGroup)
+{
     if (m_inspectorController)
-        m_inspectorController->domAgent()->removeAttribute(callId, elementId, name);
+        return m_inspectorController->wrapObject(object, objectGroup);
+    return ScriptValue();
 }
 
-void InspectorBackend::setTextNodeValue(long callId, long elementId, const String& value)
+ScriptValue InspectorBackend::unwrapObject(const String& objectId)
 {
     if (m_inspectorController)
-        m_inspectorController->domAgent()->setTextNodeValue(callId, elementId, value);
+        return m_inspectorController->unwrapObject(objectId);
+    return ScriptValue();
 }
 
-void InspectorBackend::highlight(Node* node)
+void InspectorBackend::releaseWrapperObjectGroup(const String& objectGroup)
 {
     if (m_inspectorController)
-        m_inspectorController->highlight(node);
+        m_inspectorController->releaseWrapperObjectGroup(objectGroup);
+}
+
+long InspectorBackend::pushNodePathToFrontend(Node* node, bool selectInUI)
+{
+    InspectorFrontend* frontend = inspectorFrontend();
+    InspectorDOMAgent* domAgent = inspectorDOMAgent();
+    if (!domAgent || !frontend)
+        return 0;
+    long id = domAgent->pushNodePathToFrontend(node);
+    if (selectInUI)
+        frontend->updateFocusedNode(id);
+    return id;
+}
+
+void InspectorBackend::addNodesToSearchResult(const String& nodeIds)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->addNodesToSearchResult(nodeIds);
+}
+
+#if ENABLE(DATABASE)
+Database* InspectorBackend::databaseForId(long databaseId)
+{
+    if (m_inspectorController)
+        return m_inspectorController->databaseForId(databaseId);
+    return 0;
+}
+
+void InspectorBackend::selectDatabase(Database* database)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDatabase(database);
+}
+
+void InspectorBackend::getDatabaseTableNames(long callId, long databaseId)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend()) {
+        ScriptArray result = frontend->newScriptArray();
+        Database* database = m_inspectorController->databaseForId(databaseId);
+        if (database) {
+            Vector<String> tableNames = database->tableNames();
+            unsigned length = tableNames.size();
+            for (unsigned i = 0; i < length; ++i)
+                result.set(i, tableNames[i]);
+        }
+        frontend->didGetDatabaseTableNames(callId, result);
+    }
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorBackend::selectDOMStorage(Storage* storage)
+{
+    if (m_inspectorController)
+        m_inspectorController->selectDOMStorage(storage);
+}
+
+void InspectorBackend::getDOMStorageEntries(long callId, long storageId)
+{
+    if (m_inspectorController)
+        m_inspectorController->getDOMStorageEntries(callId, storageId);
+}
+
+void InspectorBackend::setDOMStorageItem(long callId, long storageId, const String& key, const String& value)
+{
+    if (m_inspectorController)
+        m_inspectorController->setDOMStorageItem(callId, storageId, key, value);
+}
+
+void InspectorBackend::removeDOMStorageItem(long callId, long storageId, const String& key)
+{
+    if (m_inspectorController)
+        m_inspectorController->removeDOMStorageItem(callId, storageId, key);
+}
+#endif
+
+void InspectorBackend::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    if (m_inspectorController)
+        m_inspectorController->didEvaluateForTestInFrontend(callId, jsonResult);
+}
+
+void InspectorBackend::reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException)
+{
+    if (InspectorFrontend* frontend = inspectorFrontend())
+        frontend->didDispatchOnInjectedScript(callId, result, isException);
+}
+
+InspectorDOMAgent* InspectorBackend::inspectorDOMAgent()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->domAgent();
+}
+
+InspectorFrontend* InspectorBackend::inspectorFrontend()
+{
+    if (!m_inspectorController)
+        return 0;
+    return m_inspectorController->m_frontend.get();
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index daa16b4..d7eea8c 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -38,10 +38,12 @@
 namespace WebCore {
 
 class CachedResource;
+class Database;
 class InspectorClient;
 class InspectorDOMAgent;
 class JavaScriptCallFrame;
 class Node;
+class Storage;
 
 class InspectorBackend : public RefCounted<InspectorBackend>
 {
@@ -69,7 +71,7 @@ public:
     void addResourceSourceToFrame(long identifier, Node* frame);
     bool addSourceToFrame(const String& mimeType, const String& source, Node* frame);
 
-    void clearMessages();
+    void clearMessages(bool clearUI);
 
     void toggleNodeSearch();
 
@@ -82,7 +84,7 @@ public:
 
     bool searchingForNode();
 
-    void loaded(bool enableDOMAgent);
+    void loaded();
 
     void enableResourceTracking(bool always);
     void disableResourceTracking(bool always);
@@ -93,6 +95,10 @@ public:
 
     const String& platform() const;
 
+    void enableTimeline(bool always);
+    void disableTimeline(bool always);
+    bool timelineEnabled() const;
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     const ProfilesArray& profiles() const;
 
@@ -109,7 +115,8 @@ public:
 
     JavaScriptCallFrame* currentCallFrame() const;
 
-    void addBreakpoint(const String& sourceID, unsigned lineNumber);
+    void addBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
+    void updateBreakpoint(const String& sourceID, unsigned lineNumber, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
     bool pauseOnExceptions();
@@ -123,16 +130,43 @@ public:
     void stepOutOfFunctionInDebugger();
 #endif
 
-    void getChildNodes(long callId, long elementId);
+    void dispatchOnInjectedScript(long callId, const String& methodName, const String& arguments, bool async);
+    void getChildNodes(long callId, long nodeId);
     void setAttribute(long callId, long elementId, const String& name, const String& value);
     void removeAttribute(long callId, long elementId, const String& name);
-    void setTextNodeValue(long callId, long elementId, const String& value);
+    void setTextNodeValue(long callId, long nodeId, const String& value);
+    void getEventListenersForNode(long callId, long nodeId);
+    void copyNode(long nodeId);
+
+    void getCookies(long callId, const String& domain);
+    void deleteCookie(const String& cookieName, const String& domain);
 
     // Generic code called from custom implementations.
-    void highlight(Node* node);
+    void highlight(long nodeId);
+    Node* nodeForId(long nodeId);
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
+    long pushNodePathToFrontend(Node* node, bool selectInUI);
+    void addNodesToSearchResult(const String& nodeIds);
+#if ENABLE(DATABASE)
+    Database* databaseForId(long databaseId);
+    void selectDatabase(Database* database);
+    void getDatabaseTableNames(long callId, long databaseId);
+#endif
+#if ENABLE(DOM_STORAGE)
+    void selectDOMStorage(Storage* storage);
+    void getDOMStorageEntries(long callId, long storageId);
+    void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
+    void removeDOMStorageItem(long callId, long storageId, const String& key);
+#endif
+    void reportDidDispatchOnInjectedScript(long callId, const String& result, bool isException);
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
 private:
     InspectorBackend(InspectorController* inspectorController, InspectorClient* client);
+    InspectorDOMAgent* inspectorDOMAgent();
+    InspectorFrontend* inspectorFrontend();
 
     InspectorController* m_inspectorController;
     InspectorClient* m_client;
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index bae1f26..8803765 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -35,14 +35,14 @@ module core {
         GenerateConstructor
     ] InspectorBackend {
         void hideDOMNodeHighlight();
-        [Custom] void highlightDOMNode(in Node node);
-        void loaded(in boolean enableDOMAgent);
+        [Custom] void highlightDOMNode(in long nodeId);
+        void loaded();
         void windowUnloading();
         void attach();
         void detach();
 
         void closeWindow();
-        void clearMessages();
+        void clearMessages(in boolean clearUI);
         void toggleNodeSearch();
 
         boolean isWindowVisible();
@@ -52,14 +52,18 @@ module core {
         boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
         [Custom] void search(in Node node, in DOMString query);
 #if defined(ENABLE_DATABASE) && ENABLE_DATABASE
-        [Custom] DOMObject databaseTableNames(in Database database);
+        void getDatabaseTableNames(in long callId, in long databaseId);
 #endif
+
         [Custom] DOMObject setting(in DOMString key);
         [Custom] void setSetting(in DOMString key, in DOMObject  value);
         [Custom] DOMWindow inspectedWindow();
         DOMString localizedStringsURL();
         DOMString hiddenPanels();
         DOMString platform();
+        void enableTimeline(in boolean always);
+        void disableTimeline(in boolean always);
+        boolean timelineEnabled();
         [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
         void setAttachedWindowHeight(in unsigned long height);
         [Custom] DOMObject wrapCallback(in DOMObject callback);
@@ -73,7 +77,8 @@ module core {
         void enableDebugger(in boolean always);
         void disableDebugger(in boolean always);
 
-        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
+        void updateBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in DOMString condition);
         void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
 
         void pauseInDebugger();
@@ -97,9 +102,36 @@ module core {
 
         [Custom] Array profiles();
 #endif
-        void getChildNodes(in long callId, in long elementId);
+        void dispatchOnInjectedScript(in long callId, in DOMString methodName, in DOMString arguments, in boolean async);
+        void getChildNodes(in long callId, in long nodeId);
         void setAttribute(in long callId, in long elementId, in DOMString name, in DOMString value);
         void removeAttribute(in long callId, in long elementId, in DOMString name);
-        void setTextNodeValue(in long callId, in long elementId, in DOMString value);
+        void setTextNodeValue(in long callId, in long nodeId, in DOMString value);
+        void getEventListenersForNode(in long callId, in long nodeId);
+        void copyNode(in long nodeId);
+
+        void getCookies(in long callId, in DOMString domain);
+        void deleteCookie(in DOMString cookieName, in DOMString domain);
+
+        // Called from InjectedScript.
+        // TODO: extract into a separate IDL.
+        [Custom] DOMObject nodeForId(in long nodeId);
+        [Custom] long wrapObject(in DOMObject object, in DOMString objectGroup);
+        [Custom] DOMObject unwrapObject(in long objectId);
+        void releaseWrapperObjectGroup(in DOMString objectGroup);
+        [Custom] int pushNodePathToFrontend(in DOMObject node, in boolean selectInUI);
+        void addNodesToSearchResult(in DOMString nodeIds);
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] void selectDatabase(in DOMObject database);
+        [Custom] DOMObject databaseForId(in long databaseId);
+#endif
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        [Custom] void selectDOMStorage(in DOMObject storage);
+        void getDOMStorageEntries(in long callId, in long storageId);
+        void setDOMStorageItem(in long callId, in long storageId, in DOMString key, in DOMString value);
+        void removeDOMStorageItem(in long callId, in long storageId, in DOMString key);
+#endif
+        void reportDidDispatchOnInjectedScript(in long callId, in DOMString result, in boolean isException);
+        void didEvaluateForTestInFrontend(in long callId, in DOMString jsonResult);
     };
- }
+}
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index c3351e5..0922d7d 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -30,12 +30,17 @@
 #include "config.h"
 #include "InspectorController.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CString.h"
 #include "CachedResource.h"
 #include "Console.h"
 #include "ConsoleMessage.h"
+#include "Cookie.h"
+#include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "DOMWindow.h"
 #include "Element.h"
 #include "FloatConversion.h"
 #include "FloatQuad.h"
@@ -53,6 +58,7 @@
 #include "InspectorDatabaseResource.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorDOMStorageResource.h"
+#include "InspectorTimelineAgent.h"
 #include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
@@ -61,7 +67,9 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptCallStack.h"
+#include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
 #include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
@@ -69,6 +77,7 @@
 #include "TextEncoding.h"
 #include "TextIterator.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
@@ -103,6 +112,7 @@ static const char* const debuggerEnabledSettingName = "debuggerEnabled";
 static const char* const profilerEnabledSettingName = "profilerEnabled";
 static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const char* const lastActivePanelSettingName = "lastActivePanel";
+static const char* const timelineEnabledSettingName = "timelineEnabled";
 
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
@@ -125,6 +135,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_resourceTrackingEnabled(false)
     , m_resourceTrackingSettingsLoaded(false)
     , m_inspectorBackend(InspectorBackend::create(this, client))
+    , m_lastBoundObjectId(1)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
@@ -170,11 +181,6 @@ void InspectorController::inspectedPageDestroyed()
     if (m_scriptState)
         ScriptGlobalObject::remove(m_scriptState, "InspectorController");
 
-    if (m_page) {
-        m_page->setParentInspectorController(0);
-        m_page = 0;
-    }
-
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
 
@@ -258,8 +264,7 @@ void InspectorController::inspect(Node* node)
         return;
     }
 
-    if (windowVisible())
-        focusNode();
+    focusNode();
 }
 
 void InspectorController::focusNode()
@@ -270,7 +275,8 @@ void InspectorController::focusNode()
     ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    m_frontend->updateFocusedNode(m_nodeToFocus.get());
+    long id = m_domAgent->pushNodePathToFrontend(m_nodeToFocus.get());
+    m_frontend->updateFocusedNode(id);
     m_nodeToFocus = 0;
 }
 
@@ -298,14 +304,11 @@ bool InspectorController::windowVisible()
 
 void InspectorController::setWindowVisible(bool visible, bool attached)
 {
-    if (visible == m_windowVisible)
+    if (visible == m_windowVisible || !m_frontend)
         return;
 
     m_windowVisible = visible;
 
-    if (!m_frontend)
-        return;
-
     if (m_windowVisible) {
         setAttachedWindow(attached);
         populateScriptObjects();
@@ -374,16 +377,21 @@ void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMes
         m_consoleMessages.append(consoleMessage);
     }
 
-    if (windowVisible())
+    if (m_frontend)
         m_previousMessage->addToConsole(m_frontend.get());
 }
 
-void InspectorController::clearConsoleMessages()
+void InspectorController::clearConsoleMessages(bool clearUI)
 {
     deleteAllValues(m_consoleMessages);
     m_consoleMessages.clear();
     m_previousMessage = 0;
     m_groupLevel = 0;
+    releaseWrapperObjectGroup("console");
+    if (m_domAgent)
+        m_domAgent->releaseDanglingNodes();
+    if (clearUI && m_frontend)
+        m_frontend->clearConsoleMessages();
 }
 
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
@@ -494,10 +502,9 @@ void InspectorController::handleMousePressOnNode(Node* node)
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!enabled() || !m_frontend)
+    if (!enabled() || !m_frontend || frame != m_inspectedPage->mainFrame())
         return;
-
-    m_frontend->inspectedWindowScriptObjectCleared(frame);
+    resetInjectedScript();
 }
 
 void InspectorController::windowScriptObjectAvailable()
@@ -511,7 +518,7 @@ void InspectorController::windowScriptObjectAvailable()
     ScriptGlobalObject::set(m_scriptState, "InspectorController", m_inspectorBackend.get());
 }
 
-void InspectorController::scriptObjectReady(bool enableDOMAgent)
+void InspectorController::scriptObjectReady()
 {
     ASSERT(m_scriptState);
     if (!m_scriptState)
@@ -520,9 +527,10 @@ void InspectorController::scriptObjectReady(bool enableDOMAgent)
     ScriptObject webInspectorObj;
     if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
-    setFrontendProxyObject(m_scriptState, webInspectorObj);
-    if (enableDOMAgent)
-        m_domAgent = new InspectorDOMAgent(m_frontend.get());
+    ScriptObject injectedScriptObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "InjectedScript", injectedScriptObj))
+        return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj, injectedScriptObj);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     Setting debuggerEnabled = setting(debuggerEnabledSettingName);
@@ -539,9 +547,16 @@ void InspectorController::scriptObjectReady(bool enableDOMAgent)
     m_client->inspectorWindowObjectCleared();
 }
 
-void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj, ScriptObject injectedScriptObj)
 {
-    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+    m_scriptState = scriptState;
+    m_injectedScriptObj = injectedScriptObj;
+    m_frontend.set(new InspectorFrontend(this, scriptState, webInspectorObj));
+    m_domAgent = new InspectorDOMAgent(m_frontend.get());
+
+    Setting timelineEnabled = setting(timelineEnabledSettingName);
+    if (m_timelineAgent.get() || (timelineEnabled.type() == Setting::BooleanType && timelineEnabled.booleanValue()))
+        m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
 }
 
 void InspectorController::show()
@@ -595,11 +610,17 @@ void InspectorController::close()
     closeWindow();
 
     m_frontend.set(0);
-    if (m_domAgent) {
+    m_injectedScriptObj = ScriptObject();
+    // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
+    // no references to the DOM agent from the DOM tree.
+    if (m_domAgent)
         m_domAgent->setDocument(0);
-        m_domAgent = 0;
-    }
+    m_domAgent = 0;
+    m_timelineAgent = 0;
     m_scriptState = 0;
+    if (m_page)
+        m_page->setParentInspectorController(0);
+    m_page = 0;
 }
 
 void InspectorController::showWindow()
@@ -630,28 +651,35 @@ void InspectorController::populateScriptObjects()
     if (!m_frontend)
         return;
 
+    m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
         it->second->createScriptObject(m_frontend.get());
-
+        m_frontend->addCookieDomain(it->second->frame()->document()->url().host());
+    }
+        
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
         m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->bind(m_frontend.get());
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->bind(m_frontend.get());
 #endif
 
-    if (m_domAgent)
-        m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
     m_frontend->populateInterface();
+
+    // Dispatch pending frontend commands
+    for (Vector<pair<long, String> >::iterator it = m_pendingEvaluateTestCommands.begin(); it != m_pendingEvaluateTestCommands.end(); ++it)
+        m_frontend->evaluateForTestInFrontend((*it).first, (*it).second);
+    m_pendingEvaluateTestCommands.clear();
 }
 
 void InspectorController::resetScriptObjects()
@@ -664,17 +692,23 @@ void InspectorController::resetScriptObjects()
         it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        (*it)->unbind();
+    DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        it->second->unbind();
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        (*it)->unbind();
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        it->second->unbind();
 #endif
 
+    if (m_timelineAgent)
+        m_timelineAgent->reset();
+
     m_frontend->reset();
+    m_domAgent->setDocument(0);
+    m_objectGroups.clear();
+    m_idToWrappedObject.clear();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -690,7 +724,7 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
 
         if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible())
+            if (m_frontend)
                 resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
@@ -706,7 +740,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
     if (loader->frame() == m_inspectedPage->mainFrame()) {
         m_client->inspectedURLChanged(loader->url().string());
 
-        clearConsoleMessages();
+        clearConsoleMessages(false);
 
         m_times.clear();
         m_counts.clear();
@@ -715,6 +749,9 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_currentUserInitiatedProfileNumber = 1;
         m_nextUserInitiatedProfileNumber = 1;
 #endif
+        // resetScriptObjects should be called before database and DOM storage
+        // resources are cleared so that it has a chance to unbind them.
+        resetScriptObjects();
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
@@ -722,10 +759,8 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_domStorageResources.clear();
 #endif
 
-        if (windowVisible()) {
-            resetScriptObjects();
-
-            if (!loader->isLoadingFromCachedPage()) {
+        if (m_frontend) {
+            if (!loader->frameLoader()->isLoadingFromCachedPage()) {
                 ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
@@ -738,10 +773,11 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
                 // identifierForInitialRequest.
                 m_mainResource = 0;
             }
+            if (windowVisible()) {
+                m_frontend->didCommitLoad();
+                m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
+            }
         }
-
-        if (m_domAgent)
-            m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
     }
 
     for (Frame* frame = loader->frame(); frame; frame = frame->tree()->traverseNext(loader->frame()))
@@ -819,7 +855,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
         return;
 
     ASSERT(m_inspectedPage);
-    bool isMainResource = isMainResourceLoader(loader, KURL(cachedResource->url()));
+    bool isMainResource = isMainResourceLoader(loader, KURL(ParsedURLString, cachedResource->url()));
     ensureResourceTrackingSettingsLoaded();
     if (!isMainResource && !m_resourceTrackingEnabled)
         return;
@@ -833,7 +869,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -859,10 +895,28 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
 
     addResource(resource.get());
 
-    if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
+    if (m_frontend && loader->frameLoader()->isLoadingFromCachedPage() && resource == m_mainResource)
         resource->createScriptObject(m_frontend.get());
 }
 
+void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource)
+        m_mainResource->markDOMContentEventTime();
+}
+
+void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
+{
+    if (!enabled() || !isMainResourceLoader(loader, url))
+        return;
+
+    if (m_mainResource)
+        m_mainResource->markLoadEventTime();
+}
+
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
 {
     return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
@@ -881,7 +935,7 @@ void InspectorController::willSendRequest(DocumentLoader*, unsigned long identif
         resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible())
+    if (resource != m_mainResource && m_frontend)
         resource->createScriptObject(m_frontend.get());
 }
 
@@ -894,7 +948,7 @@ void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long iden
     resource->updateResponse(response);
     resource->markResponseReceivedTime();
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -906,7 +960,7 @@ void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long
 
     resource->addLength(lengthReceived);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -922,8 +976,10 @@ void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend) {
         resource->updateScriptObject(m_frontend.get());
+        m_frontend->addCookieDomain(resource->frame()->document()->url().host());
+    }
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
@@ -939,7 +995,7 @@ void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifi
 
     addResource(resource.get());
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -954,7 +1010,7 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
     resource->setXMLHttpResponseText(sourceString);
 
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -971,7 +1027,7 @@ void InspectorController::scriptImported(unsigned long identifier, const String&
     // thing by the Inspector. They should be made into distinct types.
     resource->setXMLHttpResponseText(ScriptString(sourceString));
     
-    if (windowVisible())
+    if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
 }
 
@@ -1019,7 +1075,68 @@ void InspectorController::ensureResourceTrackingSettingsLoaded()
         m_resourceTrackingEnabled = true;
 }
 
+void InspectorController::enableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(true));
+
+    if (m_timelineAgent.get())
+        return;
+
+    m_timelineAgent = new InspectorTimelineAgent(m_frontend.get());
+    if (m_frontend)
+        m_frontend->timelineWasEnabled();
+}
+
+void InspectorController::disableTimeline(bool always)
+{
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(timelineEnabledSettingName, Setting(false));
+
+    if (!m_timelineAgent.get())
+        return;
+
+    m_timelineAgent.set(0);
+    if (m_frontend)
+        m_frontend->timelineWasDisabled();
+}
+
+bool InspectorController::timelineEnabled() const
+{
+    if (!enabled())
+        return false;
+
+    return m_timelineAgent.get();
+}
+
 #if ENABLE(DATABASE)
+void InspectorController::selectDatabase(Database* database)
+{
+    if (!m_frontend)
+        return;
+
+    for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != m_databaseResources.end(); ++it) {
+        if (it->second->database() == database) {
+            m_frontend->selectDatabase(it->first);
+            break;
+        }
+    }
+}
+
+Database* InspectorController::databaseForId(int databaseId)
+{
+    DatabaseResourcesMap::iterator it = m_databaseResources.find(databaseId);
+    if (it == m_databaseResources.end())
+        return 0;
+    return it->second->database();
+}
+
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
 {
     if (!enabled())
@@ -1027,31 +1144,182 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
 
     RefPtr<InspectorDatabaseResource> resource = InspectorDatabaseResource::create(database, domain, name, version);
 
-    m_databaseResources.add(resource);
+    m_databaseResources.set(resource->id(), resource);
 
-    if (windowVisible())
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
 #endif
 
+void InspectorController::getCookies(long callId, const String& host)
+{
+    if (!m_frontend)
+        return;
+    
+    // If we can get raw cookies.
+    ListHashSet<Cookie> rawCookiesList;
+    
+    // If we can't get raw cookies - fall back to String representation
+    String stringCookiesList;
+    
+    // Return value to getRawCookies should be the same for every call because
+    // the return value is platform/network backend specific, and the call will
+    // always return the same true/false value.
+    bool rawCookiesImplemented = false;
+    
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == host) {
+            Vector<Cookie> docCookiesList;
+            rawCookiesImplemented = getRawCookies(document, document->cookieURL(), docCookiesList);
+            
+            if (!rawCookiesImplemented)
+                // FIXME: We need duplication checking for the String representation of cookies.
+                stringCookiesList += document->cookie();
+            else {
+                int cookiesSize = docCookiesList.size();
+                for (int i = 0; i < cookiesSize; i++) {
+                    if (!rawCookiesList.contains(docCookiesList[i]))
+                        rawCookiesList.add(docCookiesList[i]);
+                }
+            }
+        }
+    }
+    
+    if (!rawCookiesImplemented)
+        m_frontend->didGetCookies(callId, m_frontend->newScriptArray(), stringCookiesList);
+    else
+        m_frontend->didGetCookies(callId, buildArrayForCookies(rawCookiesList), String());
+}
+    
+ScriptArray InspectorController::buildArrayForCookies(ListHashSet<Cookie>& cookiesList)
+{
+    ScriptArray cookies = m_frontend->newScriptArray();
+
+    ListHashSet<Cookie>::iterator end = cookiesList.end();
+    ListHashSet<Cookie>::iterator it = cookiesList.begin();
+    for (int i = 0; it != end; ++it, i++)
+        cookies.set(i, buildObjectForCookie(*it));
+
+    return cookies;
+}
+
+ScriptObject InspectorController::buildObjectForCookie(const Cookie& cookie)
+{
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("name", cookie.name);
+    value.set("value", cookie.value);
+    value.set("domain", cookie.domain);
+    value.set("path", cookie.path);
+    value.set("expires", cookie.expires);
+    value.set("size", (cookie.name.length() + cookie.value.length()));
+    value.set("httpOnly", cookie.httpOnly);
+    value.set("secure", cookie.secure);
+    value.set("session", cookie.session);
+    return value;
+}
+    
 #if ENABLE(DOM_STORAGE)
 void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
 {
     if (!enabled())
         return;
 
-    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
-    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
-        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if (it->second->isSameHostAndType(frame, isLocalStorage))
             return;
 
     RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
     RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
 
-    m_domStorageResources.add(resource);
-    if (windowVisible())
+    m_domStorageResources.set(resource->id(), resource);
+
+    // Resources are only bound while visible.
+    if (m_frontend && windowVisible())
         resource->bind(m_frontend.get());
 }
+
+void InspectorController::selectDOMStorage(Storage* storage)
+{
+    ASSERT(storage);
+    if (!m_frontend)
+        return;
+
+    Frame* frame = storage->frame();
+    bool isLocalStorage = (frame->domWindow()->localStorage() == storage);
+    int storageResourceId = 0;
+    DOMStorageResourcesMap::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesMap::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it) {
+        if (it->second->isSameHostAndType(frame, isLocalStorage)) {
+            storageResourceId = it->first;
+            break;
+        }
+    }
+    if (storageResourceId)
+        m_frontend->selectDOMStorage(storageResourceId);
+}
+
+void InspectorController::getDOMStorageEntries(int callId, int storageId)
+{
+    if (!m_frontend)
+        return;
+
+    ScriptArray jsonArray = m_frontend->newScriptArray();
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        storageResource->startReportingChangesToFrontend();
+        Storage* domStorage = storageResource->domStorage();
+        for (unsigned i = 0; i < domStorage->length(); ++i) {
+            String name(domStorage->key(i));
+            String value(domStorage->getItem(name));
+            ScriptArray entry = m_frontend->newScriptArray();
+            entry.set(0, name);
+            entry.set(1, value);
+            jsonArray.set(i, entry);
+        }
+    }
+    m_frontend->didGetDOMStorageEntries(callId, jsonArray);
+}
+
+void InspectorController::setDOMStorageItem(long callId, long storageId, const String& key, const String& value)
+{
+    if (!m_frontend)
+        return;
+
+    bool success = false;
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        ExceptionCode exception = 0;
+        storageResource->domStorage()->setItem(key, value, exception);
+        success = (exception == 0);
+    }
+    m_frontend->didSetDOMStorageItem(callId, success);
+}
+
+void InspectorController::removeDOMStorageItem(long callId, long storageId, const String& key)
+{
+    if (!m_frontend)
+        return;
+
+    bool success = false;
+    InspectorDOMStorageResource* storageResource = getDOMStorageResourceForId(storageId);
+    if (storageResource) {
+        storageResource->domStorage()->removeItem(key);
+        success = true;
+    }
+    m_frontend->didRemoveDOMStorageItem(callId, success);
+}
+
+InspectorDOMStorageResource* InspectorController::getDOMStorageResourceForId(int storageId)
+{
+    DOMStorageResourcesMap::iterator it = m_domStorageResources.find(storageId);
+    if (it == m_domStorageResources.end())
+        return 0;
+    return it->second.get();
+}
 #endif
 
 void InspectorController::moveWindowBy(float x, float y) const
@@ -1073,8 +1341,10 @@ void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned li
     RefPtr<Profile> profile = prpProfile;
     m_profiles.append(profile);
 
-    if (windowVisible())
-        addScriptProfile(profile.get());
+    if (m_frontend) {
+        JSLock lock(SilenceAssertionsOnly);
+        m_frontend->addProfile(toJS(m_scriptState, profile.get()));
+    }
 
     addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
 }
@@ -1099,15 +1369,6 @@ void InspectorController::addStartProfilingMessageToConsole(const UString& title
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    if (!m_frontend)
-        return;
-
-    JSLock lock(SilenceAssertionsOnly);
-    m_frontend->addProfile(toJS(m_scriptState, profile));
-}
-
 UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
 {
     if (incrementProfileNumber)
@@ -1274,7 +1535,9 @@ void InspectorController::failedToParseSource(ExecState*, const SourceCode& sour
 
 void InspectorController::didPause()
 {
-    m_frontend->pausedScript();
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "getCallFrames");
+    ScriptValue callFrames = function.call();
+    m_frontend->pausedScript(callFrames);
 }
 
 void InspectorController::didContinue()
@@ -1284,6 +1547,25 @@ void InspectorController::didContinue()
 
 #endif
 
+void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
+{
+    if (m_frontend && windowVisible())
+        m_frontend->evaluateForTestInFrontend(callId, script);
+    else
+        m_pendingEvaluateTestCommands.append(pair<long, String>(callId, script));
+}
+
+void InspectorController::didEvaluateForTestInFrontend(long callId, const String& jsonResult)
+{
+    ScriptState* scriptState = scriptStateFromPage(m_inspectedPage);
+    ScriptObject window;
+    ScriptGlobalObject::get(scriptState, "window", window);
+    ScriptFunctionCall function(scriptState, window, "didEvaluateForTestInFrontend");
+    function.appendArgument(static_cast<int>(callId));
+    function.appendArgument(jsonResult);
+    function.call();
+}
+
 static Path quadToPath(const FloatQuad& quad)
 {
     Path quadPath;
@@ -1472,10 +1754,66 @@ InspectorController::SpecialPanels InspectorController::specialPanelForJSName(co
         return ScriptsPanel;
     else if (panelName == "profiles")
         return ProfilesPanel;
-    else if (panelName == "databases")
-        return DatabasesPanel;
+    else if (panelName == "storage" || panelName == "databases")
+        return StoragePanel;
     else
         return ElementsPanel;
 }
 
+ScriptValue InspectorController::wrapObject(const ScriptValue& quarantinedObject, const String& objectGroup)
+{
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "createProxyObject");
+    function.appendArgument(quarantinedObject);
+    if (quarantinedObject.isObject()) {
+        long id = m_lastBoundObjectId++;
+        String objectId = String::format("object#%ld", id);
+        m_idToWrappedObject.set(objectId, quarantinedObject);
+        ObjectGroupsMap::iterator it = m_objectGroups.find(objectGroup);
+        if (it == m_objectGroups.end())
+            it = m_objectGroups.set(objectGroup, Vector<String>()).first;
+        it->second.append(objectId);
+        function.appendArgument(objectId);
+    }
+    ScriptValue wrapper = function.call();
+    return wrapper;
+}
+
+ScriptValue InspectorController::unwrapObject(const String& objectId)
+{
+    HashMap<String, ScriptValue>::iterator it = m_idToWrappedObject.find(objectId);
+    if (it != m_idToWrappedObject.end())
+        return it->second;
+    return ScriptValue();
+}
+
+void InspectorController::releaseWrapperObjectGroup(const String& objectGroup)
+{
+    ObjectGroupsMap::iterator groupIt = m_objectGroups.find(objectGroup);
+    if (groupIt == m_objectGroups.end())
+        return;
+
+    Vector<String>& groupIds = groupIt->second;
+    for (Vector<String>::iterator it = groupIds.begin(); it != groupIds.end(); ++it)
+        m_idToWrappedObject.remove(*it);
+    m_objectGroups.remove(groupIt);
+}
+
+void InspectorController::resetInjectedScript()
+{
+    ScriptFunctionCall function(m_scriptState, m_injectedScriptObj, "reset");
+    function.call();
+}
+
+void InspectorController::deleteCookie(const String& cookieName, const String& domain)
+{
+    ResourcesMap::iterator resourcesEnd = m_resources.end();
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
+        Document* document = it->second->frame()->document();
+        if (document->url().host() == domain)
+            WebCore::deleteCookie(document, document->cookieURL(), cookieName);
+    }
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index 632b0ce..6c6fcfb 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -30,13 +30,18 @@
 #define InspectorController_h
 
 #include "Console.h"
+#include "Cookie.h"
 #include "PlatformString.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
 #include "ScriptState.h"
+#include "ScriptValue.h"
 #include "StringHash.h"
 #include "Timer.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
@@ -59,8 +64,12 @@ class GraphicsContext;
 class HitTestResult;
 class InspectorClient;
 class InspectorDOMAgent;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
+=======
+class InspectorFrontend;
+class InspectorTimelineAgent;
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
 class JavaScriptCallFrame;
-class StorageArea;
 class KURL;
 class Node;
 class Page;
@@ -68,9 +77,10 @@ struct ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
-class ScriptObject;
 class ScriptString;
 class SharedBuffer;
+class Storage;
+class StorageArea;
 
 class ConsoleMessage;
 class InspectorDatabaseResource;
@@ -90,17 +100,18 @@ class InspectorController
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
-    typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
-    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
+    typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
+    typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
+    typedef HashMap<String, Vector<String> > ObjectGroupsMap;
 
     typedef enum {
         CurrentPanel,
         ConsolePanel,
-        DatabasesPanel,
         ElementsPanel,
         ProfilesPanel,
         ResourcesPanel,
-        ScriptsPanel
+        ScriptsPanel,
+        StoragePanel
     } SpecialPanels;
 
     struct Setting {
@@ -187,7 +198,7 @@ public:
 
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
-    void clearConsoleMessages();
+    void clearConsoleMessages(bool clearUI);
     const Vector<ConsoleMessage*>& consoleMessages() const { return m_consoleMessages; }
 
     void attachWindow();
@@ -201,7 +212,8 @@ public:
     void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
-    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
+    void setFrontendProxyObject(ScriptState* state, ScriptObject webInspectorObj, ScriptObject injectedScriptObj = ScriptObject());
+    ScriptState* frontendScriptState() const { return m_scriptState; }
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -225,11 +237,25 @@ public:
     bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
     void ensureResourceTrackingSettingsLoaded();
 
+    void enableTimeline(bool always = false);
+    void disableTimeline(bool always = false);
+    bool timelineEnabled() const;
+    InspectorTimelineAgent* timelineAgent() { return m_timelineAgent.get(); }
+
+    void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
+    void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
+                                                        
+    void getCookies(long callId, const String& url);
+
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
 #if ENABLE(DOM_STORAGE)
     void didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame);
+    void selectDOMStorage(Storage* storage);
+    void getDOMStorageEntries(int callId, int storageId);
+    void setDOMStorageItem(long callId, long storageId, const String& key, const String& value);
+    void removeDOMStorageItem(long callId, long storageId, const String& key);
 #endif
 
     const ResourcesMap& resources() const { return m_resources; }
@@ -248,7 +274,6 @@ public:
     void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
     void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile*);
     const ProfilesArray& profiles() const { return m_profiles; }
 
     bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
@@ -273,13 +298,18 @@ public:
     virtual void didContinue();
 #endif
 
+    void evaluateForTestInFrontend(long callId, const String& script);
+
 private:
 #if !PLATFORM(ANDROID)
     friend class InspectorBackend;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
 #endif
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
     // Following are used from InspectorBackend and internally.
-    void scriptObjectReady(bool enableDOMAgent);
+    void scriptObjectReady();
     void moveWindowBy(float x, float y) const;
     void setAttachedWindow(bool);
     void setAttachedWindowHeight(unsigned height);
@@ -287,11 +317,33 @@ private:
     void closeWindow();
     InspectorDOMAgent* domAgent() { return m_domAgent.get(); }
 
+    friend class InspectorFrontend;
+    // Following are used from InspectorFrontend only. We don't want to expose them to the
+    // rest of the InspectorController clients.
+    // TODO: extract these into a separate interface.
+    ScriptValue wrapObject(const ScriptValue& object, const String& objectGroup);
+    ScriptValue unwrapObject(const String& objectId);
+    void releaseWrapperObjectGroup(const String& objectGroup);
+    
+    void resetInjectedScript();
+
+    void deleteCookie(const String& cookieName, const String& domain);
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     void startUserInitiatedProfilingSoon();
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
 #endif
+#if ENABLE(DATABASE)
+    void selectDatabase(Database* database);
+    Database* databaseForId(int databaseId);
+#endif
+#if ENABLE(DOM_STORAGE)
+    InspectorDOMStorageResource* getDOMStorageResourceForId(int storageId);
+#endif
+                                                        
+    ScriptObject buildObjectForCookie(const Cookie&);
+    ScriptArray buildArrayForCookies(ListHashSet<Cookie>&);
 
     void focusNode();
 
@@ -310,10 +362,14 @@ private:
 
     SpecialPanels specialPanelForJSName(const String& panelName);
 
+    void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
+
     Page* m_inspectedPage;
     InspectorClient* m_client;
 
     RefPtr<InspectorDOMAgent> m_domAgent;
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
+    ScriptObject m_injectedScriptObj;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -324,10 +380,10 @@ private:
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
-    DatabaseResourcesSet m_databaseResources;
+    DatabaseResourcesMap m_databaseResources;
 #endif
 #if ENABLE(DOM_STORAGE)
-    DOMStorageResourcesSet m_domStorageResources;
+    DOMStorageResourcesMap m_domStorageResources;
 #endif
     ScriptState* m_scriptState;
     bool m_windowVisible;
@@ -342,7 +398,15 @@ private:
 #if !PLATFORM(ANDROID)
     OwnPtr<InspectorFrontend> m_frontend;
     RefPtr<InspectorBackend> m_inspectorBackend;
+<<<<<<< HEAD:WebCore/inspector/InspectorController.h
 #endif
+=======
+    HashMap<String, ScriptValue> m_idToWrappedObject;
+    ObjectGroupsMap m_objectGroups;
+
+    long m_lastBoundObjectId;
+    Vector<pair<long, String> > m_pendingEvaluateTestCommands;
+>>>>>>> webkit.org at 49305:WebCore/inspector/InspectorController.h
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     bool m_debuggerEnabled;
     bool m_attachDebuggerWhenShown;
diff --git a/WebCore/inspector/InspectorDOMAgent.cpp b/WebCore/inspector/InspectorDOMAgent.cpp
index f222239..f6c2d46 100644
--- a/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/WebCore/inspector/InspectorDOMAgent.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,7 +31,12 @@
 #include "config.h"
 #include "InspectorDOMAgent.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "AtomicString.h"
+#include "ContainerNode.h"
+#include "Cookie.h"
+#include "CookieJar.h"
 #include "DOMWindow.h"
 #include "Document.h"
 #include "Event.h"
@@ -44,6 +50,7 @@
 #include "Node.h"
 #include "NodeList.h"
 #include "PlatformString.h"
+#include "ScriptEventListener.h"
 #include "ScriptObject.h"
 #include "Text.h"
 
@@ -53,7 +60,8 @@
 namespace WebCore {
 
 InspectorDOMAgent::InspectorDOMAgent(InspectorFrontend* frontend)
-    : m_frontend(frontend)
+    : EventListener(InspectorDOMAgentType)
+    , m_frontend(frontend)
     , m_lastNodeId(1)
 {
 }
@@ -67,6 +75,7 @@ void InspectorDOMAgent::setDocument(Document* doc)
 {
     if (doc == mainFrameDocument())
         return;
+    discardBindings();
 
     ListHashSet<RefPtr<Document> > copy = m_documents;
     for (ListHashSet<RefPtr<Document> >::iterator it = copy.begin(); it != copy.end(); ++it)
@@ -77,13 +86,17 @@ void InspectorDOMAgent::setDocument(Document* doc)
     if (doc) {
         startListening(doc);
         if (doc->documentElement()) {
-            pushDocumentElementToFrontend();
+            pushDocumentToFrontend();
         }
-    } else {
-        discardBindings();
     }
 }
 
+void InspectorDOMAgent::releaseDanglingNodes()
+{
+    deleteAllValues(m_danglingNodeToIdMaps);
+    m_danglingNodeToIdMaps.clear();
+}
+
 void InspectorDOMAgent::startListening(Document* doc)
 {
     if (m_documents.contains(doc))
@@ -92,8 +105,8 @@ void InspectorDOMAgent::startListening(Document* doc)
     doc->addEventListener(eventNames().DOMContentLoadedEvent, this, false);
     doc->addEventListener(eventNames().DOMNodeInsertedEvent, this, false);
     doc->addEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->addEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, true);
     doc->addEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->addEventListener(eventNames().loadEvent, this, true);
     m_documents.add(doc);
 }
 
@@ -105,24 +118,18 @@ void InspectorDOMAgent::stopListening(Document* doc)
     doc->removeEventListener(eventNames().DOMContentLoadedEvent, this, false);
     doc->removeEventListener(eventNames().DOMNodeInsertedEvent, this, false);
     doc->removeEventListener(eventNames().DOMNodeRemovedEvent, this, false);
-    doc->removeEventListener(eventNames().DOMNodeRemovedFromDocumentEvent, this, true);
     doc->removeEventListener(eventNames().DOMAttrModifiedEvent, this, false);
+    doc->removeEventListener(eventNames().loadEvent, this, true);
     m_documents.remove(doc);
 }
 
-void InspectorDOMAgent::handleEvent(Event* event, bool)
+void InspectorDOMAgent::handleEvent(ScriptExecutionContext*, Event* event)
 {
     AtomicString type = event->type();
     Node* node = event->target()->toNode();
 
-    // Remove mapping entry if necessary.
-    if (type == eventNames().DOMNodeRemovedFromDocumentEvent) {
-        unbind(node);
-        return;
-    }
-
     if (type == eventNames().DOMAttrModifiedEvent) {
-        long id = idForNode(node);
+        long id = m_documentNodeToIdMap.get(node);
         // If node is not mapped yet -> ignore the event.
         if (!id)
             return;
@@ -133,20 +140,23 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
         if (isWhitespace(node))
             return;
 
+        // We could be attaching existing subtree. Forget the bindings.
+        unbind(node, &m_documentNodeToIdMap);
+
         Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = idForNode(parent);
+        long parentId = m_documentNodeToIdMap.get(parent);
         // Return if parent is not mapped yet.
         if (!parentId)
             return;
 
         if (!m_childrenRequested.contains(parentId)) {
             // No children are mapped yet -> only notify on changes of hasChildren.
-            m_frontend->hasChildrenUpdated(parentId, true);
+            m_frontend->childNodeCountUpdated(parentId, innerChildNodeCount(parent));
         } else {
             // Children have been requested -> return value of a new child.
-            long prevId = idForNode(innerPreviousSibling(node));
-
-            ScriptObject value = buildObjectForNode(node, 0);
+            Node* prevSibling = innerPreviousSibling(node);
+            long prevId = prevSibling ? m_documentNodeToIdMap.get(prevSibling) : 0;
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
             m_frontend->childNodeInserted(parentId, prevId, value);
         }
     } else if (type == eventNames().DOMNodeRemovedEvent) {
@@ -154,7 +164,7 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
             return;
 
         Node* parent = static_cast<MutationEvent*>(event)->relatedNode();
-        long parentId = idForNode(parent);
+        long parentId = m_documentNodeToIdMap.get(parent);
         // If parent is not mapped yet -> ignore the event.
         if (!parentId)
             return;
@@ -162,92 +172,115 @@ void InspectorDOMAgent::handleEvent(Event* event, bool)
         if (!m_childrenRequested.contains(parentId)) {
             // No children are mapped yet -> only notify on changes of hasChildren.
             if (innerChildNodeCount(parent) == 1)
-                m_frontend->hasChildrenUpdated(parentId, false);
+                m_frontend->childNodeCountUpdated(parentId, 0);
         } else {
-            m_frontend->childNodeRemoved(parentId, idForNode(node));
+            m_frontend->childNodeRemoved(parentId, m_documentNodeToIdMap.get(node));
         }
+        unbind(node, &m_documentNodeToIdMap);
     } else if (type == eventNames().DOMContentLoadedEvent) {
         // Re-push document once it is loaded.
         discardBindings();
-        pushDocumentElementToFrontend();
+        pushDocumentToFrontend();
+    } else if (type == eventNames().loadEvent) {
+        long frameOwnerId = m_documentNodeToIdMap.get(node);
+        if (!frameOwnerId)
+            return;
+
+        if (!m_childrenRequested.contains(frameOwnerId)) {
+            // No children are mapped yet -> only notify on changes of hasChildren.
+            m_frontend->childNodeCountUpdated(frameOwnerId, innerChildNodeCount(node));
+        } else {
+            // Re-add frame owner element together with its new children.
+            long parentId = m_documentNodeToIdMap.get(innerParentNode(node));
+            m_frontend->childNodeRemoved(parentId, frameOwnerId);
+            long prevId = m_documentNodeToIdMap.get(innerPreviousSibling(node));
+            ScriptObject value = buildObjectForNode(node, 0, &m_documentNodeToIdMap);
+            m_frontend->childNodeInserted(parentId, prevId, value);
+            // Invalidate children requested flag for the element.
+            m_childrenRequested.remove(m_childrenRequested.find(frameOwnerId));
+        }
     }
 }
 
-long InspectorDOMAgent::bind(Node* node)
+long InspectorDOMAgent::bind(Node* node, NodeToIdMap* nodesMap)
 {
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end())
-        return it->second;
-    long id = m_lastNodeId++;
-    m_nodeToId.set(node, id);
+    long id = nodesMap->get(node);
+    if (id)
+        return id;
+    id = m_lastNodeId++;
+    nodesMap->set(node, id);
     m_idToNode.set(id, node);
+    m_idToNodesMap.set(id, nodesMap);
     return id;
 }
 
-void InspectorDOMAgent::unbind(Node* node)
+void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
 {
     if (node->isFrameOwnerElement()) {
         const HTMLFrameOwnerElement* frameOwner = static_cast<const HTMLFrameOwnerElement*>(node);
         stopListening(frameOwner->contentDocument());
     }
 
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end()) {
-        m_idToNode.remove(m_idToNode.find(it->second));
-        m_childrenRequested.remove(m_childrenRequested.find(it->second));
-        m_nodeToId.remove(it);
+    int id = nodesMap->get(node);
+    if (!id)
+        return;
+    m_idToNode.remove(id);
+    nodesMap->remove(node);
+    bool childrenRequested = m_childrenRequested.contains(id);
+    if (childrenRequested) {
+        // Unbind subtree known to client recursively.
+        m_childrenRequested.remove(id);
+        Node* child = innerFirstChild(node);
+        while (child) {
+            unbind(child, nodesMap);
+            child = innerNextSibling(child);
+        }
     }
 }
 
-void InspectorDOMAgent::pushDocumentElementToFrontend()
+void InspectorDOMAgent::pushDocumentToFrontend()
 {
-    Element* docElem = mainFrameDocument()->documentElement();
-    if (!m_nodeToId.contains(docElem))
-        m_frontend->setDocumentElement(buildObjectForNode(docElem, 0));
+    Document* document = mainFrameDocument();
+    if (!m_documentNodeToIdMap.contains(document))
+        m_frontend->setDocument(buildObjectForNode(document, 2, &m_documentNodeToIdMap));
 }
 
-void InspectorDOMAgent::pushChildNodesToFrontend(long elementId)
+void InspectorDOMAgent::pushChildNodesToFrontend(long nodeId)
 {
-    Node* node = nodeForId(elementId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE))
+    Node* node = nodeForId(nodeId);
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE))
         return;
-    if (m_childrenRequested.contains(elementId))
+    if (m_childrenRequested.contains(nodeId))
         return;
 
-    Element* element = static_cast<Element*>(node);
-    ScriptArray children = buildArrayForElementChildren(element, 1);
-    m_childrenRequested.add(elementId);
-    m_frontend->setChildNodes(elementId, children);
+    NodeToIdMap* nodeMap = m_idToNodesMap.get(nodeId);
+    ScriptArray children = buildArrayForContainerChildren(node, 1, nodeMap);
+    m_childrenRequested.add(nodeId);
+    m_frontend->setChildNodes(nodeId, children);
 }
 
 void InspectorDOMAgent::discardBindings()
 {
-    m_nodeToId.clear();
+    m_documentNodeToIdMap.clear();
     m_idToNode.clear();
+    releaseDanglingNodes();
     m_childrenRequested.clear();
 }
 
 Node* InspectorDOMAgent::nodeForId(long id)
 {
+    if (!id)
+        return 0;
+
     HashMap<long, Node*>::iterator it = m_idToNode.find(id);
     if (it != m_idToNode.end())
         return it->second;
     return 0;
 }
 
-long InspectorDOMAgent::idForNode(Node* node)
+void InspectorDOMAgent::getChildNodes(long callId, long nodeId)
 {
-    if (!node)
-        return 0;
-    HashMap<Node*, long>::iterator it = m_nodeToId.find(node);
-    if (it != m_nodeToId.end())
-        return it->second;
-    return 0;
-}
-
-void InspectorDOMAgent::getChildNodes(long callId, long elementId)
-{
-    pushChildNodesToFrontend(elementId);
+    pushChildNodesToFrontend(nodeId);
     m_frontend->didGetChildNodes(callId);
 }
 
@@ -256,31 +289,40 @@ long InspectorDOMAgent::pushNodePathToFrontend(Node* nodeToPush)
     ASSERT(nodeToPush);  // Invalid input
 
     // If we are sending information to the client that is currently being created. Send root node first.
-    pushDocumentElementToFrontend();
+    pushDocumentToFrontend();
 
     // Return id in case the node is known.
-    long result = idForNode(nodeToPush);
+    long result = m_documentNodeToIdMap.get(nodeToPush);
     if (result)
         return result;
 
-    Element* element = innerParentElement(nodeToPush);
-    ASSERT(element);  // Node is detached or is a document itself
-
-    Vector<Element*> path;
-    while (element && !idForNode(element)) {
-        path.append(element);
-        element = innerParentElement(element);
+    Node* node = nodeToPush;
+    Vector<Node*> path;
+    NodeToIdMap* danglingMap = 0;
+    while (true) {
+        Node* parent = innerParentNode(node);
+        if (!parent) {
+            // Node being pushed is detached -> push subtree root.
+            danglingMap = new NodeToIdMap();
+            m_danglingNodeToIdMaps.append(danglingMap);
+            m_frontend->setDetachedRoot(buildObjectForNode(node, 0, danglingMap));
+            break;
+        } else {
+            path.append(parent);
+            if (m_documentNodeToIdMap.get(parent))
+                break;
+            else
+                node = parent;
+        }
     }
 
-    // element is known to the client
-    ASSERT(element);
-    path.append(element);
+    NodeToIdMap* map = danglingMap ? danglingMap : &m_documentNodeToIdMap;
     for (int i = path.size() - 1; i >= 0; --i) {
-        long nodeId = idForNode(path.at(i));
+        long nodeId = map->get(path.at(i));
         ASSERT(nodeId);
         pushChildNodesToFrontend(nodeId);
     }
-    return idForNode(nodeToPush);
+    return map->get(nodeToPush);
 }
 
 void InspectorDOMAgent::setAttribute(long callId, long elementId, const String& name, const String& value)
@@ -309,9 +351,9 @@ void InspectorDOMAgent::removeAttribute(long callId, long elementId, const Strin
     }
 }
 
-void InspectorDOMAgent::setTextNodeValue(long callId, long elementId, const String& value)
+void InspectorDOMAgent::setTextNodeValue(long callId, long nodeId, const String& value)
 {
-    Node* node = nodeForId(elementId);
+    Node* node = nodeForId(nodeId);
     if (node && (node->nodeType() == Node::TEXT_NODE)) {
         Text* text_node = static_cast<Text*>(node);
         ExceptionCode ec = 0;
@@ -322,12 +364,87 @@ void InspectorDOMAgent::setTextNodeValue(long callId, long elementId, const Stri
     }
 }
 
-ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth)
+void InspectorDOMAgent::getEventListenersForNode(long callId, long nodeId)
+{
+    Node* node = nodeForId(nodeId);
+    ScriptArray listenersArray = m_frontend->newScriptArray();
+    unsigned counter = 0;
+    EventTargetData* d;
+
+    // Quick break if a null node or no listeners at all
+    if (!node || !(d = node->eventTargetData())) {
+        m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+        return;
+    }
+
+    // Get the list of event types this Node is concerned with
+    Vector<AtomicString> eventTypes;
+    const EventListenerMap& listenerMap = d->eventListenerMap;
+    HashMap<AtomicString, EventListenerVector>::const_iterator end = listenerMap.end();
+    for (HashMap<AtomicString, EventListenerVector>::const_iterator iter = listenerMap.begin(); iter != end; ++iter)
+        eventTypes.append(iter->first);
+
+    // Quick break if no useful listeners
+    size_t eventTypesLength = eventTypes.size();
+    if (eventTypesLength == 0) {
+        m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+        return;
+    }
+
+    // The Node's Event Ancestors (not including self)
+    Vector<RefPtr<ContainerNode> > ancestors;
+    node->eventAncestors(ancestors);
+
+    // Nodes and their Listeners for the concerned event types (order is top to bottom)
+    Vector<EventListenerInfo> eventInformation;
+    for (size_t i = ancestors.size(); i; --i) {
+        ContainerNode* ancestor = ancestors[i - 1].get();
+        for (size_t j = 0; j < eventTypesLength; ++j) {
+            AtomicString& type = eventTypes[j];
+            if (ancestor->hasEventListeners(type))
+                eventInformation.append(EventListenerInfo(static_cast<Node*>(ancestor), type, ancestor->getEventListeners(type)));
+        }
+    }
+
+    // Insert the Current Node at the end of that list (last in capturing, first in bubbling)
+    for (size_t i = 0; i < eventTypesLength; ++i) {
+        const AtomicString& type = eventTypes[i];
+        eventInformation.append(EventListenerInfo(node, type, node->getEventListeners(type)));
+    }
+
+    // Get Capturing Listeners (in this order)
+    size_t eventInformationLength = eventInformation.size();
+    for (size_t i = 0; i < eventInformationLength; ++i) {
+        const EventListenerInfo& info = eventInformation[i];
+        const EventListenerVector& vector = info.eventListenerVector;
+        for (size_t j = 0; j < vector.size(); ++j) {
+            const RegisteredEventListener& listener = vector[j];
+            if (listener.useCapture)
+                listenersArray.set(counter++, buildObjectForEventListener(listener, info.eventType, info.node));
+        }
+    }
+
+    // Get Bubbling Listeners (reverse order)
+    for (size_t i = eventInformationLength; i; --i) {
+        const EventListenerInfo& info = eventInformation[i - 1];
+        const EventListenerVector& vector = info.eventListenerVector;
+        for (size_t j = 0; j < vector.size(); ++j) {
+            const RegisteredEventListener& listener = vector[j];
+            if (!listener.useCapture)
+                listenersArray.set(counter++, buildObjectForEventListener(listener, info.eventType, info.node));
+        }
+    }
+
+    m_frontend->didGetEventListenersForNode(callId, nodeId, listenersArray);
+}
+
+ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap)
 {
     ScriptObject value = m_frontend->newScriptObject();
 
-    long id = bind(node);
+    long id = bind(node, nodesMap);
     String nodeName;
+    String localName;
     String nodeValue;
 
     switch (node->nodeType()) {
@@ -336,27 +453,32 @@ ScriptObject InspectorDOMAgent::buildObjectForNode(Node* node, int depth)
             nodeValue = node->nodeValue();
             break;
         case Node::ATTRIBUTE_NODE:
-        case Node::DOCUMENT_NODE:
+            localName = node->localName();
+            break;
         case Node::DOCUMENT_FRAGMENT_NODE:
             break;
+        case Node::DOCUMENT_NODE:
         case Node::ELEMENT_NODE:
         default:
             nodeName = node->nodeName();
+            localName = node->localName();
             break;
     }
 
     value.set("id", static_cast<int>(id));
     value.set("nodeType", node->nodeType());
     value.set("nodeName", nodeName);
+    value.set("localName", localName);
     value.set("nodeValue", nodeValue);
 
     if (node->nodeType() == Node::ELEMENT_NODE) {
         Element* element = static_cast<Element*>(node);
         value.set("attributes", buildArrayForElementAttributes(element));
-        int nodeCount = innerChildNodeCount(element);
+    }
+    if (node->nodeType() == Node::ELEMENT_NODE || node->nodeType() == Node::DOCUMENT_NODE) {
+        int nodeCount = innerChildNodeCount(node);
         value.set("childNodeCount", nodeCount);
-
-        ScriptArray children = buildArrayForElementChildren(element, depth);
+        ScriptArray children = buildArrayForContainerChildren(node, depth, nodesMap);
         if (children.length() > 0)
             value.set("children", children);
     }
@@ -381,16 +503,16 @@ ScriptArray InspectorDOMAgent::buildArrayForElementAttributes(Element* element)
     return attributesValue;
 }
 
-ScriptArray InspectorDOMAgent::buildArrayForElementChildren(Element* element, int depth)
+ScriptArray InspectorDOMAgent::buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap)
 {
     ScriptArray children = m_frontend->newScriptArray();
     if (depth == 0) {
         int index = 0;
         // Special case the_only text child.
-        if (innerChildNodeCount(element) == 1) {
-            Node *child = innerFirstChild(element);
+        if (innerChildNodeCount(container) == 1) {
+            Node *child = innerFirstChild(container);
             if (child->nodeType() == Node::TEXT_NODE)
-                children.set(index++, buildObjectForNode(child, 0));
+                children.set(index++, buildObjectForNode(child, 0, nodesMap));
         }
         return children;
     } else if (depth > 0) {
@@ -398,11 +520,23 @@ ScriptArray InspectorDOMAgent::buildArrayForElementChildren(Element* element, in
     }
 
     int index = 0;
-    for (Node *child = innerFirstChild(element); child; child = innerNextSibling(child))
-        children.set(index++, buildObjectForNode(child, depth));
+    for (Node *child = innerFirstChild(container); child; child = innerNextSibling(child))
+        children.set(index++, buildObjectForNode(child, depth, nodesMap));
     return children;
 }
 
+ScriptObject InspectorDOMAgent::buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node)
+{
+    RefPtr<EventListener> eventListener = registeredEventListener.listener;
+    ScriptObject value = m_frontend->newScriptObject();
+    value.set("type", eventType);
+    value.set("useCapture", registeredEventListener.useCapture);
+    value.set("isAttribute", eventListener->isAttribute());
+    value.set("nodeId", static_cast<long long>(pushNodePathToFrontend(node)));
+    value.set("listener", getEventListenerHandlerBody(node->document(), m_frontend->scriptState(), eventListener.get()));
+    return value;
+}
+
 Node* InspectorDOMAgent::innerFirstChild(Node* node)
 {
     if (node->isFrameOwnerElement()) {
@@ -446,12 +580,12 @@ int InspectorDOMAgent::innerChildNodeCount(Node* node)
     return count;
 }
 
-Element* InspectorDOMAgent::innerParentElement(Node* node)
+Node* InspectorDOMAgent::innerParentNode(Node* node)
 {
-    Element* element = node->parentElement();
-    if (!element)
-        return node->ownerDocument()->ownerElement();
-    return element;
+    Node* parent = node->parentNode();
+    if (parent && parent->nodeType() == Node::DOCUMENT_NODE)
+        return static_cast<Document*>(parent)->ownerElement();
+    return parent;
 }
 
 bool InspectorDOMAgent::isWhitespace(Node* node)
@@ -460,12 +594,21 @@ bool InspectorDOMAgent::isWhitespace(Node* node)
     return node && node->nodeType() == Node::TEXT_NODE && node->nodeValue().stripWhiteSpace().length() == 0;
 }
 
-Document* InspectorDOMAgent::mainFrameDocument()
+Document* InspectorDOMAgent::mainFrameDocument() const
 {
-    ListHashSet<RefPtr<Document> >::iterator it = m_documents.begin();
+    ListHashSet<RefPtr<Document> >::const_iterator it = m_documents.begin();
     if (it != m_documents.end())
         return it->get();
     return 0;
 }
 
+bool InspectorDOMAgent::operator==(const EventListener& listener)
+{
+    if (const InspectorDOMAgent* inspectorDOMAgentListener = InspectorDOMAgent::cast(&listener))
+        return mainFrameDocument() == inspectorDOMAgentListener->mainFrameDocument();
+    return false;
+}
+
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index 28c3a22..b9bdb6b 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -30,7 +30,9 @@
 #ifndef InspectorDOMAgent_h
 #define InspectorDOMAgent_h
 
+#include "AtomicString.h"
 #include "EventListener.h"
+#include "EventTarget.h"
 #include "ScriptArray.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
@@ -42,6 +44,7 @@
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
+    class ContainerNode;
     class Element;
     class Event;
     class Document;
@@ -50,39 +53,65 @@ namespace WebCore {
     class Node;
     class Page;
 
+    struct EventListenerInfo {
+        EventListenerInfo(Node* node, const AtomicString& eventType, const EventListenerVector& eventListenerVector)
+            : node(node)
+            , eventType(eventType)
+            , eventListenerVector(eventListenerVector)
+        {
+        }
+
+        Node* node;
+        const AtomicString eventType;
+        const EventListenerVector eventListenerVector;
+    };
+
     class InspectorDOMAgent : public EventListener {
     public:
+        static const InspectorDOMAgent* cast(const EventListener* listener)
+        {
+            return listener->type() == InspectorDOMAgentType
+                ? static_cast<const InspectorDOMAgent*>(listener)
+                : 0;
+        }
+
         InspectorDOMAgent(InspectorFrontend* frontend);
         ~InspectorDOMAgent();
 
+        virtual bool operator==(const EventListener& other);
+
         // Methods called from the frontend.
-        void getChildNodes(long callId, long elementId);
+        void getChildNodes(long callId, long nodeId);
         void setAttribute(long callId, long elementId, const String& name, const String& value);
         void removeAttribute(long callId, long elementId, const String& name);
-        void setTextNodeValue(long callId, long elementId, const String& value);
+        void setTextNodeValue(long callId, long nodeId, const String& value);
+        void getEventListenersForNode(long callId, long nodeId);
 
         // Methods called from the InspectorController.
         void setDocument(Document* document);
+        void releaseDanglingNodes();
 
         Node* nodeForId(long nodeId);
-        long idForNode(Node* node);
         long pushNodePathToFrontend(Node* node);
 
    private:
         void startListening(Document* document);
         void stopListening(Document* document);
 
-        virtual void handleEvent(Event* event, bool isWindowEvent);
+        virtual void handleEvent(ScriptExecutionContext*, Event* event);
+
+        typedef HashMap<RefPtr<Node>, long> NodeToIdMap;
+        long bind(Node* node, NodeToIdMap* nodesMap);
+        void unbind(Node* node, NodeToIdMap* nodesMap);
 
-        long bind(Node* node);
-        void unbind(Node* node);
+        void pushDocumentToFrontend();
+        void pushChildNodesToFrontend(long nodeId);
 
-        void pushDocumentElementToFrontend();
-        void pushChildNodesToFrontend(long elementId);
+        ScriptObject buildObjectForNode(Node* node, int depth, NodeToIdMap* nodesMap);
+        ScriptArray buildArrayForElementAttributes(Element* element);
+        ScriptArray buildArrayForContainerChildren(Node* container, int depth, NodeToIdMap* nodesMap);
 
-        ScriptObject buildObjectForNode(Node* node, int depth);
-        ScriptArray buildArrayForElementAttributes(Element* elemen);
-        ScriptArray buildArrayForElementChildren(Element* element, int depth);
+        ScriptObject buildObjectForEventListener(const RegisteredEventListener& registeredEventListener, const AtomicString& eventType, Node* node);
 
         // We represent embedded doms as a part of the same hierarchy. Hence we treat children of frame owners differently.
         // We also skip whitespace text nodes conditionally. Following methods encapsulate these specifics.
@@ -90,19 +119,21 @@ namespace WebCore {
         Node* innerNextSibling(Node* node);
         Node* innerPreviousSibling(Node* node);
         int innerChildNodeCount(Node* node);
-        Element* innerParentElement(Node* node);
+        Node* innerParentNode(Node* node);
         bool isWhitespace(Node* node);
 
-        Document* mainFrameDocument();
+        Document* mainFrameDocument() const;
         void discardBindings();
 
         InspectorFrontend* m_frontend;
-        HashMap<Node*, long> m_nodeToId;
+        NodeToIdMap m_documentNodeToIdMap;
+        // Owns node mappings for dangling nodes.
+        Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
         HashMap<long, Node*> m_idToNode;
+        HashMap<long, NodeToIdMap*> m_idToNodesMap;
         HashSet<long> m_childrenRequested;
         long m_lastNodeId;
         ListHashSet<RefPtr<Document> > m_documents;
-        RefPtr<EventListener> m_eventListener;
     };
 
 
diff --git a/WebCore/inspector/InspectorDOMStorageResource.cpp b/WebCore/inspector/InspectorDOMStorageResource.cpp
index 03db649..37818e7 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.cpp
+++ b/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -29,26 +29,34 @@
  */
 
 #include "config.h"
-#if ENABLE(DOM_STORAGE)
+
+#if ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
 
 #include "InspectorDOMStorageResource.h"
 
 #include "Document.h"
+#include "DOMWindow.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
 #include "ScriptObject.h"
-#include "ScriptObjectQuarantine.h"
 #include "Storage.h"
+#include "StorageEvent.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
+int InspectorDOMStorageResource::s_nextUnusedId = 1;
+
 InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
-    : m_domStorage(domStorage)
+    :  EventListener(InspectorDOMStorageResourceType)
+    , m_domStorage(domStorage)
     , m_isLocalStorage(isLocalStorage)
     , m_frame(frame)
-    , m_scriptObjectCreated(false)
+    , m_frontend(0)
+    , m_id(s_nextUnusedId++)
+    , m_reportingChangesToFrontend(false)
 {
 }
 
@@ -59,25 +67,54 @@ bool InspectorDOMStorageResource::isSameHostAndType(Frame* frame, bool isLocalSt
 
 void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
 {
-    if (m_scriptObjectCreated)
-        return;
+    ASSERT(!m_frontend);
+    m_frontend = frontend;
 
     ScriptObject jsonObject = frontend->newScriptObject();
-    ScriptObject domStorage;
-    if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
-        return;
-    jsonObject.set("domStorage", domStorage);
     jsonObject.set("host", m_frame->document()->securityOrigin()->host());
     jsonObject.set("isLocalStorage", m_isLocalStorage);
-    if (frontend->addDOMStorage(jsonObject))
-        m_scriptObjectCreated = true;
+    jsonObject.set("id", m_id);
+    frontend->addDOMStorage(jsonObject);
 }
 
 void InspectorDOMStorageResource::unbind()
 {
-    m_scriptObjectCreated = false;
+    if (!m_frontend)
+        return;  // Already unbound.
+
+    if (m_reportingChangesToFrontend) {
+        m_frame->domWindow()->removeEventListener(eventNames().storageEvent, this, true);
+        m_reportingChangesToFrontend = false;
+    }
+    m_frontend = 0;
+}
+
+void InspectorDOMStorageResource::startReportingChangesToFrontend()
+{
+    ASSERT(m_frontend);
+    if (!m_reportingChangesToFrontend) {
+        m_frame->domWindow()->addEventListener(eventNames().storageEvent, this, true);
+        m_reportingChangesToFrontend = true;
+    }
+}
+
+void InspectorDOMStorageResource::handleEvent(ScriptExecutionContext*, Event* event)
+{
+    ASSERT(m_frontend);
+    ASSERT(eventNames().storageEvent == event->type());
+    StorageEvent* storageEvent = static_cast<StorageEvent*>(event);
+    Storage* storage = storageEvent->storageArea();
+    bool isLocalStorage = storageEvent->source()->localStorage() == storage;
+    if (isSameHostAndType(storage->frame(), isLocalStorage))
+        m_frontend->updateDOMStorage(m_id);
+}
+
+bool InspectorDOMStorageResource::operator==(const EventListener& listener)
+{
+    return (this == InspectorDOMStorageResource::cast(&listener));
 }
 
 } // namespace WebCore
 
-#endif
+#endif // ENABLE(DOM_STORAGE) && ENABLE(INSPECTOR)
+
diff --git a/WebCore/inspector/InspectorDOMStorageResource.h b/WebCore/inspector/InspectorDOMStorageResource.h
index 3e05897..2b18b24 100644
--- a/WebCore/inspector/InspectorDOMStorageResource.h
+++ b/WebCore/inspector/InspectorDOMStorageResource.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(DOM_STORAGE)
 
+#include "EventListener.h"
 #include "ScriptObject.h"
 #include "ScriptState.h"
 
@@ -46,17 +47,27 @@ namespace WebCore {
     class Frame;
     class InspectorFrontend;
 
-    class InspectorDOMStorageResource : public RefCounted<InspectorDOMStorageResource> {
+    class InspectorDOMStorageResource : public EventListener {
     public:
         static PassRefPtr<InspectorDOMStorageResource> create(Storage* domStorage, bool isLocalStorage, Frame* frame)
         {
             return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
         }
+        static const InspectorDOMStorageResource* cast(const EventListener* listener)
+        {
+            return listener->type() == InspectorDOMStorageResourceType ? static_cast<const InspectorDOMStorageResource*>(listener) : 0;
+        }
 
         void bind(InspectorFrontend* frontend);
         void unbind();
+        void startReportingChangesToFrontend();
+
+        virtual void handleEvent(ScriptExecutionContext*, Event*);
+        virtual bool operator==(const EventListener& listener);
 
         bool isSameHostAndType(Frame*, bool isLocalStorage) const;
+        long id() const { return m_id; }
+        Storage* domStorage() const { return m_domStorage.get(); }
 
     private:
 
@@ -65,8 +76,11 @@ namespace WebCore {
         RefPtr<Storage> m_domStorage;
         bool m_isLocalStorage;
         RefPtr<Frame> m_frame;
-        bool m_scriptObjectCreated;
+        InspectorFrontend* m_frontend;
+        int m_id;
+        bool m_reportingChangesToFrontend;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDatabaseResource.cpp b/WebCore/inspector/InspectorDatabaseResource.cpp
index fba50a5..c2dc5c6 100644
--- a/WebCore/inspector/InspectorDatabaseResource.cpp
+++ b/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -29,9 +29,9 @@
  */
 
 #include "config.h"
-#if ENABLE(DATABASE)
 #include "InspectorDatabaseResource.h"
 
+#if ENABLE(DATABASE) && ENABLE(INSPECTOR)
 #include "Database.h"
 #include "Document.h"
 #include "Frame.h"
@@ -39,11 +39,13 @@
 #include "ScriptObject.h"
 #include "ScriptObjectQuarantine.h"
 
-
 namespace WebCore {
 
+int InspectorDatabaseResource::s_nextUnusedId = 1;
+
 InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
     : m_database(database)
+    , m_id(s_nextUnusedId++)
     , m_domain(domain)
     , m_name(name)
     , m_version(version)
@@ -60,7 +62,7 @@ void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
     ScriptObject database;
     if (!getQuarantinedScriptObject(m_database.get(), database))
         return;
-    jsonObject.set("database", database);
+    jsonObject.set("id", m_id);
     jsonObject.set("domain", m_domain);
     jsonObject.set("name", m_name);
     jsonObject.set("version", m_version);
@@ -75,4 +77,4 @@ void InspectorDatabaseResource::unbind()
 
 } // namespace WebCore
 
-#endif // ENABLE(DATABASE)
+#endif // ENABLE(DATABASE) && ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorDatabaseResource.h b/WebCore/inspector/InspectorDatabaseResource.h
index 38f9fa1..f82d898 100644
--- a/WebCore/inspector/InspectorDatabaseResource.h
+++ b/WebCore/inspector/InspectorDatabaseResource.h
@@ -53,16 +53,19 @@ namespace WebCore {
 
         void bind(InspectorFrontend* frontend);
         void unbind();
-
+        Database* database() { return m_database.get(); }
+        long id() const { return m_id; }
     private:
         InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
         
         RefPtr<Database> m_database;
+        int m_id;
         String m_domain;
         String m_name;
         String m_version;
         bool m_scriptObjectCreated;
 
+        static int s_nextUnusedId;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index af65fb4..ad935a8 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -30,9 +30,11 @@
 #include "config.h"
 #include "InspectorFrontend.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "ConsoleMessage.h"
 #include "Frame.h"
-#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
+#include "InspectorController.h"
 #include "Node.h"
 #include "ScriptFunctionCall.h"
 #include "ScriptObject.h"
@@ -49,8 +51,9 @@
 
 namespace WebCore {
 
-InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
-    : m_scriptState(scriptState)
+InspectorFrontend::InspectorFrontend(InspectorController* inspectorController, ScriptState* scriptState, ScriptObject webInspector)
+    : m_inspectorController(inspectorController)
+    , m_scriptState(scriptState)
     , m_webInspector(webInspector)
 {
 }
@@ -70,6 +73,11 @@ ScriptObject InspectorFrontend::newScriptObject()
     return ScriptObject::createNew(m_scriptState);
 }
 
+void InspectorFrontend::didCommitLoad()
+{
+    callSimpleFunction("didCommitLoad");
+}
+
 void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
@@ -79,12 +87,17 @@ void InspectorFrontend::addMessageToConsole(const ScriptObject& messageObj, cons
             function->appendArgument(frames[i]);
     } else if (!wrappedArguments.isEmpty()) {
         for (unsigned i = 0; i < wrappedArguments.size(); ++i)
-            function->appendArgument(wrappedArguments[i]);
+            function->appendArgument(m_inspectorController->wrapObject(wrappedArguments[i], "console"));
     } else
         function->appendArgument(message);
     function->call();
 }
 
+void InspectorFrontend::clearConsoleMessages()
+{
+    callSimpleFunction("clearConsoleMessages");
+}
+
 bool InspectorFrontend::addResource(long long identifier, const ScriptObject& resourceObj)
 {
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
@@ -112,14 +125,17 @@ void InspectorFrontend::removeResource(long long identifier)
     function->call();
 }
 
-void InspectorFrontend::updateFocusedNode(Node* node)
+void InspectorFrontend::addCookieDomain(String domain)
 {
-    ScriptObject quarantinedNode;
-    if (!getQuarantinedScriptObject(node, quarantinedNode))
-        return;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addCookieDomain"));
+    function->appendArgument(domain);
+    function->call();
+}
 
+void InspectorFrontend::updateFocusedNode(long long nodeId)
+{
     OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
-    function->appendArgument(quarantinedNode);
+    function->appendArgument(nodeId);
     function->call();
 }
 
@@ -130,17 +146,6 @@ void InspectorFrontend::setAttachedWindow(bool attached)
     function->call();
 }
 
-void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
-{
-    ScriptObject domWindow;
-    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
-        return;
-
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
-    function->appendArgument(domWindow);
-    function->call();
-}
-
 void InspectorFrontend::showPanel(int panel)
 {
     const char* showFunctionName;
@@ -148,9 +153,6 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ConsolePanel:
             showFunctionName = "showConsole";
             break;
-        case InspectorController::DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
         case InspectorController::ElementsPanel:
             showFunctionName = "showElementsPanel";
             break;
@@ -163,6 +165,9 @@ void InspectorFrontend::showPanel(int panel)
         case InspectorController::ScriptsPanel:
             showFunctionName = "showScriptsPanel";
             break;
+        case InspectorController::StoragePanel:
+            showFunctionName = "showStoragePanel";
+            break;
         default:
             ASSERT_NOT_REACHED();
             showFunctionName = 0;
@@ -192,6 +197,23 @@ void InspectorFrontend::resourceTrackingWasDisabled()
     callSimpleFunction("resourceTrackingWasDisabled");
 }
 
+void InspectorFrontend::timelineWasEnabled()
+{
+    callSimpleFunction("timelineWasEnabled");
+}
+
+void InspectorFrontend::timelineWasDisabled()
+{
+    callSimpleFunction("timelineWasDisabled");
+}
+
+void InspectorFrontend::addItemToTimeline(const ScriptObject& itemObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addItemToTimeline"));
+    function->appendArgument(itemObj);
+    function->call();
+}
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 void InspectorFrontend::attachDebuggerWhenShown()
 {
@@ -253,9 +275,11 @@ void InspectorFrontend::setRecordingProfile(bool isProfiling)
     function->call();
 }
 
-void InspectorFrontend::pausedScript()
+void InspectorFrontend::pausedScript(const ScriptValue& callFrames)
 {
-    callSimpleFunction("pausedScript");
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("pausedScript"));
+    function->appendArgument(callFrames);
+    function->call();
 }
 
 void InspectorFrontend::resumedScript()
@@ -264,31 +288,16 @@ void InspectorFrontend::resumedScript()
 }
 #endif
 
-#if ENABLE(DATABASE)
-bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+void InspectorFrontend::setDocument(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
-    function->appendArgument(dbObject);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
-}
-#endif
-
-#if ENABLE(DOM_STORAGE)
-bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
-{
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
-    function->appendArgument(domStorageObj);
-    bool hadException = false;
-    function->call(hadException);
-    return !hadException;
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocument"));
+    function->appendArgument(root);
+    function->call();
 }
-#endif
 
-void InspectorFrontend::setDocumentElement(const ScriptObject& root)
+void InspectorFrontend::setDetachedRoot(const ScriptObject& root)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDocumentElement"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setDetachedRoot"));
     function->appendArgument(root);
     function->call();
 }
@@ -301,9 +310,9 @@ void InspectorFrontend::setChildNodes(int parentId, const ScriptArray& nodes)
     function->call();
 }
 
-void InspectorFrontend::hasChildrenUpdated(int id, bool newValue)
+void InspectorFrontend::childNodeCountUpdated(int id, int newValue)
 {
-    OwnPtr<ScriptFunctionCall> function(newFunctionCall("hasChildrenUpdated"));
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("childNodeCountUpdated"));
     function->appendArgument(id);
     function->appendArgument(newValue);
     function->call();
@@ -349,6 +358,122 @@ void InspectorFrontend::didApplyDomChange(int callId, bool success)
     function->call();
 }
 
+void InspectorFrontend::didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetEventListenersForNode"));
+    function->appendArgument(callId);
+    function->appendArgument(nodeId);
+    function->appendArgument(listenersArray);
+    function->call();
+}
+
+void InspectorFrontend::didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetCookies"));
+    function->appendArgument(callId);
+    function->appendArgument(cookies);
+    function->appendArgument(cookiesString);
+    function->call();
+}
+
+void InspectorFrontend::didDispatchOnInjectedScript(int callId, const String& result, bool isException)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didDispatchOnInjectedScript"));
+    function->appendArgument(callId);
+    function->appendArgument(result);
+    function->appendArgument(isException);
+    function->call();
+}
+
+#if ENABLE(DATABASE)
+bool InspectorFrontend::addDatabase(const ScriptObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDatabase(int databaseId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDatabase"));
+    function->appendArgument(databaseId);
+    function->call();
+}
+void InspectorFrontend::didGetDatabaseTableNames(int callId, const ScriptArray& tableNames)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDatabaseTableNames"));
+    function->appendArgument(callId);
+    function->appendArgument(tableNames);
+    function->call();
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const ScriptObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj);
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::selectDOMStorage(int storageId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("selectDOMStorage"));
+    function->appendArgument(storageId);
+    function->call();
+}
+
+void InspectorFrontend::didGetDOMStorageEntries(int callId, const ScriptArray& entries)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didGetDOMStorageEntries"));
+    function->appendArgument(callId);
+    function->appendArgument(entries);
+    function->call();
+}
+
+void InspectorFrontend::didSetDOMStorageItem(int callId, bool success)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didSetDOMStorageItem"));
+    function->appendArgument(callId);
+    function->appendArgument(success);
+    function->call();
+}
+
+void InspectorFrontend::didRemoveDOMStorageItem(int callId, bool success)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("didRemoveDOMStorageItem"));
+    function->appendArgument(callId);
+    function->appendArgument(success);
+    function->call();
+}
+
+void InspectorFrontend::updateDOMStorage(int storageId)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateDOMStorage"));
+    function->appendArgument(storageId);
+    function->call();
+}
+#endif
+
+void InspectorFrontend::addNodesToSearchResult(const String& nodeIds)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addNodesToSearchResult"));
+    function->appendArgument(nodeIds);
+    function->call();
+}
+
+void InspectorFrontend::evaluateForTestInFrontend(int callId, const String& script)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("evaluateForTestInFrontend"));
+    function->appendArgument(callId);
+    function->appendArgument(script);
+    function->call();
+}
+
 PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
 {
     ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
@@ -364,3 +489,5 @@ void InspectorFrontend::callSimpleFunction(const String& functionName)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index 7a48b62..f7055bd 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -45,28 +45,35 @@ namespace JSC {
 
 namespace WebCore {
     class ConsoleMessage;
+    class Database;
+    class Frame;
+    class InspectorController;
     class InspectorResource;
     class Node;
     class ScriptFunctionCall;
     class ScriptString;
+    class Storage;
 
     class InspectorFrontend {
     public:
-        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        InspectorFrontend(InspectorController* inspectorController, ScriptState*, ScriptObject webInspector);
         ~InspectorFrontend();
 
         ScriptArray newScriptArray();
         ScriptObject newScriptObject();
 
+        void didCommitLoad();
         void addMessageToConsole(const ScriptObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
-        
+        void clearConsoleMessages();
+
         bool addResource(long long identifier, const ScriptObject& resourceObj);
         bool updateResource(long long identifier, const ScriptObject& resourceObj);
         void removeResource(long long identifier);
 
-        void updateFocusedNode(Node* node);
+        void addCookieDomain(String);
+
+        void updateFocusedNode(long long nodeId);
         void setAttachedWindow(bool attached);
-        void inspectedWindowScriptObjectCleared(Frame* frame);
         void showPanel(int panel);
         void populateInterface();
         void reset();
@@ -84,30 +91,52 @@ namespace WebCore {
         void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
         void addProfile(const JSC::JSValue& profile);
         void setRecordingProfile(bool isProfiling);
-        void pausedScript();
+        void pausedScript(const ScriptValue& callFrames);
         void resumedScript();
 #endif
 
 #if ENABLE(DATABASE)
         bool addDatabase(const ScriptObject& dbObj);
+        void selectDatabase(int databaseId);
+        void didGetDatabaseTableNames(int callId, const ScriptArray& tableNames);
 #endif
         
 #if ENABLE(DOM_STORAGE)
         bool addDOMStorage(const ScriptObject& domStorageObj);
+        void selectDOMStorage(int storageId);
+        void didGetDOMStorageEntries(int callId, const ScriptArray& entries);
+        void didSetDOMStorageItem(int callId, bool success);
+        void didRemoveDOMStorageItem(int callId, bool success);
+        void updateDOMStorage(int storageId);
 #endif
 
-        void setDocumentElement(const ScriptObject& root);
+        void setDocument(const ScriptObject& root);
+        void setDetachedRoot(const ScriptObject& root);
         void setChildNodes(int parentId, const ScriptArray& nodes);
-        void hasChildrenUpdated(int id, bool newValue);
+        void childNodeCountUpdated(int id, int newValue);
         void childNodeInserted(int parentId, int prevId, const ScriptObject& node);
         void childNodeRemoved(int parentId, int id);
         void attributesUpdated(int id, const ScriptArray& attributes);
         void didGetChildNodes(int callId);
         void didApplyDomChange(int callId, bool success);
+        void didGetEventListenersForNode(int callId, int nodeId, ScriptArray& listenersArray);
+
+        void timelineWasEnabled();
+        void timelineWasDisabled();
+        void addItemToTimeline(const ScriptObject& itemObj);
+
+        void didGetCookies(int callId, const ScriptArray& cookies, const String& cookiesString);
+        void didDispatchOnInjectedScript(int callId, const String& result, bool isException);
+
+        void addNodesToSearchResult(const String& nodeIds);
+
+        ScriptState* scriptState() const { return m_scriptState; }
 
+        void evaluateForTestInFrontend(int callId, const String& script);
     private:
         PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
         void callSimpleFunction(const String& functionName);
+        InspectorController* m_inspectorController;
         ScriptState* m_scriptState;
         ScriptObject m_webInspector;
     };
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index 8e6e9b1..69ab39b 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "InspectorResource.h"
 
+#if ENABLE(INSPECTOR)
+
 #include "CachedResource.h"
 #include "DocLoader.h"
 #include "DocumentLoader.h"
@@ -57,6 +59,8 @@ InspectorResource::InspectorResource(long long identifier, DocumentLoader* loade
     , m_startTime(-1.0)
     , m_responseReceivedTime(-1.0)
     , m_endTime(-1.0)
+    , m_loadEventTime(-1.0)
+    , m_domContentEventTime(-1.0)
     , m_isMainResource(false)
 {
 }
@@ -71,7 +75,7 @@ PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifi
 
     resource->m_finished = true;
 
-    resource->m_requestURL = KURL(cachedResource->url());
+    resource->m_requestURL = KURL(ParsedURLString, cachedResource->url());
     resource->updateResponse(cachedResource->response());
 
     resource->m_length = cachedResource->encodedSize();
@@ -89,6 +93,9 @@ void InspectorResource::updateRequest(const ResourceRequest& request)
 {
     m_requestHeaderFields = request.httpHeaderFields();
     m_requestURL = request.url();
+    m_requestMethod = request.httpMethod();
+    if (request.httpBody() && !request.httpBody()->isEmpty())
+        m_requestFormData = request.httpBody()->flattenToString();
 
     m_changes.set(RequestChange);
 }
@@ -126,6 +133,8 @@ void InspectorResource::createScriptObject(InspectorFrontend* frontend)
         jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
         jsonObject.set("isMainResource", m_isMainResource);
         jsonObject.set("cached", m_cached);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         if (!frontend->addResource(m_identifier, jsonObject))
             return;
 
@@ -153,6 +162,8 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
         populateHeadersObject(&requestHeaders, m_requestHeaderFields);
         jsonObject.set("requestHeaders", requestHeaders);
         jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("requestMethod", m_requestMethod);
+        jsonObject.set("requestFormData", m_requestFormData);
         jsonObject.set("didRequestChange", true);
     }
 
@@ -191,6 +202,10 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject.set("responseReceivedTime", m_responseReceivedTime);
         if (m_endTime > 0)
             jsonObject.set("endTime", m_endTime);
+        if (m_loadEventTime > 0)
+            jsonObject.set("loadEventTime", m_loadEventTime);
+        if (m_domContentEventTime > 0)
+            jsonObject.set("domContentEventTime", m_domContentEventTime);
         jsonObject.set("didTimingChange", true);
     }
     if (!frontend->updateResource(m_identifier, jsonObject))
@@ -255,32 +270,8 @@ String InspectorResource::sourceString() const
     if (!m_xmlHttpResponseText.isNull())
         return String(m_xmlHttpResponseText);
 
-    RefPtr<SharedBuffer> buffer;
     String textEncodingName;
-
-    if (m_requestURL == m_loader->requestURL()) {
-        buffer = m_loader->mainResourceData();
-        textEncodingName = m_frame->document()->inputEncoding();
-    } else {
-        CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
-        if (!cachedResource)
-            return String();
-
-        if (cachedResource->isPurgeable()) {
-            // If the resource is purgeable then make it unpurgeable to get
-            // get its data. This might fail, in which case we return an
-            // empty String.
-            // FIXME: should we do something else in the case of a purged
-            // resource that informs the user why there is no data in the
-            // inspector?
-            if (!cachedResource->makePurgeable(false))
-                return String();
-        }
-
-        buffer = cachedResource->data();
-        textEncodingName = cachedResource->encoding();
-    }
-
+    RefPtr<SharedBuffer> buffer = resourceData(&textEncodingName);
     if (!buffer)
         return String();
 
@@ -290,6 +281,31 @@ String InspectorResource::sourceString() const
     return encoding.decode(buffer->data(), buffer->size());
 }
 
+PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const {
+    if (m_requestURL == m_loader->requestURL()) {
+        *textEncodingName = m_frame->document()->inputEncoding();
+        return m_loader->mainResourceData();
+    }
+
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    if (!cachedResource)
+        return 0;
+
+    if (cachedResource->isPurgeable()) {
+        // If the resource is purgeable then make it unpurgeable to get
+        // get its data. This might fail, in which case we return an
+        // empty String.
+        // FIXME: should we do something else in the case of a purged
+        // resource that informs the user why there is no data in the
+        // inspector?
+        if (!cachedResource->makePurgeable(false))
+            return 0;
+    }
+
+    *textEncodingName = cachedResource->encoding();
+    return cachedResource->data();
+}
+
 void InspectorResource::startTiming()
 {
     m_startTime = currentTime();
@@ -310,6 +326,18 @@ void InspectorResource::endTiming()
     m_changes.set(CompletionChange);
 }
 
+void InspectorResource::markDOMContentEventTime()
+{
+    m_domContentEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markLoadEventTime()
+{
+    m_loadEventTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
 void InspectorResource::markFailed()
 {
     m_failed = true;
@@ -323,3 +351,5 @@ void InspectorResource::addLength(int lengthReceived)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 8380a8f..880eab7 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -87,14 +87,24 @@ namespace WebCore {
         void setXMLHttpResponseText(const ScriptString& data);
 
         String sourceString() const;
+        PassRefPtr<SharedBuffer> resourceData(String* textEncodingName) const;
+
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
         long long identifier() const { return m_identifier; }
         String requestURL() const { return m_requestURL.string(); }
         Frame* frame() const { return m_frame.get(); }
         const String& mimeType() const { return m_mimeType; }
+        const HTTPHeaderMap& requestHeaderFields() const { return m_requestHeaderFields; }
+        const HTTPHeaderMap& responseHeaderFields() const { return m_responseHeaderFields; }
+        int responseStatusCode() const { return m_responseStatusCode; }
+        String requestMethod() const { return m_requestMethod; }
+        String requestFormData() const { return m_requestFormData; }
+
         void startTiming();
         void markResponseReceivedTime();
+        void markLoadEventTime();
+        void markDOMContentEventTime();
         void endTiming();
 
         void markFailed();
@@ -153,9 +163,13 @@ namespace WebCore {
         double m_startTime;
         double m_responseReceivedTime;
         double m_endTime;
+        double m_loadEventTime;
+        double m_domContentEventTime;
         ScriptString m_xmlHttpResponseText;
         Changes m_changes;
         bool m_isMainResource;
+        String m_requestMethod;
+        String m_requestFormData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
new file mode 100644
index 0000000..c3ad075
--- /dev/null
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -0,0 +1,142 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorTimelineAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "DOMDispatchTimelineItem.h"
+#include "Event.h"
+#include "InspectorFrontend.h"
+#include "TimelineItem.h"
+
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
+    : m_sessionStartTime(currentTimeInMilliseconds())
+    , m_frontend(frontend)
+    , m_currentTimelineItem(0)
+{
+    ASSERT(m_frontend);
+}
+
+InspectorTimelineAgent::~InspectorTimelineAgent()
+{
+}
+
+void InspectorTimelineAgent::willDispatchDOMEvent(const Event& event)
+{
+    m_currentTimelineItem = new DOMDispatchTimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), event);
+}
+
+void InspectorTimelineAgent::didDispatchDOMEvent()
+{
+    ASSERT(m_currentTimelineItem->type() == DOMDispatchTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willLayout()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), LayoutTimelineItemType);
+}
+
+void InspectorTimelineAgent::didLayout()
+{
+    ASSERT(m_currentTimelineItem->type() == LayoutTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willRecalculateStyle()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), RecalculateStylesTimelineItemType);
+}
+
+void InspectorTimelineAgent::didRecalculateStyle()
+{
+    ASSERT(m_currentTimelineItem->type() == RecalculateStylesTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willPaint()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), PaintTimelineItemType);
+}
+
+void InspectorTimelineAgent::didPaint()
+{
+    ASSERT(m_currentTimelineItem->type() == PaintTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::willWriteHTML()
+{
+    m_currentTimelineItem = new TimelineItem(m_currentTimelineItem.release(), sessionTimeInMilliseconds(), ParseHTMLTimelineItemType);
+}
+
+void InspectorTimelineAgent::didWriteHTML()
+{
+    ASSERT(m_currentTimelineItem->type() == ParseHTMLTimelineItemType);
+    didCompleteCurrentRecord();
+}
+
+void InspectorTimelineAgent::reset()
+{
+    m_sessionStartTime = currentTimeInMilliseconds();
+    m_currentTimelineItem.set(0);
+}
+
+void InspectorTimelineAgent::didCompleteCurrentRecord()
+{
+    OwnPtr<TimelineItem> item(m_currentTimelineItem.release());
+    m_currentTimelineItem = item->releasePrevious();
+
+    item->setEndTime(sessionTimeInMilliseconds());
+    if (m_currentTimelineItem.get())
+        m_currentTimelineItem->addChildItem(item.release());
+    else
+        item->addToTimeline(m_frontend);
+}
+
+double InspectorTimelineAgent::currentTimeInMilliseconds()
+{
+    return currentTime() * 1000.0;
+}
+
+double InspectorTimelineAgent::sessionTimeInMilliseconds()
+{
+    return currentTimeInMilliseconds() - m_sessionStartTime;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
new file mode 100644
index 0000000..4095fed
--- /dev/null
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -0,0 +1,77 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorTimelineAgent_h
+#define InspectorTimelineAgent_h
+
+#include "ScriptObject.h"
+#include "ScriptArray.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+    class Event;
+    class InspectorFrontend;
+    class TimelineItem;
+
+    class InspectorTimelineAgent {
+    public:
+        InspectorTimelineAgent(InspectorFrontend* frontend);
+        ~InspectorTimelineAgent();
+
+        void reset();
+
+        // Methods called from WebCore.
+        void willDispatchDOMEvent(const Event&);
+        void didDispatchDOMEvent();
+        void willLayout();
+        void didLayout();
+        void willRecalculateStyle();
+        void didRecalculateStyle();
+        void willPaint();
+        void didPaint();
+        void didWriteHTML();
+        void willWriteHTML();
+    private:
+        double sessionTimeInMilliseconds();
+
+        static double currentTimeInMilliseconds();
+
+        void didCompleteCurrentRecord();
+
+        double m_sessionStartTime;
+        InspectorFrontend* m_frontend;
+        OwnPtr<TimelineItem> m_currentTimelineItem;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorTimelineAgent_h)
diff --git a/WebCore/inspector/JavaScriptDebugServer.cpp b/WebCore/inspector/JavaScriptDebugServer.cpp
index 10eff26..e460ae8 100644
--- a/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,10 +45,8 @@
 #include "ScrollView.h"
 #include "Widget.h"
 #include "ScriptController.h"
-#include <runtime/CollectorHeapIterator.h>
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSLock.h>
-#include <parser/Parser.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/UnusedParam.h>
@@ -59,6 +57,16 @@ namespace WebCore {
 
 typedef JavaScriptDebugServer::ListenerSet ListenerSet;
 
+inline const UString& JavaScriptDebugServer::BreakpointInfo::condition() const
+{
+    return m_condition;
+}
+
+void JavaScriptDebugServer::BreakpointInfo::setCondition(const UString& condition)
+{
+    m_condition = condition;
+}
+
 JavaScriptDebugServer& JavaScriptDebugServer::shared()
 {
     DEFINE_STATIC_LOCAL(JavaScriptDebugServer, server, ());
@@ -157,42 +165,86 @@ bool JavaScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::addBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines) {
-        lines = new HashSet<unsigned>;
-        m_breakpoints.set(sourceID, lines);
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints) {
+        sourceBreakpoints = new LineToBreakpointInfoMap;
+        m_breakpoints.set(sourceID, sourceBreakpoints);
     }
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        sourceBreakpoints->set(lineNumber, new BreakpointInfo(condition));
+    else
+        updateBreakpointInfo(info, condition);
+}
 
-    lines->add(lineNumber);
+JavaScriptDebugServer::BreakpointInfo* JavaScriptDebugServer::breakpointInfo(intptr_t sourceID, unsigned lineNumber) const
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
+        return 0;
+    return sourceBreakpoints->get(lineNumber);
 }
 
-void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void JavaScriptDebugServer::updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const UString& condition)
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return;
+    updateBreakpointInfo(info, condition);
+}
 
-    lines->remove(lineNumber);
+void JavaScriptDebugServer::updateBreakpointInfo(BreakpointInfo* info, const UString& condition)
+{
+    info->setCondition(condition);
+}
 
-    if (!lines->isEmpty())
+void JavaScriptDebugServer::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+{
+    LineToBreakpointInfoMap* sourceBreakpoints = m_breakpoints.get(sourceID);
+    if (!sourceBreakpoints)
         return;
 
-    m_breakpoints.remove(sourceID);
-    delete lines;
+    BreakpointInfo* info = sourceBreakpoints->get(lineNumber);
+    if (!info)
+        return;
+
+    sourceBreakpoints->remove(lineNumber);
+    delete info;
+
+    if (sourceBreakpoints->isEmpty()) {
+        m_breakpoints.remove(sourceID);
+        delete sourceBreakpoints;
+    }
 }
 
 bool JavaScriptDebugServer::hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const
 {
-    HashSet<unsigned>* lines = m_breakpoints.get(sourceID);
-    if (!lines)
+    BreakpointInfo* info = breakpointInfo(sourceID, lineNumber);
+    if (!info)
         return false;
-    return lines->contains(lineNumber);
+
+    // An empty condition counts as no condition which is equivalent to "true".
+    if (info->condition().isEmpty())
+        return true;
+
+    JSValue exception;
+    JSValue result = m_currentCallFrame->evaluate(info->condition(), exception);
+    if (exception) {
+        // An erroneous condition counts as "false".
+        return false;
+    }
+    return result.toBoolean(m_currentCallFrame->scopeChain()->globalObject->globalExec());
 }
 
 void JavaScriptDebugServer::clearBreakpoints()
 {
+    BreakpointsMap::iterator end = m_breakpoints.end();
+    for (BreakpointsMap::iterator it = m_breakpoints.begin(); it != end; ++it) {
+        deleteAllValues(*(it->second));
+        it->second->clear();
+    }
     deleteAllValues(m_breakpoints);
     m_breakpoints.clear();
 }
@@ -299,8 +351,6 @@ void JavaScriptDebugServer::sourceParsed(ExecState* exec, const SourceCode& sour
 
     m_callingListeners = true;
 
-    ASSERT(hasListeners());
-
     bool isError = errorLine != -1;
 
     if (hasGlobalListeners()) {
@@ -555,60 +605,7 @@ void JavaScriptDebugServer::recompileAllJSFunctionsSoon()
 void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>*)
 {
     JSLock lock(SilenceAssertionsOnly);
-    JSGlobalData* globalData = JSDOMWindow::commonJSGlobalData();
-
-    // If JavaScript is running, it's not safe to recompile, since we'll end
-    // up throwing away code that is live on the stack.
-    ASSERT(!globalData->dynamicGlobalObject);
-    if (globalData->dynamicGlobalObject)
-        return;
-
-    Vector<ProtectedPtr<JSFunction> > functions;
-    Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
-    for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info)) {
-            JSFunction* function = static_cast<JSFunction*>(*it);
-            if (!function->isHostFunction())
-                functions.append(function);
-        }
-    }
-
-    typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
-    typedef HashMap<SourceProvider*, ExecState*> SourceProviderMap;
-
-    FunctionBodyMap functionBodies;
-    SourceProviderMap sourceProviders;
-
-    size_t size = functions.size();
-    for (size_t i = 0; i < size; ++i) {
-        JSFunction* function = functions[i];
-
-        FunctionBodyNode* oldBody = function->body();
-        pair<FunctionBodyMap::iterator, bool> result = functionBodies.add(oldBody, 0);
-        if (!result.second) {
-            function->setBody(result.first->second.get());
-            continue;
-        }
-
-        ExecState* exec = function->scope().globalObject()->JSGlobalObject::globalExec();
-        const SourceCode& sourceCode = oldBody->source();
-
-        RefPtr<FunctionBodyNode> newBody = globalData->parser->parse<FunctionBodyNode>(exec, 0, sourceCode);
-        ASSERT(newBody);
-        newBody->finishParsing(oldBody->copyParameters(), oldBody->parameterCount());
-
-        result.first->second = newBody;
-        function->setBody(newBody.release());
-
-        if (hasListeners() && function->scope().globalObject()->debugger() == this)
-            sourceProviders.add(sourceCode.provider(), exec);
-    }
-
-    // Call sourceParsed() after reparsing all functions because it will execute
-    // JavaScript in the inspector.
-    SourceProviderMap::const_iterator end = sourceProviders.end();
-    for (SourceProviderMap::const_iterator iter = sourceProviders.begin(); iter != end; ++iter)
-        sourceParsed((*iter).second, SourceCode((*iter).first), -1, 0);
+    Debugger::recompileAllJSFunctions(JSDOMWindow::commonJSGlobalData());
 }
 
 void JavaScriptDebugServer::didAddListener(Page* page)
diff --git a/WebCore/inspector/JavaScriptDebugServer.h b/WebCore/inspector/JavaScriptDebugServer.h
index baa6699..33c6e3d 100644
--- a/WebCore/inspector/JavaScriptDebugServer.h
+++ b/WebCore/inspector/JavaScriptDebugServer.h
@@ -33,6 +33,7 @@
 
 #include "Timer.h"
 #include <debugger/Debugger.h>
+#include <runtime/UString.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -61,7 +62,8 @@ namespace WebCore {
         void addListener(JavaScriptDebugListener*, Page*);
         void removeListener(JavaScriptDebugListener*, Page*);
 
-        void addBreakpoint(intptr_t sourceID, unsigned lineNumber);
+        void addBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
+        void updateBreakpoint(intptr_t sourceID, unsigned lineNumber, const JSC::UString& condition);
         void removeBreakpoint(intptr_t sourceID, unsigned lineNumber);
         bool hasBreakpoint(intptr_t sourceID, unsigned lineNumber) const;
         void clearBreakpoints();
@@ -86,6 +88,15 @@ namespace WebCore {
         typedef void (JavaScriptDebugListener::*JavaScriptExecutionCallback)();
 
     private:
+        class BreakpointInfo {
+        public:
+            BreakpointInfo(const JSC::UString& condition) : m_condition(condition) {}
+            const JSC::UString& condition() const;
+            void setCondition(const JSC::UString& condition);
+        private:
+            JSC::UString m_condition;
+        };
+
         JavaScriptDebugServer();
         ~JavaScriptDebugServer();
 
@@ -100,7 +111,9 @@ namespace WebCore {
 
         void dispatchFunctionToListeners(JavaScriptExecutionCallback, Page*);
         void pauseIfNeeded(Page*);
-        
+        BreakpointInfo* breakpointInfo(intptr_t sourceID, unsigned lineNumber) const;
+        void updateBreakpointInfo(BreakpointInfo* info, const JSC::UString& condition);
+
         virtual void detach(JSC::JSGlobalObject*);
 
         virtual void sourceParsed(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMsg);
@@ -111,12 +124,15 @@ namespace WebCore {
         virtual void willExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
         virtual void didExecuteProgram(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
         virtual void didReachBreakpoint(const JSC::DebuggerCallFrame&, intptr_t sourceID, int lineno);
-        
+
         void didAddListener(Page*);
         void didRemoveListener(Page*);
         void didRemoveLastListener();
 
         typedef HashMap<Page*, ListenerSet*> PageListenersMap;
+        typedef HashMap<unsigned, BreakpointInfo*> LineToBreakpointInfoMap;
+        typedef HashMap<intptr_t, LineToBreakpointInfoMap*> BreakpointsMap;
+
         PageListenersMap m_pageListenersMap;
         ListenerSet m_listeners;
         bool m_callingListeners;
@@ -126,7 +142,7 @@ namespace WebCore {
         bool m_doneProcessingDebuggerEvents;
         JavaScriptCallFrame* m_pauseOnCallFrame;
         RefPtr<JavaScriptCallFrame> m_currentCallFrame;
-        HashMap<intptr_t, HashSet<unsigned>*> m_breakpoints;
+        BreakpointsMap m_breakpoints;
         Timer<JavaScriptDebugServer> m_recompileTimer;
     };
 
diff --git a/WebCore/inspector/TimelineItem.cpp b/WebCore/inspector/TimelineItem.cpp
new file mode 100644
index 0000000..b368c49
--- /dev/null
+++ b/WebCore/inspector/TimelineItem.cpp
@@ -0,0 +1,81 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "TimelineItem.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "InspectorFrontend.h"
+#include "ScriptArray.h"
+#include "ScriptObject.h"
+
+namespace WebCore {
+
+TimelineItem::TimelineItem(PassOwnPtr<TimelineItem> previous, double startTime, TimelineItemType itemType)
+    : m_startTime(startTime)
+    , m_endTime(0.0)
+    , m_itemType(itemType)
+    , m_previous(previous)
+{
+}
+
+void TimelineItem::addToTimeline(InspectorFrontend* frontend)
+{
+    frontend->addItemToTimeline(convertToScriptObject(frontend));
+}
+
+ScriptObject TimelineItem::convertToScriptObject(InspectorFrontend* frontend)
+{
+    ScriptObject selfObj = frontend->newScriptObject();
+    selfObj.set("time", m_startTime);
+    selfObj.set("type", static_cast<int>(m_itemType));
+    selfObj.set("duration", m_endTime - m_startTime);
+    ScriptArray children = convertChildrenToScriptArray(frontend);
+    selfObj.set("children", children);
+    return selfObj;
+}
+
+ScriptArray TimelineItem::convertChildrenToScriptArray(InspectorFrontend* frontend)
+{
+    ScriptArray children = frontend->newScriptArray();
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        children.set(i, m_children[i]->convertToScriptObject(frontend));
+    return children;
+}
+
+void TimelineItem::addChildItem(PassOwnPtr<TimelineItem> timelineItem)
+{
+    m_children.append(timelineItem);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/TimelineItem.h b/WebCore/inspector/TimelineItem.h
new file mode 100644
index 0000000..1909230
--- /dev/null
+++ b/WebCore/inspector/TimelineItem.h
@@ -0,0 +1,88 @@
+/*
+* Copyright (C) 2009 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef TimelineItem_h
+#define TimelineItem_h
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class InspectorFrontend;
+    class TimelineItem;
+    class ScriptArray;
+    class ScriptObject;
+
+    typedef Vector<OwnPtr<TimelineItem> > TimelineItems;
+
+    // Must be kept in sync with TimelineAgent.js
+    enum TimelineItemType {
+        DOMDispatchTimelineItemType = 0,
+        LayoutTimelineItemType = 1,
+        RecalculateStylesTimelineItemType = 2,
+        PaintTimelineItemType = 3,
+        ParseHTMLTimelineItemType = 4,
+    };
+
+    class TimelineItem {
+    public:
+        TimelineItem(PassOwnPtr<TimelineItem>, double startTime, TimelineItemType);
+
+        virtual ~TimelineItem() { }
+
+        TimelineItem* previous() const { return m_previous.get(); }
+
+        PassOwnPtr<TimelineItem*> releasePrevious() { return m_previous.release(); }
+
+        void addToTimeline(InspectorFrontend*);
+
+        void addChildItem(PassOwnPtr<TimelineItem>);
+
+        void setEndTime(double endTime) { m_endTime = endTime; }
+
+        TimelineItemType type() { return m_itemType; }
+    protected:
+        virtual ScriptObject convertToScriptObject(InspectorFrontend*);
+
+        ScriptArray convertChildrenToScriptArray(InspectorFrontend*);
+      
+    private:
+        double m_startTime;
+        double m_endTime;
+        TimelineItemType m_itemType;
+        OwnPtr<TimelineItem> m_previous;
+        TimelineItems m_children;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(TimelineItem_h)
diff --git a/WebCore/inspector/front-end/Breakpoint.js b/WebCore/inspector/front-end/Breakpoint.js
index 347df60..292975a 100644
--- a/WebCore/inspector/front-end/Breakpoint.js
+++ b/WebCore/inspector/front-end/Breakpoint.js
@@ -23,13 +23,14 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Breakpoint = function(url, line, sourceID)
+WebInspector.Breakpoint = function(url, line, sourceID, condition)
 {
     this.url = url;
     this.line = line;
     this.sourceID = sourceID;
     this._enabled = true;
     this._sourceText = "";
+    this._condition = condition || "";
 }
 
 WebInspector.Breakpoint.prototype = {
@@ -71,6 +72,24 @@ WebInspector.Breakpoint.prototype = {
     get id()
     {
         return this.sourceID + ":" + this.line;
+    },
+
+    get condition()
+    {
+        return this._condition;
+    },
+
+    set condition(c)
+    {
+        c = c || "";
+        if (this._condition === c)
+            return;
+
+        this._condition = c;
+        this.dispatchEventToListeners("condition-changed");
+
+        if (this.enabled)
+            InspectorController.updateBreakpoint(this.sourceID, this.line, c);
     }
 }
 
diff --git a/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 14f8c06..e6edece 100644
--- a/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -62,7 +62,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
     },
 
     _appendBreakpointElement: function(breakpoint)
@@ -150,7 +150,7 @@ WebInspector.BreakpointsSidebarPane.prototype = {
             return;
 
         if (breakpoint.enabled)
-            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+            InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
         else
             InspectorController.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
diff --git a/WebCore/inspector/front-end/CallStackSidebarPane.js b/WebCore/inspector/front-end/CallStackSidebarPane.js
index c08cc7a..2fe4315 100644
--- a/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -39,14 +39,14 @@ WebInspector.CallStackSidebarPane = function()
 }
 
 WebInspector.CallStackSidebarPane.prototype = {
-    update: function(callFrame, sourceIDMap)
+    update: function(callFrames, sourceIDMap)
     {
         this.bodyElement.removeChildren();
 
         this.placards = [];
         delete this._selectedCallFrame;
 
-        if (!callFrame) {
+        if (!callFrames) {
             var infoElement = document.createElement("div");
             infoElement.className = "info";
             infoElement.textContent = WebInspector.UIString("Not Paused");
@@ -58,7 +58,8 @@ WebInspector.CallStackSidebarPane.prototype = {
         var subtitle;
         var scriptOrResource;
 
-        do {
+        for (var i = 0; i < callFrames.length; ++i) {
+            var callFrame = callFrames[i];
             switch (callFrame.type) {
             case "function":
                 title = callFrame.functionName || WebInspector.UIString("(anonymous function)");
@@ -85,9 +86,7 @@ WebInspector.CallStackSidebarPane.prototype = {
 
             this.placards.push(placard);
             this.bodyElement.appendChild(placard.element);
-
-            callFrame = callFrame.caller;
-        } while (callFrame);
+        }
     },
 
     get selectedCallFrame()
diff --git a/WebCore/inspector/front-end/Color.js b/WebCore/inspector/front-end/Color.js
index 7968ee4..9d9cd76 100644
--- a/WebCore/inspector/front-end/Color.js
+++ b/WebCore/inspector/front-end/Color.js
@@ -30,7 +30,7 @@
 WebInspector.Color = function(str)
 {
     this.value = str;
-    this.parse();
+    this._parse();
 }
 
 WebInspector.Color.prototype = {
@@ -70,7 +70,7 @@ WebInspector.Color.prototype = {
             return this._rgb;
 
         if (this.simple)
-            this._rgb = this.hexToRgb(this.hex);
+            this._rgb = this._hexToRGB(this.hex);
         else {
             var rgba = this.rgba;
             this._rgb = [rgba[0], rgba[1], rgba[2]];
@@ -89,7 +89,7 @@ WebInspector.Color.prototype = {
         if ("_hsl" in this)
             return this._hsl;
 
-        this._hsl = this.rgbToHsl(this.rgb);
+        this._hsl = this._rgbToHSL(this.rgb);
         return this._hsl;
     },
 
@@ -137,44 +137,34 @@ WebInspector.Color.prototype = {
         return (shorthex && shorthex.length === 3);
     },
 
-    toRgb: function()
+    toString: function(format)
     {
-        return "rgb(" + this.rgb.join(", ") + ")";
-    },
-
-    toHsl: function()
-    {
-        var hsl = this.hsl;
-        return "hsl(" + hsl[0] + ", " + hsl[1] + "%, " + hsl[2] + "%)";
-    },
-
-    toShortHex: function()
-    {
-        return "#" + this.shorthex;
-    },
-
-    toHex: function()
-    {
-        return "#" + this.hex;
-    },
-
-    toRgba: function()
-    {
-        return "rgba(" + this.rgba.join(", ") + ")";
-    },
-
-    toHsla: function()
-    {
-        var hsla = this.hsla;
-        return "hsla(" + hsla[0] + ", " + hsla[1] + "%, " + hsla[2] + "%, " + hsla[3] + ")";
-    },
+        if (!format)
+            format = this.format;
+
+        switch (format) {
+            case "rgb":
+                return "rgb(" + this.rgb.join(", ") + ")";
+            case "rgba":
+                return "rgba(" + this.rgba.join(", ") + ")";
+            case "hsl":
+                var hsl = this.hsl;
+                return "hsl(" + hsl[0] + ", " + hsl[1] + "%, " + hsl[2] + "%)";
+            case "hsla":
+                var hsla = this.hsla;
+                return "hsla(" + hsla[0] + ", " + hsla[1] + "%, " + hsla[2] + "%, " + hsla[3] + ")";
+            case "hex":
+                return "#" + this.hex;
+            case "shorthex":
+                return "#" + this.shorthex;
+            case "nickname":
+                return this.nickname;
+        }
 
-    toNickname: function()
-    {
-        return this.nickname;
+        throw "invalid color format";
     },
 
-    rgbToHex: function(rgb)
+    _rgbToHex: function(rgb)
     {
         var r = parseInt(rgb[0]).toString(16);
         var g = parseInt(rgb[1]).toString(16);
@@ -189,7 +179,7 @@ WebInspector.Color.prototype = {
         return (r + g + b).toUpperCase();
     },
 
-    hexToRgb: function(hex)
+    _hexToRGB: function(hex)
     {
         var r = parseInt(hex.substring(0,2), 16);
         var g = parseInt(hex.substring(2,4), 16);
@@ -198,7 +188,7 @@ WebInspector.Color.prototype = {
         return [r, g, b];
     },
 
-    rgbToHsl: function(rgb)
+    _rgbToHSL: function(rgb)
     {
         var r = parseInt(rgb[0]) / 255;
         var g = parseInt(rgb[1]) / 255;
@@ -235,7 +225,7 @@ WebInspector.Color.prototype = {
         return [h, s, l];
     },
 
-    hslToRgb: function(hsl)
+    _hslToRGB: function(hsl)
     {
         var h = parseFloat(hsl[0]) / 360;
         var s = parseFloat(hsl[1]) / 100;
@@ -252,12 +242,12 @@ WebInspector.Color.prototype = {
         var tg = h;
         var tb = h - (1 / 3);
 
-        var r = Math.round(hueToRgb(p, q, tr) * 255);
-        var g = Math.round(hueToRgb(p, q, tg) * 255);
-        var b = Math.round(hueToRgb(p, q, tb) * 255);
+        var r = Math.round(hueToRGB(p, q, tr) * 255);
+        var g = Math.round(hueToRGB(p, q, tg) * 255);
+        var b = Math.round(hueToRGB(p, q, tb) * 255);
         return [r, g, b];
 
-        function hueToRgb(p, q, h) {
+        function hueToRGB(p, q, h) {
             if (h < 0)
                 h += 1;
             else if (h > 1)
@@ -274,28 +264,28 @@ WebInspector.Color.prototype = {
         }
     },
 
-    rgbaToHsla: function(rgba)
+    _rgbaToHSLA: function(rgba)
     {
         var alpha = rgba[3];
-        var hsl = this.rgbToHsl(rgba)
+        var hsl = this._rgbToHSL(rgba)
         hsl.push(alpha);
         return hsl;
     },
 
-    hslaToRgba: function(hsla)
+    _hslaToRGBA: function(hsla)
     {
         var alpha = hsla[3];
-        var rgb = this.hslToRgb(hsla);
+        var rgb = this._hslToRGB(hsla);
         rgb.push(alpha);
         return rgb;
     },
 
-    parse: function()
+    _parse: function()
     {
         // Special Values - Advanced but Must Be Parsed First - transparent
         var value = this.value.toLowerCase().replace(/%|\s+/g, "");
         if (value in WebInspector.Color.AdvancedNickNames) {
-            this.mode = "nickname";
+            this.format = "nickname";
             var set = WebInspector.Color.AdvancedNickNames[value];
             this.simple = false;
             this.rgba = set[0];
@@ -314,30 +304,30 @@ WebInspector.Color.prototype = {
             if (match[1]) { // hex
                 var hex = match[1].toUpperCase();
                 if (hex.length === 3) {
-                    this.mode = "shorthex";
+                    this.format = "shorthex";
                     this.hex = hex.charAt(0) + hex.charAt(0) + hex.charAt(1) + hex.charAt(1) + hex.charAt(2) + hex.charAt(2);
                 } else {
-                    this.mode = "hex";
+                    this.format = "hex";
                     this.hex = hex;
                 }
             } else if (match[2]) { // rgb
-                this.mode = "rgb";
+                this.format = "rgb";
                 var rgb = match[2].split(/\s*,\s*/);
                 this.rgb = rgb;
-                this.hex = this.rgbToHex(rgb);
+                this.hex = this._rgbToHex(rgb);
             } else if (match[3]) { // nickname
                 var nickname = match[3].toLowerCase();
                 if (nickname in WebInspector.Color.Nicknames) {
-                    this.mode = "nickname";
+                    this.format = "nickname";
                     this.hex = WebInspector.Color.Nicknames[nickname];
                 } else // unknown name
-                    throw("unknown color name");
+                    throw "unknown color name";
             } else if (match[4]) { // hsl
-                this.mode = "hsl";
+                this.format = "hsl";
                 var hsl = match[4].replace(/%g/, "").split(/\s*,\s*/);
                 this.hsl = hsl;
-                this.rgb = this.hslToRgb(hsl);
-                this.hex = this.rgbToHex(this.rgb);
+                this.rgb = this._hslToRGB(hsl);
+                this.hex = this._rgbToHex(this.rgb);
             }
 
             // Fill in the values if this is a known hex color
@@ -358,14 +348,14 @@ WebInspector.Color.prototype = {
         if (match) {
             this.simple = false;
             if (match[1]) { // rgba
-                this.mode = "rgba";
+                this.format = "rgba";
                 this.rgba = match[1].split(/\s*,\s*/);
-                this.hsla = this.rgbaToHsla(this.rgba);
+                this.hsla = this._rgbaToHSLA(this.rgba);
                 this.alpha = this.rgba[3];
             } else if (match[2]) { // hsla
-                this.mode = "hsla";
+                this.format = "hsla";
                 this.hsla = match[2].replace(/%/g, "").split(/\s*,\s*/);
-                this.rgba = this.hslaToRgba(this.hsla);
+                this.rgba = this._hslaToRGBA(this.hsla);
                 this.alpha = this.hsla[3];
             }
 
@@ -373,7 +363,7 @@ WebInspector.Color.prototype = {
         }
 
         // Could not parse as a valid color
-        throw("could not parse color");
+        throw "could not parse color";
     }
 }
 
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 6851eea..3782d32 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -57,10 +57,87 @@ WebInspector.ConsoleView = function(drawer)
 
     var anchoredStatusBar = document.getElementById("anchored-status-bar-items");
     anchoredStatusBar.appendChild(this.toggleConsoleButton);
-
+    
+    // Will hold the list of filter elements
+    this.filterBarElement = document.getElementById("console-filter");
+    
+    function createDividerElement() {
+        var dividerElement = document.createElement("div");
+        
+        dividerElement.addStyleClass("divider");
+        
+        this.filterBarElement.appendChild(dividerElement);
+    }
+    
+    function createFilterElement(category) {
+        var categoryElement = document.createElement("li");
+        categoryElement.category = category;
+     
+        categoryElement.addStyleClass(categoryElement.category);
+            
+        var label = category.toString();
+        categoryElement.appendChild(document.createTextNode(label));
+     
+        categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+     
+        this.filterBarElement.appendChild(categoryElement);
+        return categoryElement;
+    }
+    
+    this.allElement = createFilterElement.call(this, "All");
+    
+    createDividerElement.call(this);
+    
+    this.errorElement = createFilterElement.call(this, "Errors");
+    this.warningElement = createFilterElement.call(this, "Warnings");
+    this.logElement = createFilterElement.call(this, "Logs");
+
+    this.filter(this.allElement);
 }
 
 WebInspector.ConsoleView.prototype = {
+    
+    _updateFilter: function(e)
+    {
+        this.filter(e.target);
+    },
+    
+    filter: function(target)
+    {
+        if (target.category == "All") {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect all, so we break early here
+                return;
+            }
+            
+            this.errorElement.removeStyleClass("selected");
+            this.warningElement.removeStyleClass("selected");
+            this.logElement.removeStyleClass("selected");
+            
+            document.getElementById("console-messages").removeStyleClass("filter-errors");
+            document.getElementById("console-messages").removeStyleClass("filter-warnings");
+            document.getElementById("console-messages").removeStyleClass("filter-logs");
+        } else {
+            // Something other than all is being selected, so we want to unselect all
+            if (this.allElement.hasStyleClass("selected")) {
+                this.allElement.removeStyleClass("selected");
+                document.getElementById("console-messages").removeStyleClass("filter-all");
+            }
+        }
+        
+        if (target.hasStyleClass("selected")) {
+            target.removeStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.removeStyleClass(newClass);
+        } else {
+            target.addStyleClass("selected");
+            var newClass = "filter-" + target.category.toLowerCase();
+            var filterElement = document.getElementById("console-messages");
+            filterElement.addStyleClass(newClass);
+        }
+    },
+    
     _toggleConsoleButtonClicked: function()
     {
         this.drawer.visibleView = this;
@@ -70,6 +147,7 @@ WebInspector.ConsoleView.prototype = {
     {
         mainElement.appendChild(this.element);
         statusBarElement.appendChild(this.clearButton);
+        statusBarElement.appendChild(this.filterBarElement);
     },
 
     show: function()
@@ -175,7 +253,7 @@ WebInspector.ConsoleView.prototype = {
     clearMessages: function(clearInspectorController)
     {
         if (clearInspectorController)
-            InspectorController.clearMessages();
+            InspectorController.clearMessages(false);
         if (WebInspector.panels.resources)
             WebInspector.panels.resources.clearMessages();
 
@@ -212,10 +290,28 @@ WebInspector.ConsoleView.prototype = {
             return;
 
         var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
-        this._evalInInspectedWindow(expressionString, reportCompletions);
+        // Collect comma separated object properties for the completion.
+
+        if (!expressionString) {
+            if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
+                // Evaluate into properties in scope of the selected call frame.
+                reportCompletions(WebInspector.panels.scripts.variablesInSelectedCallFrame());
+                return;
+            } else {
+                expressionString = "this";
+            }
+        }
+
+        var includeInspectorCommandLineAPI = (!dotNotation && !bracketNotation);
+        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
+            var callFrameId = WebInspector.panels.scripts.selectedCallFrameId();
+        InjectedScriptAccess.getCompletions(expressionString, includeInspectorCommandLineAPI, callFrameId, reportCompletions);
     },
 
-    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result) {
+    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result, isException) {
+        if (isException)
+            return;
+
         if (bracketNotation) {
             if (prefix.length && prefix[0] === "'")
                 var quoteUsed = "'";
@@ -224,16 +320,7 @@ WebInspector.ConsoleView.prototype = {
         }
 
         var results = [];
-        var properties = Object.properties(result);
-        if (!dotNotation && !bracketNotation && result._inspectorCommandLineAPI) {
-            var commandLineAPI = Object.properties(result._inspectorCommandLineAPI);
-            for (var i = 0; i < commandLineAPI.length; ++i) {
-                var property = commandLineAPI[i];
-                if (property.charAt(0) !== "_")
-                    properties.push(property);
-            }
-        }
-        properties.sort();
+        var properties = Object.sortedProperties(result);
 
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
@@ -288,7 +375,7 @@ WebInspector.ConsoleView.prototype = {
         if (!link || !link.representedNode)
             return;
 
-        WebInspector.updateFocusedNode(link.representedNode);
+        WebInspector.updateFocusedNode(link.representedNode.id);
         event.stopPropagation();
         event.preventDefault();
     },
@@ -304,106 +391,27 @@ WebInspector.ConsoleView.prototype = {
         this.prompt.handleKeyEvent(event);
     },
 
-    _evalInInspectedWindow: function(expression, callback)
+    evalInInspectedWindow: function(expression, objectGroup, callback)
     {
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
-            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, objectGroup, callback);
             return;
         }
-        this.doEvalInWindow(expression, callback);
-    },
-
-    _ensureCommandLineAPIInstalled: function(inspectedWindow)
-    {
-        if (!inspectedWindow._inspectorCommandLineAPI) {
-            inspectedWindow.eval("window._inspectorCommandLineAPI = { \
-                $: function() { return document.getElementById.apply(document, arguments) }, \
-                $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
-                $x: function(xpath, context) { \
-                    var nodes = []; \
-                    try { \
-                        var doc = context || document; \
-                        var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
-                        var node; \
-                        while (node = results.iterateNext()) nodes.push(node); \
-                    } catch (e) {} \
-                    return nodes; \
-                }, \
-                dir: function() { return console.dir.apply(console, arguments) }, \
-                dirxml: function() { return console.dirxml.apply(console, arguments) }, \
-                keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
-                values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
-                profile: function() { return console.profile.apply(console, arguments) }, \
-                profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
-                _inspectedNodes: [], \
-                get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
-                get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
-                get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
-                get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
-                get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
-            };");
-
-            inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(this.clearMessages.bind(this));
-            inspectedWindow._inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(inspectObject.bind(this));
-
-            function inspectObject(o)
-            {
-                if (arguments.length === 0)
-                    return;
-
-                InspectorController.inspectedWindow().console.log(o);
-                if (Object.type(o, InspectorController.inspectedWindow()) === "node") {
-                    WebInspector.showElementsPanel();
-                    WebInspector.panels.elements.treeOutline.revealAndSelectNode(o);
-                } else {
-                    switch (Object.describe(o)) {
-                        case "Database":
-                            WebInspector.showDatabasesPanel();
-                            WebInspector.panels.databases.selectDatabase(o);
-                            break;
-                        case "Storage":
-                            WebInspector.showDatabasesPanel();
-                            WebInspector.panels.databases.selectDOMStorage(o);
-                            break;
-                    }
-                }
-            }
-        }
+        this.doEvalInWindow(expression, objectGroup, callback);
     },
 
-    addInspectedNode: function(node)
-    {
-        var inspectedWindow = InspectorController.inspectedWindow();
-        this._ensureCommandLineAPIInstalled(inspectedWindow);
-        var inspectedNodes = inspectedWindow._inspectorCommandLineAPI._inspectedNodes;
-        inspectedNodes.unshift(node);
-        if (inspectedNodes.length >= 5)
-            inspectedNodes.pop();
-    },
-
-    doEvalInWindow: function(expression, callback)
+    doEvalInWindow: function(expression, objectGroup, callback)
     {
         if (!expression) {
             // There is no expression, so the completion should happen against global properties.
             expression = "this";
         }
 
-        // Surround the expression in with statements to inject our command line API so that
-        // the window object properties still take more precedent than our API functions.
-        expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
-
-        var self = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            var inspectedWindow = InspectorController.inspectedWindow();
-            self._ensureCommandLineAPIInstalled(inspectedWindow);
-            try {
-                callback(inspectedWindow.eval(expression));
-            } catch (e) {
-                callback(e, true);
-            }
-        }
-        setTimeout(delayedEvaluation, 0);
+            callback(result.value, result.isException);
+        };
+        InjectedScriptAccess.evaluate(expression, objectGroup, evalCallback);
     },
 
     _enterKeyPressed: function(event)
@@ -431,18 +439,23 @@ WebInspector.ConsoleView.prototype = {
             self.prompt.text = "";
             self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
         }
-        this._evalInInspectedWindow(str, printResult);
+        this.evalInInspectedWindow(str, "console", printResult);
     },
 
     _format: function(output, forceObjectFormat)
     {
-        var inspectedWindow = InspectorController.inspectedWindow();
+        var isProxy = (output != null && typeof output === "object");
+
         if (forceObjectFormat)
             var type = "object";
-        else if (output instanceof inspectedWindow.NodeList)
-            var type = "array";
         else
-            var type = Object.type(output, inspectedWindow);
+            var type = Object.proxyType(output);
+
+        if (isProxy && type !== "object" && type !== "function" && type !== "array" && type !== "node") {
+            // Unwrap primitive value, skip decoration.
+            output = output.description;
+            type = "undecorated"
+        }
 
         // We don't perform any special formatting on these types, so we just
         // pass them through the simple _formatvalue function.
@@ -451,8 +464,7 @@ WebInspector.ConsoleView.prototype = {
             "null": 1,
             "boolean": 1,
             "number": 1,
-            "date": 1,
-            "function": 1,
+            "undecorated": 1
         };
 
         var formatter;
@@ -479,6 +491,16 @@ WebInspector.ConsoleView.prototype = {
         elem.appendChild(document.createTextNode(val));
     },
 
+    _formatfunction: function(func, elem)
+    {
+        elem.appendChild(document.createTextNode(func.description));
+    },
+
+    _formatdate: function(date, elem)
+    {
+        elem.appendChild(document.createTextNode(date));
+    },
+
     _formatstring: function(str, elem)
     {
         elem.appendChild(document.createTextNode("\"" + str + "\""));
@@ -486,34 +508,48 @@ WebInspector.ConsoleView.prototype = {
 
     _formatregexp: function(re, elem)
     {
-        var formatted = String(re).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+        var formatted = String(re.description).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
         elem.appendChild(document.createTextNode(formatted));
     },
 
     _formatarray: function(arr, elem)
     {
-        elem.appendChild(document.createTextNode("["));
-        for (var i = 0; i < arr.length; ++i) {
-            elem.appendChild(this._format(arr[i]));
-            if (i < arr.length - 1)
-                elem.appendChild(document.createTextNode(", "));
+        var self = this;
+        function printResult(properties)
+        {
+            if (!properties)
+                return;
+            elem.appendChild(document.createTextNode("["));
+            for (var i = 0; i < properties.length; ++i) {
+                var property = properties[i].value;
+                elem.appendChild(self._format(property));
+                if (i < properties.length - 1)
+                    elem.appendChild(document.createTextNode(", "));
+            }
+            elem.appendChild(document.createTextNode("]"));
         }
-        elem.appendChild(document.createTextNode("]"));
+        InjectedScriptAccess.getProperties(arr, false, printResult);
     },
 
-    _formatnode: function(node, elem)
+    _formatnode: function(object, elem)
     {
-        var treeOutline = new WebInspector.ElementsTreeOutline();
-        treeOutline.rootDOMNode = node;
-        treeOutline.element.addStyleClass("outline-disclosure");
-        if (!treeOutline.children[0].hasChildren)
-            treeOutline.element.addStyleClass("single-node");
-        elem.appendChild(treeOutline.element);
+        function printNode(nodeId)
+        {
+            if (!nodeId)
+                return;
+            var treeOutline = new WebInspector.ElementsTreeOutline();
+            treeOutline.rootDOMNode = WebInspector.domAgent.nodeForId(nodeId);
+            treeOutline.element.addStyleClass("outline-disclosure");
+            if (!treeOutline.children[0].hasChildren)
+                treeOutline.element.addStyleClass("single-node");
+            elem.appendChild(treeOutline.element);
+        }
+        InjectedScriptAccess.pushNodeToFrontend(object, printNode);
     },
 
     _formatobject: function(obj, elem)
     {
-        elem.appendChild(new WebInspector.ObjectPropertiesSection(new WebInspector.ObjectProxy(obj), Object.describe(obj, true), null, null, true).element);
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, obj.description, null, true).element);
     },
 
     _formaterror: function(obj, elem)
@@ -595,6 +631,13 @@ WebInspector.ConsoleMessage.prototype = {
         if (!parameters.length)
             return formattedResult;
 
+        // Formatting code below assumes that parameters are all wrappers whereas frontend console
+        // API allows passing arbitrary values as messages (strings, numberts, etc.). Wrap them here.
+        for (var i = 0; i < parameters.length; ++i) {
+            if (typeof parameters[i] !== "object" && typeof parameters[i] !== "function")
+                parameters[i] = WebInspector.ObjectProxy.wrapPrimitiveValue(parameters[i]);
+        }
+
         function formatForConsole(obj)
         {
             return WebInspector.console._format(obj);
@@ -605,7 +648,7 @@ WebInspector.ConsoleMessage.prototype = {
             return WebInspector.console._format(obj, true);
         }
 
-        if (Object.type(parameters[0], InspectorController.inspectedWindow()) === "string") {
+        if (Object.proxyType(parameters[0]) === "string") {
             var formatters = {}
             for (var i in String.standardFormatters)
                 formatters[i] = String.standardFormatters[i];
@@ -626,7 +669,7 @@ WebInspector.ConsoleMessage.prototype = {
                 return a;
             }
 
-            var result = String.format(parameters[0], parameters.slice(1), formatters, formattedResult, append);
+            var result = String.format(parameters[0].description, parameters.slice(1), formatters, formattedResult, append);
             formattedResult = result.formattedResult;
             parameters = result.unusedSubstitutions;
             if (parameters.length)
@@ -634,8 +677,8 @@ WebInspector.ConsoleMessage.prototype = {
         }
 
         for (var i = 0; i < parameters.length; ++i) {
-            if (typeof parameters[i] === "string")
-                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i]));
+            if (Object.proxyType(parameters[i]) === "string")
+                formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i].description));
             else
                 formattedResult.appendChild(formatForConsole(parameters[i]));
 
@@ -683,6 +726,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Log:
                 element.addStyleClass("console-log-level");
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                element.addStyleClass("console-debug-level");
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 element.addStyleClass("console-warning-level");
                 break;
@@ -789,6 +835,9 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Warning:
                 levelString = "Warning";
                 break;
+            case WebInspector.ConsoleMessage.MessageLevel.Debug:
+                levelString = "Debug";
+                break;
             case WebInspector.ConsoleMessage.MessageLevel.Error:
                 levelString = "Error";
                 break;
@@ -835,7 +884,8 @@ WebInspector.ConsoleMessage.MessageLevel = {
     Tip: 0,
     Log: 1,
     Warning: 2,
-    Error: 3
+    Error: 3,
+    Debug: 4
 }
 
 WebInspector.ConsoleCommand = function(command)
@@ -859,10 +909,18 @@ WebInspector.ConsoleCommand.prototype = {
     }
 }
 
+WebInspector.ConsoleTextMessage = function(text, level)
+{
+    level = level || WebInspector.ConsoleMessage.MessageLevel.Log;
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, WebInspector.ConsoleMessage.MessageType.Log, level, 0, null, null, 1, text);
+}
+
+WebInspector.ConsoleTextMessage.prototype.__proto__ = WebInspector.ConsoleMessage.prototype;
+
 WebInspector.ConsoleCommandResult = function(result, exception, originatingCommand)
 {
     var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
-    var message = (exception ? String(result) : result);
+    var message = result;
     var line = (exception ? result.line : -1);
     var url = (exception ? result.sourceURL : null);
 
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
new file mode 100644
index 0000000..9397e7c
--- /dev/null
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -0,0 +1,275 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.CookieItemsView = function(cookieDomain)
+{
+    WebInspector.View.call(this);
+
+    this.element.addStyleClass("storage-view");
+    this.element.addStyleClass("table");
+
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
+    this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+    
+    this._cookieDomain = cookieDomain;
+}
+
+WebInspector.CookieItemsView.prototype = {
+    get statusBarItems()
+    {
+        return [this.refreshButton.element, this.deleteButton.element];
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.update();
+    },
+
+    hide: function()
+    {
+        WebInspector.View.prototype.hide.call(this);
+        this.deleteButton.visible = false;
+    },
+
+    update: function()
+    {
+        this.element.removeChildren();
+
+        var self = this;
+        function callback(cookies, isAdvanced) {
+            var dataGrid = (isAdvanced ? self.dataGridForCookies(cookies) : self.simpleDataGridForCookies(cookies));
+            if (dataGrid) {
+                self._dataGrid = dataGrid;
+                self.element.appendChild(dataGrid.element);
+                self._dataGrid.updateWidths();
+                if (isAdvanced)
+                    self.deleteButton.visible = true;
+            } else {
+                var emptyMsgElement = document.createElement("div");
+                emptyMsgElement.className = "storage-table-empty";
+                emptyMsgElement.textContent = WebInspector.UIString("This site has no cookies.");
+                self.element.appendChild(emptyMsgElement);
+                self._dataGrid = null;
+                self.deleteButton.visible = false;
+            }
+        }
+
+        WebInspector.Cookies.getCookiesAsync(callback, this._cookieDomain);
+    },
+
+    dataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        for (var i = 0; i < cookies.length; ++i)
+            cookies[i].expires = new Date(cookies[i].expires);
+
+        var columns = { 0: {}, 1: {}, 2: {}, 3: {}, 4: {}, 5: {}, 6: {}, 7: {} };
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+        columns[2].title = WebInspector.UIString("Domain");
+        columns[2].width = columns[2].title.length;
+        columns[3].title = WebInspector.UIString("Path");
+        columns[3].width = columns[3].title.length;
+        columns[4].title = WebInspector.UIString("Expires");
+        columns[4].width = columns[4].title.length;
+        columns[5].title = WebInspector.UIString("Size");
+        columns[5].width = columns[5].title.length;
+        columns[5].aligned = "right";
+        columns[6].title = WebInspector.UIString("HTTP");
+        columns[6].width = columns[6].title.length;
+        columns[6].aligned = "centered";
+        columns[7].title = WebInspector.UIString("Secure");
+        columns[7].width = columns[7].title.length;
+        columns[7].aligned = "centered";
+
+        function updateDataAndColumn(index, value) {
+            data[index] = value;
+            if (value.length > columns[index].width)
+                columns[index].width = value.length;
+        }
+
+        var data;
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            data = {};
+
+            updateDataAndColumn(0, cookie.name);
+            updateDataAndColumn(1, cookie.value);
+            updateDataAndColumn(2, cookie.domain);
+            updateDataAndColumn(3, cookie.path);
+            updateDataAndColumn(4, (cookie.session ? WebInspector.UIString("Session") : cookie.expires.toGMTString()));
+            updateDataAndColumn(5, Number.bytesToString(cookie.size, WebInspector.UIString));
+            updateDataAndColumn(6, (cookie.httpOnly ? "\u2713" : "")); // Checkmark
+            updateDataAndColumn(7, (cookie.secure ? "\u2713" : "")); // Checkmark
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.cookie = cookie;
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = 0;
+        for (var columnIdentifier in columns)
+            totalColumnWidths += columns[columnIdentifier].width;
+
+        // Enforce the Value column (the 2nd column) to be a max of 33%
+        // tweaking the raw total width because may massively outshadow the others
+        var valueColumnWidth = columns[1].width;
+        if (valueColumnWidth / totalColumnWidths > 0.33) {
+            totalColumnWidths -= valueColumnWidth;
+            totalColumnWidths *= 1.33;
+            columns[1].width = totalColumnWidths * 0.33;
+        }
+
+        // Calculate the percentage width for the columns.
+        const minimumPrecent = 6;
+        var recoupPercent = 0;
+        for (var columnIdentifier in columns) {
+            var width = columns[columnIdentifier].width;
+            width = Math.round((width / totalColumnWidths) * 100);
+            if (width < minimumPrecent) {
+                recoupPercent += (minimumPrecent - width);
+                width = minimumPrecent;
+            }
+            columns[columnIdentifier].width = width;
+        }
+
+        // Enforce the minimum percentage width. (need to narrow total percentage due to earlier additions)
+        while (recoupPercent > 0) {
+            for (var columnIdentifier in columns) {
+                if (columns[columnIdentifier].width > minimumPrecent) {
+                    --columns[columnIdentifier].width;
+                    --recoupPercent;
+                    if (!recoupPercent)
+                        break;
+                }
+            }
+        }
+
+        for (var columnIdentifier in columns)
+            columns[columnIdentifier].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+
+    simpleDataGridForCookies: function(cookies)
+    {
+        if (!cookies.length)
+            return null;
+
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Name");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+
+        var nodes = [];
+        for (var i = 0; i < cookies.length; ++i) {
+            var cookie = cookies[i];
+            var data = {};
+
+            var name = cookie.name;
+            data[0] = name;
+            if (name.length > columns[0].width)
+                columns[0].width = name.length;
+
+            var value = cookie.value;
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 20;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+
+        return dataGrid;
+    },
+    
+    resize: function()
+    {
+        if (this._datagrid)
+            this._dataGrid.updateWidths();
+    },
+
+    _deleteButtonClicked: function(event)
+    {
+        if (!this._dataGrid)
+            return;
+
+        var cookie = this._dataGrid.selectedNode.cookie;
+        InspectorController.deleteCookie(cookie.name, this._cookieDomain);
+        this.update();
+    },
+
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
+}
+
+WebInspector.CookieItemsView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/WebCore/inspector/front-end/DOMAgent.js b/WebCore/inspector/front-end/DOMAgent.js
index 5aacd41..25ffafa 100644
--- a/WebCore/inspector/front-end/DOMAgent.js
+++ b/WebCore/inspector/front-end/DOMAgent.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,9 +32,10 @@
 WebInspector.DOMNode = function(doc, payload) {
     this.ownerDocument = doc;
 
-    this._id = payload.id;
+    this.id = payload.id;
     this.nodeType = payload.nodeType;
     this.nodeName = payload.nodeName;
+    this.localName = payload.localName;
     this._nodeValue = payload.nodeValue;
     this.textContent = this.nodeValue;
 
@@ -48,14 +50,22 @@ WebInspector.DOMNode = function(doc, payload) {
     this.nextSibling = null;
     this.prevSibling = null;
     this.firstChild = null;
+    this.lastChild = null;
     this.parentNode = null;
 
-    if (payload.childNodes)
-        this._setChildrenPayload(payload.childNodes);
+    if (payload.children)
+        this._setChildrenPayload(payload.children);
 
     this._computedStyle = null;
     this.style = null;
     this._matchedCSSRules = [];
+
+    if (this.nodeType == Node.ELEMENT_NODE) {
+        if (this.nodeName == "HTML")
+            this.ownerDocument.documentElement = this;
+        if (this.nodeName == "BODY")
+            this.ownerDocument.body = this;
+    }
 }
 
 WebInspector.DOMNode.prototype = {
@@ -161,9 +171,11 @@ WebInspector.DOMNode.prototype = {
         this._childNodeCount = this.children.length;
         if (this._childNodeCount == 0) {
             this.firstChild = null;
+            this.lastChild = null;
             return;
         }
         this.firstChild = this.children[0];
+        this.lastChild = this.children[this._childNodeCount - 1];
         for (var i = 0; i < this._childNodeCount; ++i) {
             var child = this.children[i];
             child.nextSibling = i + 1 < this._childNodeCount ? this.children[i + 1] : null;
@@ -208,17 +220,9 @@ WebInspector.DOMNode.prototype = {
     }
 }
 
-WebInspector.DOMDocument = function(domAgent, defaultView)
+WebInspector.DOMDocument = function(domAgent, defaultView, payload)
 {
-    WebInspector.DOMNode.call(this, null,
-        {
-            id: 0,
-            nodeType: Node.DOCUMENT_NODE,
-            nodeName: "",
-            nodeValue: "",
-            attributes: [],
-            childNodeCount: 0
-        });
+    WebInspector.DOMNode.call(this, this, payload);
     this._listeners = {};
     this._domAgent = domAgent;
     this.defaultView = defaultView;
@@ -226,7 +230,7 @@ WebInspector.DOMDocument = function(domAgent, defaultView)
 
 WebInspector.DOMDocument.prototype = {
 
-    addEventListener: function(name, callback, useCapture)
+    addEventListener: function(name, callback)
     {
         var listeners = this._listeners[name];
         if (!listeners) {
@@ -236,7 +240,7 @@ WebInspector.DOMDocument.prototype = {
         listeners.push(callback);
     },
 
-    removeEventListener: function(name, callback, useCapture)
+    removeEventListener: function(name, callback)
     {
         var listeners = this._listeners[name];
         if (!listeners)
@@ -251,10 +255,12 @@ WebInspector.DOMDocument.prototype = {
     {
         var listeners = this._listeners[name];
         if (!listeners)
-          return;
+            return;
 
-        for (var i = 0; i < listeners.length; ++i)
-          listeners[i](event);
+        for (var i = 0; i < listeners.length; ++i) {
+            var listener = listeners[i];
+            listener.call(this, event);
+        }
     }
 }
 
@@ -301,68 +307,44 @@ WebInspector.DOMAgent = function() {
     this._window = new WebInspector.DOMWindow(this);
     this._idToDOMNode = null;
     this.document = null;
-
-    // Install onpopulate handler. This is a temporary measure.
-    // TODO: add this code into the original updateChildren once domAgent
-    // becomes primary source of DOM information.
-    // TODO2: update ElementsPanel to not track embedded iframes - it is already being handled
-    // in the agent backend.
-    var domAgent = this;
-    var originalUpdateChildren = WebInspector.ElementsTreeElement.prototype.updateChildren;
-    WebInspector.ElementsTreeElement.prototype.updateChildren = function()
-    {
-        domAgent.getChildNodesAsync(this.representedObject, originalUpdateChildren.bind(this));
-    };
-
-    // Mute console handle to avoid crash on selection change.
-    // TODO: Re-implement inspectorConsoleAPI to work in a serialized way and remove this workaround.
-    WebInspector.Console.prototype.addInspectedNode = function()
-    {
-    };
-
-    // Whitespace is ignored in InspectorDOMAgent already -> no need to filter.
-    // TODO: Either remove all of its usages or push value into the agent backend.
-    Preferences.ignoreWhitespace = false;
 }
 
 WebInspector.DOMAgent.prototype = {
-    get inspectedWindow()
+    get domWindow()
     {
         return this._window;
     },
 
-    getChildNodesAsync: function(parent, opt_callback)
+    getChildNodesAsync: function(parent, callback)
     {
         var children = parent.children;
-        if (children && opt_callback) {
-          opt_callback(children);
-          return;
+        if (children) {
+            callback(children);
+            return;
+        }
+        function mycallback() {
+            callback(parent.children);
         }
-        var mycallback = function() {
-            if (opt_callback) {
-                opt_callback(parent.children);
-            }
-        };
         var callId = WebInspector.Callback.wrap(mycallback);
-        InspectorController.getChildNodes(callId, parent._id);
+        InspectorController.getChildNodes(callId, parent.id);
     },
 
     setAttributeAsync: function(node, name, value, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node._id, name, value);
+        InspectorController.setAttribute(WebInspector.Callback.wrap(mycallback), node.id, name, value);
     },
 
     removeAttributeAsync: function(node, name, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node._id, name);
+        InspectorController.removeAttribute(WebInspector.Callback.wrap(mycallback), node.id, name);
     },
 
     setTextNodeValueAsync: function(node, text, callback)
     {
         var mycallback = this._didApplyDomChange.bind(this, node, callback);
-        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node._id, text);
+        InspectorController.setTextNodeValue(WebInspector.Callback.wrap(mycallback), node.id, text);
     },
 
     _didApplyDomChange: function(node, callback, success)
@@ -383,26 +365,31 @@ WebInspector.DOMAgent.prototype = {
         node._setAttributesPayload(attrsArray);
     },
 
-    getNodeForId: function(nodeId) {
+    nodeForId: function(nodeId) {
         return this._idToDOMNode[nodeId];
     },
 
-    _setDocumentElement: function(payload)
+    _setDocument: function(payload)
     {
-        this.document = new WebInspector.DOMDocument(this, this._window);
-        this._idToDOMNode = { 0 : this.document };
-        this._setChildNodes(0, [payload]);
-        this.document.documentElement = this.document.firstChild;
-        this.document.documentElement.ownerDocument = this.document;
+        this._idToDOMNode = {};
+        if (payload) {
+            this.document = new WebInspector.DOMDocument(this, this._window, payload);
+            this._idToDOMNode[payload.id] = this.document;
+            this._bindNodes(this.document.children);
+        } else
+            this.document = null;
         WebInspector.panels.elements.reset();
     },
 
+    _setDetachedRoot: function(payload)
+    {
+        var root = new WebInspector.DOMNode(this.document, payload);
+        this._idToDOMNode[payload.id] = root;
+    },
+
     _setChildNodes: function(parentId, payloads)
     {
         var parent = this._idToDOMNode[parentId];
-        if (parent.children) {
-          return;
-        }
         parent._setChildrenPayload(payloads);
         this._bindNodes(parent.children);
     },
@@ -411,21 +398,20 @@ WebInspector.DOMAgent.prototype = {
     {
         for (var i = 0; i < children.length; ++i) {
             var child = children[i];
-            this._idToDOMNode[child._id] = child;
+            this._idToDOMNode[child.id] = child;
             if (child.children)
                 this._bindNodes(child.children);
         }
     },
 
-    _hasChildrenUpdated: function(nodeId, newValue)
+    _childNodeCountUpdated: function(nodeId, newValue)
     {
         var node = this._idToDOMNode[nodeId];
+        node._childNodeCount = newValue;
         var outline = WebInspector.panels.elements.treeOutline;
         var treeElement = outline.findTreeElement(node);
-        if (treeElement) {
+        if (treeElement)
             treeElement.hasChildren = newValue;
-            treeElement.whitespaceIgnored = Preferences.ignoreWhitespace;
-        }
     },
 
     _childNodeInserted: function(parentId, prevId, payload)
@@ -433,7 +419,7 @@ WebInspector.DOMAgent.prototype = {
         var parent = this._idToDOMNode[parentId];
         var prev = this._idToDOMNode[prevId];
         var node = parent._insertChild(prev, payload);
-        this._idToDOMNode[node._id] = node;
+        this._idToDOMNode[node.id] = node;
         var event = { target : node, relatedNode : parent };
         this.document._fireDomEvent("DOMNodeInserted", event);
     },
@@ -449,8 +435,53 @@ WebInspector.DOMAgent.prototype = {
     }
 }
 
-WebInspector.CSSStyleDeclaration = function(payload) {
-    this._id = payload.id;
+WebInspector.Cookies = {}
+
+WebInspector.Cookies.getCookiesAsync = function(callback, cookieDomain)
+{
+    function mycallback(cookies, cookiesString) {
+        if (cookiesString)
+            callback(WebInspector.Cookies.buildCookiesFromString(cookiesString), false);
+        else
+            callback(cookies, true);
+    }
+    var callId = WebInspector.Callback.wrap(mycallback);
+    InspectorController.getCookies(callId, cookieDomain);
+}
+
+WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
+{
+    var rawCookies = rawCookieString.split(/;\s*/);
+    var cookies = [];
+
+    if (!(/^\s*$/.test(rawCookieString))) {
+        for (var i = 0; i < rawCookies.length; ++i) {
+            var cookie = rawCookies[i];
+            var delimIndex = cookie.indexOf("=");
+            var name = cookie.substring(0, delimIndex);
+            var value = cookie.substring(delimIndex + 1);
+            var size = name.length + value.length;
+            cookies.push({ name: name, value: value, size: size });
+        }
+    }
+
+    return cookies;
+}
+
+WebInspector.EventListeners = {}
+
+WebInspector.EventListeners.getEventListenersForNodeAsync = function(node, callback)
+{
+    if (!node)
+        return;
+
+    var callId = WebInspector.Callback.wrap(callback);
+    InspectorController.getEventListenersForNode(callId, node.id);
+}
+
+WebInspector.CSSStyleDeclaration = function(payload)
+{
+    this.id = payload.id;
     this.width = payload.width;
     this.height = payload.height;
     this.__disabledProperties = payload.__disabledProperties;
@@ -492,12 +523,13 @@ WebInspector.CSSStyleDeclaration.parseStyle = function(payload)
 WebInspector.CSSStyleDeclaration.parseRule = function(payload)
 {
     var rule = {};
-    rule._id = payload.id;
+    rule.id = payload.id;
     rule.selectorText = payload.selectorText;
     rule.style = new WebInspector.CSSStyleDeclaration(payload.style);
     rule.style.parentRule = rule;
     rule.isUserAgent = payload.isUserAgent;
     rule.isUser = payload.isUser;
+    rule.isViaInspector = payload.isViaInspector;
     if (payload.parentStyleSheet)
         rule.parentStyleSheet = { href: payload.parentStyleSheet.href };
 
@@ -586,9 +618,14 @@ WebInspector.attributesUpdated = function()
     this.domAgent._attributesUpdated.apply(this.domAgent, arguments);
 }
 
-WebInspector.setDocumentElement = function()
+WebInspector.setDocument = function()
 {
-    this.domAgent._setDocumentElement.apply(this.domAgent, arguments);
+    this.domAgent._setDocument.apply(this.domAgent, arguments);
+}
+
+WebInspector.setDetachedRoot = function()
+{
+    this.domAgent._setDetachedRoot.apply(this.domAgent, arguments);
 }
 
 WebInspector.setChildNodes = function()
@@ -596,129 +633,25 @@ WebInspector.setChildNodes = function()
     this.domAgent._setChildNodes.apply(this.domAgent, arguments);
 }
 
-WebInspector.hasChildrenUpdated = function()
+WebInspector.childNodeCountUpdated = function()
 {
-    this.domAgent._hasChildrenUpdated.apply(this.domAgent, arguments);
+    this.domAgent._childNodeCountUpdated.apply(this.domAgent, arguments);
 }
 
 WebInspector.childNodeInserted = function()
 {
     this.domAgent._childNodeInserted.apply(this.domAgent, arguments);
-    this._childNodeInserted.bind(this);
 }
 
 WebInspector.childNodeRemoved = function()
 {
     this.domAgent._childNodeRemoved.apply(this.domAgent, arguments);
-    this._childNodeRemoved.bind(this);
 }
 
+WebInspector.didGetCookies = WebInspector.Callback.processCallback;
 WebInspector.didGetChildNodes = WebInspector.Callback.processCallback;
 WebInspector.didPerformSearch = WebInspector.Callback.processCallback;
 WebInspector.didApplyDomChange = WebInspector.Callback.processCallback;
 WebInspector.didRemoveAttribute = WebInspector.Callback.processCallback;
 WebInspector.didSetTextNodeValue = WebInspector.Callback.processCallback;
-
-// Temporary methods for DOMAgent migration.
-WebInspector.wrapNodeWithStyles = function(node, styles)
-{
-    var windowStub = new WebInspector.DOMWindow(null);
-    var docStub = new WebInspector.DOMDocument(null, windowStub);
-    var payload = {};
-    payload.nodeType = node.nodeType;
-    payload.nodeName = node.nodeName;
-    payload.nodeValue = node.nodeValue;
-    payload.attributes = [];
-    payload.childNodeCount = 0;
-
-    for (var i = 0; i < node.attributes.length; ++i) {
-        var attr = node.attributes[i];
-        payload.attributes.push(attr.name);
-        payload.attributes.push(attr.value);
-    }
-    var nodeStub = new WebInspector.DOMNode(docStub, payload);
-    nodeStub._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
-    return nodeStub;
-}
-
-// Temporary methods that will be dispatched via InspectorController into the injected context.
-InspectorController.getStyles = function(nodeId, authorOnly, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getStyles(nodeId, authorOnly));
-    }, 0)
-}
-
-InspectorController.getComputedStyle = function(nodeId, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getComputedStyle(nodeId));
-    }, 0)
-}
-
-InspectorController.getInlineStyle = function(nodeId, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.getInlineStyle(nodeId));
-    }, 0)
-}
-
-InspectorController.applyStyleText = function(styleId, styleText, propertyName, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.applyStyleText(styleId, styleText, propertyName));
-    }, 0)
-}
-
-InspectorController.setStyleText = function(style, cssText, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.setStyleText(style, cssText));
-    }, 0)
-}
-
-InspectorController.toggleStyleEnabled = function(styleId, propertyName, disabled, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.toggleStyleEnabled(styleId, propertyName, disabled));
-    }, 0)
-}
-
-InspectorController.applyStyleRuleText = function(ruleId, newContent, selectedNode, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.applyStyleRuleText(ruleId, newContent, selectedNode));
-    }, 0)
-}
-
-InspectorController.addStyleSelector = function(newContent, callback)
-{
-    setTimeout(function() {
-        callback(InjectedScript.addStyleSelector(newContent));
-    }, 0)
-}
-
-InspectorController.setStyleProperty = function(styleId, name, value, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.setStyleProperty(styleId, name, value));
-    }, 0)
-}
-
-InspectorController.getPrototypes = function(objectProxy, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.getPrototypes(objectProxy));
-    }, 0)
-}
-
-InspectorController.getProperties = function(objectProxy, ignoreHasOwnProperty, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.getProperties(objectProxy, ignoreHasOwnProperty));
-    }, 0)
-}
-
-InspectorController.setPropertyValue = function(objectProxy, propertyName, expression, callback) {
-    setTimeout(function() {
-        callback(InjectedScript.setPropertyValue(objectProxy, propertyName, expression));
-    }, 0)
-}
-
+WebInspector.didGetEventListenersForNode = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DOMStorage.js b/WebCore/inspector/front-end/DOMStorage.js
index 5207b69..03a10bf 100644
--- a/WebCore/inspector/front-end/DOMStorage.js
+++ b/WebCore/inspector/front-end/DOMStorage.js
@@ -26,24 +26,22 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DOMStorage = function(domStorage, domain, isLocalStorage)
+WebInspector.DOMStorage = function(id, domain, isLocalStorage)
 {
-    this.domStorage = domStorage;
-    this.domain = domain;
-    this.isLocalStorage = isLocalStorage;
+    this._id = id;
+    this._domain = domain;
+    this._isLocalStorage = isLocalStorage;
 }
 
 WebInspector.DOMStorage.prototype = {
-    get domStorage()
+    get id()
     {
-        return this._domStorage;
+        return this._id;
     },
 
-    set domStorage(x)
+    get domStorage()
     {
-        if (this._domStorage === x)
-            return;
-        this._domStorage = x;
+        return this._domStorage;
     },
 
     get domain()
@@ -51,22 +49,30 @@ WebInspector.DOMStorage.prototype = {
         return this._domain;
     },
 
-    set domain(x)
+    get isLocalStorage()
+    {
+        return this._isLocalStorage;
+    },
+
+    getEntries: function(callback)
     {
-        if (this._domain === x)
-            return;
-        this._domain = x;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.getDOMStorageEntries(callId, this._id);
     },
     
-    get isLocalStorage()
+    setItem: function(key, value, callback)
     {
-        return this._isLocalStorage;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.setDOMStorageItem(callId, this._id, key, value);
     },
     
-    set isLocalStorage(x)
+    removeItem: function(key, callback)
     {
-        if (this._isLocalStorage === x)
-            return;
-        this._isLocalStorage = x;
+        var callId = WebInspector.Callback.wrap(callback);
+        InspectorController.removeDOMStorageItem(callId, this._id, key);
     }
 }
+
+WebInspector.didGetDOMStorageEntries = WebInspector.Callback.processCallback;
+WebInspector.didSetDOMStorageItem = WebInspector.Callback.processCallback;
+WebInspector.didRemoveDOMStorageItem = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DOMStorageDataGrid.js b/WebCore/inspector/front-end/DOMStorageDataGrid.js
index 0326bc7..45a9ba1 100644
--- a/WebCore/inspector/front-end/DOMStorageDataGrid.js
+++ b/WebCore/inspector/front-end/DOMStorageDataGrid.js
@@ -23,10 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DOMStorageDataGrid = function(columns)
+WebInspector.DOMStorageDataGrid = function(columns, domStorage, keys)
 {
     WebInspector.DataGrid.call(this, columns);
     this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
+    this._domStorage = domStorage;
+    this._keys = keys;
 }
 
 WebInspector.DOMStorageDataGrid.prototype = {
@@ -44,7 +46,6 @@ WebInspector.DOMStorageDataGrid.prototype = {
         this._editing = true;
         this._editingNode = node;
         this._editingNode.select();
-        WebInspector.panels.databases._unregisterStorageEventListener();
 
         var element = this._editingNode._element.children[column];
         WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
@@ -69,7 +70,6 @@ WebInspector.DOMStorageDataGrid.prototype = {
             return this._startEditingColumnOfDataGridNode(this._editingNode, 0);
 
         this._editing = true;
-        WebInspector.panels.databases._unregisterStorageEventListener();
         WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
         window.getSelection().setBaseAndExtent(element, 0, element, 1);
     },
@@ -118,22 +118,20 @@ WebInspector.DOMStorageDataGrid.prototype = {
             return;
         }
 
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
-        if (domStorage) {
-            if (columnIdentifier == 0) {
-                if (domStorage.getItem(newText) != null) {
-                    element.textContent = this._editingNode.data[0];
-                    this._editingCancelled(element);
-                    moveToNextIfNeeded.call(this, false);
-                    return;
-                }
-                domStorage.removeItem(this._editingNode.data[0]);
-                domStorage.setItem(newText, this._editingNode.data[1]);
-                this._editingNode.data[0] = newText;            
-            } else {
-                domStorage.setItem(this._editingNode.data[0], newText);
-                this._editingNode.data[1] = newText;
+        var domStorage = this._domStorage;
+        if (columnIdentifier === 0) {
+            if (this._keys.indexOf(newText) !== -1) {
+                element.textContent = this._editingNode.data[0];
+                this._editingCancelled(element);
+                moveToNextIfNeeded.call(this, false);
+                return;
             }
+            domStorage.removeItem(this._editingNode.data[0]);
+            domStorage.setItem(newText, this._editingNode.data[1]);
+            this._editingNode.data[0] = newText;
+        } else {
+            domStorage.setItem(this._editingNode.data[0], newText);
+            this._editingNode.data[1] = newText;
         }
 
         if (this._editingNode.isCreationNode)
@@ -147,18 +145,16 @@ WebInspector.DOMStorageDataGrid.prototype = {
     {
         delete this._editing;
         this._editingNode = null;
-        WebInspector.panels.databases._registerStorageEventListener();
     },
 
     deleteSelectedRow: function()
     {
         var node = this.selectedNode;
-        if (this.selectedNode.isCreationNode)
+        if (!node || node.isCreationNode)
             return;
 
-        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
-        if (node && domStorage)
-            domStorage.removeItem(node.data[0]);
+        if (this._domStorage)
+            this._domStorage.removeItem(node.data[0]);
     }
 }
 
diff --git a/WebCore/inspector/front-end/DOMStorageItemsView.js b/WebCore/inspector/front-end/DOMStorageItemsView.js
index fad6e3c..a7da370 100644
--- a/WebCore/inspector/front-end/DOMStorageItemsView.js
+++ b/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -32,21 +32,18 @@ WebInspector.DOMStorageItemsView = function(domStorage)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.deleteButton = document.createElement("button");
-    this.deleteButton.title = WebInspector.UIString("Delete");
-    this.deleteButton.className = "delete-storage-status-bar-item status-bar-item hidden";
+    this.deleteButton = new WebInspector.StatusBarButton(WebInspector.UIString("Delete"), "delete-storage-status-bar-item");
+    this.deleteButton.visible = false;
     this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
 WebInspector.DOMStorageItemsView.prototype = {
     get statusBarItems()
     {
-        return [this.refreshButton, this.deleteButton];
+        return [this.refreshButton.element, this.deleteButton.element];
     },
 
     show: function(parentElement)
@@ -58,45 +55,94 @@ WebInspector.DOMStorageItemsView.prototype = {
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
-        this.deleteButton.addStyleClass("hidden");
+        this.deleteButton.visible = false;
     },
 
     update: function()
     {
         this.element.removeChildren();
-        var hasDOMStorage = this.domStorage;
-        if (hasDOMStorage)
-            hasDOMStorage = this.domStorage.domStorage;
-
-        if (hasDOMStorage) {
-            var dataGrid = WebInspector.panels.databases.dataGridForDOMStorage(this.domStorage.domStorage);
-            if (!dataGrid)
-                hasDOMStorage = 0;
-            else {
-                this._dataGrid = dataGrid;
-                this.element.appendChild(dataGrid.element);
-                this._dataGrid.updateWidths();
-                this.deleteButton.removeStyleClass("hidden");
-            }
-        }
+        var callback = this._showDOMStorageEntries.bind(this);
+        this.domStorage.getEntries(callback);
+    },
 
-        if (!hasDOMStorage) {
+    _showDOMStorageEntries: function(entries) 
+    {
+        if (entries.length > 0) {
+            this._dataGrid = this._dataGridForDOMStorageEntries(entries);
+            this.element.appendChild(this._dataGrid.element);
+            this._dataGrid.updateWidths();
+            this.deleteButton.visible = true;
+        } else {
             var emptyMsgElement = document.createElement("div");
             emptyMsgElement.className = "storage-table-empty";
             if (this.domStorage)
-            emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
+                emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
             this.element.appendChild(emptyMsgElement);
             this._dataGrid = null;
-            this.deleteButton.addStyleClass("hidden");
+            this.deleteButton.visible = false;
         }
     },
-    
+
     resize: function()
     {
         if (this._dataGrid)
             this._dataGrid.updateWidths();
     },
 
+    _dataGridForDOMStorageEntries: function(entries)
+    {
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Key");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[1].title.length;
+
+        var nodes = [];
+
+        var keys = [];
+        var length = entries.length;
+        for (var i = 0; i < entries.length; i++) {
+            var data = {};
+
+            var key = entries[i][0];
+            data[0] = key;
+            if (key.length > columns[0].width)
+                columns[0].width = key.length;
+
+            var value = entries[i][1];
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+            keys.push(key);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        var width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 10;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DOMStorageDataGrid(columns, this.domStorage, keys);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        dataGrid.addCreationNode(false);
+        if (length > 0)
+            nodes[0].selected = true;
+        return dataGrid;
+    },
+
     _deleteButtonClicked: function(event)
     {
         if (this._dataGrid) {
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index 42e001c..ce61548 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -39,6 +39,8 @@ WebInspector.DataGrid = function(columns)
     this._dataTable.addEventListener("mousedown", this._mouseDownInDataTable.bind(this), true);
     this._dataTable.addEventListener("click", this._clickInDataTable.bind(this), true);
 
+    this.aligned = {};
+
     var scrollContainer = document.createElement("div");
     scrollContainer.className = "data-container";
     scrollContainer.appendChild(this._dataTable);
@@ -78,6 +80,11 @@ WebInspector.DataGrid = function(columns)
             cell.addStyleClass("sortable");
         }
 
+        if (column.aligned) {
+            cell.addStyleClass(column.aligned);
+            this.aligned[columnIdentifier] = column.aligned;
+        }
+
         headerRow.appendChild(cell);
 
         ++columnCount;
@@ -752,6 +759,10 @@ WebInspector.DataGridNode.prototype = {
         var cell = document.createElement("td");
         cell.className = columnIdentifier + "-column";
 
+        var alignment = this.dataGrid.aligned[columnIdentifier];
+        if (alignment)
+            cell.addStyleClass(alignment);
+
         var div = document.createElement("div");
         div.textContent = this.data[columnIdentifier];
         cell.appendChild(div);
diff --git a/WebCore/inspector/front-end/Database.js b/WebCore/inspector/front-end/Database.js
index ef42e15..1a348fc 100644
--- a/WebCore/inspector/front-end/Database.js
+++ b/WebCore/inspector/front-end/Database.js
@@ -26,25 +26,18 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Database = function(database, domain, name, version)
+WebInspector.Database = function(id, domain, name, version)
 {
-    this.database = database;
-    this.domain = domain;
-    this.name = name;
-    this.version = version;
+    this._id = id;
+    this._domain = domain;
+    this._name = name;
+    this._version = version;
 }
 
 WebInspector.Database.prototype = {
-    get database()
+    get id()
     {
-        return this._database;
-    },
-
-    set database(x)
-    {
-        if (this._database === x)
-            return;
-        this._database = x;
+        return this._id;
     },
 
     get name()
@@ -54,8 +47,6 @@ WebInspector.Database.prototype = {
 
     set name(x)
     {
-        if (this._name === x)
-            return;
         this._name = x;
     },
 
@@ -66,8 +57,6 @@ WebInspector.Database.prototype = {
 
     set version(x)
     {
-        if (this._version === x)
-            return;
         this._version = x;
     },
 
@@ -78,8 +67,6 @@ WebInspector.Database.prototype = {
 
     set domain(x)
     {
-        if (this._domain === x)
-            return;
         this._domain = x;
     },
 
@@ -88,8 +75,28 @@ WebInspector.Database.prototype = {
         return WebInspector.Resource.prototype.__lookupGetter__("displayDomain").call(this);
     },
 
-    get tableNames()
+    getTableNames: function(callback)
     {
-        return InspectorController.databaseTableNames(this.database).sort();
+        function sortingCallback(names)
+        {
+            callback(names.sort());
+        }
+        var callId = WebInspector.Callback.wrap(sortingCallback);
+        InspectorController.getDatabaseTableNames(callId, this._id);
+    },
+    
+    executeSql: function(query, onSuccess, onError)
+    {
+        function callback(result)
+        {
+            if (!(result instanceof Array)) {
+                onError(result);
+                return;
+            }
+            onSuccess(result);
+        }
+        InjectedScriptAccess.executeSql(this._id, query, callback);
     }
 }
+
+WebInspector.didGetDatabaseTableNames = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/DatabaseQueryView.js b/WebCore/inspector/front-end/DatabaseQueryView.js
index 429c2c3..6c5fa02 100644
--- a/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -81,11 +81,15 @@ WebInspector.DatabaseQueryView.prototype = {
                     return;
             }
         }
+        
+        function tableNamesCallback(tableNames)
+        {
+            accumulateMatches(tableNames.map(function(name) { return name + " " }));
+            accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
 
-        accumulateMatches(this.database.tableNames.map(function(name) { return name + " " }));
-        accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
-
-        completionsReadyCallback(results);
+            completionsReadyCallback(results);
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     _promptKeyDown: function(event)
@@ -132,22 +136,19 @@ WebInspector.DatabaseQueryView.prototype = {
         this.prompt.historyOffset = 0;
         this.prompt.text = "";
 
-        function queryTransaction(tx)
-        {
-            tx.executeSql(query, null, InspectorController.wrapCallback(this._queryFinished.bind(this, query)), InspectorController.wrapCallback(this._executeSqlError.bind(this, query)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this, query)));
+        this.database.executeSql(query, this._queryFinished.bind(this, query), this._queryError.bind(this, query));
     },
 
-    _queryFinished: function(query, tx, result)
+    _queryFinished: function(query, result)
     {
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
+        if (!dataGrid)
+            return;
         dataGrid.element.addStyleClass("inline");
         this._appendQueryResult(query, dataGrid.element);
 
         if (query.match(/^create /i) || query.match(/^drop table /i))
-            WebInspector.panels.databases.updateDatabaseTables(this.database);
+            WebInspector.panels.storage.updateDatabaseTables(this.database);
     },
 
     _queryError: function(query, error)
@@ -162,11 +163,6 @@ WebInspector.DatabaseQueryView.prototype = {
         this._appendQueryResult(query, message, "error");
     },
 
-    _executeSqlError: function(query, tx, error)
-    {
-        this._queryError(query, error);
-    },
-
     _appendQueryResult: function(query, result, resultClassName)
     {
         var element = document.createElement("div");
diff --git a/WebCore/inspector/front-end/DatabaseTableView.js b/WebCore/inspector/front-end/DatabaseTableView.js
index bbca9d0..aa76794 100644
--- a/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/WebCore/inspector/front-end/DatabaseTableView.js
@@ -33,9 +33,7 @@ WebInspector.DatabaseTableView = function(database, tableName)
     this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
 
-    this.refreshButton = document.createElement("button");
-    this.refreshButton.title = WebInspector.UIString("Refresh");
-    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
     this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
@@ -53,19 +51,14 @@ WebInspector.DatabaseTableView.prototype = {
 
     update: function()
     {
-        function queryTransaction(tx)
-        {
-            tx.executeSql("SELECT * FROM " + this.tableName, null, InspectorController.wrapCallback(this._queryFinished.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
-        }
-
-        this.database.database.transaction(InspectorController.wrapCallback(queryTransaction.bind(this)), InspectorController.wrapCallback(this._queryError.bind(this)));
+        this.database.executeSql("SELECT * FROM " + this.tableName, this._queryFinished.bind(this), this._queryError.bind(this));
     },
 
-    _queryFinished: function(tx, result)
+    _queryFinished: function(result)
     {
         this.element.removeChildren();
 
-        var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
+        var dataGrid = WebInspector.panels.storage.dataGridForResult(result);
         if (!dataGrid) {
             var emptyMsgElement = document.createElement("div");
             emptyMsgElement.className = "storage-table-empty";
@@ -77,7 +70,7 @@ WebInspector.DatabaseTableView.prototype = {
         this.element.appendChild(dataGrid.element);
     },
 
-    _queryError: function(tx, error)
+    _queryError: function(error)
     {
         this.element.removeChildren();
 
diff --git a/WebCore/inspector/front-end/Drawer.js b/WebCore/inspector/front-end/Drawer.js
index 23dc483..1b50f91 100644
--- a/WebCore/inspector/front-end/Drawer.js
+++ b/WebCore/inspector/front-end/Drawer.js
@@ -64,6 +64,12 @@ WebInspector.Drawer.prototype = {
         }
     },
 
+    showView: function(view)
+    {
+        if (!this.visible || this.visibleView !== view)
+            this.visibleView = view;
+    },
+
     show: function()
     {
         if (this._animating || this.visible)
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index ffa0000..fd0874a 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -56,12 +56,14 @@ WebInspector.ElementsPanel = function()
         this.panel.updateStyles(true);
         this.panel.updateMetrics();
         this.panel.updateProperties();
+        this.panel.updateEventListeners();
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.panel.nodeSearchButton.removeStyleClass("toggled-on");
+            this.panel.nodeSearchButton.toggled = false;
         }
-        WebInspector.console.addInspectedNode(this._focusedDOMNode);
+        if (this._focusedDOMNode)
+            InjectedScriptAccess.addInspectedNode(this._focusedDOMNode.id, function() {});
     };
 
     this.contentElement.appendChild(this.treeOutline.element);
@@ -75,10 +77,12 @@ WebInspector.ElementsPanel = function()
     this.sidebarPanes.styles = new WebInspector.StylesSidebarPane();
     this.sidebarPanes.metrics = new WebInspector.MetricsSidebarPane();
     this.sidebarPanes.properties = new WebInspector.PropertiesSidebarPane();
+    this.sidebarPanes.eventListeners = new WebInspector.EventListenersSidebarPane();
 
     this.sidebarPanes.styles.onexpand = this.updateStyles.bind(this);
     this.sidebarPanes.metrics.onexpand = this.updateMetrics.bind(this);
     this.sidebarPanes.properties.onexpand = this.updateProperties.bind(this);
+    this.sidebarPanes.eventListeners.onexpand = this.updateEventListeners.bind(this);
 
     this.sidebarPanes.styles.expanded = true;
 
@@ -92,15 +96,13 @@ WebInspector.ElementsPanel = function()
     this.sidebarElement.appendChild(this.sidebarPanes.styles.element);
     this.sidebarElement.appendChild(this.sidebarPanes.metrics.element);
     this.sidebarElement.appendChild(this.sidebarPanes.properties.element);
+    this.sidebarElement.appendChild(this.sidebarPanes.eventListeners.element);
 
     this.sidebarResizeElement = document.createElement("div");
     this.sidebarResizeElement.className = "sidebar-resizer-vertical";
     this.sidebarResizeElement.addEventListener("mousedown", this.rightSidebarResizerDragStart.bind(this), false);
 
-    this.nodeSearchButton = this.createStatusBarButton();
-    this.nodeSearchButton.title = WebInspector.UIString("Select an element in the page to inspect it.");
-    this.nodeSearchButton.id = "node-search-status-bar-item";
-    this.nodeSearchButton.className = "status-bar-item";
+    this.nodeSearchButton = new WebInspector.StatusBarButton(WebInspector.UIString("Select an element in the page to inspect it."), "node-search-status-bar-item");
     this.nodeSearchButton.addEventListener("click", this._nodeSearchButtonClicked.bind(this), false);
 
     this.searchingForNode = false;
@@ -109,13 +111,7 @@ WebInspector.ElementsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this._mutationMonitoredWindows = [];
-    this._nodeInsertedEventListener = InspectorController.wrapCallback(this._nodeInserted.bind(this));
-    this._nodeRemovedEventListener = InspectorController.wrapCallback(this._nodeRemoved.bind(this));
-    this._contentLoadedEventListener = InspectorController.wrapCallback(this._contentLoaded.bind(this));
-
-    this.stylesheet = null;
-    this.styles = {};
+    this._changedStyles = {};
 
     this.reset();
 }
@@ -130,7 +126,7 @@ WebInspector.ElementsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.nodeSearchButton, this.crumbsElement];
+        return [this.nodeSearchButton.element, this.crumbsElement];
     },
 
     updateStatusBarItems: function()
@@ -156,7 +152,7 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
     },
 
@@ -175,40 +171,27 @@ WebInspector.ElementsPanel.prototype = {
 
         if (InspectorController.searchingForNode()) {
             InspectorController.toggleNodeSearch();
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+            this.nodeSearchButton.toggled = false;
         }
 
         this.recentlyModifiedNodes = [];
-        this.unregisterAllMutationEventListeners();
 
         delete this.currentQuery;
         this.searchCanceled();
 
-        var inspectedWindow = Preferences.useDOMAgent ? WebInspector.domAgent.inspectedWindow : InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
+        var domWindow = WebInspector.domAgent.domWindow;
+        if (!domWindow || !domWindow.document || !domWindow.document.firstChild)
             return;
 
-        if (!inspectedWindow.document.firstChild) {
-            function contentLoaded()
-            {
-                inspectedWindow.document.removeEventListener("DOMContentLoaded", contentLoadedCallback, false);
-
-                this.reset();
-            }
-
-            var contentLoadedCallback = InspectorController.wrapCallback(contentLoaded.bind(this));
-            inspectedWindow.document.addEventListener("DOMContentLoaded", contentLoadedCallback, false);
-            return;
-        }
-
         // If the window isn't visible, return early so the DOM tree isn't built
         // and mutation event listeners are not added.
         if (!InspectorController.isWindowVisible())
             return;
 
-        this.registerMutationEventListeners(inspectedWindow);
+        var inspectedRootDocument = domWindow.document;
+        inspectedRootDocument.addEventListener("DOMNodeInserted", this._nodeInserted.bind(this));
+        inspectedRootDocument.addEventListener("DOMNodeRemoved", this._nodeRemoved.bind(this));
 
-        var inspectedRootDocument = inspectedWindow.document;
         this.rootDOMNode = inspectedRootDocument;
 
         var canidateFocusNode = inspectedRootDocument.body || inspectedRootDocument.documentElement;
@@ -222,19 +205,11 @@ WebInspector.ElementsPanel.prototype = {
         }
     },
 
-    includedInSearchResultsPropertyName: "__includedInInspectorSearchResults",
-
     searchCanceled: function()
     {
         if (this._searchResults) {
-            const searchResultsProperty = this.includedInSearchResultsPropertyName;
             for (var i = 0; i < this._searchResults.length; ++i) {
-                var node = this._searchResults[i];
-
-                // Remove the searchResultsProperty since there might be an unfinished search.
-                delete node[searchResultsProperty];
-
-                var treeElement = this.treeOutline.findTreeElement(node);
+                var treeElement = this.treeOutline.findTreeElement(this._searchResults[i]);
                 if (treeElement)
                     treeElement.highlighted = false;
             }
@@ -242,13 +217,9 @@ WebInspector.ElementsPanel.prototype = {
 
         WebInspector.updateSearchMatchesCount(0, this);
 
-        if (this._currentSearchChunkIntervalIdentifier) {
-            clearInterval(this._currentSearchChunkIntervalIdentifier);
-            delete this._currentSearchChunkIntervalIdentifier;
-        }
-
         this._currentSearchResultIndex = 0;
         this._searchResults = [];
+        InjectedScriptAccess.searchCanceled(function() {});
     },
 
     performSearch: function(query)
@@ -260,241 +231,56 @@ WebInspector.ElementsPanel.prototype = {
         if (!whitespaceTrimmedQuery.length)
             return;
 
-        var tagNameQuery = whitespaceTrimmedQuery;
-        var attributeNameQuery = whitespaceTrimmedQuery;
-        var startTagFound = (tagNameQuery.indexOf("<") === 0);
-        var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
-
-        if (startTagFound || endTagFound) {
-            var tagNameQueryLength = tagNameQuery.length;
-            tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
-        }
-
-        // Check the tagNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
-            tagNameQuery = null;
-
-        // Check the attributeNameQuery is it is a possibly valid tag name.
-        if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
-            attributeNameQuery = null;
-
-        const escapedQuery = query.escapeCharacters("'");
-        const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
-        const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
-        const searchResultsProperty = this.includedInSearchResultsPropertyName;
-
-        var updatedMatchCountOnce = false;
-        var matchesCountUpdateTimeout = null;
-
-        function updateMatchesCount()
-        {
-            WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
-            matchesCountUpdateTimeout = null;
-            updatedMatchCountOnce = true;
-        }
-
-        function updateMatchesCountSoon()
-        {
-            if (!updatedMatchCountOnce)
-                return updateMatchesCount.call(this);
-            if (matchesCountUpdateTimeout)
-                return;
-            // Update the matches count every half-second so it doesn't feel twitchy.
-            matchesCountUpdateTimeout = setTimeout(updateMatchesCount.bind(this), 500);
-        }
-
-        function addNodesToResults(nodes, length, getItem)
-        {
-            if (!length)
-                return;
-
-            for (var i = 0; i < length; ++i) {
-                var node = getItem.call(nodes, i);
-                // Skip this node if it already has the property.
-                if (searchResultsProperty in node)
-                    continue;
-
-                if (!this._searchResults.length) {
-                    this._currentSearchResultIndex = 0;
-                    this.focusedDOMNode = node;
-                }
-
-                node[searchResultsProperty] = true;
-                this._searchResults.push(node);
-
-                // Highlight the tree element to show it matched the search.
-                // FIXME: highlight the substrings in text nodes and attributes.
-                var treeElement = this.treeOutline.findTreeElement(node);
-                if (treeElement)
-                    treeElement.highlighted = true;
-            }
-
-            updateMatchesCountSoon.call(this);
-        }
-
-        function matchExactItems(doc)
-        {
-            matchExactId.call(this, doc);
-            matchExactClassNames.call(this, doc);
-            matchExactTagNames.call(this, doc);
-            matchExactAttributeNames.call(this, doc);
-        }
-
-        function matchExactId(doc)
-        {
-            const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
-        }
-
-        function matchExactClassNames(doc)
-        {
-            const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchExactAttributeNames(doc)
-        {
-            if (!attributeNameQuery)
-                return;
-            const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPartialTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStartOfTagNames(doc)
-        {
-            if (!tagNameQuery)
-                return;
-            const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialTagNamesAndAttributeValues(doc)
-        {
-            if (!tagNameQuery) {
-                matchPartialAttributeValues.call(this, doc);
-                return;
-            }
-
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchPartialAttributeValues(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchStyleSelector(doc)
-        {
-            const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
-            addNodesToResults.call(this, result, result.length, result.item);
-        }
-
-        function matchPlainText(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
-
-        function matchXPathQuery(doc)
-        {
-            const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
-            addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
-        }
+        this._updatedMatchCountOnce = false;
+        this._matchesCountUpdateTimeout = null;
 
-        function finishedSearching()
-        {
-            // Remove the searchResultsProperty now that the search is finished.
-            for (var i = 0; i < this._searchResults.length; ++i)
-                delete this._searchResults[i][searchResultsProperty];
-        }
+        InjectedScriptAccess.performSearch(whitespaceTrimmedQuery, function() {});
+    },
 
-        const mainFrameDocument = InspectorController.inspectedWindow().document;
-        const searchDocuments = [mainFrameDocument];
-
-        if (tagNameQuery && startTagFound && endTagFound)
-            const searchFunctions = [matchExactTagNames, matchPlainText];
-        else if (tagNameQuery && startTagFound)
-            const searchFunctions = [matchStartOfTagNames, matchPlainText];
-        else if (tagNameQuery && endTagFound) {
-            // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
-            // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
-            const searchFunctions = [matchPartialTagNames, matchPlainText];
-        } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
-            // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
-            // so limit the search functions list to plain text and attribute matching.
-            const searchFunctions = [matchPartialAttributeValues, matchPlainText];
-        } else
-            const searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
-
-        // Find all frames, iframes and object elements to search their documents.
-        const querySelectorAllFunction = InspectorController.inspectedWindow().Document.prototype.querySelectorAll;
-        const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
-
-        for (var i = 0; i < subdocumentResult.length; ++i) {
-            var element = subdocumentResult.item(i);
-            if (element.contentDocument)
-                searchDocuments.push(element.contentDocument);
-        }
+    _updateMatchesCount: function()
+    {
+        WebInspector.updateSearchMatchesCount(this._searchResults.length, this);
+        this._matchesCountUpdateTimeout = null;
+        this._updatedMatchCountOnce = true;
+    },
 
-        const panel = this;
-        var documentIndex = 0;
-        var searchFunctionIndex = 0;
-        var chunkIntervalIdentifier = null;
+    _updateMatchesCountSoon: function()
+    {
+        if (!this._updatedMatchCountOnce)
+            return this._updateMatchesCount();
+        if (this._matchesCountUpdateTimeout)
+            return;
+        // Update the matches count every half-second so it doesn't feel twitchy.
+        this._matchesCountUpdateTimeout = setTimeout(this._updateMatchesCount.bind(this), 500);
+    },
 
-        // Split up the work into chunks so we don't block the UI thread while processing.
+    addNodesToSearchResult: function(nodeIds)
+    {
+        if (!nodeIds)
+            return;
 
-        function processChunk()
-        {
-            var searchDocument = searchDocuments[documentIndex];
-            var searchFunction = searchFunctions[searchFunctionIndex];
-
-            if (++searchFunctionIndex > searchFunctions.length) {
-                searchFunction = searchFunctions[0];
-                searchFunctionIndex = 0;
-
-                if (++documentIndex > searchDocuments.length) {
-                    if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
-                        delete panel._currentSearchChunkIntervalIdentifier;
-                    clearInterval(chunkIntervalIdentifier);
-                    finishedSearching.call(panel);
-                    return;
-                }
+        var nodeIdsArray = nodeIds.split(",");
+        for (var i = 0; i < nodeIdsArray.length; ++i) {
+            var nodeId = nodeIdsArray[i];
+            var node = WebInspector.domAgent.nodeForId(nodeId);
+            if (!node)
+                continue;
 
-                searchDocument = searchDocuments[documentIndex];
+            if (!this._searchResults.length) {
+                this._currentSearchResultIndex = 0;
+                this.focusedDOMNode = node;
             }
 
-            if (!searchDocument || !searchFunction)
-                return;
+            this._searchResults.push(node);
 
-            try {
-                searchFunction.call(panel, searchDocument);
-            } catch(err) {
-                // ignore any exceptions. the query might be malformed, but we allow that.
-            }
+            // Highlight the tree element to show it matched the search.
+            // FIXME: highlight the substrings in text nodes and attributes.
+            var treeElement = this.treeOutline.findTreeElement(node);
+            if (treeElement)
+                treeElement.highlighted = true;
         }
 
-        processChunk();
-
-        chunkIntervalIdentifier = setInterval(processChunk, 25);
-        this._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+        this._updateMatchesCountSoon();
     },
 
     jumpToNextSearchResult: function()
@@ -515,12 +301,6 @@ WebInspector.ElementsPanel.prototype = {
         this.focusedDOMNode = this._searchResults[this._currentSearchResultIndex];
     },
 
-    inspectedWindowCleared: function(window)
-    {
-        if (InspectorController.isWindowVisible())
-            this.updateMutationEventListeners(window);
-    },
-
     renameSelector: function(oldIdentifier, newIdentifier, oldSelector, newSelector)
     {
         // TODO: Implement Shifting the oldSelector, and its contents to a newSelector
@@ -532,16 +312,16 @@ WebInspector.ElementsPanel.prototype = {
             return;
 
         var selector = style.parentRule.selectorText;
-        if (!this.styles[identifier])
-            this.styles[identifier] = {};
+        if (!this._changedStyles[identifier])
+            this._changedStyles[identifier] = {};
 
-        if (!this.styles[identifier][selector])
-            this.styles[identifier][selector] = {};
+        if (!this._changedStyles[identifier][selector])
+            this._changedStyles[identifier][selector] = {};
 
-        if (!this.styles[identifier][selector][property])
+        if (!this._changedStyles[identifier][selector][property])
             WebInspector.styleChanges += 1;
 
-        this.styles[identifier][selector][property] = style.getPropertyValue(property);
+        this._changedStyles[identifier][selector][property] = style.getPropertyValue(property);
     },
 
     removeStyleChange: function(identifier, style, property)
@@ -550,11 +330,11 @@ WebInspector.ElementsPanel.prototype = {
             return;
 
         var selector = style.parentRule.selectorText;
-        if (!this.styles[identifier] || !this.styles[identifier][selector])
+        if (!this._changedStyles[identifier] || !this._changedStyles[identifier][selector])
             return;
 
-        if (this.styles[identifier][selector][property]) {
-            delete this.styles[identifier][selector][property];
+        if (this._changedStyles[identifier][selector][property]) {
+            delete this._changedStyles[identifier][selector][property];
             WebInspector.styleChanges -= 1;
         }
     },
@@ -566,24 +346,24 @@ WebInspector.ElementsPanel.prototype = {
 
         // Merge Down to Just Selectors
         var mergedSelectors = {};
-        for (var identifier in this.styles) {
-            for (var selector in this.styles[identifier]) {
+        for (var identifier in this._changedStyles) {
+            for (var selector in this._changedStyles[identifier]) {
                 if (!mergedSelectors[selector])
-                    mergedSelectors[selector] = this.styles[identifier][selector];
+                    mergedSelectors[selector] = this._changedStyles[identifier][selector];
                 else { // merge on selector
                     var merge = {};
                     for (var property in mergedSelectors[selector])
                         merge[property] = mergedSelectors[selector][property];
-                    for (var property in this.styles[identifier][selector]) {
+                    for (var property in this._changedStyles[identifier][selector]) {
                         if (!merge[property])
-                            merge[property] = this.styles[identifier][selector][property];
+                            merge[property] = this._changedStyles[identifier][selector][property];
                         else { // merge on property within a selector, include comment to notify user
                             var value1 = merge[property];
-                            var value2 = this.styles[identifier][selector][property];
+                            var value2 = this._changedStyles[identifier][selector][property];
 
                             if (value1 === value2)
                                 merge[property] = [value1];
-                            else if (Object.type(value1) === "array")
+                            else if (value1 instanceof Array)
                                 merge[property].push(value2);
                             else
                                 merge[property] = [value1, value2];
@@ -615,7 +395,7 @@ WebInspector.ElementsPanel.prototype = {
                 for (var i = 0; i < properties.length; ++i) {
                     var property = properties[i];
                     var value = psuedoStyle[property];
-                    if (Object.type(value) !== "array")
+                    if (!(value instanceof Array))
                         builder.push(displayProperty(property, value));
                     else {
                         if (value.length === 1)
@@ -632,55 +412,7 @@ WebInspector.ElementsPanel.prototype = {
         }
 
         WebInspector.showConsole();
-        var result = builder.join("\n");
-        InspectorController.inspectedWindow().console.log(result);
-    },
-
-    _addMutationEventListeners: function(monitoredWindow)
-    {
-        monitoredWindow.document.addEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.addEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-        if (monitoredWindow.frameElement)
-            monitoredWindow.addEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
-    },
-
-    _removeMutationEventListeners: function(monitoredWindow)
-    {
-        if (monitoredWindow.frameElement)
-            monitoredWindow.removeEventListener("DOMContentLoaded", this._contentLoadedEventListener, true);
-        if (!monitoredWindow.document)
-            return;
-        monitoredWindow.document.removeEventListener("DOMNodeInserted", this._nodeInsertedEventListener, true);
-        monitoredWindow.document.removeEventListener("DOMNodeRemoved", this._nodeRemovedEventListener, true);
-    },
-
-    updateMutationEventListeners: function(monitoredWindow)
-    {
-        this._addMutationEventListeners(monitoredWindow);
-    },
-
-    registerMutationEventListeners: function(monitoredWindow)
-    {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) !== -1)
-            return;
-        this._mutationMonitoredWindows.push(monitoredWindow);
-        if (InspectorController.isWindowVisible())
-            this._addMutationEventListeners(monitoredWindow);
-    },
-
-    unregisterMutationEventListeners: function(monitoredWindow)
-    {
-        if (!monitoredWindow || this._mutationMonitoredWindows.indexOf(monitoredWindow) === -1)
-            return;
-        this._mutationMonitoredWindows.remove(monitoredWindow);
-        this._removeMutationEventListeners(monitoredWindow);
-    },
-
-    unregisterAllMutationEventListeners: function()
-    {
-        for (var i = 0; i < this._mutationMonitoredWindows.length; ++i)
-            this._removeMutationEventListeners(this._mutationMonitoredWindows[i]);
-        this._mutationMonitoredWindows = [];
+        WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage(builder.join("\n")));
     },
 
     get rootDOMNode()
@@ -703,13 +435,6 @@ WebInspector.ElementsPanel.prototype = {
         this.treeOutline.focusedDOMNode = x;
     },
 
-    _contentLoaded: function(event)
-    {
-        this.recentlyModifiedNodes.push({node: event.target, parent: event.target.defaultView.frameElement, replaced: true});
-        if (this.visible)
-            this._updateModifiedNodesSoon();
-    },
-
     _nodeInserted: function(event)
     {
         this.recentlyModifiedNodes.push({node: event.target, parent: event.relatedNode, inserted: true});
@@ -747,14 +472,14 @@ WebInspector.ElementsPanel.prototype = {
             if (!parent)
                 continue;
 
-            var parentNodeItem = this.treeOutline.findTreeElement(parent, null, null, objectsAreSame);
+            var parentNodeItem = this.treeOutline.findTreeElement(parent);
             if (parentNodeItem && !parentNodeItem.alreadyUpdatedChildren) {
                 parentNodeItem.updateChildren(replaced);
                 parentNodeItem.alreadyUpdatedChildren = true;
                 updatedParentTreeElements.push(parentNodeItem);
             }
 
-            if (!updateBreadcrumbs && (objectsAreSame(this.focusedDOMNode, parent) || isAncestorIncludingParentFrames(this.focusedDOMNode, parent)))
+            if (!updateBreadcrumbs && (this.focusedDOMNode === parent || isAncestor(this.focusedDOMNode, parent)))
                 updateBreadcrumbs = true;
         }
 
@@ -814,7 +539,7 @@ WebInspector.ElementsPanel.prototype = {
         var foundRoot = false;
         var crumb = crumbs.firstChild;
         while (crumb) {
-            if (objectsAreSame(crumb.representedObject, this.rootDOMNode))
+            if (crumb.representedObject === this.rootDOMNode)
                 foundRoot = true;
 
             if (foundRoot)
@@ -822,7 +547,7 @@ WebInspector.ElementsPanel.prototype = {
             else
                 crumb.removeStyleClass("dimmed");
 
-            if (objectsAreSame(crumb.representedObject, this.focusedDOMNode)) {
+            if (crumb.representedObject === this.focusedDOMNode) {
                 crumb.addStyleClass("selected");
                 handled = true;
             } else {
@@ -875,11 +600,11 @@ WebInspector.ElementsPanel.prototype = {
         }
 
         foundRoot = false;
-        for (var current = this.focusedDOMNode; current; current = parentNodeOrFrameElement(current)) {
+        for (var current = this.focusedDOMNode; current; current = current.parentNode) {
             if (current.nodeType === Node.DOCUMENT_NODE)
                 continue;
 
-            if (objectsAreSame(current, this.rootDOMNode))
+            if (current === this.rootDOMNode)
                 foundRoot = true;
 
             var crumb = document.createElement("span");
@@ -962,7 +687,7 @@ WebInspector.ElementsPanel.prototype = {
 
             if (foundRoot)
                 crumb.addStyleClass("dimmed");
-            if (objectsAreSame(current, this.focusedDOMNode))
+            if (current === this.focusedDOMNode)
                 crumb.addStyleClass("selected");
             if (!crumbs.childNodes.length)
                 crumb.addStyleClass("end");
@@ -1256,6 +981,16 @@ WebInspector.ElementsPanel.prototype = {
         propertiesSidebarPane.needsUpdate = false;
     },
 
+    updateEventListeners: function()
+    {
+        var eventListenersSidebarPane = this.sidebarPanes.eventListeners;
+        if (!eventListenersSidebarPane.expanded || !eventListenersSidebarPane.needsUpdate)
+            return;
+
+        eventListenersSidebarPane.update(this.focusedDOMNode);
+        eventListenersSidebarPane.needsUpdate = false;
+    },
+
     handleKeyEvent: function(event)
     {
         this.treeOutline.handleKeyEvent(event);
@@ -1266,26 +1001,9 @@ WebInspector.ElementsPanel.prototype = {
         // Don't prevent the normal copy if the user has a selection.
         if (!window.getSelection().isCollapsed)
             return;
-
-        switch (this.focusedDOMNode.nodeType) {
-            case Node.ELEMENT_NODE:
-                var data = this.focusedDOMNode.outerHTML;
-                break;
-
-            case Node.COMMENT_NODE:
-                var data = "<!--" + this.focusedDOMNode.nodeValue + "-->";
-                break;
-
-            default:
-            case Node.TEXT_NODE:
-                var data = this.focusedDOMNode.nodeValue;
-        }
-
         event.clipboardData.clearData();
         event.preventDefault();
-
-        if (data)
-            event.clipboardData.setData("text/plain", data);
+        InspectorController.copyNode(this.focusedDOMNode.id);
     },
 
     rightSidebarResizerDragStart: function(event)
@@ -1316,10 +1034,7 @@ WebInspector.ElementsPanel.prototype = {
     {
         InspectorController.toggleNodeSearch();
 
-        if (InspectorController.searchingForNode())
-            this.nodeSearchButton.addStyleClass("toggled-on");
-        else
-            this.nodeSearchButton.removeStyleClass("toggled-on");
+        this.nodeSearchButton.toggled = InspectorController.searchingForNode();
     }
 }
 
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index ef53209..9e13773 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -31,7 +31,6 @@
 WebInspector.ElementsTreeOutline = function() {
     this.element = document.createElement("ol");
     this.element.addEventListener("mousedown", this._onmousedown.bind(this), false);
-    this.element.addEventListener("dblclick", this._ondblclick.bind(this), false);
     this.element.addEventListener("mousemove", this._onmousemove.bind(this), false);
     this.element.addEventListener("mouseout", this._onmouseout.bind(this), false);
 
@@ -51,7 +50,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set rootDOMNode(x)
     {
-        if (objectsAreSame(this._rootDOMNode, x))
+        if (this._rootDOMNode === x)
             return;
 
         this._rootDOMNode = x;
@@ -66,7 +65,7 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     set focusedDOMNode(x)
     {
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.revealAndSelectNode(x);
             return;
         }
@@ -79,11 +78,11 @@ WebInspector.ElementsTreeOutline.prototype = {
         // and the select() call would change the focusedDOMNode and reenter this setter. So to
         // avoid calling focusedNodeChanged() twice, first check if _focusedDOMNode is the same
         // node as the one passed in.
-        if (objectsAreSame(this._focusedDOMNode, x)) {
+        if (this._focusedDOMNode === x) {
             this.focusedNodeChanged();
 
             if (x && !this.suppressSelectHighlight) {
-                InspectorController.highlightDOMNode(x);
+                InspectorController.highlightDOMNode(x.id);
 
                 if ("_restorePreviousHighlightNodeTimeout" in this)
                     clearTimeout(this._restorePreviousHighlightNodeTimeout);
@@ -92,7 +91,7 @@ WebInspector.ElementsTreeOutline.prototype = {
                 {
                     var hoveredNode = WebInspector.hoveredDOMNode;
                     if (hoveredNode)
-                        InspectorController.highlightDOMNode(hoveredNode);
+                        InspectorController.highlightDOMNode(hoveredNode.id);
                     else
                         InspectorController.hideDOMNodeHighlight();
                 }
@@ -116,12 +115,12 @@ WebInspector.ElementsTreeOutline.prototype = {
             this.appendChild(treeElement);
         } else {
             // FIXME: this could use findTreeElement to reuse a tree element if it already exists
-            var node = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(this.rootDOMNode) : this.rootDOMNode.firstChild);
+            var node = this.rootDOMNode.firstChild;
             while (node) {
                 treeElement = new WebInspector.ElementsTreeElement(node);
                 treeElement.selectable = this.selectEnabled;
                 this.appendChild(treeElement);
-                node = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+                node = node.nextSibling;
             }
         }
 
@@ -138,19 +137,12 @@ WebInspector.ElementsTreeOutline.prototype = {
 
     focusedNodeChanged: function(forceUpdate) {},
 
-    findTreeElement: function(node, isAncestor, getParent, equal)
+    findTreeElement: function(node)
     {
-        if (typeof isAncestor === "undefined")
-            isAncestor = isAncestorIncludingParentFrames;
-        if (typeof getParent === "undefined")
-            getParent = parentNodeOrFrameElement;
-        if (typeof equal === "undefined")
-            equal = objectsAreSame;
-
-        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestor, getParent, equal);
+        var treeElement = TreeOutline.prototype.findTreeElement.call(this, node, isAncestorNode, parentNode);
         if (!treeElement && node.nodeType === Node.TEXT_NODE) {
             // The text node might have been inlined if it was short, so try to find the parent element.
-            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestor, getParent, equal);
+            treeElement = TreeOutline.prototype.findTreeElement.call(this, node.parentNode, isAncestorNode, parentNode);
         }
 
         return treeElement;
@@ -193,16 +185,6 @@ WebInspector.ElementsTreeOutline.prototype = {
         return element;
     },
 
-    _ondblclick: function(event)
-    {
-        var element = this._treeElementFromEvent(event);
-
-        if (!element || !element.ondblclick)
-            return;
-
-        element.ondblclick(element, event);
-    },
-
     _onmousedown: function(event)
     {
         var element = this._treeElementFromEvent(event);
@@ -232,7 +214,7 @@ WebInspector.ElementsTreeOutline.prototype = {
     _onmouseout: function(event)
     {
         var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        if (nodeUnderMouse.isDescendant(this.element))
+        if (nodeUnderMouse && nodeUnderMouse.isDescendant(this.element))
             return;
 
         if (this._previousHoveredElement) {
@@ -248,14 +230,10 @@ WebInspector.ElementsTreeOutline.prototype.__proto__ = TreeOutline.prototype;
 
 WebInspector.ElementsTreeElement = function(node)
 {
-    var hasChildren = node.contentDocument || (Preferences.ignoreWhitespace ? (firstChildSkippingWhitespace.call(node) ? true : false) : node.hasChildNodes());
-    var titleInfo = nodeTitleInfo.call(node, hasChildren, WebInspector.linkifyURL);
-
-    if (titleInfo.hasChildren) 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
+    var hasChildrenOverride = node.hasChildNodes() && !this._showInlineText(node);
 
     // The title will be updated in onattach.
-    TreeElement.call(this, "", node, titleInfo.hasChildren);
+    TreeElement.call(this, "", node, hasChildrenOverride);
 
     if (this.representedObject.nodeType == Node.ELEMENT_NODE)
         this._canAddAttributes = true;
@@ -380,16 +358,19 @@ WebInspector.ElementsTreeElement.prototype = {
 
     onpopulate: function()
     {
-        if (this.children.length || this.whitespaceIgnored !== Preferences.ignoreWhitespace)
+        if (this.children.length || this._showInlineText(this.representedObject))
             return;
 
-        this.whitespaceIgnored = Preferences.ignoreWhitespace;
-
         this.updateChildren();
     },
-
+    
     updateChildren: function(fullRefresh)
     {
+        WebInspector.domAgent.getChildNodesAsync(this.representedObject, this._updateChildren.bind(this, fullRefresh));
+    },
+
+    _updateChildren: function(fullRefresh)
+    {
         if (fullRefresh) {
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
             if (selectedTreeElement && selectedTreeElement.hasAncestor(this))
@@ -403,14 +384,14 @@ WebInspector.ElementsTreeElement.prototype = {
         function updateChildrenOfNode(node)
         {
             var treeOutline = treeElement.treeOutline;
-            var child = (Preferences.ignoreWhitespace ? firstChildSkippingWhitespace.call(node) : node.firstChild);
+            var child = node.firstChild;
             while (child) {
                 var currentTreeElement = treeElement.children[treeChildIndex];
-                if (!currentTreeElement || !objectsAreSame(currentTreeElement.representedObject, child)) {
+                if (!currentTreeElement || currentTreeElement.representedObject !== child) {
                     // Find any existing element that is later in the children list.
                     var existingTreeElement = null;
                     for (var i = (treeChildIndex + 1); i < treeElement.children.length; ++i) {
-                        if (objectsAreSame(treeElement.children[i].representedObject, child)) {
+                        if (treeElement.children[i].representedObject === child) {
                             existingTreeElement = treeElement.children[i];
                             break;
                         }
@@ -431,7 +412,7 @@ WebInspector.ElementsTreeElement.prototype = {
                     }
                 }
 
-                child = Preferences.ignoreWhitespace ? nextSiblingSkippingWhitespace.call(child) : child.nextSibling;
+                child = child.nextSibling;
                 ++treeChildIndex;
             }
         }
@@ -445,9 +426,7 @@ WebInspector.ElementsTreeElement.prototype = {
             var currentNode = currentChild.representedObject;
             var currentParentNode = currentNode.parentNode;
 
-            if (objectsAreSame(currentParentNode, this.representedObject))
-                continue;
-            if (this.representedObject.contentDocument && objectsAreSame(currentParentNode, this.representedObject.contentDocument))
+            if (currentParentNode === this.representedObject)
                 continue;
 
             var selectedTreeElement = this.treeOutline.selectedTreeElement;
@@ -455,13 +434,8 @@ WebInspector.ElementsTreeElement.prototype = {
                 this.select();
 
             this.removeChildAtIndex(i);
-
-            if (this.treeOutline.panel && currentNode.contentDocument)
-                this.treeOutline.panel.unregisterMutationEventListeners(currentNode.contentDocument.defaultView);
         }
 
-        if (this.representedObject.contentDocument)
-            updateChildrenOfNode(this.representedObject.contentDocument);
         updateChildrenOfNode(this.representedObject);
 
         var lastChild = this.children[this.children.length - 1];
@@ -477,9 +451,6 @@ WebInspector.ElementsTreeElement.prototype = {
     onexpand: function()
     {
         this.treeOutline.updateSelection();
-
-        if (this.treeOutline.panel && this.representedObject.contentDocument)
-            this.treeOutline.panel.registerMutationEventListeners(this.representedObject.contentDocument.defaultView);
     },
 
     oncollapse: function()
@@ -693,7 +664,7 @@ WebInspector.ElementsTreeElement.prototype = {
         }
 
         if (!parseElement.hasAttributes()) {
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
             this._updateTitle();
             moveToNextAttributeIfNeeded.call(this);
             return;
@@ -704,12 +675,12 @@ WebInspector.ElementsTreeElement.prototype = {
             var attr = parseElement.attributes[i];
             foundOriginalAttribute = foundOriginalAttribute || attr.name === attributeName;
             try {
-                InspectorController.inspectedWindow().Element.prototype.setAttribute.call(this.representedObject, attr.name, attr.value);
+                this.representedObject.setAttribute(attr.name, attr.value);
             } catch(e) {} // ignore invalid attribute (innerHTML doesn't throw errors, but this can)
         }
 
         if (!foundOriginalAttribute)
-            InspectorController.inspectedWindow().Element.prototype.removeAttribute.call(this.representedObject, attributeName);
+            this.representedObject.removeAttribute(attributeName);
 
         this._updateTitle();
 
@@ -743,12 +714,115 @@ WebInspector.ElementsTreeElement.prototype = {
 
     _updateTitle: function()
     {
-        var title = nodeTitleInfo.call(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
+        var title = this._nodeTitleInfo(this.representedObject, this.hasChildren, WebInspector.linkifyURL).title;
         this.title = "<span class=\"highlight\">" + title + "</span>";
         delete this.selectionElement;
         this.updateSelection();
         this._preventFollowingLinksOnDoubleClick();
     },
+
+    _nodeTitleInfo: function(node, hasChildren, linkify)
+    {
+        var info = {title: "", hasChildren: hasChildren};
+        
+        switch (node.nodeType) {
+            case Node.DOCUMENT_NODE:
+                info.title = "Document";
+                break;
+                
+            case Node.ELEMENT_NODE:
+                info.title = "<span class=\"webkit-html-tag\">&lt;" + node.nodeName.toLowerCase().escapeHTML();
+                
+                if (node.hasAttributes()) {
+                    for (var i = 0; i < node.attributes.length; ++i) {
+                        var attr = node.attributes[i];
+                        info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
+                        
+                        var value = attr.value;
+                        if (linkify && (attr.name === "src" || attr.name === "href")) {
+                            var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
+                            info.title += linkify(attr.value, value, "webkit-html-attribute-value", node.nodeName.toLowerCase() == "a");
+                        } else {
+                            var value = value.escapeHTML();
+                            value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
+                            info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
+                        }
+                        info.title += "\"</span>";
+                    }
+                }
+                info.title += "&gt;</span>&#8203;";
+                
+                // If this element only has a single child that is a text node,
+                // just show that text and the closing tag inline rather than
+                // create a subtree for them
+                
+                var textChild = onlyTextChild.call(node);
+                var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
+                
+                if (showInlineText) {
+                    info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + node.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
+                    info.hasChildren = false;
+                }
+                break;
+                
+            case Node.TEXT_NODE:
+                if (isNodeWhitespace.call(node))
+                    info.title = "(whitespace)";
+                else {
+                    if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "script") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var javascriptSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(null, null);
+                        javascriptSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-js-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else if (node.parentNode && node.parentNode.nodeName.toLowerCase() == "style") {
+                        var newNode = document.createElement("span");
+                        newNode.textContent = node.textContent;
+                        
+                        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(null, null);
+                        cssSyntaxHighlighter.syntaxHighlightLine(newNode, null);
+                        
+                        info.title = "<span class=\"webkit-html-text-node webkit-html-css-node\">" + newNode.innerHTML.replace(/^[\n\r]*/, "").replace(/\s*$/, "") + "</span>";
+                    } else {
+                        info.title = "\"<span class=\"webkit-html-text-node\">" + node.nodeValue.escapeHTML() + "</span>\""; 
+                    }
+                } 
+                break;
+                
+            case Node.COMMENT_NODE:
+                info.title = "<span class=\"webkit-html-comment\">&lt;!--" + node.nodeValue.escapeHTML() + "--&gt;</span>";
+                break;
+                
+            case Node.DOCUMENT_TYPE_NODE:
+                info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + node.nodeName;
+                if (node.publicId) {
+                    info.title += " PUBLIC \"" + node.publicId + "\"";
+                    if (node.systemId)
+                        info.title += " \"" + node.systemId + "\"";
+                } else if (node.systemId)
+                    info.title += " SYSTEM \"" + node.systemId + "\"";
+                if (node.internalSubset)
+                    info.title += " [" + node.internalSubset + "]";
+                info.title += "&gt;</span>";
+                break;
+            default:
+                info.title = node.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+        }
+        
+        return info;
+    },
+
+    _showInlineText: function(node)
+    {
+        if (node.nodeType === Node.ELEMENT_NODE) {
+            var textChild = onlyTextChild.call(node);
+            if (textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength)
+                return true;
+        }
+        return false;
+    }
 }
 
 WebInspector.ElementsTreeElement.prototype.__proto__ = TreeElement.prototype;
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
new file mode 100644
index 0000000..55b8e55
--- /dev/null
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.EventListenersSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Event Listeners"));
+    this.bodyElement.addStyleClass("events-pane");
+
+    this.sections = [];
+
+    this.settingsSelectElement = document.createElement("select");
+
+    var option = document.createElement("option");
+    option.value = "all";
+    if (Preferences.eventListenersFilter === "all")
+        option.selected = true;
+    option.label = WebInspector.UIString("All Nodes");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "selected";
+    if (Preferences.eventListenersFilter === "selected")
+        option.selected = true;
+    option.label = WebInspector.UIString("Selected Node Only");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
+    this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+
+    this.titleElement.appendChild(this.settingsSelectElement);
+}
+
+WebInspector.EventListenersSidebarPane.prototype = {
+    update: function(node)
+    {
+        var body = this.bodyElement;
+        body.removeChildren();
+        this.sections = [];
+
+        var self = this;
+        function callback(nodeId, eventListeners) {
+            var sectionNames = [];
+            var sectionMap = {};
+            for (var i = 0; i < eventListeners.length; ++i) {
+                var eventListener = eventListeners[i];
+                eventListener.node = WebInspector.domAgent.nodeForId(eventListener.nodeId);
+                delete eventListener.nodeId; // no longer needed
+                var type = eventListener.type;
+                var section = sectionMap[type];
+                if (!section) {
+                    section = new WebInspector.EventListenersSection(type, nodeId);
+                    sectionMap[type] = section;
+                    sectionNames.push(type);
+                    self.sections.push(section);
+                }
+                section.addListener(eventListener);
+            }
+            
+            if (sectionNames.length === 0) {
+                var div = document.createElement("div");
+                div.className = "info";
+                div.textContent = WebInspector.UIString("No Event Listeners");
+                body.appendChild(div);
+                return;
+            }
+
+            sectionNames.sort();
+            for (var i = 0; i < sectionNames.length; ++i) {
+                var section = sectionMap[sectionNames[i]];
+                section.update();
+                body.appendChild(section.element);
+            }
+        }
+
+        WebInspector.EventListeners.getEventListenersForNodeAsync(node, callback);
+    },
+
+    _changeSetting: function(event)
+    {
+        var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
+        Preferences.eventListenersFilter = selectedOption.value;
+
+        InspectorController.setSetting("event-listeners-filter", Preferences.eventListenersFilter);
+
+        for (var i = 0; i < this.sections.length; ++i)
+            this.sections[i].update();
+    }
+}
+
+WebInspector.EventListenersSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.EventListenersSection = function(title, nodeId)
+{
+    this.eventListeners = [];
+    this._nodeId = nodeId;
+    WebInspector.PropertiesSection.call(this, title);
+
+    // Changed from a Properties List
+    this.propertiesElement.parentNode.removeChild(this.propertiesElement);
+    delete this.propertiesElement;
+    delete this.propertiesTreeOutline;
+
+    this.eventBars = document.createElement("div");
+    this.eventBars.className = "event-bars";
+    this.element.appendChild(this.eventBars);
+}
+
+WebInspector.EventListenersSection.prototype = {
+    update: function()
+    {
+        // A Filtered Array simplifies when to create connectors
+        var filteredEventListeners = this.eventListeners;
+        if (Preferences.eventListenersFilter === "selected") {
+            filteredEventListeners = [];
+            for (var i = 0; i < this.eventListeners.length; ++i) {
+                var eventListener = this.eventListeners[i];
+                if (eventListener.node.id === this._nodeId)
+                    filteredEventListeners.push(eventListener);
+            }
+        }
+
+        this.eventBars.removeChildren();
+        var length = filteredEventListeners.length;
+        for (var i = 0; i < length; ++i) {
+            var eventListener = filteredEventListeners[i];
+            var eventListenerBar = new WebInspector.EventListenerBar(eventListener);
+            if (i < length - 1) {
+                var connector = document.createElement("div");
+                connector.className = "event-bar-connector";
+                eventListenerBar.element.appendChild(connector);
+            }
+
+            this.eventBars.appendChild(eventListenerBar.element);
+        }
+    },
+
+    addListener: function(eventListener)
+    {
+        this.eventListeners.push(eventListener);
+    }
+}
+
+WebInspector.EventListenersSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
+
+WebInspector.EventListenerBar = function(eventListener)
+{
+    this.eventListener = eventListener;
+    WebInspector.ObjectPropertiesSection.call(this, null, this._getFunctionDisplayName(), this._getNodeDisplayName());
+    this.editable = false;
+    this.element.className = "event-bar"; /* Changed from "section" */
+    this.propertiesElement.className = "event-properties"; /* Changed from "properties" */
+}
+
+WebInspector.EventListenerBar.prototype = {
+    update: function()
+    {
+        var properties = [];
+        for (var propertyName in this.eventListener) {
+            // Just build properties in place - no need to reach out for injected script.
+            var value = this.eventListener[propertyName];
+            if (value instanceof WebInspector.DOMNode)
+                value = new WebInspector.ObjectProxy(value.id, [], 0, appropriateSelectorForNode(value), true);
+            else
+                value = WebInspector.ObjectProxy.wrapPrimitiveValue(value);
+            properties.push(new WebInspector.ObjectPropertyProxy(propertyName, value));
+        }
+        this.updateProperties(properties);
+    },
+
+    _getNodeDisplayName: function()
+    {
+        var node = this.eventListener.node;
+        if (!node)
+            return "";
+
+        if (node.nodeType === Node.DOCUMENT_NODE)
+            return "document";
+        
+        return appropriateSelectorForNode(node);
+    },
+
+    _getFunctionDisplayName: function()
+    {
+        // TODO: v8 does not yet provide the raw function, this handles such a case with a placeholder
+        // I didn't make this a UIString because it should be implemented eventually.
+        if (!this.eventListener.listener)
+            return "(listener)";
+
+        // Requires that Function.toString() return at least the function's signature
+        var match = this.eventListener.listener.toString().match(/function ([^\(]+?)\(/);
+        return (match ? match[1] : WebInspector.UIString("(anonymous function)"));
+    }
+}
+
+WebInspector.EventListenerBar.prototype.__proto__ = WebInspector.ObjectPropertiesSection.prototype;
diff --git a/WebCore/inspector/front-end/ImageView.js b/WebCore/inspector/front-end/ImageView.js
index 001ffdd..96e1a6e 100644
--- a/WebCore/inspector/front-end/ImageView.js
+++ b/WebCore/inspector/front-end/ImageView.js
@@ -37,6 +37,7 @@ WebInspector.ImageView = function(resource)
     this.contentElement.appendChild(container);
 
     this.imagePreviewElement = document.createElement("img");
+    this.imagePreviewElement.addStyleClass("resource-image-view");
     this.imagePreviewElement.setAttribute("src", this.resource.url);
 
     container.appendChild(this.imagePreviewElement);
diff --git a/WebCore/inspector/front-end/Images/cookie.png b/WebCore/inspector/front-end/Images/cookie.png
new file mode 100644
index 0000000..90c3c15
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/cookie.png
diff --git a/WebCore/inspector/front-end/Images/domStorage.png b/WebCore/inspector/front-end/Images/domStorage.png
deleted file mode 100644
index 028550c..0000000
--- a/WebCore/inspector/front-end/Images/domStorage.png
+++ /dev/null
diff --git a/WebCore/inspector/front-end/Images/errorRedDot.png b/WebCore/inspector/front-end/Images/errorRedDot.png
new file mode 100644
index 0000000..6f0b164
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/errorRedDot.png
diff --git a/WebCore/inspector/front-end/Images/grayConnectorPoint.png b/WebCore/inspector/front-end/Images/grayConnectorPoint.png
new file mode 100644
index 0000000..fddc7ea
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/grayConnectorPoint.png
diff --git a/WebCore/inspector/front-end/Images/localStorage.png b/WebCore/inspector/front-end/Images/localStorage.png
new file mode 100644
index 0000000..44a3019
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/localStorage.png
diff --git a/WebCore/inspector/front-end/Images/paneSettingsButtons.png b/WebCore/inspector/front-end/Images/paneSettingsButtons.png
new file mode 100644
index 0000000..36a6244
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/paneSettingsButtons.png
diff --git a/WebCore/inspector/front-end/Images/sessionStorage.png b/WebCore/inspector/front-end/Images/sessionStorage.png
new file mode 100644
index 0000000..4d50e35
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/sessionStorage.png
diff --git a/WebCore/inspector/front-end/Images/databasesIcon.png b/WebCore/inspector/front-end/Images/storageIcon.png
index 79c7bb3..79c7bb3 100644
--- a/WebCore/inspector/front-end/Images/databasesIcon.png
+++ b/WebCore/inspector/front-end/Images/storageIcon.png
diff --git a/WebCore/inspector/front-end/Images/successGreenDot.png b/WebCore/inspector/front-end/Images/successGreenDot.png
new file mode 100644
index 0000000..8b9319c
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/successGreenDot.png
diff --git a/WebCore/inspector/front-end/Images/warningOrangeDot.png b/WebCore/inspector/front-end/Images/warningOrangeDot.png
new file mode 100644
index 0000000..8c8b635
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/warningOrangeDot.png
diff --git a/WebCore/inspector/front-end/Images/whiteConnectorPoint.png b/WebCore/inspector/front-end/Images/whiteConnectorPoint.png
new file mode 100644
index 0000000..c8fb1cf
--- /dev/null
+++ b/WebCore/inspector/front-end/Images/whiteConnectorPoint.png
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 4611b48..75c8ced 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
- * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,12 +26,33 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-var InjectedScript = {
-    _styles: {},
-    _styleRules: {},
-    _lastStyleId: 0,
-    _lastStyleRuleId: 0
-};
+var InjectedScript = {};
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.reset = function()
+{
+    InjectedScript._styles = {};
+    InjectedScript._styleRules = {};
+    InjectedScript._lastStyleId = 0;
+    InjectedScript._lastStyleRuleId = 0;
+    InjectedScript._searchResults = [];
+    InjectedScript._includedInSearchResultsPropertyName = "__includedInInspectorSearchResults";
+}
+
+InjectedScript.reset();
+
+InjectedScript.dispatch = function(methodName, args, callId)
+{
+    var argsArray = JSON.parse(args);
+    if (callId)
+        argsArray.splice(0, 0, callId);  // Methods that run asynchronously have a call back id parameter.
+    var result = InjectedScript[methodName].apply(InjectedScript, argsArray);
+    if (typeof result === "undefined") {
+        InjectedScript._window().console.error("Web Inspector error: InjectedScript.%s returns undefined", methodName);
+        result = null;
+    }
+    return JSON.stringify(result);
+}
 
 InjectedScript.getStyles = function(nodeId, authorOnly)
 {
@@ -99,6 +119,10 @@ InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
             style.removeProperty(propertyName);
     }
 
+    // Notify caller that the property was successfully deleted.
+    if (!styleTextLength)
+        return [null, [propertyName]];
+
     if (!tempStyle.length)
         return false;
 
@@ -133,6 +157,7 @@ InjectedScript.applyStyleText = function(styleId, styleText, propertyName)
 InjectedScript.setStyleText = function(style, cssText)
 {
     style.cssText = cssText;
+    return true;
 }
 
 InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
@@ -174,12 +199,14 @@ InjectedScript.toggleStyleEnabled = function(styleId, propertyName, disabled)
     return InjectedScript._serializeStyle(style, true);
 }
 
-InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNode)
+InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNodeId)
 {
     var rule = InjectedScript._styleRules[ruleId];
     if (!rule)
         return false;
 
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+
     try {
         var stylesheet = rule.parentStyleSheet;
         stylesheet.addRule(newContent);
@@ -194,20 +221,14 @@ InjectedScript.applyStyleRuleText = function(ruleId, newContent, selectedNode)
             }
         }
 
-        var nodes = selectedNode.ownerDocument.querySelectorAll(newContent);
-        for (var i = 0; i < nodes.length; ++i) {
-            if (nodes[i] === selectedNode) {
-                return [InjectedScript._serializeRule(newRule), true];
-            }
-        }
-        return [InjectedScript._serializeRule(newRule), false];
+        return [InjectedScript._serializeRule(newRule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode)];
     } catch(e) {
         // Report invalid syntax.
         return false;
     }
 }
 
-InjectedScript.addStyleSelector = function(newContent)
+InjectedScript.addStyleSelector = function(newContent, selectedNodeId)
 {
     var stylesheet = InjectedScript.stylesheet;
     if (!stylesheet) {
@@ -227,10 +248,28 @@ InjectedScript.addStyleSelector = function(newContent)
         return false;
     }
 
-    return InjectedScript._serializeRule(stylesheet.cssRules[stylesheet.cssRules.length - 1]);
+    var selectedNode = InjectedScript._nodeForId(selectedNodeId);
+    var rule = stylesheet.cssRules[stylesheet.cssRules.length - 1];
+    rule.__isViaInspector = true;
+
+    return [ InjectedScript._serializeRule(rule), InjectedScript._doesSelectorAffectNode(newContent, selectedNode) ];
 }
 
-InjectedScript.setStyleProperty = function(styleId, name, value) {
+InjectedScript._doesSelectorAffectNode = function(selectorText, node)
+{
+    if (!node)
+        return false;
+    var nodes = node.ownerDocument.querySelectorAll(selectorText);
+    for (var i = 0; i < nodes.length; ++i) {
+        if (nodes[i] === node) {
+            return true;
+        }
+    }
+    return false;
+}
+
+InjectedScript.setStyleProperty = function(styleId, name, value)
+{
     var style = InjectedScript._styles[styleId];
     if (!style)
         return false;
@@ -251,17 +290,18 @@ InjectedScript._serializeRule = function(rule)
     }
     ruleValue.isUserAgent = parentStyleSheet && !parentStyleSheet.ownerNode && !parentStyleSheet.href;
     ruleValue.isUser = parentStyleSheet && parentStyleSheet.ownerNode && parentStyleSheet.ownerNode.nodeName == "#document";
+    ruleValue.isViaInspector = !!rule.__isViaInspector;
 
     // Bind editable scripts only.
     var doBind = !ruleValue.isUserAgent && !ruleValue.isUser;
     ruleValue.style = InjectedScript._serializeStyle(rule.style, doBind);
 
     if (doBind) {
-        if (!rule._id) {
-            rule._id = InjectedScript._lastStyleRuleId++;
-            InjectedScript._styleRules[rule._id] = rule;
+        if (!rule.id) {
+            rule.id = InjectedScript._lastStyleRuleId++;
+            InjectedScript._styleRules[rule.id] = rule;
         }
-        ruleValue.id = rule._id;
+        ruleValue.id = rule.id;
     }
     return ruleValue;
 }
@@ -295,11 +335,11 @@ InjectedScript._serializeStyle = function(style, doBind)
     result.uniqueStyleProperties = InjectedScript._getUniqueStyleProperties(style);
 
     if (doBind) {
-        if (!style._id) {
-            style._id = InjectedScript._lastStyleId++;
-            InjectedScript._styles[style._id] = style;
+        if (!style.id) {
+            style.id = InjectedScript._lastStyleId++;
+            InjectedScript._styles[style.id] = style;
         }
-        result.id = style._id;
+        result.id = style.id;
     }
     return result;
 }
@@ -389,7 +429,7 @@ InjectedScript.getPrototypes = function(nodeId)
 
     var result = [];
     for (var prototype = node; prototype; prototype = prototype.__proto__) {
-        var title = Object.describe(prototype);
+        var title = Object.describe(prototype, true);
         if (title.match(/Prototype$/)) {
             title = title.replace(/Prototype$/, "");
         }
@@ -405,39 +445,26 @@ InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty)
         return false;
 
     var properties = [];
+
     // Go over properties, prepare results.
     for (var propertyName in object) {
         if (!ignoreHasOwnProperty && "hasOwnProperty" in object && !object.hasOwnProperty(propertyName))
             continue;
 
-        //TODO: remove this once object becomes really remote.
-        if (propertyName === "__treeElementIdentifier")
-            continue;
         var property = {};
         property.name = propertyName;
+        property.parentObjectProxy = objectProxy;
         var isGetter = object["__lookupGetter__"] && object.__lookupGetter__(propertyName);
         if (!property.isGetter) {
             var childObject = object[propertyName];
-            property.type = typeof childObject;
-            property.textContent = Object.describe(childObject, true);
-            property.parentObjectProxy = objectProxy;
-            var parentPath = objectProxy.path.slice();
-            property.childObjectProxy = {
-                objectId : objectProxy.objectId,
-                path : parentPath.splice(parentPath.length, 0, propertyName),
-                protoDepth : objectProxy.protoDepth
-            };
-            if (childObject && (property.type === "object" || property.type === "function")) {
-                for (var subPropertyName in childObject) {
-                    if (propertyName === "__treeElementIdentifier")
-                        continue;
-                    property.hasChildren = true;
-                    break;
-                }
-            }
+            var childObjectProxy = new InjectedScript.createProxyObject(childObject, objectProxy.objectId, true);
+            childObjectProxy.path = objectProxy.path ? objectProxy.path.slice() : [];
+            childObjectProxy.path.push(propertyName);
+            childObjectProxy.protoDepth = objectProxy.protoDepth || 0;
+            property.value = childObjectProxy;
         } else {
             // FIXME: this should show something like "getter" (bug 16734).
-            property.textContent = "\u2014"; // em dash
+            property.value = { description: "\u2014" }; // em dash
             property.isGetter = true;
         }
         properties.push(property);
@@ -479,6 +506,418 @@ InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression
     }
 }
 
+
+InjectedScript.getCompletions = function(expression, includeInspectorCommandLineAPI, callFrameId)
+{
+    var props = {};
+    try {
+        var expressionResult;
+        // Evaluate on call frame if call frame id is available.
+        if (typeof callFrameId === "number") {
+            var callFrame = InjectedScript._callFrameForId(callFrameId);
+            if (!callFrame)
+                return props;
+            expressionResult = InjectedScript._evaluateOn(callFrame.evaluate, callFrame, expression);
+        } else {
+            expressionResult = InjectedScript._evaluateOn(InjectedScript._window().eval, InjectedScript._window(), expression);
+        }
+        for (var prop in expressionResult)
+            props[prop] = true;
+        if (includeInspectorCommandLineAPI)
+            for (var prop in InjectedScript._window()._inspectorCommandLineAPI)
+                if (prop.charAt(0) !== '_')
+                    props[prop] = true;
+    } catch(e) {
+    }
+    return props;
+}
+
+InjectedScript.evaluate = function(expression, objectGroup)
+{
+    return InjectedScript._evaluateAndWrap(InjectedScript._window().eval, InjectedScript._window(), expression, objectGroup);
+}
+
+InjectedScript._evaluateAndWrap = function(evalFunction, object, expression, objectGroup)
+{
+    var result = {};
+    try {
+        result.value = InspectorController.wrapObject(InjectedScript._evaluateOn(evalFunction, object, expression), objectGroup);
+        // Handle error that might have happened while describing result.
+        if (result.value.errorText) {
+            result.value = result.value.errorText;
+            result.isException = true;
+        }
+    } catch (e) {
+        result.value = e.toString();
+        result.isException = true;
+    }
+    return result;
+}
+
+InjectedScript._evaluateOn = function(evalFunction, object, expression)
+{
+    InjectedScript._ensureCommandLineAPIInstalled(evalFunction, object);
+    // Surround the expression in with statements to inject our command line API so that
+    // the window object properties still take more precedent than our API functions.
+    expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
+    var value = evalFunction.call(object, expression);
+
+    // When evaluating on call frame error is not thrown, but returned as a value.
+    if (Object.type(value) === "error")
+        throw value.toString();
+
+    return value;
+}
+
+InjectedScript.addInspectedNode = function(nodeId)
+{
+    var node = InjectedScript._nodeForId(nodeId);
+    if (!node)
+        return false;
+
+    InjectedScript._ensureCommandLineAPIInstalled(InjectedScript._window().eval, InjectedScript._window());
+    var inspectedNodes = InjectedScript._window()._inspectorCommandLineAPI._inspectedNodes;
+    inspectedNodes.unshift(node);
+    if (inspectedNodes.length >= 5)
+        inspectedNodes.pop();
+    return true;
+}
+
+InjectedScript.performSearch = function(whitespaceTrimmedQuery)
+{
+    var tagNameQuery = whitespaceTrimmedQuery;
+    var attributeNameQuery = whitespaceTrimmedQuery;
+    var startTagFound = (tagNameQuery.indexOf("<") === 0);
+    var endTagFound = (tagNameQuery.lastIndexOf(">") === (tagNameQuery.length - 1));
+
+    if (startTagFound || endTagFound) {
+        var tagNameQueryLength = tagNameQuery.length;
+        tagNameQuery = tagNameQuery.substring((startTagFound ? 1 : 0), (endTagFound ? (tagNameQueryLength - 1) : tagNameQueryLength));
+    }
+
+    // Check the tagNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(tagNameQuery))
+        tagNameQuery = null;
+
+    // Check the attributeNameQuery is it is a possibly valid tag name.
+    if (!/^[a-zA-Z0-9\-_:]+$/.test(attributeNameQuery))
+        attributeNameQuery = null;
+
+    const escapedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const escapedTagNameQuery = (tagNameQuery ? tagNameQuery.escapeCharacters("'") : null);
+    const escapedWhitespaceTrimmedQuery = whitespaceTrimmedQuery.escapeCharacters("'");
+    const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+
+    function addNodesToResults(nodes, length, getItem)
+    {
+        if (!length)
+            return;
+
+        var nodeIds = [];
+        for (var i = 0; i < length; ++i) {
+            var node = getItem.call(nodes, i);
+            // Skip this node if it already has the property.
+            if (searchResultsProperty in node)
+                continue;
+
+            if (!InjectedScript._searchResults.length) {
+                InjectedScript._currentSearchResultIndex = 0;
+            }
+
+            node[searchResultsProperty] = true;
+            InjectedScript._searchResults.push(node);
+            var nodeId = InspectorController.pushNodePathToFrontend(node, false);
+            nodeIds.push(nodeId);
+        }
+        InspectorController.addNodesToSearchResult(nodeIds.join(","));
+    }
+
+    function matchExactItems(doc)
+    {
+        matchExactId.call(this, doc);
+        matchExactClassNames.call(this, doc);
+        matchExactTagNames.call(this, doc);
+        matchExactAttributeNames.call(this, doc);
+    }
+
+    function matchExactId(doc)
+    {
+        const result = doc.__proto__.getElementById.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, (result ? 1 : 0), function() { return this });
+    }
+
+    function matchExactClassNames(doc)
+    {
+        const result = doc.__proto__.getElementsByClassName.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.getElementsByTagName.call(doc, tagNameQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchExactAttributeNames(doc)
+    {
+        if (!attributeNameQuery)
+            return;
+        const result = doc.__proto__.querySelectorAll.call(doc, "[" + attributeNameQuery + "]");
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPartialTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStartOfTagNames(doc)
+    {
+        if (!tagNameQuery)
+            return;
+        const result = doc.__proto__.evaluate.call(doc, "//*[starts-with(name(), '" + escapedTagNameQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialTagNamesAndAttributeValues(doc)
+    {
+        if (!tagNameQuery) {
+            matchPartialAttributeValues.call(this, doc);
+            return;
+        }
+
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(name(), '" + escapedTagNameQuery + "') or contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchPartialAttributeValues(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//*[contains(@*, '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchStyleSelector(doc)
+    {
+        const result = doc.__proto__.querySelectorAll.call(doc, whitespaceTrimmedQuery);
+        addNodesToResults.call(this, result, result.length, result.item);
+    }
+
+    function matchPlainText(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, "//text()[contains(., '" + escapedQuery + "')] | //comment()[contains(., '" + escapedQuery + "')]", doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function matchXPathQuery(doc)
+    {
+        const result = doc.__proto__.evaluate.call(doc, whitespaceTrimmedQuery, doc, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE);
+        addNodesToResults.call(this, result, result.snapshotLength, result.snapshotItem);
+    }
+
+    function finishedSearching()
+    {
+        // Remove the searchResultsProperty now that the search is finished.
+        for (var i = 0; i < InjectedScript._searchResults.length; ++i)
+            delete InjectedScript._searchResults[i][searchResultsProperty];
+    }
+
+    const mainFrameDocument = InjectedScript._window().document;
+    const searchDocuments = [mainFrameDocument];
+    var searchFunctions;
+    if (tagNameQuery && startTagFound && endTagFound)
+        searchFunctions = [matchExactTagNames, matchPlainText];
+    else if (tagNameQuery && startTagFound)
+        searchFunctions = [matchStartOfTagNames, matchPlainText];
+    else if (tagNameQuery && endTagFound) {
+        // FIXME: we should have a matchEndOfTagNames search function if endTagFound is true but not startTagFound.
+        // This requires ends-with() support in XPath, WebKit only supports starts-with() and contains().
+        searchFunctions = [matchPartialTagNames, matchPlainText];
+    } else if (whitespaceTrimmedQuery === "//*" || whitespaceTrimmedQuery === "*") {
+        // These queries will match every node. Matching everything isn't useful and can be slow for large pages,
+        // so limit the search functions list to plain text and attribute matching.
+        searchFunctions = [matchPartialAttributeValues, matchPlainText];
+    } else
+        searchFunctions = [matchExactItems, matchStyleSelector, matchPartialTagNamesAndAttributeValues, matchPlainText, matchXPathQuery];
+
+    // Find all frames, iframes and object elements to search their documents.
+    const querySelectorAllFunction = InjectedScript._window().Document.prototype.querySelectorAll;
+    const subdocumentResult = querySelectorAllFunction.call(mainFrameDocument, "iframe, frame, object");
+
+    for (var i = 0; i < subdocumentResult.length; ++i) {
+        var element = subdocumentResult.item(i);
+        if (element.contentDocument)
+            searchDocuments.push(element.contentDocument);
+    }
+
+    const panel = InjectedScript;
+    var documentIndex = 0;
+    var searchFunctionIndex = 0;
+    var chunkIntervalIdentifier = null;
+
+    // Split up the work into chunks so we don't block the UI thread while processing.
+
+    function processChunk()
+    {
+        var searchDocument = searchDocuments[documentIndex];
+        var searchFunction = searchFunctions[searchFunctionIndex];
+
+        if (++searchFunctionIndex > searchFunctions.length) {
+            searchFunction = searchFunctions[0];
+            searchFunctionIndex = 0;
+
+            if (++documentIndex > searchDocuments.length) {
+                if (panel._currentSearchChunkIntervalIdentifier === chunkIntervalIdentifier)
+                    delete panel._currentSearchChunkIntervalIdentifier;
+                clearInterval(chunkIntervalIdentifier);
+                finishedSearching.call(panel);
+                return;
+            }
+
+            searchDocument = searchDocuments[documentIndex];
+        }
+
+        if (!searchDocument || !searchFunction)
+            return;
+
+        try {
+            searchFunction.call(panel, searchDocument);
+        } catch(err) {
+            // ignore any exceptions. the query might be malformed, but we allow that.
+        }
+    }
+
+    processChunk();
+
+    chunkIntervalIdentifier = setInterval(processChunk, 25);
+    InjectedScript._currentSearchChunkIntervalIdentifier = chunkIntervalIdentifier;
+    return true;
+}
+
+InjectedScript.searchCanceled = function()
+{
+    if (InjectedScript._searchResults) {
+        const searchResultsProperty = InjectedScript._includedInSearchResultsPropertyName;
+        for (var i = 0; i < this._searchResults.length; ++i) {
+            var node = this._searchResults[i];
+
+            // Remove the searchResultsProperty since there might be an unfinished search.
+            delete node[searchResultsProperty];
+        }
+    }
+
+    if (InjectedScript._currentSearchChunkIntervalIdentifier) {
+        clearInterval(InjectedScript._currentSearchChunkIntervalIdentifier);
+        delete InjectedScript._currentSearchChunkIntervalIdentifier;
+    }
+    InjectedScript._searchResults = [];
+    return true;
+}
+
+InjectedScript.openInInspectedWindow = function(url)
+{
+    // Don't call window.open on wrapper - popup blocker mutes it.
+    // URIs should have no double quotes.
+    InjectedScript._window().eval("window.open(\"" + url + "\")");
+    return true;
+}
+
+InjectedScript.getCallFrames = function()
+{
+    var callFrame = InspectorController.currentCallFrame();
+    if (!callFrame)
+        return false;
+
+    var result = [];
+    var depth = 0;
+    do {
+        result.push(new InjectedScript.CallFrameProxy(depth++, callFrame));
+        callFrame = callFrame.caller;
+    } while (callFrame);
+    return result;
+}
+
+InjectedScript.evaluateInCallFrame = function(callFrameId, code, objectGroup)
+{
+    var callFrame = InjectedScript._callFrameForId(callFrameId);
+    if (!callFrame)
+        return false;
+    return InjectedScript._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup);
+}
+
+InjectedScript._callFrameForId = function(id)
+{
+    var callFrame = InspectorController.currentCallFrame();
+    while (--id >= 0 && callFrame)
+        callFrame = callFrame.caller;
+    return callFrame;
+}
+
+InjectedScript._clearConsoleMessages = function()
+{
+    InspectorController.clearMessages(true);
+}
+
+InjectedScript._inspectObject = function(o)
+{
+    if (arguments.length === 0)
+        return;
+
+    var inspectedWindow = InjectedScript._window();
+    inspectedWindow.console.log(o);
+    if (Object.type(o) === "node") {
+        InspectorController.pushNodePathToFrontend(o, true);
+    } else {
+        switch (Object.describe(o)) {
+            case "Database":
+                InspectorController.selectDatabase(o);
+                break;
+            case "Storage":
+                InspectorController.selectDOMStorage(o);
+                break;
+        }
+    }
+}
+
+InjectedScript._ensureCommandLineAPIInstalled = function(evalFunction, evalObject)
+{
+    if (evalFunction.call(evalObject, "window._inspectorCommandLineAPI"))
+        return;
+    var inspectorCommandLineAPI = evalFunction.call(evalObject, "window._inspectorCommandLineAPI = { \
+        $: function() { return document.getElementById.apply(document, arguments) }, \
+        $$: function() { return document.querySelectorAll.apply(document, arguments) }, \
+        $x: function(xpath, context) { \
+            var nodes = []; \
+            try { \
+                var doc = context || document; \
+                var results = doc.evaluate(xpath, doc, null, XPathResult.ANY_TYPE, null); \
+                var node; \
+                while (node = results.iterateNext()) nodes.push(node); \
+            } catch (e) {} \
+            return nodes; \
+        }, \
+        dir: function() { return console.dir.apply(console, arguments) }, \
+        dirxml: function() { return console.dirxml.apply(console, arguments) }, \
+        keys: function(o) { var a = []; for (var k in o) a.push(k); return a; }, \
+        values: function(o) { var a = []; for (var k in o) a.push(o[k]); return a; }, \
+        profile: function() { return console.profile.apply(console, arguments) }, \
+        profileEnd: function() { return console.profileEnd.apply(console, arguments) }, \
+        _inspectedNodes: [], \
+        get $0() { return _inspectorCommandLineAPI._inspectedNodes[0] }, \
+        get $1() { return _inspectorCommandLineAPI._inspectedNodes[1] }, \
+        get $2() { return _inspectorCommandLineAPI._inspectedNodes[2] }, \
+        get $3() { return _inspectorCommandLineAPI._inspectedNodes[3] }, \
+        get $4() { return _inspectorCommandLineAPI._inspectedNodes[4] } \
+    };");
+
+    inspectorCommandLineAPI.clear = InspectorController.wrapCallback(InjectedScript._clearConsoleMessages);
+    inspectorCommandLineAPI.inspect = InspectorController.wrapCallback(InjectedScript._inspectObject);
+}
+
 InjectedScript._resolveObject = function(objectProxy)
 {
     var object = InjectedScript._objectForId(objectProxy.objectId);
@@ -486,11 +925,11 @@ InjectedScript._resolveObject = function(objectProxy)
     var protoDepth = objectProxy.protoDepth;
 
     // Follow the property path.
-    for (var i = 0; object && i < path.length; ++i)
+    for (var i = 0; object && path && i < path.length; ++i)
         object = object[path[i]];
 
     // Get to the necessary proto layer.
-    for (var i = 0; object && i < protoDepth; ++i)
+    for (var i = 0; object && protoDepth && i < protoDepth; ++i)
         object = object.__proto__;
 
     return object;
@@ -505,12 +944,251 @@ InjectedScript._window = function()
 
 InjectedScript._nodeForId = function(nodeId)
 {
-    // TODO: replace with node lookup in the InspectorDOMAgent once DOMAgent nodes are used.
-    return nodeId;
+    if (!nodeId)
+        return null;
+    return InspectorController.nodeForId(nodeId);
 }
 
 InjectedScript._objectForId = function(objectId)
 {
-    // TODO: replace with node lookups for node ids and evaluation result lookups for the rest of ids.
+    // There are three types of object ids used:
+    // - numbers point to DOM Node via the InspectorDOMAgent mapping
+    // - strings point to console objects cached in InspectorController for lazy evaluation upon them
+    // - objects contain complex ids and are currently used for scoped objects
+    if (typeof objectId === "number") {
+        return InjectedScript._nodeForId(objectId);
+    } else if (typeof objectId === "string") {
+        return InspectorController.unwrapObject(objectId);
+    } else if (typeof objectId === "object") {
+        var callFrame = InjectedScript._callFrameForId(objectId.callFrame);
+        if (objectId.thisObject)
+            return callFrame.thisObject;
+        else
+            return callFrame.scopeChain[objectId.chainIndex];
+    }
     return objectId;
 }
+
+InjectedScript.pushNodeToFrontend = function(objectProxy)
+{
+    var object = InjectedScript._resolveObject(objectProxy);
+    if (!object || Object.type(object) !== "node")
+        return false;
+    return InspectorController.pushNodePathToFrontend(object, false);
+}
+
+// Called from within InspectorController on the 'inspected page' side.
+InjectedScript.createProxyObject = function(object, objectId, abbreviate)
+{
+    var result = {};
+    result.objectId = objectId;
+    result.type = Object.type(object);
+
+    var type = typeof object;
+    if ((type === "object" && object !== null) || type === "function") {
+        for (var subPropertyName in object) {
+            result.hasChildren = true;
+            break;
+        }
+    }
+    try {
+        result.description = Object.describe(object, abbreviate);
+    } catch (e) {
+        result.errorText = e.toString();
+    }
+    return result;
+}
+
+InjectedScript.CallFrameProxy = function(id, callFrame)
+{
+    this.id = id;
+    this.type = callFrame.type;
+    this.functionName = (this.type === "function" ? callFrame.functionName : "");
+    this.sourceID = callFrame.sourceID;
+    this.line = callFrame.line;
+    this.scopeChain = this._wrapScopeChain(callFrame);
+}
+
+InjectedScript.CallFrameProxy.prototype = {
+    _wrapScopeChain: function(callFrame)
+    {
+        var foundLocalScope = false;
+        var scopeChain = callFrame.scopeChain;
+        var scopeChainProxy = [];
+        for (var i = 0; i < scopeChain.length; ++i) {
+            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = InjectedScript.createProxyObject(scopeObject, { callFrame: this.id, chainIndex: i }, true);
+
+            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
+                if (!foundLocalScope)
+                    scopeObjectProxy.thisObject = InjectedScript.createProxyObject(callFrame.thisObject, { callFrame: this.id, thisObject: true }, true);
+                else
+                    scopeObjectProxy.isClosure = true;
+                foundLocalScope = true;
+                scopeObjectProxy.isLocal = true;
+            } else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Element)
+                scopeObjectProxy.isElement = true;
+            else if (foundLocalScope && scopeObject instanceof InjectedScript._window().Document)
+                scopeObjectProxy.isDocument = true;
+            else if (!foundLocalScope)
+                scopeObjectProxy.isWithBlock = true;
+            scopeObjectProxy.properties = [];
+            try {
+                for (var propertyName in scopeObject)
+                    scopeObjectProxy.properties.push(propertyName);
+            } catch (e) {
+            }
+            scopeChainProxy.push(scopeObjectProxy);
+        }
+        return scopeChainProxy;
+    }
+}
+
+InjectedScript.executeSql = function(callId, databaseId, query)
+{
+    function successCallback(tx, result)
+    {
+        var rows = result.rows;
+        var result = [];
+        var length = rows.length;
+        for (var i = 0; i < length; ++i) {
+            var data = {};
+            result.push(data);
+            var row = rows.item(i);
+            for (var columnIdentifier in row) {
+                // FIXME: (Bug 19439) We should specially format SQL NULL here
+                // (which is represented by JavaScript null here, and turned
+                // into the string "null" by the String() function).
+                var text = row[columnIdentifier];
+                data[columnIdentifier] = String(text);
+            }
+        }
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(result), false);
+    }
+
+    function errorCallback(tx, error)
+    {
+        InspectorController.reportDidDispatchOnInjectedScript(callId, JSON.stringify(error), false);
+    }
+
+    function queryTransaction(tx)
+    {
+        tx.executeSql(query, null, InspectorController.wrapCallback(successCallback), InspectorController.wrapCallback(errorCallback));
+    }
+
+    var database = InspectorController.databaseForId(databaseId);
+    if (!database)
+        errorCallback(null, { code : 2 });  // Return as unexpected version.
+    database.transaction(InspectorController.wrapCallback(queryTransaction), InspectorController.wrapCallback(errorCallback));
+    return true;
+}
+
+Object.type = function(obj)
+{
+    if (obj === null)
+        return "null";
+
+    var type = typeof obj;
+    if (type !== "object" && type !== "function")
+        return type;
+
+    var win = InjectedScript._window();
+
+    if (obj instanceof win.Node)
+        return (obj.nodeType === undefined ? type : "node");
+    if (obj instanceof win.String)
+        return "string";
+    if (obj instanceof win.Array)
+        return "array";
+    if (obj instanceof win.Boolean)
+        return "boolean";
+    if (obj instanceof win.Number)
+        return "number";
+    if (obj instanceof win.Date)
+        return "date";
+    if (obj instanceof win.RegExp)
+        return "regexp";
+    if (obj instanceof win.NodeList)
+        return "array";
+    if (obj instanceof win.Error)
+        return "error";
+    return type;
+}
+
+Object.hasProperties = function(obj)
+{
+    if (typeof obj === "undefined" || typeof obj === "null")
+        return false;
+    for (var name in obj)
+        return true;
+    return false;
+}
+
+Object.describe = function(obj, abbreviated)
+{
+    var type1 = Object.type(obj);
+    var type2 = Object.className(obj);
+
+    switch (type1) {
+    case "object":
+    case "node":
+        return type2;
+    case "array":
+        return "[" + obj.toString() + "]";
+    case "string":
+        if (!abbreviated)
+            return obj;
+        if (obj.length > 100)
+            return "\"" + obj.substring(0, 100) + "\u2026\"";
+        return "\"" + obj + "\"";
+    case "function":
+        var objectText = String(obj);
+        if (!/^function /.test(objectText))
+            objectText = (type2 == "object") ? type1 : type2;
+        else if (abbreviated)
+            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
+        return objectText;
+    case "regexp":
+        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
+    default:
+        return String(obj);
+    }
+}
+
+Object.className = function(obj)
+{
+    return Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1")
+}
+
+// Although Function.prototype.bind and String.prototype.escapeCharacters are defined in utilities.js they will soon become
+// unavailable in the InjectedScript context. So we define them here for the local use.
+// TODO: remove this comment once InjectedScript runs in a separate context.
+Function.prototype.bind = function(thisObject)
+{
+    var func = this;
+    var args = Array.prototype.slice.call(arguments, 1);
+    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))) };
+}
+
+String.prototype.escapeCharacters = function(chars)
+{
+    var foundChar = false;
+    for (var i = 0; i < chars.length; ++i) {
+        if (this.indexOf(chars.charAt(i)) !== -1) {
+            foundChar = true;
+            break;
+        }
+    }
+
+    if (!foundChar)
+        return this;
+
+    var result = "";
+    for (var i = 0; i < this.length; ++i) {
+        if (chars.indexOf(this.charAt(i)) !== -1)
+            result += "\\";
+        result += this.charAt(i);
+    }
+
+    return result;
+}
diff --git a/WebCore/inspector/front-end/InjectedScriptAccess.js b/WebCore/inspector/front-end/InjectedScriptAccess.js
new file mode 100644
index 0000000..c6d4b65
--- /dev/null
+++ b/WebCore/inspector/front-end/InjectedScriptAccess.js
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+var InjectedScriptAccess = {};
+
+InjectedScriptAccess._installHandler = function(methodName, async)
+{
+    InjectedScriptAccess[methodName] = function()
+    {
+        var allArgs = Array.prototype.slice.call(arguments);
+        var callback = allArgs[allArgs.length - 1];
+        var argsString = JSON.stringify(Array.prototype.slice.call(allArgs, 0, allArgs.length - 1));
+        
+        function myCallback(result, isException)
+        {
+            if (!isException)
+                callback(JSON.parse(result));
+            else
+                WebInspector.console.addMessage(new WebInspector.ConsoleTextMessage("Error dispatching: " + methodName));
+        }
+        var callId = WebInspector.Callback.wrap(myCallback);
+        InspectorController.dispatchOnInjectedScript(callId, methodName, argsString, !!async);
+    };
+}
+
+// InjectedScriptAccess message forwarding puts some constraints on the way methods are imlpemented and called:
+// - Make sure corresponding methods in InjectedScript return non-null and non-undefined values,
+// - Make sure last parameter of all the InjectedSriptAccess.* calls is a callback function.
+// We keep these sorted.
+InjectedScriptAccess._installHandler("addInspectedNode");
+InjectedScriptAccess._installHandler("addStyleSelector");
+InjectedScriptAccess._installHandler("applyStyleRuleText");
+InjectedScriptAccess._installHandler("applyStyleText");
+InjectedScriptAccess._installHandler("evaluate");
+InjectedScriptAccess._installHandler("evaluateInCallFrame");
+InjectedScriptAccess._installHandler("getCompletions");
+InjectedScriptAccess._installHandler("getComputedStyle");
+InjectedScriptAccess._installHandler("getInlineStyle");
+InjectedScriptAccess._installHandler("getProperties");
+InjectedScriptAccess._installHandler("getPrototypes");
+InjectedScriptAccess._installHandler("getStyles");
+InjectedScriptAccess._installHandler("openInInspectedWindow");
+InjectedScriptAccess._installHandler("performSearch");
+InjectedScriptAccess._installHandler("pushNodeToFrontend");
+InjectedScriptAccess._installHandler("searchCanceled");
+InjectedScriptAccess._installHandler("setPropertyValue");
+InjectedScriptAccess._installHandler("setStyleProperty");
+InjectedScriptAccess._installHandler("setStyleText");
+InjectedScriptAccess._installHandler("toggleStyleEnabled");
+
+// Some methods can't run synchronously even on the injected script side (such as DB transactions).
+// Mark them as asynchronous here.
+InjectedScriptAccess._installHandler("executeSql", true);
+
+WebInspector.didDispatchOnInjectedScript = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/MetricsSidebarPane.js b/WebCore/inspector/front-end/MetricsSidebarPane.js
index 8712dcd..a33653b 100644
--- a/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -57,14 +57,14 @@ WebInspector.MetricsSidebarPane.prototype = {
             var style = WebInspector.CSSStyleDeclaration.parseStyle(stylePayload);
             self._update(node, body, style);
         };
-        InspectorController.getComputedStyle(node, callback);
+        InjectedScriptAccess.getComputedStyle(node.id, callback);
 
         var inlineStyleCallback = function(stylePayload) {
             if (!stylePayload)
                 return;
             self._inlineStyleId = stylePayload.id;
         };
-        InspectorController.getInlineStyle(node, inlineStyleCallback);
+        InjectedScriptAccess.getInlineStyle(node.id, inlineStyleCallback);
     },
 
     _update: function(node, body, style)
@@ -208,7 +208,7 @@ WebInspector.MetricsSidebarPane.prototype = {
             self.dispatchEventToListeners("metrics edited");
             self.update();
         };
-        InspectorController.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
+        InjectedScriptAccess.setStyleProperty(this._inlineStyleId, context.styleProperty, userInput, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Object.js b/WebCore/inspector/front-end/Object.js
index 80202b0..74fb56e 100644
--- a/WebCore/inspector/front-end/Object.js
+++ b/WebCore/inspector/front-end/Object.js
@@ -67,10 +67,10 @@ WebInspector.Object.prototype = {
         }
 
         var event = {target: this, type: eventType, defaultPrevented: false};
-        event.stopPropagation = stopPropagation.bind(event);
-        event.preventDefault = preventDefault.bind(event);
+        event.stopPropagation = stopPropagation;
+        event.preventDefault = preventDefault;
 
-        var listeners = this._listeners[eventType];
+        var listeners = this._listeners[eventType].slice(0);
         for (var i = 0; i < listeners.length; ++i) {
             listeners[i].listener.call(listeners[i].thisObject, event);
             if (stoppedPropagation)
diff --git a/WebCore/inspector/front-end/ObjectPropertiesSection.js b/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 9b03940..8bb4e35 100644
--- a/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -48,73 +48,81 @@ WebInspector.ObjectPropertiesSection.prototype = {
         var callback = function(properties) {
             if (!properties)
                 return;
-            self._update(properties);
+            self.updateProperties(properties);
         };
-        InspectorController.getProperties(this.object, this.ignoreHasOwnProperty, callback);
+        InjectedScriptAccess.getProperties(this.object, this.ignoreHasOwnProperty, callback);
     },
 
-    _update: function(properties)
+    updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
     {
+        if (!rootTreeElementConstructor)
+            rootTreeElementConstructor = this.treeElementConstructor;
+            
+        if (!rootPropertyComparer)
+            rootPropertyComparer = WebInspector.ObjectPropertiesSection.CompareProperties;
+            
         if (this.extraProperties)
-            for (var prop in this.extraProperties)
-                properties.push(new WebInspector.ObjectPropertyProxy(prop, this.extraProperties[prop]));
-        properties.sort(this._displaySort);
+            for (var i = 0; i < this.extraProperties.length; ++i)
+                properties.push(this.extraProperties[i]);
+                
+        properties.sort(rootPropertyComparer);
 
         this.propertiesTreeOutline.removeChildren();
 
         for (var i = 0; i < properties.length; ++i)
-            this.propertiesTreeOutline.appendChild(new this.treeElementConstructor(properties[i]));
+            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
 
         if (!this.propertiesTreeOutline.children.length) {
             var title = "<div class=\"info\">" + this.emptyPlaceholder + "</div>";
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
-    },
-
-    _displaySort: function(propertyA, propertyB) {
-        var a = propertyA.name;
-        var b = propertyB.name;
-
-        // if used elsewhere make sure to
-        //  - convert a and b to strings (not needed here, properties are all strings)
-        //  - check if a == b (not needed here, no two properties can be the same)
-
-        var diff = 0;
-        var chunk = /^\d+|^\D+/;
-        var chunka, chunkb, anum, bnum;
-        while (diff === 0) {
-            if (!a && b)
-                return -1;
-            if (!b && a)
-                return 1;
-            chunka = a.match(chunk)[0];
-            chunkb = b.match(chunk)[0];
-            anum = !isNaN(chunka);
-            bnum = !isNaN(chunkb);
-            if (anum && !bnum)
-                return -1;
-            if (bnum && !anum)
-                return 1;
-            if (anum && bnum) {
-                diff = chunka - chunkb;
-                if (diff === 0 && chunka.length !== chunkb.length) {
-                    if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
-                        return chunka.length - chunkb.length;
-                    else
-                        return chunkb.length - chunka.length;
-                }
-            } else if (chunka !== chunkb)
-                return (chunka < chunkb) ? -1 : 1;
-            a = a.substring(chunka.length);
-            b = b.substring(chunkb.length);
-        }
-        return diff;
     }
 }
 
 WebInspector.ObjectPropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
+WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, propertyB) 
+{
+    var a = propertyA.name;
+    var b = propertyB.name;
+
+    // if used elsewhere make sure to
+    //  - convert a and b to strings (not needed here, properties are all strings)
+    //  - check if a == b (not needed here, no two properties can be the same)
+
+    var diff = 0;
+    var chunk = /^\d+|^\D+/;
+    var chunka, chunkb, anum, bnum;
+    while (diff === 0) {
+        if (!a && b)
+            return -1;
+        if (!b && a)
+            return 1;
+        chunka = a.match(chunk)[0];
+        chunkb = b.match(chunk)[0];
+        anum = !isNaN(chunka);
+        bnum = !isNaN(chunkb);
+        if (anum && !bnum)
+            return -1;
+        if (bnum && !anum)
+            return 1;
+        if (anum && bnum) {
+            diff = chunka - chunkb;
+            if (diff === 0 && chunka.length !== chunkb.length) {
+                if (!+chunka && !+chunkb) // chunks are strings of all 0s (special case)
+                    return chunka.length - chunkb.length;
+                else
+                    return chunkb.length - chunka.length;
+            }
+        } else if (chunka !== chunkb)
+            return (chunka < chunkb) ? -1 : 1;
+        a = a.substring(chunka.length);
+        b = b.substring(chunkb.length);
+    }
+    return diff;
+}
+
 WebInspector.ObjectPropertyTreeElement = function(property)
 {
     this.property = property;
@@ -124,30 +132,22 @@ WebInspector.ObjectPropertyTreeElement = function(property)
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype = {
-    safePropertyValue: function(object, propertyName)
-    {
-        if (object["__lookupGetter__"] && object.__lookupGetter__(propertyName))
-            return;
-        return object[propertyName];
-    },
-
     onpopulate: function()
     {
         if (this.children.length && !this.shouldRefreshChildren)
             return;
 
-        var self = this;
         var callback = function(properties) {
-            self.removeChildren();
+            this.removeChildren();
             if (!properties)
                 return;
 
-            properties.sort(self._displaySort);
+            properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
             for (var i = 0; i < properties.length; ++i) {
-                self.appendChild(new self.treeOutline.section.treeElementConstructor(properties[i]));
+                this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
         };
-        InspectorController.getProperties(this.property.childObjectProxy, false, callback);
+        InjectedScriptAccess.getProperties(this.property.value, false, callback.bind(this));
     },
 
     ondblclick: function(element, event)
@@ -162,22 +162,26 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     update: function()
     {
-        var nameElement = document.createElement("span");
-        nameElement.className = "name";
-        nameElement.textContent = this.property.name;
-
+        this.nameElement = document.createElement("span");
+        this.nameElement.className = "name";
+        this.nameElement.textContent = this.property.name;
+
+        var separatorElement = document.createElement("span");
+        separatorElement.className = "separator";
+        separatorElement.textContent = ": ";
+        
         this.valueElement = document.createElement("span");
         this.valueElement.className = "value";
-        this.valueElement.textContent = this.property.textContent;
+        this.valueElement.textContent = this.property.value.description;
         if (this.property.isGetter)
            this.valueElement.addStyleClass("dimmed");
 
         this.listItemElement.removeChildren();
 
-        this.listItemElement.appendChild(nameElement);
-        this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(this.nameElement);
+        this.listItemElement.appendChild(separatorElement);
         this.listItemElement.appendChild(this.valueElement);
-        this.hasChildren = this.property.hasChildren;
+        this.hasChildren = this.property.value.hasChildren;
     },
 
     updateSiblings: function()
@@ -247,7 +251,7 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
                 self.updateSiblings();
             }
         };
-        InspectorController.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
+        InjectedScriptAccess.setPropertyValue(this.property.parentObjectProxy, this.property.name, expression.trimWhitespace(), callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/ObjectProxy.js b/WebCore/inspector/front-end/ObjectProxy.js
index fa7816e..bb4afa5 100644
--- a/WebCore/inspector/front-end/ObjectProxy.js
+++ b/WebCore/inspector/front-end/ObjectProxy.js
@@ -28,18 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.ObjectProxy = function(objectId, path, protoDepth)
+WebInspector.ObjectProxy = function(objectId, path, protoDepth, description, hasChildren)
 {
     this.objectId = objectId;
     this.path = path || [];
     this.protoDepth = protoDepth || 0;
+    this.description = description;
+    this.hasChildren = hasChildren;
 }
 
-WebInspector.ObjectPropertyProxy = function(name, object)
+WebInspector.ObjectProxy.wrapPrimitiveValue = function(value)
+{
+    var proxy = new WebInspector.ObjectProxy();
+    proxy.type = typeof value;
+    proxy.description = value;
+    return proxy;
+}
+
+WebInspector.ObjectPropertyProxy = function(name, value)
 {
     this.name = name;
-    this.type = "object";
-    this.hasChildren = true;
-    this.textContent = Object.describe(object, true);
-    this.childObjectProxy = new WebInspector.ObjectProxy(object);
+    this.value = value;
 }
diff --git a/WebCore/inspector/front-end/Panel.js b/WebCore/inspector/front-end/Panel.js
index 3e2212c..5046f6b 100644
--- a/WebCore/inspector/front-end/Panel.js
+++ b/WebCore/inspector/front-end/Panel.js
@@ -66,18 +66,6 @@ WebInspector.Panel.prototype = {
         return this._toolbarItem;
     },
 
-    createStatusBarButton: function()
-    {
-        var button = document.createElement("button");
-        var glyph = document.createElement("div");
-        glyph.className = "glyph";
-        button.appendChild(glyph);
-        var glyphShadow = document.createElement("div");
-        glyphShadow.className = "glyph shadow";
-        button.appendChild(glyphShadow);
-        return button;
-    },
-
     show: function()
     {
         WebInspector.View.prototype.show.call(this);
diff --git a/WebCore/inspector/front-end/Popup.js b/WebCore/inspector/front-end/Popup.js
new file mode 100644
index 0000000..9c8ef24
--- /dev/null
+++ b/WebCore/inspector/front-end/Popup.js
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * This class provides a popup that can be shown relative to an anchor element
+ * or at an arbitrary absolute position.
+ * Points are Objects: {x: xValue, y: yValue}.
+ * Rectangles are Objects: {x: xValue, y: yValue, width: widthValue, height: heightValue}.
+ *
+ * element is an optional unparented visible element (style.display != "none" AND style.visibility != "hidden").
+ * If the element is absent/undefined, it must have been set with the element(x) setter before the show() method invocation.
+ */
+WebInspector.Popup = function(element)
+{
+    if (element)
+        this.element = element;
+    this._keyHandler = this._keyEventHandler.bind(this);
+    this._mouseDownHandler = this._mouseDownEventHandler.bind(this);
+    this._visible = false;
+    this._autoHide = true;
+}
+
+WebInspector.Popup.prototype = {
+    show: function()
+    {
+        if (this.visible)
+            return;
+        var ownerDocument = this._contentElement.ownerDocument;
+        if (!ownerDocument)
+            return;
+
+        this._glasspaneElement = ownerDocument.createElement("div");
+        this._glasspaneElement.className = "popup-glasspane";
+        ownerDocument.body.appendChild(this._glasspaneElement);
+
+        this._contentElement.positionAt(0, 0);
+        this._contentElement.removeStyleClass("hidden");
+        ownerDocument.body.appendChild(this._contentElement);
+
+        this.positionElement();
+        this._visible = true;
+        ownerDocument.addEventListener("keydown", this._keyHandler, false);
+        ownerDocument.addEventListener("mousedown", this._mouseDownHandler, false);
+    },
+
+    hide: function()
+    {
+        if (this.visible) {
+            this._visible = false;
+            this._contentElement.ownerDocument.removeEventListener("keydown", this._keyHandler, false);
+            this._contentElement.ownerDocument.removeEventListener("mousedown", this._mouseDownHandler, false);
+            this._glasspaneElement.parentElement.removeChild(this._glasspaneElement);
+            this._contentElement.parentElement.removeChild(this._contentElement);
+        }
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set element(x)
+    {
+        this._checkNotVisible();
+        this._contentElement = x;
+        this._contentElement.addStyleClass("hidden");
+    },
+
+    get element()
+    {
+        return this._contentElement;
+    },
+
+    positionElement: function()
+    {
+        var element = this._contentElement;
+        var anchorElement = this._anchorElement;
+
+        var targetDocument = element.ownerDocument;
+        var targetDocumentBody = targetDocument.body;
+        var targetDocumentElement = targetDocument.documentElement;
+        var clippingBox = {x: 0, y: 0, width: targetDocumentElement.clientWidth, height: targetDocumentElement.clientHeight};
+        var parentElement = element.offsetParent || element.parentElement;
+
+        var anchorPosition = {x: anchorElement.totalOffsetLeft, y: anchorElement.totalOffsetTop};
+
+        // FIXME(apavlov@chromium.org): Translate anchorPosition to the element.ownerDocument frame when https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var anchorBox = {x: anchorPosition.x, y: anchorPosition.y, width: anchorElement.offsetWidth, height: anchorElement.offsetHeight};
+        var elementBox = {x: element.totalOffsetLeft, y: element.totalOffsetTop, width: element.offsetWidth, height: element.offsetHeight};
+        var newElementPosition = {x: 0, y: 0};
+
+        if (anchorBox.y - elementBox.height >= clippingBox.y)
+            newElementPosition.y = anchorBox.y - elementBox.height;
+        else
+            newElementPosition.y = Math.min(anchorBox.y + anchorBox.height, Math.max(clippingBox.y, clippingBox.y + clippingBox.height - elementBox.height));
+
+        if (anchorBox.x + elementBox.height <= clippingBox.x + clippingBox.height)
+            newElementPosition.x = anchorBox.x;
+        else
+            newElementPosition.x = Math.max(clippingBox.x, clippingBox.x + clippingBox.height - elementBox.height);
+        element.positionAt(newElementPosition.x, newElementPosition.y);
+    },
+
+    set anchor(x)
+    {
+        this._checkNotVisible();
+        this._anchorElement = x;
+    },
+
+    get anchor()
+    {
+        return this._anchorElement;
+    },
+
+    set autoHide(x)
+    {
+        this._autoHide = x;
+    },
+
+    _checkNotVisible: function()
+    {
+        if (this.visible)
+            throw new Error("The popup must not be visible.");
+    },
+
+    _keyEventHandler: function(event)
+    {
+        // Escape hides the popup.
+        if (event.keyIdentifier == "U+001B") {
+            this.hide();
+            event.preventDefault();
+            event.handled = true;
+        }
+    },
+
+    _mouseDownEventHandler: function(event)
+    {
+        if (this._autoHide && event.originalTarget === this._glasspaneElement)
+            this.hide();
+    }
+}
diff --git a/WebCore/inspector/front-end/ProfileDataGridTree.js b/WebCore/inspector/front-end/ProfileDataGridTree.js
index 84d9923..3fb0e00 100644
--- a/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -50,7 +50,7 @@ WebInspector.ProfileDataGridNode.prototype = {
     {
         function formatMilliseconds(time)
         {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), !Preferences.samplingCPUProfiler);
         }
 
         var data = {};
@@ -153,8 +153,11 @@ WebInspector.ProfileDataGridNode.prototype = {
 
                 // If the grid node is collapsed, then don't sort children (save operation for later).
                 // If the grid node has the same sorting as previously, then there is no point in sorting it again.
-                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator) {
+                    if (gridNode.children.length)
+                        gridNode.shouldRefreshChildren = true;
                     continue;
+                }
 
                 gridNode.lastComparator = comparator;
 
diff --git a/WebCore/inspector/front-end/ProfileView.js b/WebCore/inspector/front-end/ProfileView.js
index 2517bd2..2b8c6ce 100644
--- a/WebCore/inspector/front-end/ProfileView.js
+++ b/WebCore/inspector/front-end/ProfileView.js
@@ -39,6 +39,11 @@ WebInspector.ProfileView = function(profile)
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
+    if (Preferences.samplingCPUProfiler) {
+        delete columns.average;
+        delete columns.calls;
+    }
+
     this.dataGrid = new WebInspector.DataGrid(columns);
     this.dataGrid.addEventListener("sorting changed", this._sortData, this);
     this.dataGrid.element.addEventListener("mousedown", this._mouseDownInDataGrid.bind(this), true);
@@ -56,25 +61,19 @@ WebInspector.ProfileView = function(profile)
     this.viewSelectElement.appendChild(heavyViewOption);
     this.viewSelectElement.appendChild(treeViewOption);
 
-    this.percentButton = document.createElement("button");
-    this.percentButton.className = "percent-time-status-bar-item status-bar-item";
+    this.percentButton = new WebInspector.StatusBarButton("", "percent-time-status-bar-item");
     this.percentButton.addEventListener("click", this._percentClicked.bind(this), false);
 
-    this.focusButton = document.createElement("button");
-    this.focusButton.title = WebInspector.UIString("Focus selected function.");
-    this.focusButton.className = "focus-profile-node-status-bar-item status-bar-item";
+    this.focusButton = new WebInspector.StatusBarButton(WebInspector.UIString("Focus selected function."), "focus-profile-node-status-bar-item");
     this.focusButton.disabled = true;
     this.focusButton.addEventListener("click", this._focusClicked.bind(this), false);
 
-    this.excludeButton = document.createElement("button");
-    this.excludeButton.title = WebInspector.UIString("Exclude selected function.");
-    this.excludeButton.className = "exclude-profile-node-status-bar-item status-bar-item";
+    this.excludeButton = new WebInspector.StatusBarButton(WebInspector.UIString("Exclude selected function."), "exclude-profile-node-status-bar-item");
     this.excludeButton.disabled = true;
     this.excludeButton.addEventListener("click", this._excludeClicked.bind(this), false);
 
-    this.resetButton = document.createElement("button");
-    this.resetButton.title = WebInspector.UIString("Restore all functions.");
-    this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
+    this.resetButton = new WebInspector.StatusBarButton(WebInspector.UIString("Restore all functions."), "reset-profile-status-bar-item");
+    this.resetButton.visible = false;
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
     this.profile = profile;
@@ -90,7 +89,7 @@ WebInspector.ProfileView = function(profile)
 WebInspector.ProfileView.prototype = {
     get statusBarItems()
     {
-        return [this.viewSelectElement, this.percentButton, this.focusButton, this.excludeButton, this.resetButton];
+        return [this.viewSelectElement, this.percentButton.element, this.focusButton.element, this.excludeButton.element, this.resetButton.element];
     },
 
     get profile()
@@ -439,10 +438,10 @@ WebInspector.ProfileView.prototype = {
     {
         if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
-            this.percentButton.addStyleClass("toggled-on");
+            this.percentButton.toggled = true;
         } else {
             this.percentButton.title = WebInspector.UIString("Show total and self times as percentages.");
-            this.percentButton.removeStyleClass("toggled-on");
+            this.percentButton.toggled = false;
         }
     },
 
@@ -451,7 +450,7 @@ WebInspector.ProfileView.prototype = {
         if (!this.dataGrid.selectedNode)
             return;
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -466,7 +465,7 @@ WebInspector.ProfileView.prototype = {
 
         selectedNode.deselect();
 
-        this.resetButton.removeStyleClass("hidden");
+        this.resetButton.visible = true;
         this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
         this.refreshVisibleData();
@@ -474,7 +473,7 @@ WebInspector.ProfileView.prototype = {
 
     _resetClicked: function(event)
     {
-        this.resetButton.addStyleClass("hidden");
+        this.resetButton.visible = false;
         this.profileDataGridTree.restore();
         this.refresh();
         this.refreshVisibleData();
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index c8b948a..3bd4464 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -55,22 +55,32 @@ WebInspector.ProfilesPanel = function()
 
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
+    this.profilesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("CPU PROFILES"), null, true);
+    this.sidebarTree.appendChild(this.profilesListTreeElement);
+    this.profilesListTreeElement.expand();
+
+    this.snapshotsListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("HEAP SNAPSHOTS"), null, true);
+    if (Preferences.heapProfilerPresent) {
+        this.sidebarTree.appendChild(this.snapshotsListTreeElement);
+        this.snapshotsListTreeElement.expand();
+    }
+
     this.profileViews = document.createElement("div");
     this.profileViews.id = "profile-views";
     this.element.appendChild(this.profileViews);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleProfiling.bind(this), false);
 
-    this.recordButton = this.createStatusBarButton();
-    this.recordButton.title = WebInspector.UIString("Start profiling.");
-    this.recordButton.id = "record-profile-status-bar-item";
-    this.recordButton.className = "status-bar-item";
+    this.recordButton = new WebInspector.StatusBarButton(WebInspector.UIString("Start profiling."), "record-profile-status-bar-item");
     this.recordButton.addEventListener("click", this._recordClicked.bind(this), false);
 
     this.recording = false;
 
+    this.snapshotButton = new WebInspector.StatusBarButton(WebInspector.UIString("Take heap snapshot."), "heap-snapshot-status-bar-item");
+    this.snapshotButton.visible = Preferences.heapProfilerPresent;
+    this.snapshotButton.addEventListener("click", this._snapshotClicked.bind(this), false);
+
     this.profileViewStatusBarItemsContainer = document.createElement("div");
     this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
 
@@ -87,7 +97,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.recordButton, this.profileViewStatusBarItemsContainer];
+        return [this.enableToggleButton.element, this.recordButton.element, this.snapshotButton.element, this.profileViewStatusBarItemsContainer];
     },
 
     show: function()
@@ -137,7 +147,8 @@ WebInspector.ProfilesPanel.prototype = {
 
         this.sidebarTreeElement.removeStyleClass("some-expandable");
 
-        this.sidebarTree.removeChildren();
+        this.profilesListTreeElement.removeChildren();
+        this.snapshotsListTreeElement.removeChildren();
         this.profileViews.removeChildren();
 
         this.profileViewStatusBarItemsContainer.removeChildren();
@@ -155,7 +166,7 @@ WebInspector.ProfilesPanel.prototype = {
         this._profiles.push(profile);
         this._profilesIdMap[profile.uid] = profile;
 
-        var sidebarParent = this.sidebarTree;
+        var sidebarParent = this.profilesListTreeElement;
         var small = false;
         var alternateTitle;
 
@@ -317,10 +328,10 @@ WebInspector.ProfilesPanel.prototype = {
         this.recording = isProfiling;
 
         if (isProfiling) {
-            this.recordButton.addStyleClass("toggled-on");
+            this.recordButton.toggled = true;
             this.recordButton.title = WebInspector.UIString("Stop profiling.");
         } else {
-            this.recordButton.removeStyleClass("toggled-on");
+            this.recordButton.toggled = false;
             this.recordButton.title = WebInspector.UIString("Start profiling.");
         }
     },
@@ -336,14 +347,17 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (InspectorController.profilerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Profiling enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.recordButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.recordButton.visible = true;
+            if (Preferences.heapProfilerPresent)
+                this.snapshotButton.visible = true;
             this.profileViewStatusBarItemsContainer.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Profiling disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.recordButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.recordButton.visible = false;
+            this.snapshotButton.visible = false;
             this.profileViewStatusBarItemsContainer.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -359,6 +373,11 @@ WebInspector.ProfilesPanel.prototype = {
             InspectorController.stopProfiling();
     },
 
+    _snapshotClicked: function()
+    {
+        InspectorController.takeHeapSnapshot();
+    },
+
     _enableProfiling: function()
     {
         if (InspectorController.profilerEnabled())
@@ -376,7 +395,10 @@ WebInspector.ProfilesPanel.prototype = {
 
     _populateProfiles: function()
     {
-        if (this.sidebarTree.children.length)
+        // FIXME: This code needs to be adjusted when more profiling types are added.
+        // Currently defaults to CPU profiles.
+        var cpuProfiles = this.sidebarTree.children[0];
+        if (cpuProfiles.children.length)
             return;
 
         var profiles = InspectorController.profiles();
@@ -386,8 +408,8 @@ WebInspector.ProfilesPanel.prototype = {
             this.addProfile(profile);
         }
 
-        if (this.sidebarTree.children[0])
-            this.sidebarTree.children[0].select();
+        if (cpuProfiles.children[0])
+            cpuProfiles.children[0].select();
 
         delete this._shouldPopulateProfiles;
     },
diff --git a/WebCore/inspector/front-end/PropertiesSidebarPane.js b/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 2d32137..ec08210 100644
--- a/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -32,7 +32,7 @@ WebInspector.PropertiesSidebarPane = function()
 }
 
 WebInspector.PropertiesSidebarPane.prototype = {
-    update: function(object)
+    update: function(node)
     {
         var body = this.bodyElement;
 
@@ -40,7 +40,7 @@ WebInspector.PropertiesSidebarPane.prototype = {
 
         this.sections = [];
 
-        if (!object)
+        if (!node)
             return;
 
         var self = this;
@@ -51,13 +51,13 @@ WebInspector.PropertiesSidebarPane.prototype = {
 
             // Get array of prototype user-friendly names.
             for (var i = 0; i < prototypes.length; ++i) {
-                var prototype = new WebInspector.ObjectProxy(object, [], i);
+                var prototype = new WebInspector.ObjectProxy(node.id, [], i);
                 var section = new WebInspector.ObjectPropertiesSection(prototype, prototypes[i], WebInspector.UIString("Prototype"));
                 self.sections.push(section);
                 body.appendChild(section.element);
             }
         };
-        InspectorController.getPrototypes(object, callback);
+        InjectedScriptAccess.getPrototypes(node.id, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/Resource.js b/WebCore/inspector/front-end/Resource.js
index bcb7b2a..56696e3 100644
--- a/WebCore/inspector/front-end/Resource.js
+++ b/WebCore/inspector/front-end/Resource.js
@@ -26,7 +26,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached)
+WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComponent, identifier, mainResource, cached, requestMethod, requestFormData)
 {
     this.identifier = identifier;
 
@@ -39,10 +39,70 @@ WebInspector.Resource = function(requestHeaders, url, domain, path, lastPathComp
     this.path = path;
     this.lastPathComponent = lastPathComponent;
     this.cached = cached;
+    this.requestMethod = requestMethod || "";
+    this.requestFormData = requestFormData || "";
 
     this.category = WebInspector.resourceCategories.other;
 }
 
+
+WebInspector.Resource.StatusText = {
+    100: "Continue",
+    101: "Switching Protocols",
+    102: "Processing (WebDav)",
+    200: "OK",
+    201: "Created",
+    202: "Accepted",
+    203: "Non-Authoritative Information",
+    204: "No Content",
+    205: "Reset Content",
+    206: "Partial Content",
+    207: "Multi-Status (WebDav)",
+    300: "Multiple Choices",
+    301: "Moved Permanently",
+    302: "Found",
+    303: "See Other",
+    304: "Not Modified",
+    305: "Use Proxy",
+    306: "Switch Proxy",
+    307: "Temporary",
+    400: "Bad Request",
+    401: "Unauthorized",
+    402: "Payment Required",
+    403: "Forbidden",
+    404: "Not Found",
+    405: "Method Not Allowed",
+    406: "Not Acceptable",
+    407: "Proxy Authentication Required",
+    408: "Request Timeout",
+    409: "Conflict",
+    410: "Gone",
+    411: "Length Required",
+    412: "Precondition Failed",
+    413: "Request Entity Too Large",
+    414: "Request-URI Too Long",
+    415: "Unsupported Media Type",
+    416: "Requested Range Not Satisfiable",
+    417: "Expectation Failed",
+    418: "I'm a teapot",
+    422: "Unprocessable Entity (WebDav)",
+    423: "Locked (WebDav)",
+    424: "Failed Dependency (WebDav)",
+    425: "Unordered Collection",
+    426: "Upgrade Required",
+    449: "Retry With",
+    500: "Internal Server Error",
+    501: "Not Implemented",
+    502: "Bad Gateway",
+    503: "Service Unavailable",
+    504: "Gateway Timeout",
+    505: "HTTP Version Not Supported",
+    506: "Variant Also Negotiates",
+    507: "Insufficient Storage (WebDav)",
+    509: "Bandwidth Limit Exceeded",
+    510: "Not Extended"
+};
+
 // Keep these in sync with WebCore::InspectorResource::Type
 WebInspector.Resource.Type = {
     Document:   0,
@@ -538,7 +598,6 @@ WebInspector.Resource.prototype = {
 
     _checkWarning: function(warning)
     {
-        var addWarning = false;
         var msg;
         switch (warning.id) {
             case WebInspector.Warnings.IncorrectMIMEType.id:
@@ -619,3 +678,8 @@ WebInspector.Resource.CompareBySize = function(a, b)
         return 1;
     return 0;
 }
+
+WebInspector.Resource.StatusTextForCode = function(code)
+{
+    return code ? code + " " + WebInspector.Resource.StatusText[code] : "";
+}
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index b480362..28586f6 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,11 +54,37 @@ WebInspector.ResourceView = function(resource)
     this.urlTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.urlTreeElement);
 
+    this.httpInformationTreeElement = new TreeElement("", null, true);
+    this.httpInformationTreeElement.expanded = false;
+    this.httpInformationTreeElement.selectable = false;
+    this.headersTreeOutline.appendChild(this.httpInformationTreeElement);
+     
     this.requestHeadersTreeElement = new TreeElement("", null, true);
     this.requestHeadersTreeElement.expanded = false;
     this.requestHeadersTreeElement.selectable = false;
     this.headersTreeOutline.appendChild(this.requestHeadersTreeElement);
 
+    this._decodeHover = WebInspector.UIString("Double-Click to toggle between URL encoded and decoded formats");
+    this._decodeRequestParameters = true;
+
+    this.queryStringTreeElement = new TreeElement("", null, true);
+    this.queryStringTreeElement.expanded = false;
+    this.queryStringTreeElement.selectable = false;
+    this.queryStringTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.queryStringTreeElement);
+
+    this.formDataTreeElement = new TreeElement("", null, true);
+    this.formDataTreeElement.expanded = false;
+    this.formDataTreeElement.selectable = false;
+    this.formDataTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.formDataTreeElement);
+
+    this.requestPayloadTreeElement = new TreeElement(WebInspector.UIString("Request Payload"), null, true);
+    this.requestPayloadTreeElement.expanded = false;
+    this.requestPayloadTreeElement.selectable = false;
+    this.requestPayloadTreeElement.hidden = true;
+    this.headersTreeOutline.appendChild(this.requestPayloadTreeElement);
+
     this.responseHeadersTreeElement = new TreeElement("", null, true);
     this.responseHeadersTreeElement.expanded = false;
     this.responseHeadersTreeElement.selectable = false;
@@ -68,10 +95,12 @@ WebInspector.ResourceView = function(resource)
     resource.addEventListener("url changed", this._refreshURL, this);
     resource.addEventListener("requestHeaders changed", this._refreshRequestHeaders, this);
     resource.addEventListener("responseHeaders changed", this._refreshResponseHeaders, this);
+    resource.addEventListener("finished", this._refreshHTTPInformation, this);
 
     this._refreshURL();
     this._refreshRequestHeaders();
     this._refreshResponseHeaders();
+    this._refreshHTTPInformation();
 }
 
 WebInspector.ResourceView.prototype = {
@@ -104,12 +133,141 @@ WebInspector.ResourceView.prototype = {
 
     _refreshURL: function()
     {
-        this.urlTreeElement.title = this.resource.url.escapeHTML();
+        var url = this.resource.url;
+        var statusCodeImage = "";
+        if (this.resource.statusCode) {
+            var statusImageSource = "";
+            
+            if (this.resource.statusCode < 300)
+                statusImageSource = "Images/successGreenDot.png";
+            else if (this.resource.statusCode < 400)
+                statusImageSource = "Images/warningOrangeDot.png";
+            else
+                statusImageSource = "Images/errorRedDot.png";
+        
+            statusCodeImage = "<img class=\"resource-status-image\" src=\"" + statusImageSource + "\" title=\"" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "\">";
+        }
+
+        this.urlTreeElement.title = statusCodeImage + "<span class=\"resource-url\">" + url.escapeHTML() + "</span>";
+        this._refreshQueryString();
+    },
+
+    _refreshQueryString: function()
+    {
+        var url = this.resource.url;
+        var hasQueryString = url.indexOf("?") >= 0;
+
+        if (!hasQueryString) {
+            this.queryStringTreeElement.hidden = true;
+            return;
+        }
+
+        this.queryStringTreeElement.hidden = false;
+        var parmString = url.split("?", 2)[1];
+        this._refreshParms(WebInspector.UIString("Query String Parameters"), parmString, this.queryStringTreeElement);
+    },
+
+    _refreshFormData: function()
+    {
+        this.formDataTreeElement.hidden = true;
+        this.requestPayloadTreeElement.hidden = true;
+
+        var isFormData = this.resource.requestFormData;
+        if (!isFormData)
+            return;
+
+        var isFormEncoded = false;
+        var requestContentType = this._getHeaderValue(this.resource.requestHeaders, "Content-Type");
+        if (requestContentType.match(/^application\/x-www-form-urlencoded\s*(;.*)?$/i))
+            isFormEncoded = true;
+
+        if (isFormEncoded) {
+            this.formDataTreeElement.hidden = false;
+            this._refreshParms(WebInspector.UIString("Form Data"), this.resource.requestFormData, this.formDataTreeElement);
+        } else {
+            this.requestPayloadTreeElement.hidden = false;
+            this._refreshRequestPayload(this.resource.requestFormData);
+        }
+    },
+
+    _refreshRequestPayload: function(formData)
+    {
+        this.requestPayloadTreeElement.removeChildren();
+
+        var title = "<div class=\"header-name\">&nbsp;</div>";
+        title += "<div class=\"raw-form-data header-value\">" + formData.escapeHTML() + "</div>";
+        var parmTreeElement = new TreeElement(title, null, false);
+        parmTreeElement.selectable = false;
+        this.requestPayloadTreeElement.appendChild(parmTreeElement);
+    },
+
+    _refreshParms: function(title, parmString, parmsTreeElement)
+    {
+        var parms = parmString.split("&");
+        for (var i = 0; i < parms.length; ++i) {
+            var parm = parms[i];
+            parm = parm.split("=", 2);
+            if (parm.length == 1)
+                parm.push("");
+            parms[i] = parm;
+        }
+
+        parmsTreeElement.removeChildren();
+
+        parmsTreeElement.title = title + "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", parms.length) + "</span>";
+
+        for (var i = 0; i < parms.length; ++i) {
+            var key = parms[i][0];
+            var value = parms[i][1];
+
+            var errorDecoding = false;
+            if (this._decodeRequestParameters) {
+                if (value.indexOf("%") >= 0) {
+                    try {
+                        value = decodeURIComponent(value);
+                    } catch(e) {
+                        errorDecoding = true;
+                    }
+                }
+                    
+                value = value.replace(/\+/g, " ");
+            }
+
+            valueEscaped = value.escapeHTML();
+            if (errorDecoding)
+                valueEscaped += " <span class=\"error-message\">" + WebInspector.UIString("(unable to decode value)").escapeHTML() + "</span>";
+
+            var title = "<div class=\"header-name\">" + key.escapeHTML() + ":</div>";
+            title += "<div class=\"header-value\">" + valueEscaped + "</div>";
+
+            var parmTreeElement = new TreeElement(title, null, false);
+            parmTreeElement.selectable = false;
+            parmTreeElement.tooltip = this._decodeHover;
+            parmTreeElement.ondblclick = this._toggleURLdecoding.bind(this);
+            parmsTreeElement.appendChild(parmTreeElement);
+        }
+    },
+
+    _toggleURLdecoding: function(treeElement, event)
+    {
+        this._decodeRequestParameters = !this._decodeRequestParameters;
+        this._refreshQueryString();
+        this._refreshFormData();
+    },
+
+    _getHeaderValue: function(headers, key)
+    {
+        var lowerKey = key.toLowerCase();
+        for (var testKey in headers) {
+            if (testKey.toLowerCase() === lowerKey)
+                return headers[testKey];
+        }
     },
 
     _refreshRequestHeaders: function()
     {
         this._refreshHeaders(WebInspector.UIString("Request Headers"), this.resource.sortedRequestHeaders, this.requestHeadersTreeElement);
+        this._refreshFormData();
     },
 
     _refreshResponseHeaders: function()
@@ -117,6 +275,33 @@ WebInspector.ResourceView.prototype = {
         this._refreshHeaders(WebInspector.UIString("Response Headers"), this.resource.sortedResponseHeaders, this.responseHeadersTreeElement);
     },
 
+    _refreshHTTPInformation: function()
+    {
+        const listElements = 2;
+
+        var headerElement = this.httpInformationTreeElement;
+        headerElement.removeChildren();
+        headerElement.hidden = !this.resource.statusCode;
+
+        if (this.resource.statusCode) {
+            headerElement.title = WebInspector.UIString("HTTP Information") +  "<span class=\"header-count\">" + WebInspector.UIString(" (%d)", listElements) + "</span>";
+        
+            var title = "<div class=\"header-name\">" + WebInspector.UIString("Request Method") + ":</div>";
+            title += "<div class=\"header-value\">" + this.resource.requestMethod + "</div>"
+            
+            var headerTreeElement = new TreeElement(title, null, false);
+            headerTreeElement.selectable = false;
+            headerElement.appendChild(headerTreeElement);
+            
+            title = "<div class=\"header-name\">" + WebInspector.UIString("Status Code") + ":</div>";
+            title += "<div class=\"header-value\">" + WebInspector.Resource.StatusTextForCode(this.resource.statusCode) + "</div>"
+            
+            headerTreeElement = new TreeElement(title, null, false);
+            headerTreeElement.selectable = false;
+            headerElement.appendChild(headerTreeElement);
+        }
+    },
+    
     _refreshHeaders: function(title, headers, headersTreeElement)
     {
         headersTreeElement.removeChildren();
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index fb43551..b575fc3 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -60,9 +60,9 @@ WebInspector.ResourcesPanel = function()
     this.containerContentElement.id = "resources-container-content";
     this.containerElement.appendChild(this.containerContentElement);
 
-    this.summaryElement = document.createElement("div");
-    this.summaryElement.id = "resources-summary";
-    this.containerContentElement.appendChild(this.summaryElement);
+    this.summaryBar = new WebInspector.SummaryBar(this.categories);
+    this.summaryBar.element.id = "resources-summary";
+    this.containerContentElement.appendChild(this.summaryBar.element);
 
     this.resourcesGraphsElement = document.createElement("div");
     this.resourcesGraphsElement.id = "resources-graphs";
@@ -76,16 +76,6 @@ WebInspector.ResourcesPanel = function()
     this.dividersLabelBarElement.id = "resources-dividers-label-bar";
     this.containerContentElement.appendChild(this.dividersLabelBarElement);
 
-    this.summaryGraphElement = document.createElement("canvas");
-    this.summaryGraphElement.setAttribute("width", "450");
-    this.summaryGraphElement.setAttribute("height", "38");
-    this.summaryGraphElement.id = "resources-summary-graph";
-    this.summaryElement.appendChild(this.summaryGraphElement);
-
-    this.legendElement = document.createElement("div");
-    this.legendElement.id = "resources-graph-legend";
-    this.summaryElement.appendChild(this.legendElement);
-
     this.sidebarTreeElement = document.createElement("ol");
     this.sidebarTreeElement.className = "sidebar-tree";
     this.sidebarElement.appendChild(this.sidebarTreeElement);
@@ -139,15 +129,16 @@ WebInspector.ResourcesPanel = function()
 
     this.element.appendChild(this.panelEnablerView.element);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
 
-    this.largerResourcesButton = this.createStatusBarButton();
-    this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
-    this.largerResourcesButton.className = "status-bar-item toggled-on";
-    this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
+    this.largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "resources-larger-resources-status-bar-item");
+    this.largerResourcesButton.toggled = Preferences.resourcesLargeRows;
     this.largerResourcesButton.addEventListener("click", this._toggleLargerResources.bind(this), false);
+    if (!Preferences.resourcesLargeRows) {
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        this._toggleLargerResources(); // this will toggle the preference back to the original
+    }
 
     this.sortingSelectElement = document.createElement("select");
     this.sortingSelectElement.className = "status-bar-item";
@@ -168,8 +159,8 @@ WebInspector.ResourcesPanel = function()
 
     var allElement = createFilterElement.call(this, "all");
     this.filter(allElement.category);
-    for (var i = 0; i < this.categoryOrder.length; i++)
-        createFilterElement.call(this, this.categoryOrder[i]);
+    for (var category in this.categories)
+        createFilterElement.call(this, category);
 
     this.reset();
 
@@ -179,7 +170,16 @@ WebInspector.ResourcesPanel = function()
 WebInspector.ResourcesPanel.prototype = {
     toolbarItemClass: "resources",
 
-    categoryOrder: ["documents", "stylesheets", "images", "scripts", "xhr", "fonts", "other"],
+    get categories()
+    {
+        if (!this._categories) {
+            this._categories = {documents: {color: {r: 47, g: 102, b: 236}}, stylesheets: {color: {r: 157, g: 231, b: 119}}, images: {color: {r: 164, g: 60, b: 255}}, scripts: {color: {r: 255, g: 121, b: 0}}, xhr: {color: {r: 231, g: 231, b: 10}}, fonts: {color: {r: 255, g: 82, b: 62}}, other: {color: {r: 186, g: 186, b: 186}}};
+            for (var category in this._categories) {
+                this._categories[category].title = WebInspector.resourceCategories[category].title;
+            }
+        }
+        return this._categories; 
+    },
 
     filter: function (category) {
         if (this._filterCategory && this._filterCategory === category)
@@ -208,10 +208,41 @@ WebInspector.ResourcesPanel.prototype = {
     {
         return WebInspector.UIString("Resources");
     },
+    
+    get mainResourceLoadTime()
+    {
+        return this._mainResourceLoadTime || -1;
+    },
+    
+    set mainResourceLoadTime(x)
+    {
+        if (this._mainResourceLoadTime === x)
+            return;
+        
+        this._mainResourceLoadTime = x;
+        
+        // Update the dividers to draw the new line
+        this._updateGraphDividersIfNeeded(true);
+    },
+    
+    get mainResourceDOMContentTime()
+    {
+        return this._mainResourceDOMContentTime || -1;
+    },
+    
+    set mainResourceDOMContentTime(x)
+    {
+        if (this._mainResourceDOMContentTime === x)
+            return;
+        
+        this._mainResourceDOMContentTime = x;
+        
+        this._updateGraphDividersIfNeeded(true);
+    },
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton.element, this.largerResourcesButton.element, this.sortingSelectElement];
     },
 
     show: function()
@@ -455,26 +486,27 @@ WebInspector.ResourcesPanel.prototype = {
 
         this._resources = [];
         this._staleResources = [];
+        
+        this.mainResourceLoadTime = -1;
+        this.mainResourceDOMContentTime = -1;
 
         this.resourcesTreeElement.removeChildren();
         this.viewsContainerElement.removeChildren();
         this.resourcesGraphsElement.removeChildren();
-        this.legendElement.removeChildren();
+        this.summaryBar.reset();
 
         this._updateGraphDividersIfNeeded(true);
 
-        this._drawSummaryGraph(); // draws an empty graph
-
         if (InspectorController.resourceTrackingEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.largerResourcesButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.largerResourcesButton.visible = true;
             this.sortingSelectElement.removeStyleClass("hidden");
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.largerResourcesButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.largerResourcesButton.visible = false;
             this.sortingSelectElement.addStyleClass("hidden");
             this.panelEnablerView.visible = true;
         }
@@ -665,40 +697,6 @@ WebInspector.ResourcesPanel.prototype = {
         this.sidebarTree.handleKeyEvent(event);
     },
 
-    _makeLegendElement: function(label, value, color)
-    {
-        var legendElement = document.createElement("label");
-        legendElement.className = "resources-graph-legend-item";
-
-        if (color) {
-            var swatch = document.createElement("canvas");
-            swatch.className = "resources-graph-legend-swatch";
-            swatch.setAttribute("width", "13");
-            swatch.setAttribute("height", "24");
-
-            legendElement.appendChild(swatch);
-
-            this._drawSwatch(swatch, color);
-        }
-
-        var labelElement = document.createElement("div");
-        labelElement.className = "resources-graph-legend-label";
-        legendElement.appendChild(labelElement);
-
-        var headerElement = document.createElement("div");
-        var headerElement = document.createElement("div");
-        headerElement.className = "resources-graph-legend-header";
-        headerElement.textContent = label;
-        labelElement.appendChild(headerElement);
-
-        var valueElement = document.createElement("div");
-        valueElement.className = "resources-graph-legend-value";
-        valueElement.textContent = value;
-        labelElement.appendChild(valueElement);
-
-        return legendElement;
-    },
-
     _sortResourcesIfNeeded: function()
     {
         var sortedElements = [].concat(this.resourcesTreeElement.children);
@@ -761,283 +759,42 @@ WebInspector.ResourcesPanel.prototype = {
 
             this.dividersLabelBarElement.appendChild(divider);
         }
-    },
-
-    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
-    {
-        ctx.save();
-
-        var gradient = ctx.createLinearGradient(x, y, x, y + h);
-        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
-        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
-        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
-
-        ctx.globalCompositeOperation = "destination-out";
-
-        ctx.fillStyle = gradient;
-        ctx.fillRect(x, y, w, h);
-
-        ctx.restore();
-    },
-
-    _drawSwatch: function(canvas, color)
-    {
-        var ctx = canvas.getContext("2d");
-
-        function drawSwatchSquare() {
-            ctx.fillStyle = color;
-            ctx.fillRect(0, 0, 13, 13);
 
-            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
-            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
-            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            gradient = ctx.createLinearGradient(13, 13, 0, 0);
-            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
-            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
-
-            ctx.fillStyle = gradient;
-            ctx.fillRect(0, 0, 13, 13);
-
-            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
-            ctx.strokeRect(0.5, 0.5, 12, 12);
-        }
-
-        ctx.clearRect(0, 0, 13, 24);
-
-        drawSwatchSquare();
-
-        ctx.save();
-
-        ctx.translate(0, 25);
-        ctx.scale(1, -1);
-
-        drawSwatchSquare();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
-    },
-
-    _drawSummaryGraph: function(segments)
-    {
-        if (!this.summaryGraphElement)
+        if (this.calculator.startAtZero) {
+            // If our current sorting method starts at zero, that means it shows all
+            // resources starting at the same point, and so onLoad event and DOMContent
+            // event lines really wouldn't make much sense here, so don't render them.
             return;
-
-        if (!segments || !segments.length) {
-            segments = [{color: "white", value: 1}];
-            this._showingEmptySummaryGraph = true;
-        } else
-            delete this._showingEmptySummaryGraph;
-
-        // Calculate the total of all segments.
-        var total = 0;
-        for (var i = 0; i < segments.length; ++i)
-            total += segments[i].value;
-
-        // Calculate the percentage of each segment, rounded to the nearest percent.
-        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
-
-        // Calculate the total percentage.
-        var percentTotal = 0;
-        for (var i = 0; i < percents.length; ++i)
-            percentTotal += percents[i];
-
-        // Make sure our percentage total is not greater-than 100, it can be greater
-        // if we rounded up for a few segments.
-        while (percentTotal > 100) {
-            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
-                if (percents[i] > 1) {
-                    --percents[i];
-                    --percentTotal;
-                }
-            }
         }
 
-        // Make sure our percentage total is not less-than 100, it can be less
-        // if we rounded down for a few segments.
-        while (percentTotal < 100) {
-            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
-                ++percents[i];
-                ++percentTotal;
-            }
+        if (this.mainResourceLoadTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceLoadTime);
+            var loadDivider = document.createElement("div");
+            loadDivider.className = "resources-onload-divider";
+            loadDivider.style.left = percent + "%";
+            loadDivider.title = WebInspector.UIString("Load event fired");
+            this.dividersElement.appendChild(loadDivider);
         }
-
-        var ctx = this.summaryGraphElement.getContext("2d");
-
-        var x = 0;
-        var y = 0;
-        var w = 450;
-        var h = 19;
-        var r = (h / 2);
-
-        function drawPillShadow()
-        {
-            // This draws a line with a shadow that is offset away from the line. The line is stroked
-            // twice with different X shadow offsets to give more feathered edges. Later we erase the
-            // line with destination-out 100% transparent black, leaving only the shadow. This only
-            // works if nothing has been drawn into the canvas yet.
-
-            ctx.beginPath();
-            ctx.moveTo(x + 4, y + h - 3 - 0.5);
-            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
-            ctx.closePath();
-
-            ctx.save();
-
-            ctx.shadowBlur = 2;
-            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
-            ctx.shadowOffsetX = 3;
-            ctx.shadowOffsetY = 5;
-
-            ctx.strokeStyle = "white";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.shadowOffsetX = -3;
-
-            ctx.stroke();
-
-            ctx.restore();
-
-            ctx.save();
-
-            ctx.globalCompositeOperation = "destination-out";
-            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
-            ctx.lineWidth = 1;
-
-            ctx.stroke();
-
-            ctx.restore();
-        }
-
-        function drawPill()
-        {
-            // Make a rounded rect path.
-            ctx.beginPath();
-            ctx.moveTo(x, y + r);
-            ctx.lineTo(x, y + h - r);
-            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
-            ctx.lineTo(x + w - r, y + h);
-            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
-            ctx.lineTo(x + w, y + r);
-            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
-            ctx.lineTo(x + r, y);
-            ctx.quadraticCurveTo(x, y, x, y + r);
-            ctx.closePath();
-
-            // Clip to the rounded rect path.
-            ctx.save();
-            ctx.clip();
-
-            // Fill the segments with the associated color.
-            var previousSegmentsWidth = 0;
-            for (var i = 0; i < segments.length; ++i) {
-                var segmentWidth = Math.round(w * percents[i] / 100);
-                ctx.fillStyle = segments[i].color;
-                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
-                previousSegmentsWidth += segmentWidth;
-            }
-
-            // Draw the segment divider lines.
-            ctx.lineWidth = 1;
-            for (var i = 1; i < 20; ++i) {
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
-                ctx.stroke();
-
-                ctx.beginPath();
-                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
-                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
-                ctx.closePath();
-
-                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
-                ctx.stroke();
-            }
-
-            // Draw the pill shading.
-            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
-            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
-            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
-            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
-
-            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
-            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
-            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
-            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
-
-            ctx.fillStyle = darkGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.fillStyle = lightGradient;
-            ctx.fillRect(x, y, w, h);
-
-            ctx.restore();
+        
+        if (this.mainResourceDOMContentTime !== -1) {
+            var percent = this.calculator.computePercentageFromEventTime(this.mainResourceDOMContentTime);
+            var domContentDivider = document.createElement("div");
+            domContentDivider.className = "resources-ondomcontent-divider";
+            domContentDivider.title = WebInspector.UIString("DOMContent event fired");
+            domContentDivider.style.left = percent + "%";
+            this.dividersElement.appendChild(domContentDivider);
         }
-
-        ctx.clearRect(x, y, w, (h * 2));
-
-        drawPillShadow();
-        drawPill();
-
-        ctx.save();
-
-        ctx.translate(0, (h * 2) + 1);
-        ctx.scale(1, -1);
-
-        drawPill();
-
-        ctx.restore();
-
-        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
     },
 
     _updateSummaryGraph: function()
     {
-        var graphInfo = this.calculator.computeSummaryValues(this._resources);
-
-        var categoryColors = {documents: {r: 47, g: 102, b: 236}, stylesheets: {r: 157, g: 231, b: 119}, images: {r: 164, g: 60, b: 255}, scripts: {r: 255, g: 121, b: 0}, xhr: {r: 231, g: 231, b: 10}, fonts: {r: 255, g: 82, b: 62}, other: {r: 186, g: 186, b: 186}};
-        var fillSegments = [];
-
-        this.legendElement.removeChildren();
-
-        for (var i = 0; i < this.categoryOrder.length; ++i) {
-            var category = this.categoryOrder[i];
-            var size = graphInfo.categoryValues[category];
-            if (!size)
-                continue;
-
-            var color = categoryColors[category];
-            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
-
-            var fillSegment = {color: colorString, value: size};
-            fillSegments.push(fillSegment);
-
-            var legendLabel = this._makeLegendElement(WebInspector.resourceCategories[category].title, this.calculator.formatValue(size), colorString);
-            this.legendElement.appendChild(legendLabel);
-        }
-
-        if (graphInfo.total) {
-            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
-            totalLegendLabel.addStyleClass("total");
-            this.legendElement.appendChild(totalLegendLabel);
-        }
-
-        this._drawSummaryGraph(fillSegments);
+        this.summaryBar.update(this._resources);
     },
 
     _updateDividersLabelBarPosition: function()
     {
         var scrollTop = this.containerElement.scrollTop;
-        var dividersTop = (scrollTop < this.summaryElement.offsetHeight ? this.summaryElement.offsetHeight : scrollTop);
+        var dividersTop = (scrollTop < this.summaryBar.element.offsetHeight ? this.summaryBar.element.offsetHeight : scrollTop);
         this.dividersElement.style.top = scrollTop + "px";
         this.dividersLabelBarElement.style.top = dividersTop + "px";
     },
@@ -1072,16 +829,18 @@ WebInspector.ResourcesPanel.prototype = {
             return;
 
         this.resourcesTreeElement.smallChildren = !this.resourcesTreeElement.smallChildren;
+        Preferences.resourcesLargeRows = !Preferences.resourcesLargeRows;
+        InspectorController.setSetting("resources-large-rows", Preferences.resourcesLargeRows);
 
         if (this.resourcesTreeElement.smallChildren) {
             this.resourcesGraphsElement.addStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
-            this.largerResourcesButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = false;
             this._adjustScrollPosition();
         } else {
             this.resourcesGraphsElement.removeStyleClass("small");
             this.largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
-            this.largerResourcesButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.toggled = true;
         }
     },
 
@@ -1096,7 +855,7 @@ WebInspector.ResourcesPanel.prototype = {
     {
         var selectedOption = this.sortingSelectElement[this.sortingSelectElement.selectedIndex];
         this.sortingFunction = selectedOption.sortingFunction;
-        this.calculator = selectedOption.calculator;
+        this.calculator = this.summaryBar.calculator = selectedOption.calculator;
     },
 
     _createResourceView: function(resource)
@@ -1354,6 +1113,17 @@ WebInspector.ResourceTimeCalculator.prototype = {
 
         return {start: start, middle: middle, end: end};
     },
+    
+    computePercentageFromEventTime: function(eventTime)
+    {
+        // This function computes a percentage in terms of the total loading time
+        // of a specific event. If startAtZero is set, then this is useless, and we
+        // want to return 0.
+        if (eventTime !== -1 && !this.startAtZero)
+            return ((eventTime - this.minimumBoundary) / this.boundarySpan) * 100;
+
+        return 0;
+    },
 
     computeBarGraphLabels: function(resource)
     {
@@ -1515,7 +1285,7 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
     
     ondblclick: function(treeElement, event)
     {
-        InspectorController.inspectedWindow().open(this.resource.url);
+        InjectedScriptAccess.openInInspectedWindow(this.resource.url, function() {});
     },
 
     get mainTitle()
@@ -1546,6 +1316,11 @@ WebInspector.ResourceSidebarTreeElement.prototype = {
         // Do nothing.
     },
 
+    get selectable()
+    {
+        return WebInspector.panels.resources._filterCategory == "all" || WebInspector.panels.resources._filterCategory == this.resource.category.name;
+    },
+
     createIconElement: function()
     {
         var previousIconElement = this.iconElement;
diff --git a/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index a293fa0..fdfcd38 100644
--- a/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -26,6 +26,7 @@
 WebInspector.ScopeChainSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Scope Variables"));
+    this._expandedProperties = [];
 }
 
 WebInspector.ScopeChainSidebarPane.prototype = {
@@ -44,52 +45,43 @@ WebInspector.ScopeChainSidebarPane.prototype = {
             return;
         }
 
-        if (!callFrame._expandedProperties) {
-            // FIXME: fix this when https://bugs.webkit.org/show_bug.cgi?id=19410 is fixed.
-            // The callFrame is a JSInspectedObjectWrapper, so we are not allowed to assign
-            // an object created in the Inspector's context to that object. So create an
-            // Object from the inspectedWindow.
-            var inspectedWindow = InspectorController.inspectedWindow();
-            callFrame._expandedProperties = new inspectedWindow.Object;
-        }
-
         var foundLocalScope = false;
         var scopeChain = callFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
+            var scopeObjectProxy = scopeChain[i];
             var title = null;
-            var subtitle = Object.describe(scopeObject, true);
+            var subtitle = scopeObjectProxy.description;
             var emptyPlaceholder = null;
-            var localScope = false;
             var extraProperties = null;
 
-            if (Object.prototype.toString.call(scopeObject) === "[object JSActivation]") {
-                if (!foundLocalScope) {
-                    extraProperties = { "this": callFrame.thisObject };
-                    title = WebInspector.UIString("Local");
-                } else
-                    title = WebInspector.UIString("Closure");
+            if (scopeObjectProxy.isLocal) {
+                foundLocalScope = true;
+                title = WebInspector.UIString("Local");
+                emptyPlaceholder = WebInspector.UIString("No Variables");
+                subtitle = null;
+                if (scopeObjectProxy.thisObject)
+                    extraProperties = [ new WebInspector.ObjectPropertyProxy("this", scopeObjectProxy.thisObject) ];
+            } else if (scopeObjectProxy.isClosure) {
+                title = WebInspector.UIString("Closure");
                 emptyPlaceholder = WebInspector.UIString("No Variables");
                 subtitle = null;
-                foundLocalScope = true;
-                localScope = true;
             } else if (i === (scopeChain.length - 1))
                 title = WebInspector.UIString("Global");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Element)
+            else if (scopeObjectProxy.isElement)
                 title = WebInspector.UIString("Event Target");
-            else if (foundLocalScope && scopeObject instanceof InspectorController.inspectedWindow().Document)
+            else if (scopeObjectProxy.isDocument)
                 title = WebInspector.UIString("Event Document");
-            else if (!foundLocalScope && !localScope)
+            else if (scopeObjectProxy.isWithBlock)
                 title = WebInspector.UIString("With Block");
 
             if (!title || title === subtitle)
                 subtitle = null;
 
-            var section = new WebInspector.ObjectPropertiesSection(new WebInspector.ObjectProxy(scopeObject), title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
+            var section = new WebInspector.ObjectPropertiesSection(scopeObjectProxy, title, subtitle, emptyPlaceholder, true, extraProperties, WebInspector.ScopeVariableTreeElement);
             section.editInSelectedCallFrameWhenPaused = true;
             section.pane = this;
 
-            if (!foundLocalScope || localScope)
+            if (!foundLocalScope || scopeObjectProxy.isLocal)
                 section.expanded = true;
 
             this.sections.push(section);
@@ -109,18 +101,18 @@ WebInspector.ScopeVariableTreeElement.prototype = {
     onattach: function()
     {
         WebInspector.ObjectPropertyTreeElement.prototype.onattach.call(this);
-        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane.callFrame._expandedProperties)
+        if (this.hasChildren && this.propertyIdentifier in this.treeOutline.section.pane._expandedProperties)
             this.expand();
     },
 
     onexpand: function()
     {
-        this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier] = true;
+        this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier] = true;
     },
 
     oncollapse: function()
     {
-        delete this.treeOutline.section.pane.callFrame._expandedProperties[this.propertyIdentifier];
+        delete this.treeOutline.section.pane._expandedProperties[this.propertyIdentifier];
     },
 
     get propertyIdentifier()
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 0058374..05ec197 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -126,6 +126,7 @@ WebInspector.ScriptsPanel = function()
     this.topStatusBar.appendChild(this.sidebarResizeWidgetElement);
 
     this.sidebarPanes = {};
+    this.sidebarPanes.watchExpressions = new WebInspector.WatchExpressionsSidebarPane();
     this.sidebarPanes.callstack = new WebInspector.CallStackSidebarPane();
     this.sidebarPanes.scopechain = new WebInspector.ScopeChainSidebarPane();
     this.sidebarPanes.breakpoints = new WebInspector.BreakpointsSidebarPane();
@@ -151,13 +152,10 @@ WebInspector.ScriptsPanel = function()
     this.element.appendChild(this.sidebarElement);
     this.element.appendChild(this.sidebarResizeElement);
 
-    this.enableToggleButton = this.createStatusBarButton();
-    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton = new WebInspector.StatusBarButton("", "enable-toggle-status-bar-item");
     this.enableToggleButton.addEventListener("click", this._toggleDebugging.bind(this), false);
 
-    this.pauseOnExceptionButton = this.createStatusBarButton();
-    this.pauseOnExceptionButton.id = "scripts-pause-on-exceptions-status-bar-item";
-    this.pauseOnExceptionButton.className = "status-bar-item";
+    this.pauseOnExceptionButton = new WebInspector.StatusBarButton("", "scripts-pause-on-exceptions-status-bar-item");
     this.pauseOnExceptionButton.addEventListener("click", this._togglePauseOnExceptions.bind(this), false);
 
     this._breakpointsURLMap = {};
@@ -208,7 +206,7 @@ WebInspector.ScriptsPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.enableToggleButton, this.pauseOnExceptionButton];
+        return [this.enableToggleButton.element, this.pauseOnExceptionButton.element];
     },
 
     get paused()
@@ -286,7 +284,7 @@ WebInspector.ScriptsPanel.prototype = {
                 if (startingLine <= breakpoint.line) {
                     breakpoint.sourceID = sourceID;
                     if (breakpoint.enabled)
-                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line);
+                        InspectorController.addBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.condition);
                 }
             }
         }
@@ -353,7 +351,15 @@ WebInspector.ScriptsPanel.prototype = {
             sourceFrame.removeBreakpoint(breakpoint);
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface, callback)
+    selectedCallFrameId: function()
+    {
+        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
+        if (!selectedCallFrame)
+            return null;
+        return selectedCallFrame.id;
+    },
+
+    evaluateInSelectedCallFrame: function(code, updateInterface, objectGroup, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
@@ -369,41 +375,36 @@ WebInspector.ScriptsPanel.prototype = {
             if (updateInterface)
                 self.sidebarPanes.scopechain.update(selectedCallFrame);
         }
-        this.doEvalInCallFrame(selectedCallFrame, code, updatingCallbackWrapper);
+        this.doEvalInCallFrame(selectedCallFrame, code, objectGroup, updatingCallbackWrapper);
     },
 
-    doEvalInCallFrame: function(callFrame, code, callback)
+    doEvalInCallFrame: function(callFrame, code, objectGroup, callback)
     {
-        var panel = this;
-        function delayedEvaluation()
+        function evalCallback(result)
         {
-            if (!code) {
-                // Evaluate into properties in scope of the selected call frame.
-                callback(panel._variablesInScope(callFrame));
-                return;
-            }
-            try {
-                callback(callFrame.evaluate(code));
-            } catch (e) {
-                callback(e, true);
-            }
+            if (result)
+                callback(result.value, result.isException);
         }
-        setTimeout(delayedEvaluation, 0);
+        InjectedScriptAccess.evaluateInCallFrame(callFrame.id, code, objectGroup, evalCallback);
     },
 
-    _variablesInScope: function(callFrame)
+    variablesInSelectedCallFrame: function()
     {
+        var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
+        if (!this._paused || !selectedCallFrame)
+            return {};
+
         var result = {};
-        var scopeChain = callFrame.scopeChain;
+        var scopeChain = selectedCallFrame.scopeChain;
         for (var i = 0; i < scopeChain.length; ++i) {
-            var scopeObject = scopeChain[i];
-            for (var property in scopeObject)
-                result[property] = true;
+            var scopeObjectProperties = scopeChain[i].properties;
+            for (var j = 0; j < scopeObjectProperties.length; ++j)
+                result[scopeObjectProperties[j]] = true;
         }
         return result;
     },
 
-    debuggerPaused: function()
+    debuggerPaused: function(callFrames)
     {
         this._paused = true;
         this._waitingToPause = false;
@@ -411,10 +412,8 @@ WebInspector.ScriptsPanel.prototype = {
 
         this._updateDebuggerButtons();
 
-        var callStackPane = this.sidebarPanes.callstack;
-        var currentFrame = InspectorController.currentCallFrame();
-        callStackPane.update(currentFrame, this._sourceIDMap);
-        callStackPane.selectedCallFrame = currentFrame;
+        this.sidebarPanes.callstack.update(callFrames, this._sourceIDMap);
+        this.sidebarPanes.callstack.selectedCallFrame = callFrames[0];
 
         WebInspector.currentPanel = this;
         window.focus();
@@ -481,6 +480,8 @@ WebInspector.ScriptsPanel.prototype = {
         }
 
         this._sourceIDMap = {};
+        
+        this.sidebarPanes.watchExpressions.refreshExpressions();
     },
 
     get visibleView()
@@ -714,6 +715,7 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         this.sidebarPanes.scopechain.update(currentFrame);
+        this.sidebarPanes.watchExpressions.refreshExpressions();
 
         var scriptOrResource = this._sourceIDMap[currentFrame.sourceID];
         this._showScriptOrResource(scriptOrResource, currentFrame.line);
@@ -764,10 +766,10 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.pauseOnExceptions()) {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Don't pause on exceptions.");
-            this.pauseOnExceptionButton.addStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = true;
         } else {
             this.pauseOnExceptionButton.title = WebInspector.UIString("Pause on exceptions.");
-            this.pauseOnExceptionButton.removeStyleClass("toggled-on");
+            this.pauseOnExceptionButton.toggled = false;
         }
     },
 
@@ -775,13 +777,13 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.debuggerEnabled()) {
             this.enableToggleButton.title = WebInspector.UIString("Debugging enabled. Click to disable.");
-            this.enableToggleButton.addStyleClass("toggled-on");
-            this.pauseOnExceptionButton.removeStyleClass("hidden");
+            this.enableToggleButton.toggled = true;
+            this.pauseOnExceptionButton.visible = true;
             this.panelEnablerView.visible = false;
         } else {
             this.enableToggleButton.title = WebInspector.UIString("Debugging disabled. Click to enable.");
-            this.enableToggleButton.removeStyleClass("toggled-on");
-            this.pauseOnExceptionButton.addStyleClass("hidden");
+            this.enableToggleButton.toggled = false;
+            this.pauseOnExceptionButton.visible = false;
             this.panelEnablerView.visible = true;
         }
 
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index 930eb16..790055a 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Joseph Pecoraro
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -115,7 +116,7 @@ WebInspector.SourceFrame.prototype = {
             this._lineNumberToReveal = lineNumber;
             return;
         }
-    
+
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -199,6 +200,7 @@ WebInspector.SourceFrame.prototype = {
     _loaded: function()
     {
         WebInspector.addMainEventListeners(this.element.contentDocument);
+        this.element.contentDocument.addEventListener("contextmenu", this._documentContextMenu.bind(this), true);
         this.element.contentDocument.addEventListener("mousedown", this._documentMouseDown.bind(this), true);
         this.element.contentDocument.addEventListener("keydown", this._documentKeyDown.bind(this), true);
         this.element.contentDocument.addEventListener("keyup", WebInspector.documentKeyUp.bind(WebInspector), true);
@@ -215,27 +217,45 @@ WebInspector.SourceFrame.prototype = {
             headElement = this.element.contentDocument.createElement("head");
             this.element.contentDocument.documentElement.insertBefore(headElement, this.element.contentDocument.documentElement.firstChild);
         }
+        
+        var linkElement = this.element.contentDocument.createElement("link");
+        linkElement.type = "text/css";
+        linkElement.rel = "stylesheet";
+        linkElement.href = "inspectorSyntaxHighlight.css";
+        headElement.appendChild(linkElement);
 
         var styleElement = this.element.contentDocument.createElement("style");
         headElement.appendChild(styleElement);
 
         // Add these style rules here since they are specific to the Inspector. They also behave oddly and not
-        // all properties apply if added to view-source.css (becuase it is a user agent sheet.)
+        // all properties apply if added to view-source.css (because it is a user agent sheet.)
         var styleText = ".webkit-line-number { background-repeat: no-repeat; background-position: right 1px; }\n";
+        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
+
         styleText += ".webkit-breakpoint .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint); }\n";
         styleText += ".webkit-breakpoint-disabled .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled); }\n";
-        styleText += ".webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(program-counter); }\n";
         styleText += ".webkit-breakpoint.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-program-counter); }\n";
         styleText += ".webkit-breakpoint-disabled.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-program-counter); }\n";
+
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-conditional); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional .webkit-line-number { color: white; background-image: -webkit-canvas(breakpoint-disabled-conditional); }\n";
+        styleText += ".webkit-breakpoint.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-conditional-program-counter); }\n";
+        styleText += ".webkit-breakpoint-disabled.webkit-breakpoint-conditional.webkit-execution-line .webkit-line-number { color: transparent; background-image: -webkit-canvas(breakpoint-disabled-conditional-program-counter); }\n";
+
         styleText += ".webkit-execution-line .webkit-line-content { background-color: rgb(171, 191, 254); outline: 1px solid rgb(64, 115, 244); }\n";
         styleText += ".webkit-height-sized-to-fit { overflow-y: hidden }\n";
         styleText += ".webkit-line-content { background-color: white; }\n";
         styleText += "@-webkit-keyframes fadeout {from {background-color: rgb(255, 255, 120);} to { background-color: white;}}\n";
         styleText += ".webkit-highlighted-line .webkit-line-content { background-color: rgb(255, 255, 120); -webkit-animation: 'fadeout' 2s 500ms}\n";
-        styleText += ".webkit-javascript-comment { color: rgb(0, 116, 0); }\n";
-        styleText += ".webkit-javascript-keyword { color: rgb(170, 13, 145); }\n";
-        styleText += ".webkit-javascript-number { color: rgb(28, 0, 207); }\n";
-        styleText += ".webkit-javascript-string, .webkit-javascript-regexp { color: rgb(196, 26, 22); }\n";
+
+        // TODO: Move these styles into inspector.css once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed and popup moved into the top frame.
+        styleText += ".popup-content { position: absolute; z-index: 10000; padding: 4px; background-color: rgb(203, 226, 255); -webkit-border-radius: 7px; border: 2px solid rgb(169, 172, 203); }";
+        styleText += ".popup-glasspane { position: absolute; top: 0; left: 0; height: 100%; width: 100%; opacity: 0; z-index: 9900; }";
+        styleText += ".popup-message { background-color: transparent; font-family: Lucida Grande, sans-serif; font-weight: normal; font-size: 11px; text-align: left; text-shadow: none; color: rgb(85, 85, 85); cursor: default; margin: 0 0 2px 0; }";
+        styleText += ".popup-content.breakpoint-condition { width: 90%; }";
+        styleText += ".popup-content input#bp-condition { font-family: monospace; margin: 0; border: 1px inset rgb(190, 190, 190) !important; width: 100%; box-shadow: none !important; outline: none !important; -webkit-user-modify: read-write; }";
+        // This class is already in inspector.css
+        styleText += ".hidden { display: none !important; }";
 
         styleElement.textContent = styleText;
 
@@ -244,8 +264,12 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.positionAt = Element.prototype.positionAt;
         this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
+        this.element.contentWindow.Element.prototype.pageOffsetRelativeToWindow = Element.prototype.pageOffsetRelativeToWindow;
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetLeft", Element.prototype.__lookupGetter__("totalOffsetLeft"));
+        this.element.contentWindow.Element.prototype.__defineGetter__("totalOffsetTop", Element.prototype.__lookupGetter__("totalOffsetTop"));
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
 
@@ -257,20 +281,20 @@ WebInspector.SourceFrame.prototype = {
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
-            
+
         if (this._lineNumberToReveal) {
             this.revealLine(this._lineNumberToReveal);
             delete this._lineNumberToReveal;
         }
-    
+
         if (this._lineNumberToHighlight) {
             this.highlightLine(this._lineNumberToHighlight);
             delete this._lineNumberToHighlight;
         }
-        
+
         this.dispatchEventToListeners("content loaded");
     },
-    
+
     _isContentLoaded: function() {
         var doc = this.element.contentDocument;
         return doc && doc.getElementsByTagName("table")[0];
@@ -283,18 +307,102 @@ WebInspector.SourceFrame.prototype = {
         this.sizeToFitContentHeight();
     },
 
-    _documentMouseDown: function(event)
+    _documentContextMenu: function(event)
     {
         if (!event.target.hasStyleClass("webkit-line-number"))
             return;
+        var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
+        if (!sourceRow._breakpointObject && this.addBreakpointDelegate)
+            this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
+
+        var breakpoint = sourceRow._breakpointObject;
+        if (!breakpoint)
+            return;
 
+        this._editBreakpointCondition(event.target, sourceRow, breakpoint);
+        event.preventDefault();
+    },
+
+    _documentMouseDown: function(event)
+    {
+        if (!event.target.hasStyleClass("webkit-line-number"))
+            return;
+        if (event.button != 0 || event.altKey || event.ctrlKey || event.metaKey || event.shiftKey)
+            return;
         var sourceRow = event.target.enclosingNodeOrSelfWithNodeName("tr");
-        if (sourceRow._breakpointObject)
-            sourceRow._breakpointObject.enabled = !sourceRow._breakpointObject.enabled;
+        if (sourceRow._breakpointObject && sourceRow._breakpointObject.enabled)
+            sourceRow._breakpointObject.enabled = false;
+        else if (sourceRow._breakpointObject)
+            WebInspector.panels.scripts.removeBreakpoint(sourceRow._breakpointObject);
         else if (this.addBreakpointDelegate)
             this.addBreakpointDelegate(this.lineNumberForSourceRow(sourceRow));
     },
 
+    _editBreakpointCondition: function(eventTarget, sourceRow, breakpoint)
+    {
+        // TODO: Migrate the popup to the top-level document and remove the blur listener from conditionElement once https://bugs.webkit.org/show_bug.cgi?id=28913 is fixed.
+        var popupDocument = this.element.contentDocument;
+        this._showBreakpointConditionPopup(eventTarget, breakpoint.line, popupDocument);
+
+        function committed(element, newText)
+        {
+            breakpoint.condition = newText;
+            if (breakpoint.condition)
+                sourceRow.addStyleClass("webkit-breakpoint-conditional");
+            else
+                sourceRow.removeStyleClass("webkit-breakpoint-conditional");
+            dismissed.call(this);
+        }
+
+        function dismissed()
+        {
+            this._popup.hide();
+            delete this._conditionEditorElement;
+        }
+
+        var dismissedHandler = dismissed.bind(this);
+        this._conditionEditorElement.addEventListener("blur", dismissedHandler, false);
+
+        WebInspector.startEditing(this._conditionEditorElement, committed.bind(this), dismissedHandler);
+        this._conditionEditorElement.value = breakpoint.condition;
+        this._conditionEditorElement.select();
+    },
+
+    _showBreakpointConditionPopup: function(clickedElement, lineNumber, popupDocument)
+    {
+        var popupContentElement = this._createPopupElement(lineNumber, popupDocument);
+        var lineElement = clickedElement.enclosingNodeOrSelfWithNodeName("td").nextSibling;
+        if (this._popup) {
+            this._popup.hide();
+            this._popup.element = popupContentElement;
+        } else {
+            this._popup = new WebInspector.Popup(popupContentElement);
+            this._popup.autoHide = true;
+        }
+        this._popup.anchor = lineElement;
+        this._popup.show();
+    },
+
+    _createPopupElement: function(lineNumber, popupDocument)
+    {
+        var popupContentElement = popupDocument.createElement("div");
+        popupContentElement.className = "popup-content breakpoint-condition";
+
+        var labelElement = document.createElement("label");
+        labelElement.className = "popup-message";
+        labelElement.htmlFor = "bp-condition";
+        labelElement.appendChild(document.createTextNode(WebInspector.UIString("The breakpoint on line %d will stop only if this expression is true:", lineNumber)));
+        popupContentElement.appendChild(labelElement);
+
+        var editorElement = document.createElement("input");
+        editorElement.id = "bp-condition";
+        editorElement.type = "text"
+        popupContentElement.appendChild(editorElement);
+        this._conditionEditorElement = editorElement;
+
+        return popupContentElement;
+    },
+
     _documentKeyDown: function(event)
     {
         var shortcut = WebInspector.KeyboardShortcut.makeKeyFromEvent(event);
@@ -380,6 +488,8 @@ WebInspector.SourceFrame.prototype = {
         sourceRow.addStyleClass("webkit-breakpoint");
         if (!breakpoint.enabled)
             sourceRow.addStyleClass("webkit-breakpoint-disabled");
+        if (breakpoint.condition)
+            sourceRow.addStyleClass("webkit-breakpoint-conditional");
     },
 
     _removeBreakpointFromSource: function(breakpoint)
@@ -392,8 +502,9 @@ WebInspector.SourceFrame.prototype = {
 
         sourceRow.removeStyleClass("webkit-breakpoint");
         sourceRow.removeStyleClass("webkit-breakpoint-disabled");
+        sourceRow.removeStyleClass("webkit-breakpoint-conditional");
     },
-    
+
     _incrementMessageRepeatCount: function(msg, repeatDelta)
     {
         if (!msg._resourceMessageLineElement)
@@ -518,12 +629,12 @@ WebInspector.SourceFrame.prototype = {
         delete this._needsProgramCounterImage;
     },
 
-    _drawBreakpointImagesIfNeeded: function()
+    _drawBreakpointImagesIfNeeded: function(conditional)
     {
         if (!this._needsBreakpointImages || !this.element.contentDocument)
             return;
 
-        function drawBreakpoint(ctx, disabled)
+        function drawBreakpoint(ctx, disabled, conditional)
         {
             ctx.beginPath();
             ctx.moveTo(0, 2);
@@ -534,8 +645,8 @@ WebInspector.SourceFrame.prototype = {
             ctx.lineTo(2, 11);
             ctx.lineTo(0, 9);
             ctx.closePath();
-            ctx.fillStyle = "rgb(1, 142, 217)";
-            ctx.strokeStyle = "rgb(0, 103, 205)";
+            ctx.fillStyle = conditional ? "rgb(217, 142, 1)" : "rgb(1, 142, 217)";
+            ctx.strokeStyle = conditional ? "rgb(205, 103, 0)" : "rgb(0, 103, 205)";
             ctx.lineWidth = 3;
             ctx.fill();
             ctx.save();
@@ -553,6 +664,9 @@ WebInspector.SourceFrame.prototype = {
             ctx.restore();
         }
 
+
+        // Unconditional breakpoints.
+
         var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint", 26, 11);
         ctx.clearRect(0, 0, 26, 11);
         drawBreakpoint(ctx);
@@ -573,6 +687,29 @@ WebInspector.SourceFrame.prototype = {
         ctx.clearRect(20, 0, 6, 11);
         this._drawProgramCounterInContext(ctx, true);
 
+
+        // Conditional breakpoints.
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, false, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+
+        var ctx = this.element.contentDocument.getCSSCanvasContext("2d", "breakpoint-disabled-conditional-program-counter", 26, 11);
+        ctx.clearRect(0, 0, 26, 11);
+        drawBreakpoint(ctx, true, true);
+        ctx.clearRect(20, 0, 6, 11);
+        this._drawProgramCounterInContext(ctx, true);
+
         delete this._needsBreakpointImages;
     },
 
@@ -582,190 +719,394 @@ WebInspector.SourceFrame.prototype = {
         if (!table)
             return;
 
-        function deleteContinueFlags(cell)
-        {
-            if (!cell)
-                return;
-            delete cell._commentContinues;
-            delete cell._singleQuoteStringContinues;
-            delete cell._doubleQuoteStringContinues;
-            delete cell._regexpContinues;
-        }
+        var jsSyntaxHighlighter = new WebInspector.JavaScriptSourceSyntaxHighlighter(table, this);
+        jsSyntaxHighlighter.process();
+    },
 
-        function createSpan(content, className)
-        {
-            var span = document.createElement("span");
-            span.className = className;
-            span.appendChild(document.createTextNode(content));
-            return span;
-        }
+    syntaxHighlightCSS: function()
+    {
+        var table = this.element.contentDocument.getElementsByTagName("table")[0];
+        if (!table)
+            return;
 
-        function generateFinder(regex, matchNumber, className)
-        {
-            return function(str) {
-                var match = regex.exec(str);
-                if (!match)
-                    return null;
-                previousMatchLength = match[matchNumber].length;
-                return createSpan(match[matchNumber], className);
-            };
-        }
+        var cssSyntaxHighlighter = new WebInspector.CSSSourceSyntaxHighligher(table, this);
+        cssSyntaxHighlighter.process();
+    }
+}
 
-        var findNumber = generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
-        var findKeyword = generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
-        var findSingleLineString = generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
-        var findMultilineCommentStart = generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
-        var findMultilineCommentEnd = generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
-        var findMultilineSingleQuoteStringStart = generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineSingleQuoteStringEnd = generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringStart = generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
-        var findMultilineDoubleQuoteStringEnd = generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
-        var findMultilineRegExpEnd = generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
-        var findSingleLineComment = generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
-
-        function findMultilineRegExpStart(str)
-        {
-            var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
-            if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.SourceSyntaxHighligher = function(table, sourceFrame)
+{
+    this.table = table;
+    this.sourceFrame = sourceFrame;
+}
+
+WebInspector.SourceSyntaxHighligher.prototype = {
+    createSpan: function(content, className)
+    {
+        var span = document.createElement("span");
+        span.className = className;
+        span.appendChild(document.createTextNode(content));
+        return span;
+    },
+
+    generateFinder: function(regex, matchNumber, className)
+    {
+        return function(str) {
+            var match = regex.exec(str);
+            if (!match)
                 return null;
-            var node = createSpan(match[0], "webkit-javascript-regexp");
-            previousMatchLength = match[0].length;
-            return node;
-        }
+            this.previousMatchLength = match[matchNumber].length;
+            return this.createSpan(match[matchNumber], className);
+        };
+    },
+
+    process: function()
+    {
+        // Split up the work into chunks so we don't block the
+        // UI thread while processing.
+
+        var i = 0;
+        var rows = this.table.rows;
+        var rowsLength = rows.length;
+        var previousCell = null;
+        const linesPerChunk = 10;
 
-        function findSingleLineRegExp(str)
+        function processChunk()
         {
-            var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
-            if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
-                return null;
-            var node = createSpan(match[1], "webkit-javascript-regexp");
-            previousMatchLength = match[1].length;
-            return node;
+            for (var end = Math.min(i + linesPerChunk, rowsLength); i < end; ++i) {
+                var row = rows[i];
+                if (!row)
+                    continue;
+                var cell = row.cells[1];
+                if (!cell)
+                    continue;
+                this.syntaxHighlightLine(cell, previousCell);
+                if (i < (end - 1))
+                    this.deleteContinueFlags(previousCell);
+                previousCell = cell;
+            }
+
+            if (i >= rowsLength && processChunkInterval) {
+                this.deleteContinueFlags(previousCell);
+                delete this.previousMatchLength;
+                clearInterval(processChunkInterval);
+
+                this.sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            }
         }
 
-        function syntaxHighlightJavascriptLine(line, prevLine)
-        {
-            var messageBubble = line.lastChild;
-            if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
-                line.removeChild(messageBubble);
-            else
-                messageBubble = null;
+        var boundProcessChunk = processChunk.bind(this);
+        var processChunkInterval = setInterval(boundProcessChunk, 25);
+        boundProcessChunk();
+    }
+}
+
+WebInspector.CSSSourceSyntaxHighligher = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^((-?(\d+|\d*\.\d+))|^(#[a-fA-F0-9]{3,6}))(?:\D|$)/, 1, "webkit-css-number");
+    this.findUnits = this.generateFinder(/^(px|em|pt|in|cm|mm|pc|ex)(?:\W|$)/, 1, "webkit-css-unit");
+    this.findKeyword = this.generateFinder(/^(rgba?|hsla?|var)(?:\W|$)/, 1, "webkit-css-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-css-string"); // " this quote keeps Xcode happy
+    this.findSingleLineComment = this.generateFinder(/^\/\*.*?\*\//, 0, "webkit-css-comment");
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-css-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-css-comment");
+    this.findSelector = this.generateFinder(/^([#\.]?[_a-zA-Z].*?)(?:\W|$)/, 1, "webkit-css-selector");
+    this.findProperty = this.generateFinder(/^(-?[_a-z0-9][_a-z0-9-]*\s*)(?:\:)/, 1, "webkit-css-property");
+    this.findGenericIdent = this.generateFinder(/^([@-]?[_a-z0-9][_a-z0-9-]*)(?:\W|$)/, 1, "webkit-css-string");
+}
+
+WebInspector.CSSSourceSyntaxHighligher.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._inSelector;
+    },
+
+    findPseudoClass: function(str)
+    {
+        var match = /^(::?)([_a-z0-9][_a-z0-9-]*)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var span = document.createElement("span");
+        span.appendChild(document.createTextNode(match[1]));
+        span.appendChild(this.createSpan(match[2], "webkit-css-pseudo-class"));
+        return span;
+    },
+
+    findURL: function(str)
+    {
+        var match = /^(?:local|url)\(([^\)]*?)\)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        var innerUrlSpan = this.createSpan(match[1], "webkit-css-url");
+        var outerSpan = document.createElement("span");
+        outerSpan.appendChild(this.createSpan("url", "webkit-css-keyword"));
+        outerSpan.appendChild(document.createTextNode("("));
+        outerSpan.appendChild(innerUrlSpan);
+        outerSpan.appendChild(document.createTextNode(")"));
+        return outerSpan;
+    },
+
+    findAtRule: function(str)
+    {
+        var match = /^@[_a-z0-9][_a-z0-9-]*(?:\W|$)/.exec(str);
+        if (!match)
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-css-at-rule");
+    },
 
-            var code = line.textContent;
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var code = line.textContent;
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
 
-            while (line.firstChild)
-                line.removeChild(line.firstChild);
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
 
-            var token;
-            var tmp = 0;
-            var i = 0;
-            previousMatchLength = 0;
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
+            }
+        }
 
-            if (prevLine) {
-                if (prevLine._commentContinues) {
-                    if (!(token = findMultilineCommentEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-comment");
-                        line._commentContinues = true;
+        var inSelector = (prevLine && prevLine._inSelector); // inside a selector, we can now parse properties and values
+        var inAtRuleBlock = (prevLine && prevLine._inAtRuleBlock); // inside an @rule block, but not necessarily inside a selector yet
+        var atRuleStarted = (prevLine && prevLine._atRuleStarted); // we received an @rule, we may stop the @rule at a semicolon or open a block and become inAtRuleBlock
+        var atRuleIsSelector = (prevLine && prevLine._atRuleIsSelector); // when this @rule opens a block it immediately goes into parsing properties and values instead of selectors
+
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            var currChar = codeFragment[0];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (currChar === ";" && !inAtRuleBlock)
+                    atRuleStarted = false;
+                else if (currChar === "}") {
+                    if (inSelector && inAtRuleBlock && atRuleIsSelector) {
+                        inSelector = false;
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
+                    } else if (inSelector) {
+                        inSelector = false;
+                    } else if (inAtRuleBlock) {
+                        inAtRuleBlock = false;
+                        atRuleStarted = false;
                     }
-                } else if (prevLine._singleQuoteStringContinues) {
-                    if (!(token = findMultilineSingleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._singleQuoteStringContinues = true;
+                } else if (currChar === "{") {
+                    if (!atRuleStarted || inAtRuleBlock) {
+                        inSelector = true;
+                    } else if (!inAtRuleBlock && atRuleIsSelector) {
+                        inAtRuleBlock = true;
+                        inSelector = true;
+                    } else if (!inAtRuleBlock) {
+                        inAtRuleBlock = true;
+                        inSelector = false;
                     }
-                } else if (prevLine._doubleQuoteStringContinues) {
-                    if (!(token = findMultilineDoubleQuoteStringEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-string");
-                        line._doubleQuoteStringContinues = true;
+                } else if (inSelector) {
+                    if (!prevChar || /^\d/.test(prevChar)) {
+                        token = this.findUnits(codeFragment);
+                    } else if (!prevChar || /^\W/.test(prevChar)) {
+                        token = this.findNumber(codeFragment) ||
+                                this.findKeyword(codeFragment) ||
+                                this.findURL(codeFragment) ||
+                                this.findProperty(codeFragment) ||
+                                this.findAtRule(codeFragment) ||
+                                this.findGenericIdent(codeFragment) ||
+                                this.findSingleLineString(codeFragment);
                     }
-                } else if (prevLine._regexpContinues) {
-                    if (!(token = findMultilineRegExpEnd(code))) {
-                        token = createSpan(code, "webkit-javascript-regexp");
-                        line._regexpContinues = true;
+                } else if (!inSelector) {
+                    if (atRuleStarted && !inAtRuleBlock)
+                        token = this.findURL(codeFragment); // for @import
+                    if (!token) {
+                        token = this.findSelector(codeFragment) ||
+                                this.findPseudoClass(codeFragment) ||
+                                this.findAtRule(codeFragment);
                     }
                 }
-                if (token) {
-                    i += previousMatchLength ? previousMatchLength : code.length;
-                    tmp = i;
-                    line.appendChild(token);
-                }
             }
 
-            for ( ; i < code.length; ++i) {
-                var codeFragment = code.substr(i);
-                var prevChar = code[i - 1];
-                token = findSingleLineComment(codeFragment);
-                if (!token) {
-                    if ((token = findMultilineCommentStart(codeFragment)))
-                        line._commentContinues = true;
-                    else if (!prevChar || /^\W/.test(prevChar)) {
-                        token = findNumber(codeFragment, code[i - 1]) ||
-                                findKeyword(codeFragment, code[i - 1]) ||
-                                findSingleLineString(codeFragment) ||
-                                findSingleLineRegExp(codeFragment);
-                        if (!token) {
-                            if (token = findMultilineSingleQuoteStringStart(codeFragment))
-                                line._singleQuoteStringContinues = true;
-                            else if (token = findMultilineDoubleQuoteStringStart(codeFragment))
-                                line._doubleQuoteStringContinues = true;
-                            else if (token = findMultilineRegExpStart(codeFragment))
-                                line._regexpContinues = true;
-                        }
-                    }
-                }
+            if (token) {
+                if (currChar === "@") {
+                    atRuleStarted = true;
 
-                if (token) {
-                    if (tmp !== i)
-                        line.appendChild(document.createTextNode(code.substring(tmp, i)));
-                    line.appendChild(token);
-                    i += previousMatchLength - 1;
-                    tmp = i + 1;
+                    // The @font-face, @page, and @variables at-rules do not contain selectors like other at-rules
+                    // instead it acts as a selector and contains properties and values.
+                    var text = token.textContent;
+                    atRuleIsSelector = /font-face/.test(text) || /page/.test(text) || /variables/.test(text);
                 }
+
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
+        }
 
-            if (tmp < code.length)
-                line.appendChild(document.createTextNode(code.substring(tmp, i)));
+        line._inSelector = inSelector;
+        line._inAtRuleBlock = inAtRuleBlock;
+        line._atRuleStarted = atRuleStarted;
+        line._atRuleIsSelector = atRuleIsSelector;
 
-            if (messageBubble)
-                line.appendChild(messageBubble);
-        }
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
+    }
+}
 
-        var i = 0;
-        var rows = table.rows;
-        var rowsLength = rows.length;
-        var previousCell = null;
-        var previousMatchLength = 0;
-        var sourceFrame = this;
+WebInspector.CSSSourceSyntaxHighligher.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
+
+WebInspector.JavaScriptSourceSyntaxHighlighter = function(table, sourceFrame) {
+    WebInspector.SourceSyntaxHighligher.call(this, table, sourceFrame);
+
+    this.findNumber = this.generateFinder(/^(-?(\d+\.?\d*([eE][+-]\d+)?|0[xX]\h+|Infinity)|NaN)(?:\W|$)/, 1, "webkit-javascript-number");
+    this.findKeyword = this.generateFinder(/^(null|true|false|break|case|catch|const|default|finally|for|instanceof|new|var|continue|function|return|void|delete|if|this|do|while|else|in|switch|throw|try|typeof|with|debugger|class|enum|export|extends|import|super|get|set)(?:\W|$)/, 1, "webkit-javascript-keyword");
+    this.findSingleLineString = this.generateFinder(/^"(?:[^"\\]|\\.)*"|^'([^'\\]|\\.)*'/, 0, "webkit-javascript-string"); // " this quote keeps Xcode happy
+    this.findMultilineCommentStart = this.generateFinder(/^\/\*.*$/, 0, "webkit-javascript-comment");
+    this.findMultilineCommentEnd = this.generateFinder(/^.*?\*\//, 0, "webkit-javascript-comment");
+    this.findMultilineSingleQuoteStringStart = this.generateFinder(/^'(?:[^'\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineSingleQuoteStringEnd = this.generateFinder(/^(?:[^'\\]|\\.)*?'/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringStart = this.generateFinder(/^"(?:[^"\\]|\\.)*\\$/, 0, "webkit-javascript-string");
+    this.findMultilineDoubleQuoteStringEnd = this.generateFinder(/^(?:[^"\\]|\\.)*?"/, 0, "webkit-javascript-string");
+    this.findMultilineRegExpEnd = this.generateFinder(/^(?:[^\/\\]|\\.)*?\/([gim]{0,3})/, 0, "webkit-javascript-regexp");
+    this.findSingleLineComment = this.generateFinder(/^\/\/.*|^\/\*.*?\*\//, 0, "webkit-javascript-comment");
+}
 
-        // Split up the work into chunks so we don't block the
-        // UI thread while processing.
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype = {
+    deleteContinueFlags: function(cell)
+    {
+        if (!cell)
+            return;
+        delete cell._commentContinues;
+        delete cell._singleQuoteStringContinues;
+        delete cell._doubleQuoteStringContinues;
+        delete cell._regexpContinues;
+    },
 
-        function processChunk()
-        {
-            for (var end = Math.min(i + 10, rowsLength); i < end; ++i) {
-                var row = rows[i];
-                if (!row)
-                    continue;
-                var cell = row.cells[1];
-                if (!cell)
-                    continue;
-                syntaxHighlightJavascriptLine(cell, previousCell);
-                if (i < (end - 1))
-                    deleteContinueFlags(previousCell);
-                previousCell = cell;
+    findMultilineRegExpStart: function(str)
+    {
+        var match = /^\/(?:[^\/\\]|\\.)*\\$/.exec(str);
+        if (!match || !/\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[0]))
+            return null;
+        this.previousMatchLength = match[0].length;
+        return this.createSpan(match[0], "webkit-javascript-regexp");
+    },
+
+    findSingleLineRegExp: function(str)
+    {
+        var match = /^(\/(?:[^\/\\]|\\.)*\/([gim]{0,3}))(.?)/.exec(str);
+        if (!match || !(match[2].length > 0 || /\\|\$|\.[\?\*\+]|[^\|]\|[^\|]/.test(match[1]) || /\.|;|,/.test(match[3])))
+            return null;
+        this.previousMatchLength = match[1].length;
+        return this.createSpan(match[1], "webkit-javascript-regexp");
+    },
+
+    syntaxHighlightLine: function(line, prevLine)
+    {
+        var messageBubble = line.lastChild;
+        if (messageBubble && messageBubble.nodeType === Node.ELEMENT_NODE && messageBubble.hasStyleClass("webkit-html-message-bubble"))
+            line.removeChild(messageBubble);
+        else
+            messageBubble = null;
+
+        var code = line.textContent;
+
+        while (line.firstChild)
+            line.removeChild(line.firstChild);
+
+        var token;
+        var tmp = 0;
+        var i = 0;
+        this.previousMatchLength = 0;
+
+        if (prevLine) {
+            if (prevLine._commentContinues) {
+                if (!(token = this.findMultilineCommentEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-comment");
+                    line._commentContinues = true;
+                }
+            } else if (prevLine._singleQuoteStringContinues) {
+                if (!(token = this.findMultilineSingleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._singleQuoteStringContinues = true;
+                }
+            } else if (prevLine._doubleQuoteStringContinues) {
+                if (!(token = this.findMultilineDoubleQuoteStringEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-string");
+                    line._doubleQuoteStringContinues = true;
+                }
+            } else if (prevLine._regexpContinues) {
+                if (!(token = this.findMultilineRegExpEnd(code))) {
+                    token = this.createSpan(code, "webkit-javascript-regexp");
+                    line._regexpContinues = true;
+                }
+            }
+            if (token) {
+                i += this.previousMatchLength ? this.previousMatchLength : code.length;
+                tmp = i;
+                line.appendChild(token);
             }
+        }
 
-            if (i >= rowsLength && processChunkInterval) {
-                deleteContinueFlags(previousCell);
-                clearInterval(processChunkInterval);
+        for ( ; i < code.length; ++i) {
+            var codeFragment = code.substr(i);
+            var prevChar = code[i - 1];
+            token = this.findSingleLineComment(codeFragment);
+            if (!token) {
+                if ((token = this.findMultilineCommentStart(codeFragment)))
+                    line._commentContinues = true;
+                else if (!prevChar || /^\W/.test(prevChar)) {
+                    token = this.findNumber(codeFragment) ||
+                            this.findKeyword(codeFragment) ||
+                            this.findSingleLineString(codeFragment) ||
+                            this.findSingleLineRegExp(codeFragment);
+                    if (!token) {
+                        if (token = this.findMultilineSingleQuoteStringStart(codeFragment))
+                            line._singleQuoteStringContinues = true;
+                        else if (token = this.findMultilineDoubleQuoteStringStart(codeFragment))
+                            line._doubleQuoteStringContinues = true;
+                        else if (token = this.findMultilineRegExpStart(codeFragment))
+                            line._regexpContinues = true;
+                    }
+                }
+            }
 
-                sourceFrame.dispatchEventToListeners("syntax highlighting complete");
+            if (token) {
+                if (tmp !== i)
+                    line.appendChild(document.createTextNode(code.substring(tmp, i)));
+                line.appendChild(token);
+                i += this.previousMatchLength - 1;
+                tmp = i + 1;
             }
         }
 
-        processChunk();
+        if (tmp < code.length)
+            line.appendChild(document.createTextNode(code.substring(tmp, i)));
 
-        var processChunkInterval = setInterval(processChunk, 25);
+        if (messageBubble)
+            line.appendChild(messageBubble);
     }
 }
 
-WebInspector.SourceFrame.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.JavaScriptSourceSyntaxHighlighter.prototype.__proto__ = WebInspector.SourceSyntaxHighligher.prototype;
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index 97a5bd5..c1b1bbf 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -106,11 +106,16 @@ WebInspector.SourceView.prototype = {
         this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
         
         if (this.resource.type === WebInspector.Resource.Type.Script
-            || this.resource.mimeType === 'application/json'
-            || this.resource.mimeType === 'application/javascript'
+            || this.resource.mimeType === "application/json"
+            || this.resource.mimeType === "application/javascript"
             || /\.js(on)?$/.test(this.resource.lastPathComponent) ) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
             this.sourceFrame.syntaxHighlightJavascript();
+        } else if (this.resource.type === WebInspector.Resource.Type.Stylesheet
+            || this.resource.mimeType === "text/css"
+            || /\.css$/.test(this.resource.lastPathComponent) ) {
+            this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
+            this.sourceFrame.syntaxHighlightCSS();
         } else
             this._sourceFrameSetupFinished();
     },
diff --git a/WebCore/inspector/front-end/StatusBarButton.js b/WebCore/inspector/front-end/StatusBarButton.js
new file mode 100644
index 0000000..5c69ed5
--- /dev/null
+++ b/WebCore/inspector/front-end/StatusBarButton.js
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.StatusBarButton = function(title, className)
+{
+    this.element = document.createElement("button");
+    this.element.className = className + " status-bar-item";
+    this.element.addEventListener("click", this._clicked.bind(this), false);
+
+    this.glyph = document.createElement("div");
+    this.glyph.className = "glyph";
+    this.element.appendChild(this.glyph);
+
+    this.glyphShadow = document.createElement("div");
+    this.glyphShadow.className = "glyph shadow";
+    this.element.appendChild(this.glyphShadow);
+
+    this.title = title;
+    this.disabled = false;
+    this._toggled = false;
+    this._visible = true;
+}
+
+WebInspector.StatusBarButton.prototype = {
+    _clicked: function()
+    {
+        this.dispatchEventToListeners("click");
+    },
+
+    get disabled()
+    {
+        return this._disabled;
+    },
+
+    set disabled(x)
+    {
+        if (this._disabled === x)
+            return;
+        this._disabled = x;
+        this.element.disabled = x;
+    },
+
+    get title()
+    {
+        return this._title;
+    },
+
+    set title(x)
+    {
+        if (this._title === x)
+            return;
+        this._title = x;
+        this.element.title = x;
+    },
+
+    get toggled()
+    {
+        return this._toggled;
+    },
+
+    set toggled(x)
+    {
+        if (this._toggled === x)
+            return;
+
+        if (x)
+            this.element.addStyleClass("toggled-on");
+        else
+            this.element.removeStyleClass("toggled-on");
+        this._toggled = x;
+    },
+
+    get visible()
+    {
+        return this._visible;
+    },
+
+    set visible(x)
+    {
+        if (this._visible === x)
+            return;
+
+        if (x)
+            this.element.removeStyleClass("hidden");
+        else
+            this.element.addStyleClass("hidden");
+        this._visible = x;
+    }
+}
+
+WebInspector.StatusBarButton.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/WebCore/inspector/front-end/DatabasesPanel.js b/WebCore/inspector/front-end/StoragePanel.js
index a31e3ff..089bb98 100644
--- a/WebCore/inspector/front-end/DatabasesPanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -27,12 +27,12 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-WebInspector.DatabasesPanel = function(database)
+WebInspector.StoragePanel = function(database)
 {
     WebInspector.Panel.call(this);
 
     this.sidebarElement = document.createElement("div");
-    this.sidebarElement.id = "databases-sidebar";
+    this.sidebarElement.id = "storage-sidebar";
     this.sidebarElement.className = "sidebar";
     this.element.appendChild(this.sidebarElement);
 
@@ -59,6 +59,10 @@ WebInspector.DatabasesPanel = function(database)
     this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
     this.sessionStorageListTreeElement.expand();
 
+    this.cookieListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("COOKIES"), {}, true);
+    this.sidebarTree.appendChild(this.cookieListTreeElement);
+    this.cookieListTreeElement.expand();
+
     this.storageViews = document.createElement("div");
     this.storageViews.id = "storage-views";
     this.element.appendChild(this.storageViews);
@@ -69,12 +73,12 @@ WebInspector.DatabasesPanel = function(database)
     this.reset();
 }
 
-WebInspector.DatabasesPanel.prototype = {
-    toolbarItemClass: "databases",
+WebInspector.StoragePanel.prototype = {
+    toolbarItemClass: "storage",
 
     get toolbarItemLabel()
     {
-        return WebInspector.UIString("Databases");
+        return WebInspector.UIString("Storage");
     },
 
     get statusBarItems()
@@ -86,7 +90,6 @@ WebInspector.DatabasesPanel.prototype = {
     {
         WebInspector.Panel.prototype.show.call(this);
         this._updateSidebarWidth();
-        this._registerStorageEventListener();
     },
 
     reset: function()
@@ -103,8 +106,6 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._databases = [];
 
-        this._unregisterStorageEventListener();
-
         if (this._domStorage) {
             var domStorageLength = this._domStorage.length;
             for (var i = 0; i < domStorageLength; ++i) {
@@ -116,12 +117,20 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._domStorage = [];
 
+        this._cookieDomains = {};
+        this._cookieViews = {};
+
         this.databasesListTreeElement.removeChildren();
         this.localStorageListTreeElement.removeChildren();
         this.sessionStorageListTreeElement.removeChildren();
-        this.storageViews.removeChildren();
-        
+        this.cookieListTreeElement.removeChildren();
+
+        this.storageViews.removeChildren();        
+
         this.storageViewStatusBarItemsContainer.removeChildren();
+        
+        if (this.sidebarTree.selectedTreeElement)
+            this.sidebarTree.selectedTreeElement.deselect();
     },
 
     handleKeyEvent: function(event)
@@ -137,11 +146,22 @@ WebInspector.DatabasesPanel.prototype = {
         database._databasesTreeElement = databaseTreeElement;
         this.databasesListTreeElement.appendChild(databaseTreeElement);
     },
+    
+    addCookieDomain: function(domain)
+    {
+        // Eliminate duplicate domains from the list.
+        if (typeof this._cookieDomains[domain] !== "undefined")
+            return;
+
+        var cookieDomainTreeElement = new WebInspector.CookieSidebarTreeElement(domain);
+        this.cookieListTreeElement.appendChild(cookieDomainTreeElement);
+        this._cookieDomains[domain] = true;
+    },
 
     addDOMStorage: function(domStorage)
     {
         this._domStorage.push(domStorage);
-        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage);
+        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage, (domStorage.isLocalStorage ? "local-storage" : "session-storage"));
         domStorage._domStorageTreeElement = domStorageTreeElement;
         if (domStorage.isLocalStorage)
             this.localStorageListTreeElement.appendChild(domStorageTreeElement);
@@ -149,12 +169,12 @@ WebInspector.DatabasesPanel.prototype = {
             this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
-    selectDatabase: function(db)
+    selectDatabase: function(databaseId)
     {
         var database;
         for (var i = 0, len = this._databases.length; i < len; ++i) {
             database = this._databases[i];
-            if ( db === database.database ) {
+            if (database.id === databaseId) {
                 this.showDatabase(database);
                 database._databasesTreeElement.select();
                 return;
@@ -162,16 +182,12 @@ WebInspector.DatabasesPanel.prototype = {
         }
     },
 
-    selectDOMStorage: function(s)
+    selectDOMStorage: function(storageId)
     {
-        var isLocalStorage = (s === InspectorController.inspectedWindow().localStorage);
-        for (var i = 0, len = this._domStorage.length; i < len; ++i) {
-            var storage = this._domStorage[i];
-            if ( isLocalStorage === storage.isLocalStorage ) {
-                this.showDOMStorage(storage);
-                storage._domStorageTreeElement.select();
-                return;
-            }
+        var domStorage = this._domStorageForId(storageId);
+        if (domStorage) {
+            this.showDOMStorage(domStorage);
+            domStorage._domStorageTreeElement.select();
         }
     },
 
@@ -207,7 +223,7 @@ WebInspector.DatabasesPanel.prototype = {
         this.storageViewStatusBarItemsContainer.removeChildren();
         var statusBarItems = view.statusBarItems || [];
         for (var i = 0; i < statusBarItems.length; ++i)
-            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i].element);
     },
 
     showDOMStorage: function(domStorage)
@@ -235,6 +251,27 @@ WebInspector.DatabasesPanel.prototype = {
             this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
+    showCookies: function(cookieDomain)
+    {
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        var view = this._cookieViews[cookieDomain];
+        if (!view) {
+            view = new WebInspector.CookieItemsView(cookieDomain);
+            this._cookieViews[cookieDomain] = view;
+        }
+
+        view.show(this.storageViews);
+
+        this.visibleView = view;
+
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+    },
+
     closeVisibleView: function()
     {
         if (this.visibleView)
@@ -253,34 +290,39 @@ WebInspector.DatabasesPanel.prototype = {
             return;
 
         var tableNamesHash = {};
-        var tableNames = database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            tableNamesHash[tableNames[i]] = true;
-
-        for (var tableName in database._tableViews) {
-            if (!(tableName in tableNamesHash)) {
-                if (this.visibleView === database._tableViews[tableName])
-                    this.closeVisibleView();
-                delete database._tableViews[tableName];
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                tableNamesHash[tableNames[i]] = true;
+
+            for (var tableName in database._tableViews) {
+                if (!(tableName in tableNamesHash)) {
+                    if (self.visibleView === database._tableViews[tableName])
+                        self.closeVisibleView();
+                    delete database._tableViews[tableName];
+                }
             }
         }
+        database.getTableNames(tableNamesCallback);
     },
 
-    dataGridForResult: function(result)
+    dataGridForResult: function(rows)
     {
-        if (!result.rows.length)
+        if (!rows.length)
             return null;
 
         var columns = {};
+        var numColumns = 0;
 
-        var rows = result.rows;
-        for (var columnIdentifier in rows.item(0)) {
+        for (var columnIdentifier in rows[0]) {
             var column = {};
             column.width = columnIdentifier.length;
             column.title = columnIdentifier;
 
             columns[columnIdentifier] = column;
+            ++numColumns;
         }
 
         var nodes = [];
@@ -288,12 +330,9 @@ WebInspector.DatabasesPanel.prototype = {
         for (var i = 0; i < length; ++i) {
             var data = {};
 
-            var row = rows.item(i);
+            var row = rows[i];
             for (var columnIdentifier in row) {
-                // FIXME: (Bug 19439) We should specially format SQL NULL here
-                // (which is represented by JavaScript null here, and turned
-                // into the string "null" by the String() function).
-                var text = String(row[columnIdentifier]);
+                var text = row[columnIdentifier];
                 data[columnIdentifier] = text;
                 if (text.length > columns[columnIdentifier].width)
                     columns[columnIdentifier].width = text.length;
@@ -309,7 +348,7 @@ WebInspector.DatabasesPanel.prototype = {
             totalColumnWidths += columns[columnIdentifier].width;
 
         // Calculate the percentage width for the columns.
-        const minimumPrecent = 5;
+        const minimumPrecent = Math.min(5, Math.floor(100/numColumns));
         var recoupPercent = 0;
         for (var columnIdentifier in columns) {
             var width = columns[columnIdentifier].width;
@@ -346,61 +385,6 @@ WebInspector.DatabasesPanel.prototype = {
         return dataGrid;
     },
 
-    dataGridForDOMStorage: function(domStorage)
-    {
-        if (!domStorage.length)
-            return null;
-
-        var columns = {};
-        columns[0] = {};
-        columns[1] = {};
-        columns[0].title = WebInspector.UIString("Key");
-        columns[0].width = columns[0].title.length;
-        columns[1].title = WebInspector.UIString("Value");
-        columns[1].width = columns[0].title.length;
-
-        var nodes = [];
-        
-        var length = domStorage.length;
-        for (var index = 0; index < domStorage.length; index++) {
-            var data = {};
-       
-            var key = String(domStorage.key(index));
-            data[0] = key;
-            if (key.length > columns[0].width)
-                columns[0].width = key.length;
-        
-            var value = String(domStorage.getItem(key));
-            data[1] = value;
-            if (value.length > columns[1].width)
-                columns[1].width = value.length;
-            var node = new WebInspector.DataGridNode(data, false);
-            node.selectable = true;
-            nodes.push(node);
-        }
-
-        var totalColumnWidths = columns[0].width + columns[1].width;
-        width = Math.round((columns[0].width * 100) / totalColumnWidths);
-        const minimumPrecent = 10;
-        if (width < minimumPrecent)
-            width = minimumPrecent;
-        if (width > 100 - minimumPrecent)
-            width = 100 - minimumPrecent;
-        columns[0].width = width;
-        columns[1].width = 100 - width;
-        columns[0].width += "%";
-        columns[1].width += "%";
-
-        var dataGrid = new WebInspector.DOMStorageDataGrid(columns);
-        var length = nodes.length;
-        for (var i = 0; i < length; ++i)
-            dataGrid.appendChild(nodes[i]);
-        dataGrid.addCreationNode(false);
-        if (length > 0)
-            nodes[0].selected = true;
-        return dataGrid;
-    },
-    
     resize: function()
     {
         var visibleView = this.visibleView;
@@ -408,44 +392,28 @@ WebInspector.DatabasesPanel.prototype = {
             visibleView.resize();
     },
 
-    _registerStorageEventListener: function()
+    updateDOMStorage: function(storageId)
     {
-        var inspectedWindow = InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
-            return;
-
-        this._storageEventListener = InspectorController.wrapCallback(this._storageEvent.bind(this));
-        inspectedWindow.addEventListener("storage", this._storageEventListener, true);
-    },
-
-    _unregisterStorageEventListener: function()
-    {
-        if (!this._storageEventListener)
-            return;
-
-        var inspectedWindow = InspectorController.inspectedWindow();
-        if (!inspectedWindow || !inspectedWindow.document)
+        var domStorage = this._domStorageForId(storageId);
+        if (!domStorage)
             return;
 
-        inspectedWindow.removeEventListener("storage", this._storageEventListener, true);
-        delete this._storageEventListener;
+        var view = domStorage._domStorageView;
+        if (this.visibleView && view === this.visibleView)
+            domStorage._domStorageView.update();
     },
 
-    _storageEvent: function(event)
+    _domStorageForId: function(storageId)
     {
         if (!this._domStorage)
-            return;
-
-        var isLocalStorage = (event.storageArea === InspectorController.inspectedWindow().localStorage);
+            return null;
         var domStorageLength = this._domStorage.length;
         for (var i = 0; i < domStorageLength; ++i) {
             var domStorage = this._domStorage[i];
-            if (isLocalStorage === domStorage.isLocalStorage) {
-                var view = domStorage._domStorageView;
-                if (this.visibleView && view === this.visibleView)
-                    domStorage._domStorageView.update();
-            }
+            if (domStorage.id == storageId)
+                return domStorage;
         }
+        return null;
     },
 
     _startSidebarDragging: function(event)
@@ -494,7 +462,7 @@ WebInspector.DatabasesPanel.prototype = {
     }
 }
 
-WebInspector.DatabasesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
+WebInspector.StoragePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 WebInspector.DatabaseSidebarTreeElement = function(database)
 {
@@ -508,7 +476,7 @@ WebInspector.DatabaseSidebarTreeElement = function(database)
 WebInspector.DatabaseSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database);
+        WebInspector.panels.storage.showDatabase(this.database);
     },
 
     oncollapse: function()
@@ -522,10 +490,14 @@ WebInspector.DatabaseSidebarTreeElement.prototype = {
     {
         this.removeChildren();
 
-        var tableNames = this.database.tableNames;
-        var tableNamesLength = tableNames.length;
-        for (var i = 0; i < tableNamesLength; ++i)
-            this.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(this.database, tableNames[i]));
+        var self = this;
+        function tableNamesCallback(tableNames)
+        {
+            var tableNamesLength = tableNames.length;
+            for (var i = 0; i < tableNamesLength; ++i)
+                self.appendChild(new WebInspector.SidebarDatabaseTableTreeElement(self.database, tableNames[i]));
+        }
+        this.database.getTableNames(tableNamesCallback);
     },
 
     get mainTitle()
@@ -562,18 +534,18 @@ WebInspector.SidebarDatabaseTableTreeElement = function(database, tableName)
 WebInspector.SidebarDatabaseTableTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDatabase(this.database, this.tableName);
+        WebInspector.panels.storage.showDatabase(this.database, this.tableName);
     }
 }
 
 WebInspector.SidebarDatabaseTableTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
 
-WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
+WebInspector.DOMStorageSidebarTreeElement = function(domStorage, className)
 {
 
     this.domStorage = domStorage;
 
-    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item", domStorage, "", null, false);
+    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item " + className, domStorage, "", null, false);
 
     this.refreshTitles();
 }
@@ -581,7 +553,7 @@ WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
 WebInspector.DOMStorageSidebarTreeElement.prototype = {
     onselect: function()
     {
-        WebInspector.panels.databases.showDOMStorage(this.domStorage);
+        WebInspector.panels.storage.showDOMStorage(this.domStorage);
     },
 
     get mainTitle()
@@ -606,3 +578,30 @@ WebInspector.DOMStorageSidebarTreeElement.prototype = {
 }
 
 WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.CookieSidebarTreeElement = function(cookieDomain)
+{
+    WebInspector.SidebarTreeElement.call(this, "cookie-sidebar-tree-item", cookieDomain, "", null, false);
+    this._cookieDomain = cookieDomain;
+
+    this.refreshTitles();
+}
+
+WebInspector.CookieSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.storage.showCookies(this._cookieDomain);
+    },
+
+    get subtitle()
+    {
+        return "";
+    },
+
+    set subtitle(x)
+    {
+        // Do nothing.
+    }
+}
+
+WebInspector.CookieSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index 8a3a67f..3582f96 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -30,6 +30,44 @@
 WebInspector.StylesSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Styles"));
+
+    this.settingsSelectElement = document.createElement("select");
+
+    var option = document.createElement("option");
+    option.value = "hex";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hex")
+        option.selected = true;
+    option.label = WebInspector.UIString("Hex Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "rgb";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "rgb")
+        option.selected = true;
+    option.label = WebInspector.UIString("RGB Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    option = document.createElement("option");
+    option.value = "hsl";
+    option.action = this._changeColorFormat.bind(this);
+    if (Preferences.colorFormat === "hsl")
+        option.selected = true;
+    option.label = WebInspector.UIString("HSL Colors");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.appendChild(document.createElement("hr"));
+
+    option = document.createElement("option");
+    option.action = this._createNewRule.bind(this);
+    option.label = WebInspector.UIString("New Style Rule");
+    this.settingsSelectElement.appendChild(option);
+
+    this.settingsSelectElement.addEventListener("click", function(event) { event.stopPropagation() }, false);
+    this.settingsSelectElement.addEventListener("change", this._changeSetting.bind(this), false);
+
+    this.titleElement.appendChild(this.settingsSelectElement);
 }
 
 WebInspector.StylesSidebarPane.prototype = {
@@ -64,13 +102,15 @@ WebInspector.StylesSidebarPane.prototype = {
             return;
 
         var self = this;
-        var callback = function(styles) {
+        function callback(styles)
+        {
             if (!styles)
                 return;
-            var nodeWrapper = WebInspector.wrapNodeWithStyles(node, styles);
-            self._update(refresh, body, nodeWrapper, editedSection, forceUpdate);
-        };
-        InspectorController.getStyles(node, !Preferences.showUserAgentStyles, callback);
+            node._setStyles(styles.computedStyle, styles.inlineStyle, styles.styleAttributes, styles.matchedCSSRules);
+            self._update(refresh, body, node, editedSection, forceUpdate);
+        }
+
+        InjectedScriptAccess.getStyles(node.id, !Preferences.showUserAgentStyles, callback);
     },
 
     _update: function(refresh, body, node, editedSection, forceUpdate)
@@ -85,7 +125,7 @@ WebInspector.StylesSidebarPane.prototype = {
         if (refresh) {
             for (var i = 0; i < this.sections.length; ++i) {
                 var section = this.sections[i];
-                if (section._blank)
+                if (section instanceof WebInspector.BlankStylePropertiesSection)
                     continue;
                 if (section.computedStyle)
                     section.styleRule.style = node.ownerDocument.defaultView.getComputedStyle(node);
@@ -269,41 +309,64 @@ WebInspector.StylesSidebarPane.prototype = {
                 body.appendChild(section.element);
                 this.sections.push(section);
             }
+        }
+    },
 
-            this.addBlankSection();
+    _changeSetting: function(event)
+    {
+        var options = this.settingsSelectElement.options;
+        var selectedOption = options[this.settingsSelectElement.selectedIndex];
+        selectedOption.action(event);
+
+        // Select the correct color format setting again, since it needs to be selected.
+        var selectedIndex = 0;
+        for (var i = 0; i < options.length; ++i) {
+            if (options[i].value === Preferences.colorFormat) {
+                selectedIndex = i;
+                break;
+            }
         }
+
+        this.settingsSelectElement.selectedIndex = selectedIndex;
     },
 
-    addBlankSection: function()
+    _changeColorFormat: function(event)
     {
-        var blankSection = new WebInspector.BlankStylePropertiesSection();
-        blankSection.pane = this;
+        var selectedOption = this.settingsSelectElement[this.settingsSelectElement.selectedIndex];
+        Preferences.colorFormat = selectedOption.value;
+
+        InspectorController.setSetting("color-format", Preferences.colorFormat);
 
-        this.bodyElement.insertBefore(blankSection.element, this.bodyElement.firstChild.nextSibling.nextSibling); // 0 is computed, 1 is element.style
-        var computed = this.sections.shift();
-        var elementStyle = this.sections.shift();
-        this.sections.unshift(blankSection);
-        this.sections.unshift(elementStyle);
-        this.sections.unshift(computed);
+        for (var i = 0; i < this.sections.length; ++i)
+            this.sections[i].update(true);
     },
 
-    appropriateSelectorForNode: function()
+    _createNewRule: function(event)
     {
-        var node = this.node;
-        if (!node)
-            return;
+        this.addBlankSection().startEditingSelector();
+    },
 
-        if (node.id)
-            return "#" + node.id;
+    addBlankSection: function()
+    {
+        var blankSection = new WebInspector.BlankStylePropertiesSection(appropriateSelectorForNode(this.node, true));
+        blankSection.pane = this;
 
-        if (node.className)
-            return "." + node.className.replace(/\s+/, ".");
+        var elementStyleSection = this.sections[1];        
+        this.bodyElement.insertBefore(blankSection.element, elementStyleSection.element.nextSibling);
 
-        var nodeName = node.nodeName.toLowerCase();
-        if (nodeName === "input" && node.type)
-            return nodeName + "[type=\"" + node.type + "\"]";
+        this.sections.splice(2, 0, blankSection);
 
-        return nodeName;
+        return blankSection;
+    },
+
+    removeSection: function(section)
+    {
+        var index = this.sections.indexOf(section);
+        if (index === -1)
+            return;
+        this.sections.splice(index, 1);
+        if (section.element.parentNode)
+            section.element.parentNode.removeChild(section.element);
     }
 }
 
@@ -312,6 +375,7 @@ WebInspector.StylesSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.pr
 WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyle, usedProperties, editable)
 {
     WebInspector.PropertiesSection.call(this, styleRule.selectorText);
+
     this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
     this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
     this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
@@ -322,8 +386,9 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
     this.editable = (editable && !computedStyle);
 
     // Prevent editing the user agent and user rules.
-    var isUserAgent = this.styleRule.isUserAgent;
-    var isUser = this.styleRule.isUser;
+    var isUserAgent = this.rule && this.rule.isUserAgent;
+    var isUser = this.rule && this.rule.isUser;
+    var isViaInspector = this.rule && this.rule.isViaInspector;
 
     if (isUserAgent || isUser)
         this.editable = false;
@@ -366,7 +431,7 @@ WebInspector.StylePropertiesSection = function(styleRule, subtitle, computedStyl
                 subtitle = WebInspector.UIString("user agent stylesheet");
             else if (isUser)
                 subtitle = WebInspector.UIString("user stylesheet");
-            else if (this.styleRule.parentStyleSheet === WebInspector.panels.elements.stylesheet)
+            else if (isViaInspector)
                 subtitle = WebInspector.UIString("via inspector");
             else
                 subtitle = WebInspector.UIString("inline stylesheet");
@@ -394,9 +459,6 @@ WebInspector.StylePropertiesSection.prototype = {
 
     expand: function(dontRememberState)
     {
-        if (this._blank)
-            return;
-
         WebInspector.PropertiesSection.prototype.expand.call(this);
         if (dontRememberState)
             return;
@@ -559,8 +621,7 @@ WebInspector.StylePropertiesSection.prototype = {
         if (WebInspector.isBeingEdited(element))
             return;
 
-        var context = this.styleRule.selectorText;
-        WebInspector.startEditing(this.titleElement, this.editingSelectorCommitted.bind(this), this.editingSelectorCancelled.bind(this), context);
+        WebInspector.startEditing(this.titleElement, this.editingSelectorCommitted.bind(this), this.editingSelectorCancelled.bind(this), null);
         window.getSelection().setBaseAndExtent(element, 0, element, 1);
     },
 
@@ -583,10 +644,10 @@ WebInspector.StylePropertiesSection.prototype = {
             return moveToNextIfNeeded.call(this);
 
         var self = this;
-        var callback = function(result) {
+        function callback(result)
+        {
             if (!result) {
                 // Invalid Syntax for a Selector
-                self.editingSelectorCancelled(element, context);
                 moveToNextIfNeeded.call(self);
                 return;
             }
@@ -604,84 +665,61 @@ WebInspector.StylePropertiesSection.prototype = {
             var newRule = WebInspector.CSSStyleDeclaration.parseRule(newRulePayload);
             self.rule = newRule;
             self.styleRule = { section: self, style: newRule.style, selectorText: newRule.selectorText, parentStyleSheet: newRule.parentStyleSheet, rule: newRule };
+
             var oldIdentifier = this.identifier;
             self.identifier = newRule.selectorText + ":" + self.subtitleElement.textContent;
-            self.pane.update(null, true);
+
+            self.pane.update();
+
             WebInspector.panels.elements.renameSelector(oldIdentifier, this.identifier, oldContent, newContent);
-            moveToNextIfNeeded.call(self);
-        };
 
-        InspectorController.applyStyleRuleText(this.rule._id, newContent, this.pane.node, callback);
-    },
+            moveToNextIfNeeded.call(self);
+        }
 
-    editingSelectorCancelled: function(element, context)
-    {
-        element.textContent = context;
+        InjectedScriptAccess.applyStyleRuleText(this.rule.id, newContent, this.pane.node.id, callback);
     },
 
-    _doesSelectorAffectSelectedNode: function(selector)
+    editingSelectorCancelled: function()
     {
-        var selectedNode = this.pane.node;
-        var nodes = selectedNode.ownerDocument.querySelectorAll(selector);
-        for (var i = 0; i < nodes.length; ++i) {
-            if (nodes[i] === selectedNode)
-                return true;
-        }
-
-        return false;
+        // Do nothing, this is overridden by BlankStylePropertiesSection.
     }
 }
 
 WebInspector.StylePropertiesSection.prototype.__proto__ = WebInspector.PropertiesSection.prototype;
 
-WebInspector.BlankStylePropertiesSection = function()
+WebInspector.BlankStylePropertiesSection = function(defaultSelectorText)
 {
-    WebInspector.PropertiesSection.call(this, WebInspector.UIString("Double-Click to Add"), null);
+    WebInspector.StylePropertiesSection.call(this, {selectorText: defaultSelectorText, rule: {isViaInspector: true}}, "", false, {}, false);
 
-    this._blank = true;
-    this._dblclickListener = this._dblclick.bind(this);
     this.element.addStyleClass("blank-section");
-    this.titleElement.addStyleClass("blank-title");
-    this.titleElement.addEventListener("click", function(e) { e.stopPropagation(); }, false);
-    this.titleElement.addEventListener("dblclick", this._dblclickListener, false);
 }
 
 WebInspector.BlankStylePropertiesSection.prototype = {
-    _dblclick: function(event)
-    {
-        this.startEditing();
-    },
-
-    startEditing: function()
-    {
-        var element = this.titleElement;
-        if (WebInspector.isBeingEdited(element))
-            return;
-
-        this.titleElement.textContent = this.pane.appropriateSelectorForNode();
-        this.titleElement.removeStyleClass("blank-title");
-        WebInspector.startEditing(this.titleElement, this.editingCommitted.bind(this), this.editingCancelled.bind(this), "");
-        window.getSelection().setBaseAndExtent(element, 0, element, 1);
-    },
-
-    editingCancelled: function()
+    expand: function()
     {
-        this.titleElement.textContent = WebInspector.UIString("Double-Click to Add");
-        this.titleElement.addStyleClass("blank-title");
+        // Do nothing, blank sections are not expandable.
     },
 
-    editingCommitted: function(element, newContent, oldContent, context)
+    editingSelectorCommitted: function(element, newContent, oldContent, context)
     {
         var self = this;
-        var callback = function(styleRule) {
-            if (!styleRule) {
+        function callback(result)
+        {
+            if (!result) {
                 // Invalid Syntax for a Selector
-                self.editingCancelled();
+                self.editingSelectorCancelled();
                 return;
             }
-            self.makeNormal(WebInspector.CSSStyleDeclaration.parseRule(styleRule));
 
-            if (!self._doesSelectorAffectSelectedNode(newContent)) {
+            var rule = result[0];
+            var doesSelectorAffectSelectedNode = result[1];
+
+            var styleRule = WebInspector.CSSStyleDeclaration.parseRule(rule);
+            styleRule.rule = rule;
+
+            self.makeNormal(styleRule);
+
+            if (!doesSelectorAffectSelectedNode) {
                 self.noAffect = true;
                 self.element.addStyleClass("no-affect");
             }
@@ -689,31 +727,28 @@ WebInspector.BlankStylePropertiesSection.prototype = {
             self.subtitleElement.textContent = WebInspector.UIString("via inspector");
             self.expand();
 
-            self.pane.addBlankSection();
             self.addNewBlankProperty().startEditing();
-        };
-        InspectorController.addStyleSelector(newContent, callback);
+        }
+
+        InjectedScriptAccess.addStyleSelector(newContent, this.pane.node.id, callback);
+    },
+
+    editingSelectorCancelled: function()
+    {
+        this.pane.removeSection(this);
     },
 
     makeNormal: function(styleRule)
     {
-        this.titleElement.removeEventListener("dblclick", this._dblclickListener, false);
-        this.titleElement.addEventListener("dblclick", this._dblclickSelector.bind(this), false);
-        this.element.addEventListener("dblclick", this._dblclickEmptySpace.bind(this), false);
         this.element.removeStyleClass("blank-section");
-        delete this._blank;
-        delete this._dblclick;
-        delete this.startEditing;
-        delete this.editingCancelled;
-        delete this.editingCommitted;
-        delete this._dblclickListener;
-        delete this.makeNormal;
+
         this.styleRule = styleRule;
         this.rule = styleRule.rule;
         this.computedStyle = false;
         this.editable = true;
-        this.identifier = styleRule.selectorText + ":inspector";
-        // leftovers are: this.noAffect if applicable
+        this.identifier = styleRule.selectorText + ":via inspector";
+
+        this.__proto__ = WebInspector.StylePropertiesSection.prototype;
     }
 }
 
@@ -794,49 +829,14 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
     updateTitle: function()
     {
-        // "Nicknames" for some common values that are easier to read.
-        var valueNicknames = {
-            "rgb(0, 0, 0)": "black",
-            "#000": "black",
-            "#000000": "black",
-            "rgb(255, 255, 255)": "white",
-            "#fff": "white",
-            "#ffffff": "white",
-            "#FFF": "white",
-            "#FFFFFF": "white",
-            "rgba(0, 0, 0, 0)": "transparent",
-            "rgb(255, 0, 0)": "red",
-            "rgb(0, 255, 0)": "lime",
-            "rgb(0, 0, 255)": "blue",
-            "rgb(255, 255, 0)": "yellow",
-            "rgb(255, 0, 255)": "magenta",
-            "rgb(0, 255, 255)": "cyan"
-        };
-
         var priority = this.priority;
         var value = this.value;
-        var htmlValue = value;
 
         if (priority && !priority.length)
             delete priority;
         if (priority)
             priority = "!" + priority;
 
-        if (value) {
-            var urls = value.match(/url\([^)]+\)/);
-            if (urls) {
-                for (var i = 0; i < urls.length; ++i) {
-                    var url = urls[i].substring(4, urls[i].length - 1);
-                    htmlValue = htmlValue.replace(urls[i], "url(" + WebInspector.linkifyURL(url) + ")");
-                }
-            } else {
-                if (value in valueNicknames)
-                    htmlValue = valueNicknames[value];
-                htmlValue = htmlValue.escapeHTML();
-            }
-        } else
-            htmlValue = value = "";
-
         this.updateState();
 
         var enabledCheckboxElement = document.createElement("input");
@@ -852,113 +852,156 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
         var valueElement = document.createElement("span");
         valueElement.className = "value";
-        valueElement.innerHTML = htmlValue;
         this.valueElement = valueElement;
 
-        if (priority) {
-            var priorityElement = document.createElement("span");
-            priorityElement.className = "priority";
-            priorityElement.textContent = priority;
-        }
-
-        this.listItemElement.removeChildren();
-
-        // Append the checkbox for root elements of an editable section.
-        if (this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
-            this.listItemElement.appendChild(enabledCheckboxElement);
-        this.listItemElement.appendChild(nameElement);
-        this.listItemElement.appendChild(document.createTextNode(": "));
-        this.listItemElement.appendChild(valueElement);
+        if (value) {
+            function processValue(regex, processor, nextProcessor, valueText)
+            {
+                var container = document.createDocumentFragment();
+
+                var items = valueText.replace(regex, "\0$1\0").split("\0");
+                for (var i = 0; i < items.length; ++i) {
+                    if ((i % 2) === 0) {
+                        if (nextProcessor)
+                            container.appendChild(nextProcessor(items[i]));
+                        else
+                            container.appendChild(document.createTextNode(items[i]));
+                    } else {
+                        var processedNode = processor(items[i]);
+                        if (processedNode)
+                            container.appendChild(processedNode);
+                    }
+                }
 
-        if (priorityElement) {
-            this.listItemElement.appendChild(document.createTextNode(" "));
-            this.listItemElement.appendChild(priorityElement);
-        }
+                return container;
+            }
 
-        this.listItemElement.appendChild(document.createTextNode(";"));
+            function linkifyURL(url)
+            {
+                var container = document.createDocumentFragment();
+                container.appendChild(document.createTextNode("url("));
+                container.appendChild(WebInspector.linkifyURLAsNode(url, url, null, (url in WebInspector.resourceURLMap)));
+                container.appendChild(document.createTextNode(")"));
+                return container;
+            }
 
-        if (value) {
-            // FIXME: this only covers W3C and CSS 16 valid color names
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow|transparent/g);
-            var swatch;
-            if (colors) {
-                var colorsLength = colors.length;
-                for (var i = 0; i < colorsLength; ++i) {
-                    var swatchElement = document.createElement("span");
-                    swatchElement.className = "swatch";
-                    swatchElement.style.setProperty("background-color", colors[i]);
-                    this.listItemElement.appendChild(swatchElement);
-                    swatch = swatchElement;
+            function processColor(text)
+            {
+                try {
+                    var color = new WebInspector.Color(text);
+                } catch (e) {
+                    return document.createTextNode(text);
                 }
-            }
 
-            // Rotate through Color Representations by Clicking on the Swatch
-            // Simple: rgb -> hsl -> nickname? -> shorthex? -> hex -> ...
-            // Advanced: rgba -> hsla -> nickname? -> ...            
-            if (colors && colors.length === 1) {
-                var color = new WebInspector.Color(htmlValue);
-                swatch.addEventListener("click", changeColorDisplay, false);
-                swatch.addEventListener("dblclick", function(event) {
-                    event.stopPropagation();
-                }, false);
-
-                var mode = color.mode;
-                var valueElement = this.valueElement;
-                function changeColorDisplay(event) {
-
-                    function changeTo(newMode, content) {
-                        mode = newMode;
-                        valueElement.textContent = content;
-                    }
+                var swatchElement = document.createElement("span");
+                swatchElement.title = WebInspector.UIString("Click to change color format");
+                swatchElement.className = "swatch";
+                swatchElement.style.setProperty("background-color", text);
+
+                swatchElement.addEventListener("click", changeColorDisplay, false);
+                swatchElement.addEventListener("dblclick", function(event) { event.stopPropagation() }, false);
+
+                var format;
+                if (Preferences.showColorNicknames && color.nickname)
+                    format = "nickname";
+                else if (Preferences.colorFormat === "rgb")
+                    format = (color.simple ? "rgb" : "rgba");
+                else if (Preferences.colorFormat === "hsl")
+                    format = (color.simple ? "hsl" : "hsla");
+                else if (color.simple)
+                    format = (color.hasShortHex() ? "shorthex" : "hex");
+                else
+                    format = "rgba";
 
-                    switch (mode) {
+                var colorValueElement = document.createElement("span");
+                colorValueElement.textContent = color.toString(format);
+
+                function changeColorDisplay(event)
+                {
+                    switch (format) {
                         case "rgb":
-                            changeTo("hsl", color.toHsl());
+                            format = "hsl";
                             break;
 
                         case "shorthex":
-                            changeTo("hex", color.toHex());
+                            format = "hex";
                             break;
 
                         case "hex":
-                            changeTo("rgb", color.toRgb());
+                            format = "rgb";
                             break;
 
                         case "nickname":
                             if (color.simple) {
                                 if (color.hasShortHex())
-                                    changeTo("shorthex", color.toShortHex());
+                                    format = "shorthex";
                                 else
-                                    changeTo("hex", color.toHex());
-                            } else
-                                changeTo("rgba", color.toRgba());
+                                    format = "hex";
+                                break;
+                            }
+
+                            format = "rgba";
                             break;
 
                         case "hsl":
                             if (color.nickname)
-                                changeTo("nickname", color.toNickname());
+                                format = "nickname";
                             else if (color.hasShortHex())
-                                changeTo("shorthex", color.toShortHex());
+                                format = "shorthex";
                             else
-                                changeTo("hex", color.toHex());
+                                format = "hex";
                             break;
 
                         case "rgba":
-                            changeTo("hsla", color.toHsla());
+                            format = "hsla";
                             break;
 
                         case "hsla":
                             if (color.nickname)
-                                changeTo("nickname", color.toNickname());
+                                format = "nickname";
                             else
-                                changeTo("rgba", color.toRgba());
+                                format = "rgba";
                             break;
                     }
+
+                    colorValueElement.textContent = color.toString(format);
                 }
+
+                var container = document.createDocumentFragment();
+                container.appendChild(swatchElement);
+                container.appendChild(colorValueElement);
+                return container;
             }
+
+            var colorRegex = /((?:rgb|hsl)a?\([^)]+\)|#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}|\b\w+\b)/g;
+            var colorProcessor = processValue.bind(window, colorRegex, processColor, null);
+
+            valueElement.appendChild(processValue(/url\(([^)]+)\)/g, linkifyURL, colorProcessor, value));
+        }
+
+        if (priority) {
+            var priorityElement = document.createElement("span");
+            priorityElement.className = "priority";
+            priorityElement.textContent = priority;
+        }
+
+        this.listItemElement.removeChildren();
+
+        // Append the checkbox for root elements of an editable section.
+        if (this.treeOutline.section && this.treeOutline.section.editable && this.parent.root)
+            this.listItemElement.appendChild(enabledCheckboxElement);
+        this.listItemElement.appendChild(nameElement);
+        this.listItemElement.appendChild(document.createTextNode(": "));
+        this.listItemElement.appendChild(valueElement);
+
+        if (priorityElement) {
+            this.listItemElement.appendChild(document.createTextNode(" "));
+            this.listItemElement.appendChild(priorityElement);
         }
 
-        this.tooltip = this.name + ": " + (valueNicknames[value] || value) + (priority ? " " + priority : "");
+        this.listItemElement.appendChild(document.createTextNode(";"));
+
+        this.tooltip = this.name + ": " + valueElement.textContent + (priority ? " " + priority : "");
     },
 
     updateAll: function(updateAllRules)
@@ -976,7 +1019,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var disabled = !event.target.checked;
 
         var self = this;
-        var callback = function(newPayload) {
+        function callback(newPayload)
+        {
             if (!newPayload)
                 return;
 
@@ -991,8 +1035,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 self.treeOutline.section.pane.dispatchEventToListeners("style property toggled");
 
             self.updateAll(true);
-        };
-        InspectorController.toggleStyleEnabled(this.style._id, this.name, disabled, callback);
+        }
+
+        InjectedScriptAccess.toggleStyleEnabled(this.style.id, this.name, disabled, callback);
     },
 
     updateState: function()
@@ -1155,7 +1200,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         } else {
             // Restore the original CSS text before applying user changes. This is needed to prevent
             // new properties from sticking around if the user adds one, then removes it.
-            InspectorController.setStyleText(this.style, this.originalCSSText);
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
         }
 
         this.applyStyleText(this.listItemElement.textContent);
@@ -1175,7 +1220,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         if (this._newProperty)
             this.treeOutline.removeChild(this);
         else if (this.originalCSSText) {
-            InspectorController.setStyleText(this.style, this.originalCSSText);
+            InjectedScriptAccess.setStyleText(this.style.id, this.originalCSSText);
 
             if (this.treeOutline.section && this.treeOutline.section.pane)
                 this.treeOutline.section.pane.dispatchEventToListeners("style edited");
@@ -1210,7 +1255,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
             moveToNextCallback(this._newProperty, false, this.treeOutline.section, false);
 
         // The Callback to start editing the next property
-        function moveToNextCallback(alreadyNew, valueChanged, section) {
+        function moveToNextCallback(alreadyNew, valueChanged, section)
+        {
             if (!moveDirection)
                 return;
 
@@ -1249,21 +1295,19 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var section = this.treeOutline.section;
         var elementsPanel = WebInspector.panels.elements;
         var styleTextLength = styleText.trimWhitespace().length;
-        if (!styleTextLength) {
-            if (updateInterface) {
+        if (!styleTextLength && updateInterface) {
+            if (this._newProperty) {
                 // The user deleted everything, so remove the tree element and update.
-                if (!this._newProperty)
-                    delete section._afterUpdate;
-                if (section && section.pane)
-                    section.pane.update();
                 this.parent.removeChild(this);
-                elementsPanel.removeStyleChange(section.identifier, this.style, this.name);
+                return;
+            } else {
+                delete section._afterUpdate;
             }
-            return;
         }
 
         var self = this;
-        var callback = function(result) {
+        function callback(result)
+        {
             if (!result) {
                 // The user typed something, but it didn't parse. Just abort and restore
                 // the original title for this property.  If this was a new attribute and
@@ -1281,10 +1325,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
             var changedProperties = result[1];
             elementsPanel.removeStyleChange(section.identifier, self.style, self.name);
 
-            self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
-            for (var i = 0; i < changedProperties.length; ++i)
-                elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
-            self._styleRule.style = self.style;
+            if (!styleTextLength) {
+                // Do remove ourselves from UI when the property removal is confirmed.
+                self.parent.removeChild(self);
+            } else {
+                self.style = WebInspector.CSSStyleDeclaration.parseStyle(newPayload);
+                for (var i = 0; i < changedProperties.length; ++i)
+                    elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
+                self._styleRule.style = self.style;
+            }
+
             if (section && section.pane)
                 section.pane.dispatchEventToListeners("style edited");
 
@@ -1293,8 +1343,9 @@ WebInspector.StylePropertyTreeElement.prototype = {
 
             if (!self.rule)
                 WebInspector.panels.elements.treeOutline.update();
-        };
-        InspectorController.applyStyleText(this.style._id, styleText.trimWhitespace(), this.name, callback);
+        }
+
+        InjectedScriptAccess.applyStyleText(this.style.id, styleText.trimWhitespace(), this.name, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/SummaryBar.js b/WebCore/inspector/front-end/SummaryBar.js
new file mode 100644
index 0000000..bbf2b1a
--- /dev/null
+++ b/WebCore/inspector/front-end/SummaryBar.js
@@ -0,0 +1,364 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Anthony Ricaud <rik@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.SummaryBar = function(categories)
+{
+    this.categories = categories;
+
+    this.element = document.createElement("div");
+    this.element.className = "summary-bar";
+
+    this.graphElement = document.createElement("canvas");
+    this.graphElement.setAttribute("width", "450");
+    this.graphElement.setAttribute("height", "38");
+    this.graphElement.className = "summary-graph";
+    this.element.appendChild(this.graphElement);
+
+    this.legendElement = document.createElement("div");
+    this.legendElement.className = "summary-graph-legend";
+    this.element.appendChild(this.legendElement);
+}
+
+WebInspector.SummaryBar.prototype = {
+
+    get calculator() {
+        return this._calculator;
+    },
+
+    set calculator(x) {
+        this._calculator = x;
+    },
+
+    reset: function()
+    {
+        this.legendElement.removeChildren();
+        this._drawSummaryGraph();
+    },
+
+    update: function(data)
+    {
+        var graphInfo = this.calculator.computeSummaryValues(data);
+
+        var fillSegments = [];
+
+        this.legendElement.removeChildren();
+
+        for (var category in this.categories) {
+            var size = graphInfo.categoryValues[category];
+            if (!size)
+                continue;
+
+            var color = this.categories[category].color;
+            var colorString = "rgb(" + color.r + ", " + color.g + ", " + color.b + ")";
+
+            var fillSegment = {color: colorString, value: size};
+            fillSegments.push(fillSegment);
+
+            var legendLabel = this._makeLegendElement(this.categories[category].title, this.calculator.formatValue(size), colorString);
+            this.legendElement.appendChild(legendLabel);
+        }
+
+        if (graphInfo.total) {
+            var totalLegendLabel = this._makeLegendElement(WebInspector.UIString("Total"), this.calculator.formatValue(graphInfo.total));
+            totalLegendLabel.addStyleClass("total");
+            this.legendElement.appendChild(totalLegendLabel);
+        }
+
+        this._drawSummaryGraph(fillSegments);
+    },
+
+    _drawSwatch: function(canvas, color)
+    {
+        var ctx = canvas.getContext("2d");
+
+        function drawSwatchSquare() {
+            ctx.fillStyle = color;
+            ctx.fillRect(0, 0, 13, 13);
+
+            var gradient = ctx.createLinearGradient(0, 0, 13, 13);
+            gradient.addColorStop(0.0, "rgba(255, 255, 255, 0.2)");
+            gradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            gradient = ctx.createLinearGradient(13, 13, 0, 0);
+            gradient.addColorStop(0.0, "rgba(0, 0, 0, 0.2)");
+            gradient.addColorStop(1.0, "rgba(0, 0, 0, 0.0)");
+
+            ctx.fillStyle = gradient;
+            ctx.fillRect(0, 0, 13, 13);
+
+            ctx.strokeStyle = "rgba(0, 0, 0, 0.6)";
+            ctx.strokeRect(0.5, 0.5, 12, 12);
+        }
+
+        ctx.clearRect(0, 0, 13, 24);
+
+        drawSwatchSquare();
+
+        ctx.save();
+
+        ctx.translate(0, 25);
+        ctx.scale(1, -1);
+
+        drawSwatchSquare();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, 0, 13, 13, 13, 0.5, 0.0);
+    },
+
+    _drawSummaryGraph: function(segments)
+    {
+        if (!segments || !segments.length) {
+            segments = [{color: "white", value: 1}];
+            this._showingEmptySummaryGraph = true;
+        } else
+            delete this._showingEmptySummaryGraph;
+
+        // Calculate the total of all segments.
+        var total = 0;
+        for (var i = 0; i < segments.length; ++i)
+            total += segments[i].value;
+
+        // Calculate the percentage of each segment, rounded to the nearest percent.
+        var percents = segments.map(function(s) { return Math.max(Math.round(100 * s.value / total), 1) });
+
+        // Calculate the total percentage.
+        var percentTotal = 0;
+        for (var i = 0; i < percents.length; ++i)
+            percentTotal += percents[i];
+
+        // Make sure our percentage total is not greater-than 100, it can be greater
+        // if we rounded up for a few segments.
+        while (percentTotal > 100) {
+            for (var i = 0; i < percents.length && percentTotal > 100; ++i) {
+                if (percents[i] > 1) {
+                    --percents[i];
+                    --percentTotal;
+                }
+            }
+        }
+
+        // Make sure our percentage total is not less-than 100, it can be less
+        // if we rounded down for a few segments.
+        while (percentTotal < 100) {
+            for (var i = 0; i < percents.length && percentTotal < 100; ++i) {
+                ++percents[i];
+                ++percentTotal;
+            }
+        }
+
+        var ctx = this.graphElement.getContext("2d");
+
+        var x = 0;
+        var y = 0;
+        var w = 450;
+        var h = 19;
+        var r = (h / 2);
+
+        function drawPillShadow()
+        {
+            // This draws a line with a shadow that is offset away from the line. The line is stroked
+            // twice with different X shadow offsets to give more feathered edges. Later we erase the
+            // line with destination-out 100% transparent black, leaving only the shadow. This only
+            // works if nothing has been drawn into the canvas yet.
+
+            ctx.beginPath();
+            ctx.moveTo(x + 4, y + h - 3 - 0.5);
+            ctx.lineTo(x + w - 4, y + h - 3 - 0.5);
+            ctx.closePath();
+
+            ctx.save();
+
+            ctx.shadowBlur = 2;
+            ctx.shadowColor = "rgba(0, 0, 0, 0.5)";
+            ctx.shadowOffsetX = 3;
+            ctx.shadowOffsetY = 5;
+
+            ctx.strokeStyle = "white";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.shadowOffsetX = -3;
+
+            ctx.stroke();
+
+            ctx.restore();
+
+            ctx.save();
+
+            ctx.globalCompositeOperation = "destination-out";
+            ctx.strokeStyle = "rgba(0, 0, 0, 1)";
+            ctx.lineWidth = 1;
+
+            ctx.stroke();
+
+            ctx.restore();
+        }
+
+        function drawPill()
+        {
+            // Make a rounded rect path.
+            ctx.beginPath();
+            ctx.moveTo(x, y + r);
+            ctx.lineTo(x, y + h - r);
+            ctx.quadraticCurveTo(x, y + h, x + r, y + h);
+            ctx.lineTo(x + w - r, y + h);
+            ctx.quadraticCurveTo(x + w, y + h, x + w, y + h - r);
+            ctx.lineTo(x + w, y + r);
+            ctx.quadraticCurveTo(x + w, y, x + w - r, y);
+            ctx.lineTo(x + r, y);
+            ctx.quadraticCurveTo(x, y, x, y + r);
+            ctx.closePath();
+
+            // Clip to the rounded rect path.
+            ctx.save();
+            ctx.clip();
+
+            // Fill the segments with the associated color.
+            var previousSegmentsWidth = 0;
+            for (var i = 0; i < segments.length; ++i) {
+                var segmentWidth = Math.round(w * percents[i] / 100);
+                ctx.fillStyle = segments[i].color;
+                ctx.fillRect(x + previousSegmentsWidth, y, segmentWidth, h);
+                previousSegmentsWidth += segmentWidth;
+            }
+
+            // Draw the segment divider lines.
+            ctx.lineWidth = 1;
+            for (var i = 1; i < 20; ++i) {
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 0.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 0.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(0, 0, 0, 0.2)";
+                ctx.stroke();
+
+                ctx.beginPath();
+                ctx.moveTo(x + (i * Math.round(w / 20)) + 1.5, y);
+                ctx.lineTo(x + (i * Math.round(w / 20)) + 1.5, y + h);
+                ctx.closePath();
+
+                ctx.strokeStyle = "rgba(255, 255, 255, 0.2)";
+                ctx.stroke();
+            }
+
+            // Draw the pill shading.
+            var lightGradient = ctx.createLinearGradient(x, y, x, y + (h / 1.5));
+            lightGradient.addColorStop(0.0, "rgba(220, 220, 220, 0.6)");
+            lightGradient.addColorStop(0.4, "rgba(220, 220, 220, 0.2)");
+            lightGradient.addColorStop(1.0, "rgba(255, 255, 255, 0.0)");
+
+            var darkGradient = ctx.createLinearGradient(x, y + (h / 3), x, y + h);
+            darkGradient.addColorStop(0.0, "rgba(0, 0, 0, 0.0)");
+            darkGradient.addColorStop(0.8, "rgba(0, 0, 0, 0.2)");
+            darkGradient.addColorStop(1.0, "rgba(0, 0, 0, 0.5)");
+
+            ctx.fillStyle = darkGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.fillStyle = lightGradient;
+            ctx.fillRect(x, y, w, h);
+
+            ctx.restore();
+        }
+
+        ctx.clearRect(x, y, w, (h * 2));
+
+        drawPillShadow();
+        drawPill();
+
+        ctx.save();
+
+        ctx.translate(0, (h * 2) + 1);
+        ctx.scale(1, -1);
+
+        drawPill();
+
+        ctx.restore();
+
+        this._fadeOutRect(ctx, x, y + h + 1, w, h, 0.5, 0.0);
+    },
+
+    _fadeOutRect: function(ctx, x, y, w, h, a1, a2)
+    {
+        ctx.save();
+
+        var gradient = ctx.createLinearGradient(x, y, x, y + h);
+        gradient.addColorStop(0.0, "rgba(0, 0, 0, " + (1.0 - a1) + ")");
+        gradient.addColorStop(0.8, "rgba(0, 0, 0, " + (1.0 - a2) + ")");
+        gradient.addColorStop(1.0, "rgba(0, 0, 0, 1.0)");
+
+        ctx.globalCompositeOperation = "destination-out";
+
+        ctx.fillStyle = gradient;
+        ctx.fillRect(x, y, w, h);
+
+        ctx.restore();
+    },
+
+    _makeLegendElement: function(label, value, color)
+    {
+        var legendElement = document.createElement("label");
+        legendElement.className = "summary-graph-legend-item";
+
+        if (color) {
+            var swatch = document.createElement("canvas");
+            swatch.className = "summary-graph-legend-swatch";
+            swatch.setAttribute("width", "13");
+            swatch.setAttribute("height", "24");
+
+            legendElement.appendChild(swatch);
+
+            this._drawSwatch(swatch, color);
+        }
+
+        var labelElement = document.createElement("div");
+        labelElement.className = "summary-graph-legend-label";
+        legendElement.appendChild(labelElement);
+
+        var headerElement = document.createElement("div");
+        headerElement.className = "summary-graph-legend-header";
+        headerElement.textContent = label;
+        labelElement.appendChild(headerElement);
+
+        var valueElement = document.createElement("div");
+        valueElement.className = "summary-graph-legend-value";
+        valueElement.textContent = value;
+        labelElement.appendChild(valueElement);
+
+        return legendElement;
+    }
+}
+
+WebInspector.SummaryBar.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/WebCore/inspector/front-end/TextPrompt.js b/WebCore/inspector/front-end/TextPrompt.js
index 5ff774f..f73ab0d 100644
--- a/WebCore/inspector/front-end/TextPrompt.js
+++ b/WebCore/inspector/front-end/TextPrompt.js
@@ -252,7 +252,7 @@ WebInspector.TextPrompt.prototype = {
                 foundNextText = true;
             }
 
-            node = node.traverseNextNode(false, this.element);
+            node = node.traverseNextNode(this.element);
         }
 
         return true;
diff --git a/WebCore/inspector/front-end/TimelineAgent.js b/WebCore/inspector/front-end/TimelineAgent.js
new file mode 100644
index 0000000..6d18732
--- /dev/null
+++ b/WebCore/inspector/front-end/TimelineAgent.js
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TimelineAgent = function() {
+    // Not implemented.
+}
+
+// Must be kept in sync with TimelineItem.h
+WebInspector.TimelineAgent.ItemType = {
+    DOMDispatch       : 0,
+    Layout            : 1,
+    RecalculateStyles : 2,
+    Paint             : 3,
+    ParseHTML         : 4
+};
+
+WebInspector.addItemToTimeline = function(record) {
+    // Not implemented.
+}
+
+WebInspector.timelineWasEnabled = function() {
+    // Not implemented.
+}
+
+WebInspector.timelineWasDisabled = function() {
+    // Not implemented.
+}
diff --git a/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
new file mode 100644
index 0000000..96a20ab
--- /dev/null
+++ b/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -0,0 +1,285 @@
+/*
+ * Copyright (C) IBM Corp. 2009  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of IBM Corp. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.WatchExpressionsSidebarPane = function()
+{
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Watch Expressions"));
+
+    this.section = new WebInspector.WatchExpressionsSection();
+
+    this.bodyElement.appendChild(this.section.element);
+
+    var addElement = document.createElement("button");
+    addElement.setAttribute("type", "button");
+    addElement.textContent = WebInspector.UIString("Add");
+    addElement.addEventListener("click", this.section.addExpression.bind(this.section), false);
+
+    var refreshElement = document.createElement("button");
+    refreshElement.setAttribute("type", "button");
+    refreshElement.textContent = WebInspector.UIString("Refresh");
+    refreshElement.addEventListener("click", this.section.update.bind(this.section), false);
+
+    var centerElement = document.createElement("div");
+    centerElement.addStyleClass("watch-expressions-buttons-container");
+    centerElement.appendChild(addElement);
+    centerElement.appendChild(refreshElement);
+    this.bodyElement.appendChild(centerElement);
+
+    this.expanded = this.section.loadSavedExpressions().length > 0;
+    this.onexpand = this.refreshExpressions.bind(this);
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype = {
+    refreshExpressions: function()
+    {
+        this.section.update();
+    }
+}
+
+WebInspector.WatchExpressionsSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
+
+WebInspector.WatchExpressionsSection = function()
+{
+    WebInspector.ObjectPropertiesSection.call(this);
+
+    this.watchExpressions = this.loadSavedExpressions();
+
+    this.headerElement.className = "hidden";
+    this.editable = true;
+    this.expanded = true;
+    this.propertiesElement.addStyleClass("watch-expressions");
+
+    this._watchObjectGroupId = "watch-group";
+}
+
+WebInspector.WatchExpressionsSection.NewWatchExpression = "\xA0";
+
+WebInspector.WatchExpressionsSection.prototype = {
+    update: function()
+    {
+        function appendResult(expression, watchIndex, result, exception)
+        {
+            if (exception) {
+                // Exception results are not wrappers, but text messages.
+                result = WebInspector.ObjectProxy.wrapPrimitiveValue(result);
+            } else if (result.type === "string") {
+                // Evaluation result is intentionally not abbreviated. However, we'd like to distinguish between null and "null"
+                result.description = "\"" + result.description + "\"";
+            }
+
+            var property = new WebInspector.ObjectPropertyProxy(expression, result);
+            property.watchIndex = watchIndex;
+            property.isException = exception;
+
+            // For newly added, empty expressions, set description to "",
+            // since otherwise you get DOMWindow
+            if (property.name === WebInspector.WatchExpressionsSection.NewWatchExpression) 
+                property.value.description = "";
+
+            // To clarify what's going on here: 
+            // In the outer function, we calculate the number of properties
+            // that we're going to be updating, and set that in the
+            // propertyCount variable.  
+            // In this function, we test to see when we are processing the 
+            // last property, and then call the superclass's updateProperties() 
+            // method to get all the properties refreshed at once.
+            properties.push(property);
+            
+            if (properties.length == propertyCount)
+                this.updateProperties(properties, WebInspector.WatchExpressionTreeElement, WebInspector.WatchExpressionsSection.CompareProperties);
+        }
+
+        InspectorController.releaseWrapperObjectGroup(this._watchObjectGroupId)
+        var properties = [];
+
+        // Count the properties, so we known when to call this.updateProperties()
+        // in appendResult()
+        var propertyCount = 0;
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            if (!this.watchExpressions[i]) 
+                continue;
+            ++propertyCount;
+        }
+
+        // Now process all the expressions, since we have the actual count,
+        // which is checked in the appendResult inner function.
+        for (var i = 0; i < this.watchExpressions.length; ++i) {
+            var expression = this.watchExpressions[i];
+            if (!expression)
+                continue;
+
+            WebInspector.console.evalInInspectedWindow("(" + expression + ")", this._watchObjectGroupId, appendResult.bind(this, expression, i));
+        }
+
+        // note this is setting the expansion of the tree, not the section;
+        // with no expressions, and expanded tree, we get some extra vertical
+        // white space
+        // FIXME: should change to use header buttons instead of the buttons
+        // at the bottom of the section, then we can add a "No Watch Expressions
+        // element when there are no watch expressions, and this issue should
+        // go away.
+        this.expanded = (propertyCount != 0);
+    },
+
+    addExpression: function()
+    {
+        this.watchExpressions.push(WebInspector.WatchExpressionsSection.NewWatchExpression);
+        this.update();
+
+        // After update(), the new empty expression to be edited
+        // will be in the tree, but we have to find it.
+        treeElement = this.findAddedTreeElement();
+        if (treeElement)
+            treeElement.startEditing();
+    },
+
+    updateExpression: function(element, value)
+    {
+        this.watchExpressions[element.property.watchIndex] = value;
+        this.saveExpressions();
+        this.update();
+    },
+
+    findAddedTreeElement: function()
+    {
+        var children = this.propertiesTreeOutline.children;
+        for (var i = 0; i < children.length; ++i)
+            if (children[i].property.name === WebInspector.WatchExpressionsSection.NewWatchExpression)
+                return children[i];
+    },
+
+    loadSavedExpressions: function()
+    {
+        var json = InspectorController.setting("watchExpressions");
+        if (!json)
+            return [];
+
+        try {
+            json = JSON.parse(json);
+        } catch(e) {
+            return [];
+        }
+
+        return json.expressions || [];
+    },
+
+    saveExpressions: function()
+    {
+        var toSave = [];
+        for (var i = 0; i < this.watchExpressions.length; i++)
+            if (this.watchExpressions[i])
+                toSave.push(this.watchExpressions[i]);
+
+        var json = JSON.stringify({expressions: toSave});
+        InspectorController.setSetting("watchExpressions", json);
+
+        return toSave.length;
+    }
+}
+
+WebInspector.WatchExpressionsSection.prototype.__proto__ = WebInspector.ObjectPropertiesSection.prototype;
+
+WebInspector.WatchExpressionsSection.CompareProperties = function(propertyA, propertyB) 
+{
+    if (propertyA.watchIndex == propertyB.watchIndex)
+        return 0;
+    else if (propertyA.watchIndex < propertyB.watchIndex)
+        return -1;
+    else
+        return 1;
+}
+
+WebInspector.WatchExpressionTreeElement = function(property)
+{
+    WebInspector.ObjectPropertyTreeElement.call(this, property);
+}
+
+WebInspector.WatchExpressionTreeElement.prototype = {
+    update: function()
+    {
+        WebInspector.ObjectPropertyTreeElement.prototype.update.call(this);
+
+        if (this.property.isException)
+            this.valueElement.addStyleClass("watch-expressions-error-level");
+
+        var deleteButton = document.createElement("input");
+        deleteButton.type = "button";
+        deleteButton.title = WebInspector.UIString("Delete watch expression.");
+        deleteButton.addStyleClass("enabled-button");
+        deleteButton.addStyleClass("delete-button");
+        deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+        this.listItemElement.insertBefore(deleteButton, this.listItemElement.firstChild);
+    },
+
+    _deleteButtonClicked: function()
+    {
+        this.treeOutline.section.updateExpression(this, null);
+    },
+
+    startEditing: function()
+    {
+        if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
+            return;
+
+        this.nameElement.textContent = this.property.name.trimWhitespace();
+
+        var context = { expanded: this.expanded };
+
+        // collapse temporarily, if required
+        this.hasChildren = false;
+
+        this.listItemElement.addStyleClass("editing-sub-part");
+
+        WebInspector.startEditing(this.nameElement, this.editingCommitted.bind(this), this.editingCancelled.bind(this), context);
+    },
+
+    editingCancelled: function(element, context)
+    {
+        if (!this.nameElement.textContent)
+            this.treeOutline.section.updateExpression(this, null);
+            
+        this.update();
+        this.editingEnded(context);
+    },
+
+    applyExpression: function(expression, updateInterface)
+    {
+        expression = expression.trimWhitespace();
+
+        if (!expression)
+            expression = null;
+
+        this.property.name = expression;
+        this.treeOutline.section.updateExpression(this, expression);
+    }
+}
+
+WebInspector.WatchExpressionTreeElement.prototype.__proto__ = WebInspector.ObjectPropertyTreeElement.prototype;
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index c39c95b..c0f282c 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -9,9 +9,9 @@
     <file>ChangesView.js</file>
     <file>Color.js</file>
     <file>ConsoleView.js</file>
+    <file>CookieItemsView.js</file>
     <file>Database.js</file>
     <file>DatabaseQueryView.js</file>
-    <file>DatabasesPanel.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
     <file>DOMAgent.js</file>
@@ -21,9 +21,11 @@
     <file>Drawer.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
+    <file>EventListenersSidebarPane.js</file>
     <file>FontView.js</file>
     <file>ImageView.js</file>
     <file>InjectedScript.js</file>
+    <file>InjectedScriptAccess.js</file>
     <file>inspector.js</file>
     <file>KeyboardShortcut.js</file>
     <file>MetricsSidebarPane.js</file>
@@ -33,6 +35,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>Popup.js</file>
     <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
@@ -50,20 +53,26 @@
     <file>SidebarTreeElement.js</file>
     <file>SourceFrame.js</file>
     <file>SourceView.js</file>
+    <file>StatusBarButton.js</file>
+    <file>StoragePanel.js</file>
     <file>StylesSidebarPane.js</file>
+    <file>SummaryBar.js</file>
     <file>TextPrompt.js</file>
+    <file>TimelineAgent.js</file>
     <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
+    <file>WatchExpressionsSidebarPane.js</file>
     <file>inspector.css</file>
+    <file>inspectorSyntaxHighlight.css</file>
     <file>Images/back.png</file>
     <file>Images/checker.png</file>
     <file>Images/clearConsoleButtonGlyph.png</file>
     <file>Images/closeButtons.png</file>
     <file>Images/consoleButtonGlyph.png</file>
+    <file>Images/cookie.png</file>
     <file>Images/database.png</file>
-    <file>Images/databasesIcon.png</file>
     <file>Images/databaseTable.png</file>
     <file>Images/debuggerContinue.png</file>
     <file>Images/debuggerPause.png</file>
@@ -80,12 +89,12 @@
     <file>Images/disclosureTriangleSmallRightDownWhite.png</file>
     <file>Images/disclosureTriangleSmallRightWhite.png</file>
     <file>Images/dockButtonGlyph.png</file>
-    <file>Images/domStorage.png</file>
     <file>Images/elementsIcon.png</file>
     <file>Images/enableOutlineButtonGlyph.png</file>
     <file>Images/enableSolidButtonGlyph.png</file>
     <file>Images/errorIcon.png</file>
     <file>Images/errorMediumIcon.png</file>
+    <file>Images/errorRedDot.png</file>
     <file>Images/excludeButtonGlyph.png</file>
     <file>Images/focusButtonGlyph.png</file>
     <file>Images/forward.png</file>
@@ -96,11 +105,14 @@
     <file>Images/goArrow.png</file>
     <file>Images/graphLabelCalloutLeft.png</file>
     <file>Images/graphLabelCalloutRight.png</file>
+    <file>Images/grayConnectorPoint.png</file>
     <file>Images/largerResourcesButtonGlyph.png</file>
+    <file>Images/localStorage.png</file>
     <file>Images/nodeSearchButtonGlyph.png</file>
     <file>Images/paneBottomGrow.png</file>
     <file>Images/paneBottomGrowActive.png</file>
     <file>Images/paneGrowHandleLine.png</file>
+    <file>Images/paneSettingsButtons.png</file>
     <file>Images/pauseOnExceptionButtonGlyph.png</file>
     <file>Images/percentButtonGlyph.png</file>
     <file>Images/profileGroupIcon.png</file>
@@ -134,6 +146,7 @@
     <file>Images/segmentHoverEnd.png</file>
     <file>Images/segmentSelected.png</file>
     <file>Images/segmentSelectedEnd.png</file>
+    <file>Images/sessionStorage.png</file>
     <file>Images/splitviewDimple.png</file>
     <file>Images/splitviewDividerBackground.png</file>
     <file>Images/statusbarBackground.png</file>
@@ -143,6 +156,8 @@
     <file>Images/statusbarMenuButtonSelected.png</file>
     <file>Images/statusbarResizerHorizontal.png</file>
     <file>Images/statusbarResizerVertical.png</file>
+    <file>Images/storageIcon.png</file>
+    <file>Images/successGreenDot.png</file>
     <file>Images/timelineHollowPillBlue.png</file>
     <file>Images/timelineHollowPillGray.png</file>
     <file>Images/timelineHollowPillGreen.png</file>
@@ -174,6 +189,8 @@
     <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
+    <file>Images/warningOrangeDot.png</file>
     <file>Images/warningsErrors.png</file>
+    <file>Images/whiteConnectorPoint.png</file>
 </qresource>
 </RCC>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 51d626a..3d7c99a 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -94,6 +94,10 @@ body.attached #toolbar {
     padding-left: 0;
 }
 
+body.attached.platform-qt #toolbar {
+    cursor: auto;
+}
+
 body.attached.inactive #toolbar {
     border-top: 1px solid rgb(64%, 64%, 64%);
 }
@@ -199,15 +203,15 @@ body.attached #search-results-matches {
     background-image: url(Images/scriptsIcon.png);
 }
 
-.toolbar-item.databases .toolbar-icon {
-    background-image: url(Images/databasesIcon.png);
+.toolbar-item.storage .toolbar-icon {
+    background-image: url(Images/storageIcon.png);
 }
 
 .toolbar-item.profiles .toolbar-icon {
     background-image: url(Images/profilesIcon.png);
 }
 
-#close-button {
+#close-button-left, #close-button-right {
     width: 14px;
     height: 14px;
     background-image: url(Images/closeButtons.png);
@@ -217,15 +221,27 @@ body.attached #search-results-matches {
     margin: 5px 0;
 }
 
-#close-button:hover {
+#close-button-left:hover, #close-button-right:hover {
     background-position: 14px 0;
 }
 
-#close-button:active {
+#close-button-left:active, #close-button-right:active {
     background-position: 28px 0;
 }
 
-body.detached .toolbar-item.close {
+body.detached .toolbar-item.close-left, body.detached .toolbar-item.close-right {
+    display: none;
+}
+
+body.attached.platform-qt .toolbar-item.close-left, body.attached.platform-qt .toolbar-item.close-right {
+    display: none;
+}
+
+body.platform-mac-tiger .toolbar-item.close-right, body.platform-mac-leopard .toolbar-item.close-right { 
+    display: none;
+}
+
+body:not(.platform-mac-tiger):not(.platform-mac-leopard) .toolbar-item.close-left { 
     display: none;
 }
 
@@ -372,6 +388,10 @@ body.detached #dock-status-bar-item .glyph {
     -webkit-mask-image: url(Images/dockButtonGlyph.png);
 }
 
+body.platform-qt #dock-status-bar-item {
+    display: none
+}
+
 #console-status-bar-item .glyph {
     -webkit-mask-image: url(Images/consoleButtonGlyph.png);
 }
@@ -543,7 +563,7 @@ body.drawer-visible #drawer {
     padding-left: 6px;
 }
 
-.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before {
+.repeated-message.console-error-level::before, .repeated-message.console-warning-level:before, .repeated-message.console-debug-level:before {
     visibility: hidden;
 }
 
@@ -574,6 +594,14 @@ body.drawer-visible #drawer {
     color: red;
 }
 
+.console-debug-level .console-message-text {
+    color: blue;
+}
+
+.console-debug-level::before {
+    background-image: url(Images/searchSmallBrightBlue.png);
+}
+
 .console-error-level::before {
     background-image: url(Images/errorIcon.png);
 }
@@ -773,6 +801,10 @@ body.drawer-visible #drawer {
     margin-right: 100px;
 }
 
+.resource-view-headers .outline-disclosure .raw-form-data {
+    white-space:pre-wrap;
+}
+
 .resource-view .resource-view-content {
     position: absolute;
     top: 0;
@@ -830,7 +862,7 @@ body.drawer-visible #drawer {
     -webkit-user-select: text;
 }
 
-.resource-view.image img {
+.resource-view.image img.resource-image-view {
     max-width: 100%;
     max-height: 1000px;
     background-image: url(Images/checker.png);
@@ -839,6 +871,14 @@ body.drawer-visible #drawer {
     -webkit-user-drag: auto;
 }
 
+.resource-url {
+    vertical-align: middle;
+}
+
+.resource-status-image {
+    vertical-align: middle;
+}
+
 .resource-view.image .title {
     text-align: center;
     font-size: 13px;
@@ -1190,10 +1230,22 @@ body.inactive .placard.selected {
     margin-top: 1px;
 }
 
-.section:nth-last-of-type(1) {
+.section:nth-last-of-type(1), .event-bar:nth-last-of-type(1) {
     margin-bottom: 1px;
 }
 
+.watch-expressions-buttons-container {
+    text-align: center;
+}
+
+.event-bar:first-child {
+    margin-top: 1px;
+}
+
+.event-bar:nth-last-of-type(1) .header {
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
 .section .header {
     padding: 2px 8px 4px 18px;
     border-top: 1px solid rgb(145, 160, 192);
@@ -1225,7 +1277,7 @@ body.inactive .placard.selected {
     content: url(Images/treeDownTriangleWhite.png);
 }
 
-.section .header .title {
+.section .header .title, .event-bar .header .title {
     color: white;
     font-weight: bold;
     word-wrap: break-word;
@@ -1236,11 +1288,11 @@ body.inactive .placard.selected {
     font-style: italic;
 }
 
-.section .header label {
+.section .header label, .event-bar .header label {
     display: none;
 }
 
-.section.expanded .header label {
+.section.expanded .header label, .event-bar.expanded .header label {
     display: inline;
 }
 
@@ -1253,7 +1305,7 @@ body.inactive .placard.selected {
     vertical-align: 2px;
 }
 
-.section .header .subtitle {
+.section .header .subtitle, .event-bar .header .subtitle {
     float: right;
     font-size: 10px;
     margin-left: 5px;
@@ -1267,7 +1319,7 @@ body.inactive .placard.selected {
     color: inherit;
 }
 
-.section .properties {
+.section .properties, .event-bar .event-properties {
     display: none;
     margin: 0;
     padding: 2px 6px 3px;
@@ -1284,11 +1336,11 @@ body.inactive .placard.selected {
     opacity: 1.0;
 }
 
-.section.expanded .properties {
+.section.expanded .properties, .event-bar.expanded .event-properties {
     display: block;
 }
 
-.section .properties li {
+.section .properties li, .event-properties li {
     margin-left: 12px;
     white-space: nowrap;
     text-overflow: ellipsis;
@@ -1297,22 +1349,22 @@ body.inactive .placard.selected {
     cursor: auto;
 }
 
-.section .properties li.parent {
+.section .properties li.parent, .event-properties li.parent {
     margin-left: 1px;
 }
 
-.section .properties ol {
+.section .properties ol, .event-properties ol {
     display: none;
     margin: 0;
     -webkit-padding-start: 12px;
     list-style: none;
 }
 
-.section .properties ol.expanded {
+.section .properties ol.expanded, .event-properties ol.expanded {
     display: block;
 }
 
-.section .properties li.parent::before {
+.section .properties li.parent::before, .event-properties li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     opacity: 0.75;
     float: left;
@@ -1324,16 +1376,79 @@ body.inactive .placard.selected {
     cursor: default;
 }
 
-.section .properties li.parent.expanded::before {
+.section .properties li.parent.expanded::before, .event-properties li.parent.expanded::before {
     content: url(Images/treeDownTriangleBlack.png);
     margin-top: 1px;
 }
 
-.section .properties li .info {
+.section .properties li .info, .event-properties li .info {
     padding-top: 4px;
     padding-bottom: 3px;
 }
 
+.section .event-bars {
+    display: none;
+}
+
+.section.expanded .event-bars {
+    display: block;
+}
+
+.event-bar {
+    position: relative;
+}
+
+.event-bar-connector {
+    position: absolute;
+    left: 75%;
+    bottom: -7px;
+    margin-left: -7px;
+    content: url(Images/grayConnectorPoint.png);
+    z-index: 3;
+}
+
+.event-bar.expanded .event-bar-connector {
+    content: url(Images/whiteConnectorPoint.png);
+}
+
+.event-bars .event-bar .header {
+    padding: 2px 8px 4px 18px;
+    border-top: 1px solid rgb(163, 163, 163);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(243, 243, 243)), to(rgb(207, 207, 207)));
+    min-height: 18px;
+    white-space: nowrap;
+    -webkit-background-origin: padding;
+    -webkit-background-clip: padding;
+}
+
+.event-bars .event-bar.expanded .header {
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.event-bars .event-bar .header .title {
+    font-weight: bold;
+    color: #333;
+    text-shadow: white 0 1px 0; 
+}
+
+.event-bars .event-bar .header .subtitle {
+    color: rgba(90, 90, 90, 0.742188);
+}
+
+.event-bars .event-bar .header::before {
+    position: absolute;
+    top: 4px;
+    left: 7px;
+    width: 8px;
+    height: 8px;
+    opacity: 0.75;
+    content: url(Images/treeRightTriangleBlack.png);
+}
+
+.event-bars .event-bar.expanded .header::before {
+    content: url(Images/treeDownTriangleBlack.png);
+}
+
 .editing {
     -webkit-user-select: text;
     -webkit-box-shadow: rgba(0, 0, 0, .5) 3px 3px 4px;
@@ -1360,10 +1475,23 @@ body.inactive .placard.selected {
     text-overflow: clip;
 }
 
-li.editing .swatch, li.editing .enabled-button {
+li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-button {
     display: none !important;
 }
 
+.watch-expressions > li.editing-sub-part .name {
+    display: block; 
+    width: 100%;
+}
+
+.watch-expressions > li.editing-sub-part .value, .watch-expressions > li.editing-sub-part .separator  {
+    display: none;
+}
+
+.watch-expressions-error-level {
+    color: red;
+}
+
 .section .properties li.editing-sub-part {
     padding: 3px 6px 8px 18px;
     margin: -3px -6px -8px -6px;
@@ -1397,11 +1525,22 @@ li.editing .swatch, li.editing .enabled-button {
     z-index: 1;
 }
 
+/* FIXME: need a better icon (comment in bug 27514) */
+.section .properties .delete-button {
+    width: 10px;
+    height: 10px;
+    background-image: url(Images/errorIcon.png);
+    background-position: 0 0;
+    background-color: transparent;
+    background-repeat: no-repeat;
+    border: 0 none transparent;
+}
+
 .section:hover .properties .enabled-button {
     display: block;
 }
 
-.section .properties .name {
+.section .properties .name, .event-properties .name {
     color: rgb(136, 19, 145);
 }
 
@@ -1409,7 +1548,7 @@ li.editing .swatch, li.editing .enabled-button {
     color: rgb(100, 100, 100);
 }
 
-.section .properties .number {
+.section .properties .number, .event-properties .number {
     color: blue;
 }
 
@@ -1417,22 +1556,27 @@ li.editing .swatch, li.editing .enabled-button {
     color: rgb(128, 0, 0);
 }
 
-.section .properties .keyword {
+.section .properties .keyword, .event-properties .keyword {
     color: rgb(136, 19, 79);
 }
 
-.section .properties .color {
+.section .properties .color, .event-properties .color {
     color: rgb(118, 15, 21);
 }
 
 .swatch {
     display: inline-block;
     vertical-align: baseline;
-    margin-left: 4px;
+    margin-left: 1px;
+    margin-right: 2px;
     margin-bottom: -1px;
     width: 1em;
     height: 1em;
-    border: 1px solid rgb(180, 180, 180);
+    border: 1px solid rgba(128, 128, 128, 0.6);
+}
+
+.swatch:hover {
+    border: 1px solid rgba(64, 64, 64, 0.8);
 }
 
 .pane:not(.expanded) + .pane, .pane:first-of-type {
@@ -1473,6 +1617,34 @@ li.editing .swatch, li.editing .enabled-button {
     content: url(Images/disclosureTriangleSmallDownBlack.png);
 }
 
+.pane > .title > select {
+    display: none;
+    float: right;
+    width: 23px;
+    height: 17px;
+    color: transparent;
+    background-color: transparent;
+    border: none;
+    background-image: url(Images/paneSettingsButtons.png);
+    background-repeat: no-repeat;
+    margin: 1px 0 0 0;
+    padding: 0;
+    -webkit-border-radius: 0;
+    -webkit-appearance: none;
+}
+
+.pane.expanded:hover > .title > select {
+    display: inline-block;
+}
+
+.pane > .title > select:hover {
+    background-position: -23px 0px;
+}
+
+.pane > .title > select:active {
+    background-position: -46px 0px;
+}
+
 .pane > .body {
     position: relative;
     display: none;
@@ -1622,8 +1794,16 @@ body.inactive .sidebar {
     content: url(Images/databaseTable.png);
 }
 
-.domstorage-sidebar-tree-item .icon {
-    content: url(Images/domStorage.png);
+.domstorage-sidebar-tree-item.local-storage .icon {
+    content: url(Images/localStorage.png);
+}
+
+.domstorage-sidebar-tree-item.session-storage .icon {
+    content: url(Images/sessionStorage.png);
+}
+
+.cookie-sidebar-tree-item .icon {
+    content: url(Images/cookie.png);
 }
 
 #storage-views {
@@ -1785,6 +1965,14 @@ body.inactive .sidebar {
     overflow: hidden;
 }
 
+.data-grid .centered div {
+    text-align: center;
+}
+
+.data-grid .right div {
+    text-align: right;
+}
+
 .data-grid th.sortable div {
     position: relative;
 }
@@ -2091,7 +2279,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/enableSolidButtonGlyph.png);
 }
 
-#scripts-pause-on-exceptions-status-bar-item .glyph {
+.scripts-pause-on-exceptions-status-bar-item .glyph {
     -webkit-mask-image: url(Images/pauseOnExceptionButtonGlyph.png);
 }
 
@@ -2209,7 +2397,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     overflow: auto;
 }
 
-#resources-larger-resources-status-bar-item .glyph {
+.resources-larger-resources-status-bar-item .glyph {
     -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
 }
 
@@ -2221,7 +2409,13 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     overflow: hidden;
 }
 
-#resources-filter li {
+#console-filter {
+    height: 24px;
+    padding: 2px 10px 0;
+    overflow: hidden;
+}
+
+#resources-filter li, #console-filter li {
     display: inline-block;
     margin: 1px 1px 0 0;
     padding: 0 6px 3px;
@@ -2236,7 +2430,17 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     text-shadow: rgba(255, 255, 255, 0.5) 1px 1px 0;
 }
 
-#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active {
+#console-filter div.divider {
+    margin-left: 5px;
+    margin-right: 5px;
+    /* Only want a border-left here because border on both sides
+    made the divider too thick */
+    border-left: 1px solid gray;
+    display: inline;
+}
+
+#resources-filter li.selected, #resources-filter li:hover, #resources-filter li:active,
+#console-filter li.selected, #console-filter li:hover, #console-filter li:active {
     color: white;
     text-shadow: rgb(80, 80, 80) 1px 1px 1px;
     background: rgba(20, 20, 20, 0.4);
@@ -2244,13 +2448,15 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-box-shadow: 0 1px 0px rgba(255, 255, 255, 0.5);
 }
 
-#resources-filter li:hover {
+#resources-filter li:hover,
+#console-filter li:hover {
     background: rgba(20, 20, 20, 0.4);
     border-color: transparent;
     -webkit-box-shadow: none;
 }
 
-#resources-filter li:active {
+#resources-filter li:active,
+#console-filter li:active {
     background: rgba(20, 20, 20, 0.6);
 }
 
@@ -2316,36 +2522,36 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     -webkit-background-clip: padding;
 }
 
-#resources-graph-legend {
+.summary-graph-legend {
     margin-top: -10px;
     padding-left: 15px;
 }
 
-.resources-graph-legend-item {
+.summary-graph-legend-item {
     display: inline-block;
     font-weight: bold;
     margin-right: 15px;
     vertical-align: top;
 }
 
-.resources-graph-legend-item.total {
+.summary-graph-legend-item.total {
     margin-left: 10px;
 }
 
-.resources-graph-legend-label {
+.summary-graph-legend-label {
     display: inline-block;
     text-align: left;
 }
 
-.resources-graph-legend-header {
+.summary-graph-legend-header {
     font-size: 12px;
 }
 
-.resources-graph-legend-value {
+.summary-graph-legend-value {
     font-size: 10px;
 }
 
-.resources-graph-legend-swatch {
+.summary-graph-legend-swatch {
     vertical-align: top;
     margin-top: 1px;
     margin-right: 3px;
@@ -2380,6 +2586,24 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     background-color: rgba(0, 0, 0, 0.1);
 }
 
+.resources-onload-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(255, 0, 0, 0.5);
+}
+
+.resources-ondomcontent-divider {
+    position: absolute;
+    width: 2px;
+    top: 0;
+    bottom: 0;
+    z-index: 300;
+    background-color: rgba(0, 0, 255, 0.5);
+}
+
 .resources-divider.last {
     background-color: transparent;
 }
@@ -2477,6 +2701,16 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     display: list-item;
 }
 
+.console-warning-level, .console-error-level, .console-log-level {
+    display: none;
+}
+
+.filter-all .console-warning-level, .filter-warnings .console-warning-level,
+.filter-all .console-error-level, .filter-errors .console-error-level,
+.filter-all .console-log-level, .filter-logs .console-log-level {
+    display: block;
+}
+
 .resources-graph-bar.waiting {
     opacity: 0.35;
 }
@@ -2970,6 +3204,10 @@ body.inactive .sidebar-tree-item.selected {
     content: url(Images/resourceDocumentIconSmall.png);
 }
 
+.bubble.debug, .console-debug-level .bubble {
+    background-color: rgb(0, 0, 255) !important;
+}
+
 .bubble.warning, .console-warning-level .bubble {
     background-color: rgb(232, 164, 0) !important;
 }
@@ -3093,16 +3331,21 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 button.enable-toggle-status-bar-item .glyph {
 }
 
-#record-profile-status-bar-item .glyph {
+.record-profile-status-bar-item .glyph {
     -webkit-mask-image: url(Images/recordButtonGlyph.png);
 }
 
-#record-profile-status-bar-item.toggled-on .glyph {
+.record-profile-status-bar-item.toggled-on .glyph {
     -webkit-mask-image: url(Images/recordToggledButtonGlyph.png);
-    background-color: rgb(216, 0, 0);
+    background-color: rgb(216, 0, 0) !important;
 }
 
-#node-search-status-bar-item .glyph {
+/* FIXME: should have its own glyph. */
+.heap-snapshot-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/focusButtonGlyph.png);
+}
+
+.node-search-status-bar-item .glyph {
     -webkit-mask-image: url(Images/nodeSearchButtonGlyph.png);
 }
 
@@ -3136,12 +3379,8 @@ button.enable-toggle-status-bar-item .glyph {
     margin-left: -1px;
 }
 
-.refresh-storage-status-bar-item {
-    background-image: url(Images/reloadButtons.png) !important;
-}
-
-.refresh-storage-status-bar-item:active {
-    background-position: 32px 0;
+.refresh-storage-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/reloadButtonGlyph.png);
 }
 
 #storage-view-status-bar-items {
@@ -3191,3 +3430,7 @@ ol.breakpoint-list {
 .breakpoint-list a:hover {
     color: rgb(15%, 15%, 15%);
 }
+
+.webkit-html-js-node, .webkit-html-css-node {
+    white-space: pre;
+}
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index a3dc407..db9bfd7 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -6,13 +6,13 @@ modification, are permitted provided that the following conditions
 are met:
 
 1.  Redistributions of source code must retain the above copyright
-    notice, this list of conditions and the following disclaimer. 
+    notice, this list of conditions and the following disclaimer.
 2.  Redistributions in binary form must reproduce the above copyright
     notice, this list of conditions and the following disclaimer in the
-    documentation and/or other materials provided with the distribution. 
+    documentation and/or other materials provided with the distribution.
 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     its contributors may be used to endorse or promote products derived
-    from this software without specific prior written permission. 
+    from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
 EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -30,12 +30,14 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 <head>
     <meta http-equiv="content-type" content="text/html; charset=utf-8">
     <link rel="stylesheet" type="text/css" href="inspector.css">
+    <link rel="stylesheet" type="text/css" href="inspectorSyntaxHighlight.css">
     <script type="text/javascript" src="utilities.js"></script>
     <script type="text/javascript" src="treeoutline.js"></script>
     <script type="text/javascript" src="inspector.js"></script>
     <script type="text/javascript" src="Object.js"></script>
     <script type="text/javascript" src="KeyboardShortcut.js"></script>
     <script type="text/javascript" src="TextPrompt.js"></script>
+    <script type="text/javascript" src="Popup.js"></script>
     <script type="text/javascript" src="Placard.js"></script>
     <script type="text/javascript" src="View.js"></script>
     <script type="text/javascript" src="Callback.js"></script>
@@ -49,6 +51,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
     <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
+    <script type="text/javascript" src="CookieItemsView.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
@@ -60,16 +63,20 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="BreakpointsSidebarPane.js"></script>
     <script type="text/javascript" src="CallStackSidebarPane.js"></script>
     <script type="text/javascript" src="ScopeChainSidebarPane.js"></script>
+    <script type="text/javascript" src="WatchExpressionsSidebarPane.js"></script>
     <script type="text/javascript" src="MetricsSidebarPane.js"></script>
     <script type="text/javascript" src="PropertiesSidebarPane.js"></script>
+    <script type="text/javascript" src="EventListenersSidebarPane.js"></script>
     <script type="text/javascript" src="Color.js"></script>
     <script type="text/javascript" src="StylesSidebarPane.js"></script>
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="PanelEnablerView.js"></script>
+    <script type="text/javascript" src="StatusBarButton.js"></script>
+    <script type="text/javascript" src="SummaryBar.js"></script>
     <script type="text/javascript" src="ElementsPanel.js"></script>
     <script type="text/javascript" src="ResourcesPanel.js"></script>
     <script type="text/javascript" src="ScriptsPanel.js"></script>
-    <script type="text/javascript" src="DatabasesPanel.js"></script>
+    <script type="text/javascript" src="StoragePanel.js"></script>
     <script type="text/javascript" src="ProfilesPanel.js"></script>
     <script type="text/javascript" src="ResourceView.js"></script>
     <script type="text/javascript" src="SourceFrame.js"></script>
@@ -85,13 +92,16 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ProfileView.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
     <script type="text/javascript" src="InjectedScript.js"></script>
+    <script type="text/javascript" src="InjectedScriptAccess.js"></script>
+    <script type="text/javascript" src="TimelineAgent.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
-        <div class="toolbar-item close"><button id="close-button"></button></div>
+        <div class="toolbar-item close-left"><button id="close-button-left"></button></div>
         <div class="toolbar-item flexable-space"></div>
         <div class="toolbar-item hidden" id="search-results-matches"></div>
         <div class="toolbar-item"><input id="search" type="search" incremental results="0"><div id="search-toolbar-label" class="toolbar-label"></div></div>
+        <div class="toolbar-item close-right"><button id="close-button-right"></button></div>
     </div>
     <div id="main">
         <div id="main-panels" tabindex="0" spellcheck="false"></div>
@@ -99,7 +109,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     </div>
     <div id="drawer">
         <div id="console-view"><div id="console-messages"><div id="console-prompt" spellcheck="false"><br></div></div></div>
-        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button></div></div>
+        <div id="drawer-status-bar" class="status-bar"><div id="other-drawer-status-bar-items"><button id="clear-console-status-bar-item" class="status-bar-item"><div class="glyph"></div><div class="glyph shadow"></div></button><div id="console-filter" class="status-bar-item"></div></div></div>
     </div>
 </body>
 </html>
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index aa21a86..f090d3a 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -8,13 +8,13 @@
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
+ *     documentation and/or other materials provided with the distribution.
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -29,7 +29,6 @@
  */
 
 var Preferences = {
-    ignoreWhitespace: true,
     showUserAgentStyles: true,
     maxInlineTextChildLength: 80,
     minConsoleHeight: 75,
@@ -39,7 +38,12 @@ var Preferences = {
     showInheritedComputedStyleProperties: false,
     styleRulesExpandedState: {},
     showMissingLocalizedStrings: false,
-    useDOMAgent: false
+    heapProfilerPresent: false,
+    samplingCPUProfiler: false,
+    showColorNicknames: true,
+    colorFormat: "hex",
+    eventListenersFilter: "all",
+    resourcesLargeRows: true
 }
 
 var WebInspector = {
@@ -70,7 +74,7 @@ var WebInspector = {
             // there isn't already a caret selection inside.
             var selection = window.getSelection();
             if (selection.isCollapsed && !this._currentFocusElement.isInsertionCaretInside()) {
-                var selectionRange = document.createRange();
+                var selectionRange = this._currentFocusElement.ownerDocument.createRange();
                 selectionRange.setStart(this._currentFocusElement, 0);
                 selectionRange.setEnd(this._currentFocusElement, 0);
 
@@ -119,13 +123,13 @@ var WebInspector = {
                 }
             }
         }
-        
+
         for (var panelName in WebInspector.panels) {
             if (WebInspector.panels[panelName] == x)
                 InspectorController.storeLastActivePanel(panelName);
         }
     },
-  
+
     _createPanels: function()
     {
         var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
@@ -137,8 +141,23 @@ var WebInspector = {
             this.panels.scripts = new WebInspector.ScriptsPanel();
         if (hiddenPanels.indexOf("profiles") === -1)
             this.panels.profiles = new WebInspector.ProfilesPanel();
-        if (hiddenPanels.indexOf("databases") === -1)
-            this.panels.databases = new WebInspector.DatabasesPanel();      
+        if (hiddenPanels.indexOf("storage") === -1 && hiddenPanels.indexOf("databases") === -1)
+            this.panels.storage = new WebInspector.StoragePanel();      
+    },
+
+    _loadPreferences: function()
+    {
+        var colorFormat = InspectorController.setting("color-format");
+        if (colorFormat)
+            Preferences.colorFormat = colorFormat;
+
+        var eventListenersFilter = InspectorController.setting("event-listeners-filter");
+        if (eventListenersFilter)
+            Preferences.eventListenersFilter = eventListenersFilter;
+
+        var resourcesLargeRows = InspectorController.setting("resources-large-rows");
+        if (typeof resourcesLargeRows !== "undefined")
+            Preferences.resourcesLargeRows = resourcesLargeRows;
     },
 
     get attached()
@@ -307,7 +326,7 @@ var WebInspector = {
 
     set hoveredDOMNode(x)
     {
-        if (objectsAreSame(this._hoveredDOMNode, x))
+        if (this._hoveredDOMNode === x)
             return;
 
         this._hoveredDOMNode = x;
@@ -333,7 +352,7 @@ var WebInspector = {
         }
 
         if (this._hoveredDOMNode) {
-            InspectorController.highlightDOMNode(this._hoveredDOMNode);
+            InspectorController.highlightDOMNode(this._hoveredDOMNode.id);
             this.showingDOMNodeHighlight = true;
         } else {
             InspectorController.hideDOMNodeHighlight();
@@ -347,15 +366,15 @@ WebInspector.loaded = function()
     var platform = InspectorController.platform();
     document.body.addStyleClass("platform-" + platform);
 
+    this._loadPreferences();
+
     this.drawer = new WebInspector.Drawer();
     this.console = new WebInspector.ConsoleView(this.drawer);
     // TODO: Uncomment when enabling the Changes Panel
     // this.changes = new WebInspector.ChangesView(this.drawer);
     // TODO: Remove class="hidden" from inspector.html on button#changes-status-bar-item
     this.drawer.visibleView = this.console;
-
-    if (Preferences.useDOMAgent)
-        this.domAgent = new WebInspector.DOMAgent();
+    this.domAgent = new WebInspector.DOMAgent();
 
     this.resourceCategories = {
         documents: new WebInspector.ResourceCategory(WebInspector.UIString("Documents"), "documents"),
@@ -404,6 +423,7 @@ WebInspector.loaded = function()
     document.addEventListener("keyup", this.documentKeyUp.bind(this), true);
     document.addEventListener("beforecopy", this.documentCanCopy.bind(this), true);
     document.addEventListener("copy", this.documentCopy.bind(this), true);
+    document.addEventListener("contextmenu", this.contextMenu.bind(this), true);
 
     var mainPanelsElement = document.getElementById("main-panels");
     mainPanelsElement.handleKeyEvent = this.mainKeyDown.bind(this);
@@ -438,10 +458,11 @@ WebInspector.loaded = function()
     searchField.addEventListener("keyup", this.searchKeyUp.bind(this), false);
     searchField.addEventListener("search", this.performSearch.bind(this), false); // when the search is emptied
 
-    document.getElementById("toolbar").addEventListener("mousedown", this.toolbarDragStart, true);
-    document.getElementById("close-button").addEventListener("click", this.close, true);
+    toolbarElement.addEventListener("mousedown", this.toolbarDragStart, true);
+    document.getElementById("close-button-left").addEventListener("click", this.close, true);
+    document.getElementById("close-button-right").addEventListener("click", this.close, true);
 
-    InspectorController.loaded(Preferences.useDOMAgent);
+    InspectorController.loaded();
 }
 
 var windowLoaded = function()
@@ -658,6 +679,12 @@ WebInspector.documentCopy = function(event)
         WebInspector[this.currentFocusElement.id + "Copy"](event);
 }
 
+WebInspector.contextMenu = function(event)
+{
+    if (event.handled || event.target.hasStyleClass("popup-glasspane"))
+        event.preventDefault();
+}
+
 WebInspector.mainKeyDown = function(event)
 {
     if (this.currentPanel && this.currentPanel.handleKeyEvent)
@@ -772,7 +799,7 @@ WebInspector.toggleAttach = function()
 
 WebInspector.toolbarDragStart = function(event)
 {
-    if (!WebInspector.attached && InspectorController.platform() !== "mac-leopard")
+    if ((!WebInspector.attached && InspectorController.platform() !== "mac-leopard") || InspectorController.platform() == "qt")
         return;
 
     var target = event.target;
@@ -822,7 +849,7 @@ WebInspector.toolbarDrag = function(event)
     event.preventDefault();
 }
 
-WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor) 
+WebInspector.elementDragStart = function(element, dividerDrag, elementDragEnd, event, cursor)
 {
     if (this._elementDraggingEventListener || this._elementEndDraggingEventListener)
         this.elementDragEnd(event);
@@ -853,12 +880,12 @@ WebInspector.elementDragEnd = function(event)
 
 WebInspector.showConsole = function()
 {
-    this.drawer.visibleView = this.console;
+    this.drawer.showView(this.console);
 }
 
 WebInspector.showChanges = function()
 {
-    this.drawer.visibleView = this.changes;
+    this.drawer.showView(this.changes);
 }
 
 WebInspector.showElementsPanel = function()
@@ -881,9 +908,9 @@ WebInspector.showProfilesPanel = function()
     this.currentPanel = this.panels.profiles;
 }
 
-WebInspector.showDatabasesPanel = function()
+WebInspector.showStoragePanel = function()
 {
-    this.currentPanel = this.panels.databases;
+    this.currentPanel = this.panels.storage;
 }
 
 WebInspector.addResource = function(identifier, payload)
@@ -896,19 +923,36 @@ WebInspector.addResource = function(identifier, payload)
         payload.lastPathComponent,
         identifier,
         payload.isMainResource,
-        payload.cached);
+        payload.cached,
+        payload.requestMethod,
+        payload.requestFormData);
     this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
-    if (resource.mainResource) {
+    if (resource.mainResource)
         this.mainResource = resource;
-        this.panels.elements.reset();
-    }
 
     if (this.panels.resources)
         this.panels.resources.addResource(resource);
 }
 
+WebInspector.clearConsoleMessages = function()
+{
+    WebInspector.console.clearMessages(false);
+}
+
+WebInspector.selectDatabase = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDatabase(o);
+}
+
+WebInspector.selectDOMStorage = function(o)
+{
+    WebInspector.showStoragePanel();
+    WebInspector.panels.storage.selectDOMStorage(o);
+}
+
 WebInspector.updateResource = function(identifier, payload)
 {
     var resource = this.resources[identifier];
@@ -922,6 +966,8 @@ WebInspector.updateResource = function(identifier, payload)
         resource.lastPathComponent = payload.lastPathComponent;
         resource.requestHeaders = payload.requestHeaders;
         resource.mainResource = payload.mainResource;
+        resource.requestMethod = payload.requestMethod;
+        resource.requestFormData = payload.requestFormData;
     }
 
     if (payload.didResponseChange) {
@@ -936,7 +982,7 @@ WebInspector.updateResource = function(identifier, payload)
     if (payload.didTypeChange) {
         resource.type = payload.type;
     }
-    
+
     if (payload.didLengthChange) {
         resource.contentLength = payload.contentLength;
     }
@@ -953,6 +999,21 @@ WebInspector.updateResource = function(identifier, payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
+        
+        if (payload.loadEventTime) {
+            // This loadEventTime is for the main resource, and we want to show it
+            // for all resources on this page. This means we want to set it as a member
+            // of the resources panel instead of the individual resource.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
+        }
+        
+        if (payload.domContentEventTime) {
+            // This domContentEventTime is for the main resource, so it should go in
+            // the resources panel for the same reasons as above.
+            if (this.panels.resources)
+                this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
+        }
     }
 }
 
@@ -973,20 +1034,30 @@ WebInspector.removeResource = function(identifier)
 WebInspector.addDatabase = function(payload)
 {
     var database = new WebInspector.Database(
-        payload.database,
+        payload.id,
         payload.domain,
         payload.name,
         payload.version);
-    this.panels.databases.addDatabase(database);
+    this.panels.storage.addDatabase(database);
+}
+
+WebInspector.addCookieDomain = function(domain)
+{
+    this.panels.storage.addCookieDomain(domain);
 }
 
 WebInspector.addDOMStorage = function(payload)
 {
     var domStorage = new WebInspector.DOMStorage(
-        payload.domStorage,
+        payload.id,
         payload.host,
         payload.isLocalStorage);
-    this.panels.databases.addDOMStorage(domStorage);
+    this.panels.storage.addDOMStorage(domStorage);
+}
+
+WebInspector.updateDOMStorage = function(storageId)
+{
+    this.panels.storage.updateDOMStorage(storageId);
 }
 
 WebInspector.resourceTrackingWasEnabled = function()
@@ -1034,9 +1105,9 @@ WebInspector.failedToParseScriptSource = function(sourceURL, source, startingLin
     this.panels.scripts.addScript(null, sourceURL, source, startingLine, errorLine, errorMessage);
 }
 
-WebInspector.pausedScript = function()
+WebInspector.pausedScript = function(callFrames)
 {
-    this.panels.scripts.debuggerPaused();
+    this.panels.scripts.debuggerPaused(callFrames);
 }
 
 WebInspector.resumedScript = function()
@@ -1073,17 +1144,18 @@ WebInspector.reset = function()
     this.console.clearMessages();
 }
 
-WebInspector.inspectedWindowCleared = function(inspectedWindow)
-{
-    this.panels.elements.inspectedWindowCleared(inspectedWindow);
-}
-
 WebInspector.resourceURLChanged = function(resource, oldURL)
 {
     delete this.resourceURLMap[oldURL];
     this.resourceURLMap[resource.url] = resource;
 }
 
+WebInspector.didCommitLoad = function()
+{
+    // Cleanup elements panel early on inspected page refresh.
+    WebInspector.setDocument(null);
+}
+
 WebInspector.addMessageToConsole = function(payload)
 {
     var consoleMessage = new WebInspector.ConsoleMessage(
@@ -1098,6 +1170,90 @@ WebInspector.addMessageToConsole = function(payload)
     this.console.addMessage(consoleMessage);
 }
 
+WebInspector.log = function(message)
+{
+    // remember 'this' for setInterval() callback
+    var self = this;
+    
+    // return indication if we can actually log a message
+    function isLogAvailable()
+    {
+        return WebInspector.ConsoleMessage && WebInspector.ObjectProxy && self.console;
+    }
+    
+    // flush the queue of pending messages
+    function flushQueue()
+    {
+        var queued = WebInspector.log.queued;
+        if (!queued) 
+            return;
+            
+        for (var i = 0; i < queued.length; ++i)
+            logMessage(queued[i]);
+        
+        delete WebInspector.log.queued;
+    }
+
+    // flush the queue if it console is available
+    // - this function is run on an interval
+    function flushQueueIfAvailable()
+    {
+        if (!isLogAvailable())
+            return;
+            
+        clearInterval(WebInspector.log.interval);
+        delete WebInspector.log.interval;
+        
+        flushQueue();
+    }
+    
+    // actually log the message
+    function logMessage(message)
+    {
+        var repeatCount = 1;
+        if (message == WebInspector.log.lastMessage)
+            repeatCount = WebInspector.log.repeatCount + 1;
+    
+        WebInspector.log.lastMessage = message;
+        WebInspector.log.repeatCount = repeatCount;
+        
+        // ConsoleMessage expects a proxy object
+        message = new WebInspector.ObjectProxy(null, [], 0, message, false);
+        
+        // post the message
+        var msg = new WebInspector.ConsoleMessage(
+            WebInspector.ConsoleMessage.MessageSource.Other,
+            WebInspector.ConsoleMessage.MessageType.Log,
+            WebInspector.ConsoleMessage.MessageLevel.Debug,
+            -1,
+            null,
+            null,
+            repeatCount,
+            message);
+    
+        self.console.addMessage(msg);
+    }
+    
+    // if we can't log the message, queue it
+    if (!isLogAvailable()) {
+        if (!WebInspector.log.queued)
+            WebInspector.log.queued = [];
+            
+        WebInspector.log.queued.push(message);
+        
+        if (!WebInspector.log.interval)
+            WebInspector.log.interval = setInterval(flushQueueIfAvailable, 1000);
+        
+        return;
+    }
+
+    // flush the pending queue if any
+    flushQueue();
+
+    // log the message
+    logMessage(message);
+}
+
 WebInspector.addProfile = function(profile)
 {
     this.panels.profiles.addProfile(profile);
@@ -1117,7 +1273,7 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
     var r = 7;
 
     g.beginPath();
-    g.arc(cx, cy, r, 0, Math.PI * 2, false); 
+    g.arc(cx, cy, r, 0, Math.PI * 2, false);
     g.closePath();
 
     g.lineWidth = 1;
@@ -1131,15 +1287,16 @@ WebInspector.drawLoadingPieChart = function(canvas, percent) {
 
     g.beginPath();
     g.moveTo(cx, cy);
-    g.arc(cx, cy, r, startangle, endangle, false); 
+    g.arc(cx, cy, r, startangle, endangle, false);
     g.closePath();
 
     g.fillStyle = darkColor;
     g.fill();
 }
 
-WebInspector.updateFocusedNode = function(node)
+WebInspector.updateFocusedNode = function(nodeId)
 {
+    var node = WebInspector.domAgent.nodeForId(nodeId);
     if (!node)
         // FIXME: Should we deselect if null is passed in?
         return;
@@ -1247,7 +1404,7 @@ WebInspector.linkifyURLAsNode = function(url, linkText, classes, isExternal)
     a.title = url;
     a.target = "_blank";
     a.textContent = linkText;
-    
+
     return a;
 }
 
@@ -1329,6 +1486,11 @@ WebInspector.performSearch = function(event)
     this.currentPanel.performSearch(query);
 }
 
+WebInspector.addNodesToSearchResult = function(nodeIds)
+{
+    WebInspector.panels.elements.addNodesToSearchResult(nodeIds);
+}
+
 WebInspector.updateSearchMatchesCount = function(matches, panel)
 {
     if (!panel)
@@ -1385,7 +1547,7 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         return;
     element.__editing = true;
 
-    var oldText = element.textContent;
+    var oldText = getContent(element);
     var oldHandleKeyEvent = element.handleKeyEvent;
     var moveDirection = "";
 
@@ -1399,6 +1561,13 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
         editingCommitted.call(element);
     }
 
+    function getContent(element) {
+        if (element.tagName === "INPUT" && element.type === "text")
+            return element.value;
+        else
+            return element.textContent;
+    }
+
     function cleanUpAfterEditing() {
         delete this.__editing;
 
@@ -1415,17 +1584,22 @@ WebInspector.startEditing = function(element, committedCallback, cancelledCallba
     }
 
     function editingCancelled() {
-        this.innerText = oldText;
+        if (this.tagName === "INPUT" && this.type === "text")
+            this.value = oldText;
+        else
+            this.textContent = oldText;
 
         cleanUpAfterEditing.call(this);
 
-        cancelledCallback(this, context);
+        if (cancelledCallback)
+            cancelledCallback(this, context);
     }
 
     function editingCommitted() {
         cleanUpAfterEditing.call(this);
 
-        committedCallback(this, this.textContent, oldText, context, moveDirection);
+        if (committedCallback)
+            committedCallback(this, getContent(this), oldText, context, moveDirection);
     }
 
     element.handleKeyEvent = function(event) {
@@ -1456,6 +1630,11 @@ WebInspector._toolbarItemClicked = function(event)
     this.currentPanel = toolbarItem.panel;
 }
 
+WebInspector.evaluateForTestInFrontend = function(callId, script)
+{
+    InspectorController.didEvaluateForTestInFrontend(callId, JSON.stringify(window.eval(script)));
+}
+
 // This table maps MIME types to the Resource.Types which are valid for them.
 // The following line:
 //    "text/html":                {0: 1},
diff --git a/WebCore/loader/UserStyleSheetLoader.cpp b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
index 3afbc15..2cbb3c5 100644
--- a/WebCore/loader/UserStyleSheetLoader.cpp
+++ b/WebCore/inspector/front-end/inspectorSyntaxHighlight.css
@@ -1,18 +1,18 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
+ *     documentation and/or other materials provided with the distribution. 
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     from this software without specific prior written permission. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -26,37 +26,46 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "UserStyleSheetLoader.h"
+.webkit-css-comment { 
+    color: rgb(0, 116, 0);
+}
+
+.webkit-css-string, .webkit-css-keyword, .webkit-css-unit {
+    color: rgb(7, 144, 154);
+}
 
-#include "CachedCSSStyleSheet.h"
-#include "DocLoader.h"
-#include "Frame.h"
+.webkit-css-number {
+    color: rgb(50, 0, 255);
+}
 
-using namespace WebCore;
+.webkit-css-property, .webkit-css-at-rule {
+    color: rgb(200, 0, 0);
+}
+
+.webkit-css-url {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-selector {
+    color: rgb(0, 0, 0);
+}
+
+.webkit-css-pseudo-class {
+    color: rgb(128, 128, 128);
+}
+
+.webkit-javascript-comment {
+    color: rgb(0, 116, 0);
+}
 
-UserStyleSheetLoader::UserStyleSheetLoader(PassRefPtr<Document> document, const String& url)
-    : m_document(document)
-    , m_cachedSheet(m_document->docLoader()->requestUserCSSStyleSheet(url, ""))
-{
-    if (m_cachedSheet) {
-        m_document->addPendingSheet();
-        m_cachedSheet->addClient(this);
-    }
+.webkit-javascript-keyword {
+    color: rgb(170, 13, 145);
 }
 
-UserStyleSheetLoader::~UserStyleSheetLoader()
-{
-    if (m_cachedSheet) {
-        if (!m_cachedSheet->isLoaded())
-            m_document->removePendingSheet();
-        m_cachedSheet->removeClient(this);
-    }
+.webkit-javascript-number {
+    color: rgb(28, 0, 207);
 }
 
-void UserStyleSheetLoader::setCSSStyleSheet(const String& /*URL*/, const String& /*charset*/, const CachedCSSStyleSheet* sheet)
-{
-    m_document->removePendingSheet();
-    if (Frame* frame = m_document->frame())
-        frame->setUserStyleSheet(sheet->sheetText());
+.webkit-javascript-string, .webkit-javascript-regexp {
+    color: rgb(196, 26, 22);
 }
diff --git a/WebCore/inspector/front-end/treeoutline.js b/WebCore/inspector/front-end/treeoutline.js
index 579e7fb..ecc322b 100644
--- a/WebCore/inspector/front-end/treeoutline.js
+++ b/WebCore/inspector/front-end/treeoutline.js
@@ -249,35 +249,40 @@ TreeOutline.prototype._forgetChildrenRecursive = function(parentElement)
     }
 }
 
-TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent, equal)
+TreeOutline.prototype.getCachedTreeElement = function(representedObject)
 {
     if (!representedObject)
         return null;
 
-    if (!equal)
-        equal = function(a, b) { return a === b };
-
     if ("__treeElementIdentifier" in representedObject) {
         // If this representedObject has a tree element identifier, and it is a known TreeElement
         // in our tree we can just return that tree element.
         var elements = this._knownTreeElements[representedObject.__treeElementIdentifier];
         if (elements) {
             for (var i = 0; i < elements.length; ++i)
-                if (equal(elements[i].representedObject, representedObject))
+                if (elements[i].representedObject === representedObject)
                     return elements[i];
         }
     }
+    return null;
+}
 
-    if (!isAncestor || !(isAncestor instanceof Function) || !getParent || !(getParent instanceof Function))
+TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor, getParent)
+{
+    if (!representedObject)
         return null;
 
+    var cachedElement = this.getCachedTreeElement(representedObject);
+    if (cachedElement)
+        return cachedElement;
+
     // The representedObject isn't know, so we start at the top of the tree and work down to find the first
     // tree element that represents representedObject or one of its ancestors.
     var item;
     var found = false;
     for (var i = 0; i < this.children.length; ++i) {
         item = this.children[i];
-        if (equal(item.representedObject, representedObject) || isAncestor(item.representedObject, representedObject)) {
+        if (item.representedObject === representedObject || isAncestor(item.representedObject, representedObject)) {
             found = true;
             break;
         }
@@ -292,7 +297,7 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     var currentObject = representedObject;
     while (currentObject) {
         ancestors.unshift(currentObject);
-        if (equal(currentObject, item.representedObject))
+        if (currentObject === item.representedObject)
             break;
         currentObject = getParent(currentObject);
     }
@@ -301,18 +306,16 @@ TreeOutline.prototype.findTreeElement = function(representedObject, isAncestor,
     for (var i = 0; i < ancestors.length; ++i) {
         // Make sure we don't call findTreeElement with the same representedObject
         // again, to prevent infinite recursion.
-        if (equal(ancestors[i], representedObject))
+        if (ancestors[i] === representedObject)
             continue;
         // FIXME: we could do something faster than findTreeElement since we will know the next
         // ancestor exists in the tree.
-        item = this.findTreeElement(ancestors[i], isAncestor, getParent, equal);
+        item = this.findTreeElement(ancestors[i], isAncestor, getParent);
         if (item && item.onpopulate)
             item.onpopulate(item);
     }
 
-    // Now that all the ancestors are populated, try to find the representedObject again. This time
-    // without the isAncestor and getParent functions to prevent an infinite recursion if it isn't found.
-    return this.findTreeElement(representedObject, null, null, equal);
+    return this.getCachedTreeElement(representedObject);
 }
 
 TreeOutline.prototype.treeElementFromPoint = function(x, y)
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index eec0b87..6df23de 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -26,72 +26,16 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-Object.type = function(obj, win)
+Object.proxyType = function(objectProxy)
 {
-    if (obj === null)
+    if (objectProxy === null)
         return "null";
 
-    var type = typeof obj;
+    var type = typeof objectProxy;
     if (type !== "object" && type !== "function")
         return type;
 
-    win = win || window;
-
-    if (obj instanceof win.Node)
-        return (obj.nodeType === undefined ? type : "node");
-    if (obj instanceof win.String)
-        return "string";
-    if (obj instanceof win.Array)
-        return "array";
-    if (obj instanceof win.Boolean)
-        return "boolean";
-    if (obj instanceof win.Number)
-        return "number";
-    if (obj instanceof win.Date)
-        return "date";
-    if (obj instanceof win.RegExp)
-        return "regexp";
-    if (obj instanceof win.Error)
-        return "error";
-    return type;
-}
-
-Object.hasProperties = function(obj)
-{
-    if (typeof obj === "undefined" || typeof obj === "null")
-        return false;
-    for (var name in obj)
-        return true;
-    return false;
-}
-
-Object.describe = function(obj, abbreviated)
-{
-    var type1 = Object.type(obj);
-    var type2 = Object.prototype.toString.call(obj).replace(/^\[object (.*)\]$/i, "$1");
-
-    switch (type1) {
-    case "object":
-    case "node":
-        return type2;
-    case "array":
-        return "[" + obj.toString() + "]";
-    case "string":
-        if (obj.length > 100)
-            return "\"" + obj.substring(0, 100) + "\u2026\"";
-        return "\"" + obj + "\"";
-    case "function":
-        var objectText = String(obj);
-        if (!/^function /.test(objectText))
-            objectText = (type2 == "object") ? type1 : type2;
-        else if (abbreviated)
-            objectText = /.*/.exec(obj)[0].replace(/ +$/g, "");
-        return objectText;
-    case "regexp":
-        return String(obj).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
-    default:
-        return String(obj);
-    }
+    return objectProxy.type;
 }
 
 Object.properties = function(obj)
@@ -147,7 +91,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (startNode)
                 break;
 
-            node = node.traversePreviousNode(false, stayWithinNode);
+            node = node.traversePreviousNode(stayWithinNode);
         }
 
         if (!startNode) {
@@ -182,7 +126,7 @@ Node.prototype.rangeOfWord = function(offset, stopCharacters, stayWithinNode, di
             if (endNode)
                 break;
 
-            node = node.traverseNextNode(false, stayWithinNode);
+            node = node.traverseNextNode(stayWithinNode);
         }
 
         if (!endNode) {
@@ -236,9 +180,15 @@ Element.prototype.hasStyleClass = function(className)
     return regex.test(this.className);
 }
 
+Element.prototype.positionAt = function(x, y)
+{
+    this.style.left = x + "px";
+    this.style.top = y + "px";
+}
+
 Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = function(nameArray)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         for (var i = 0; i < nameArray.length; ++i)
             if (node.nodeName.toLowerCase() === nameArray[i].toLowerCase())
                 return node;
@@ -252,7 +202,7 @@ Node.prototype.enclosingNodeOrSelfWithNodeName = function(nodeName)
 
 Node.prototype.enclosingNodeOrSelfWithClass = function(className)
 {
-    for (var node = this; node && !objectsAreSame(node, this.ownerDocument); node = node.parentNode)
+    for (var node = this; node && node !== this.ownerDocument; node = node.parentNode)
         if (node.nodeType === Node.ELEMENT_NODE && node.hasStyleClass(className))
             return node;
     return null;
@@ -301,18 +251,31 @@ Element.prototype.__defineGetter__("totalOffsetTop", function()
     return total;
 });
 
-Element.prototype.firstChildSkippingWhitespace = firstChildSkippingWhitespace;
-Element.prototype.lastChildSkippingWhitespace = lastChildSkippingWhitespace;
+Element.prototype.offsetRelativeToWindow = function(targetWindow)
+{
+    var elementOffset = {x: 0, y: 0};
+    var curElement = this;
+    var curWindow = this.ownerDocument.defaultView;
+    while (curWindow && curElement) {
+        elementOffset.x += curElement.totalOffsetLeft;
+        elementOffset.y += curElement.totalOffsetTop;
+        if (curWindow === targetWindow)
+            break;
+
+        curElement = curWindow.frameElement;
+        curWindow = curWindow.parent;
+    }
+
+    return elementOffset;
+}
 
 Node.prototype.isWhitespace = isNodeWhitespace;
-Node.prototype.nodeTypeName = nodeTypeName;
 Node.prototype.displayName = nodeDisplayName;
-Node.prototype.contentPreview = nodeContentPreview;
-Node.prototype.isAncestor = isAncestorNode;
+Node.prototype.isAncestor = function(node)
+{
+    return isAncestorNode(this, node);
+};
 Node.prototype.isDescendant = isDescendantNode;
-Node.prototype.firstCommonAncestor = firstCommonNodeAncestor;
-Node.prototype.nextSiblingSkippingWhitespace = nextSiblingSkippingWhitespace;
-Node.prototype.previousSiblingSkippingWhitespace = previousSiblingSkippingWhitespace;
 Node.prototype.traverseNextNode = traverseNextNode;
 Node.prototype.traversePreviousNode = traversePreviousNode;
 Node.prototype.onlyTextChild = onlyTextChild;
@@ -394,29 +357,6 @@ function isNodeWhitespace()
     return this.nodeValue.match(/^[\s\xA0]+$/);
 }
 
-function nodeTypeName()
-{
-    if (!this)
-        return "(unknown)";
-
-    switch (this.nodeType) {
-        case Node.ELEMENT_NODE: return "Element";
-        case Node.ATTRIBUTE_NODE: return "Attribute";
-        case Node.TEXT_NODE: return "Text";
-        case Node.CDATA_SECTION_NODE: return "Character Data";
-        case Node.ENTITY_REFERENCE_NODE: return "Entity Reference";
-        case Node.ENTITY_NODE: return "Entity";
-        case Node.PROCESSING_INSTRUCTION_NODE: return "Processing Instruction";
-        case Node.COMMENT_NODE: return "Comment";
-        case Node.DOCUMENT_NODE: return "Document";
-        case Node.DOCUMENT_TYPE_NODE: return "Document Type";
-        case Node.DOCUMENT_FRAGMENT_NODE: return "Document Fragment";
-        case Node.NOTATION_NODE: return "Notation";
-    }
-
-    return "(unknown)";
-}
-
 function nodeDisplayName()
 {
     if (!this)
@@ -491,277 +431,110 @@ function nodeDisplayName()
     return this.nodeName.toLowerCase().collapseWhitespace();
 }
 
-function nodeContentPreview()
+function isAncestorNode(ancestor, node)
 {
-    if (!this || !this.hasChildNodes || !this.hasChildNodes())
-        return "";
-
-    var limit = 0;
-    var preview = "";
-
-    // always skip whitespace here
-    var currentNode = traverseNextNode.call(this, true, this);
-    while (currentNode) {
-        if (currentNode.nodeType === Node.TEXT_NODE)
-            preview += currentNode.nodeValue.escapeHTML();
-        else
-            preview += nodeDisplayName.call(currentNode).escapeHTML();
-
-        currentNode = traverseNextNode.call(currentNode, true, this);
-
-        if (++limit > 4) {
-            preview += "&#x2026;"; // ellipsis
-            break;
-        }
-    }
-
-    return preview.collapseWhitespace();
-}
-
-function objectsAreSame(a, b)
-{
-    // FIXME: Make this more generic so is works with any wrapped object, not just nodes.
-    // This function is used to compare nodes that might be JSInspectedObjectWrappers, since
-    // JavaScript equality is not true for JSInspectedObjectWrappers of the same node wrapped
-    // with different global ExecStates, we use isSameNode to compare them.
-    if (a === b)
-        return true;
-    if (!a || !b)
-        return false;
-    if (a.isSameNode && b.isSameNode)
-        return a.isSameNode(b);
-    return false;
-}
-
-function isAncestorNode(ancestor)
-{
-    if (!this || !ancestor)
+    if (!node || !ancestor)
         return false;
 
-    var currentNode = ancestor.parentNode;
+    var currentNode = node.parentNode;
     while (currentNode) {
-        if (objectsAreSame(this, currentNode))
+        if (ancestor === currentNode)
             return true;
         currentNode = currentNode.parentNode;
     }
-
     return false;
 }
 
 function isDescendantNode(descendant)
 {
-    return isAncestorNode.call(descendant, this);
-}
-
-function firstCommonNodeAncestor(node)
-{
-    if (!this || !node)
-        return;
-
-    var node1 = this.parentNode;
-    var node2 = node.parentNode;
-
-    if ((!node1 || !node2) || !objectsAreSame(node1, node2))
-        return null;
-
-    while (node1 && node2) {
-        if (!node1.parentNode || !node2.parentNode)
-            break;
-        if (!objectsAreSame(node1, node2))
-            break;
-
-        node1 = node1.parentNode;
-        node2 = node2.parentNode;
-    }
-
-    return node1;
-}
-
-function nextSiblingSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.nextSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.nextSibling;
-    return node;
+    return isAncestorNode(descendant, this);
 }
 
-function previousSiblingSkippingWhitespace()
+function traverseNextNode(stayWithin)
 {
     if (!this)
         return;
-    var node = this.previousSibling;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = node.previousSibling;
-    return node;
-}
 
-function firstChildSkippingWhitespace()
-{
-    if (!this)
-        return;
     var node = this.firstChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = nextSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function lastChildSkippingWhitespace()
-{
-    if (!this)
-        return;
-    var node = this.lastChild;
-    while (node && node.nodeType === Node.TEXT_NODE && isNodeWhitespace.call(node))
-        node = previousSiblingSkippingWhitespace.call(node);
-    return node;
-}
-
-function traverseNextNode(skipWhitespace, stayWithin)
-{
-    if (!this)
-        return;
-
-    var node = skipWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
     if (node)
         return node;
 
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
 
-    node = skipWhitespace ? nextSiblingSkippingWhitespace.call(this) : this.nextSibling;
+    node = this.nextSibling;
     if (node)
         return node;
 
     node = this;
-    while (node && !(skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling) && (!stayWithin || !node.parentNode || !objectsAreSame(node.parentNode, stayWithin)))
+    while (node && !node.nextSibling && (!stayWithin || !node.parentNode || node.parentNode !== stayWithin))
         node = node.parentNode;
     if (!node)
         return null;
 
-    return skipWhitespace ? nextSiblingSkippingWhitespace.call(node) : node.nextSibling;
+    return node.nextSibling;
 }
 
-function traversePreviousNode(skipWhitespace, stayWithin)
+function traversePreviousNode(stayWithin)
 {
     if (!this)
         return;
-    if (stayWithin && objectsAreSame(this, stayWithin))
+    if (stayWithin && this === stayWithin)
         return null;
-    var node = skipWhitespace ? previousSiblingSkippingWhitespace.call(this) : this.previousSibling;
-    while (node && (skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild) )
-        node = skipWhitespace ? lastChildSkippingWhitespace.call(node) : node.lastChild;
+    var node = this.previousSibling;
+    while (node && node.lastChild)
+        node = node.lastChild;
     if (node)
         return node;
     return this.parentNode;
 }
 
-function onlyTextChild(ignoreWhitespace)
+function onlyTextChild()
 {
     if (!this)
         return null;
 
-    var firstChild = ignoreWhitespace ? firstChildSkippingWhitespace.call(this) : this.firstChild;
+    var firstChild = this.firstChild;
     if (!firstChild || firstChild.nodeType !== Node.TEXT_NODE)
         return null;
 
-    var sibling = ignoreWhitespace ? nextSiblingSkippingWhitespace.call(firstChild) : firstChild.nextSibling;
+    var sibling = firstChild.nextSibling;
     return sibling ? null : firstChild;
 }
 
-function nodeTitleInfo(hasChildren, linkify)
+function appropriateSelectorForNode(node, justSelector)
 {
-    var info = {title: "", hasChildren: hasChildren};
-
-    switch (this.nodeType) {
-        case Node.DOCUMENT_NODE:
-            info.title = "Document";
-            break;
-
-        case Node.ELEMENT_NODE:
-            info.title = "<span class=\"webkit-html-tag\">&lt;" + this.nodeName.toLowerCase().escapeHTML();
-
-            if (this.hasAttributes()) {
-                for (var i = 0; i < this.attributes.length; ++i) {
-                    var attr = this.attributes[i];
-                    info.title += " <span class=\"webkit-html-attribute\"><span class=\"webkit-html-attribute-name\">" + attr.name.escapeHTML() + "</span>=&#8203;\"";
-
-                    var value = attr.value;
-                    if (linkify && (attr.name === "src" || attr.name === "href")) {
-                        var value = value.replace(/([\/;:\)\]\}])/g, "$1\u200B");
-                        info.title += linkify(attr.value, value, "webkit-html-attribute-value", this.nodeName.toLowerCase() == "a");
-                    } else {
-                        var value = value.escapeHTML();
-                        value = value.replace(/([\/;:\)\]\}])/g, "$1&#8203;");
-                        info.title += "<span class=\"webkit-html-attribute-value\">" + value + "</span>";
-                    }
-                    info.title += "\"</span>";
-                }
-            }
-            info.title += "&gt;</span>&#8203;";
-
-            // If this element only has a single child that is a text node,
-            // just show that text and the closing tag inline rather than
-            // create a subtree for them
-
-            var textChild = onlyTextChild.call(this, Preferences.ignoreWhitespace);
-            var showInlineText = textChild && textChild.textContent.length < Preferences.maxInlineTextChildLength;
-
-            if (showInlineText) {
-                info.title += "<span class=\"webkit-html-text-node\">" + textChild.nodeValue.escapeHTML() + "</span>&#8203;<span class=\"webkit-html-tag\">&lt;/" + this.nodeName.toLowerCase().escapeHTML() + "&gt;</span>";
-                info.hasChildren = false;
-            }
-            break;
+    if (!node)
+        return "";
 
-        case Node.TEXT_NODE:
-            if (isNodeWhitespace.call(this))
-                info.title = "(whitespace)";
-            else
-                info.title = "\"<span class=\"webkit-html-text-node\">" + this.nodeValue.escapeHTML() + "</span>\"";
-            break
+    var lowerCaseName = node.localName || node.nodeName.toLowerCase();
 
-        case Node.COMMENT_NODE:
-            info.title = "<span class=\"webkit-html-comment\">&lt;!--" + this.nodeValue.escapeHTML() + "--&gt;</span>";
-            break;
+    var id = node.getAttribute("id");
+    if (id) {
+        var selector = "#" + id;
+        return (justSelector ? selector : lowerCaseName + selector);
+    }
 
-        case Node.DOCUMENT_TYPE_NODE:
-            info.title = "<span class=\"webkit-html-doctype\">&lt;!DOCTYPE " + this.nodeName;
-            if (this.publicId) {
-                info.title += " PUBLIC \"" + this.publicId + "\"";
-                if (this.systemId)
-                    info.title += " \"" + this.systemId + "\"";
-            } else if (this.systemId)
-                info.title += " SYSTEM \"" + this.systemId + "\"";
-            if (this.internalSubset)
-                info.title += " [" + this.internalSubset + "]";
-            info.title += "&gt;</span>";
-            break;
-        default:
-            info.title = this.nodeName.toLowerCase().collapseWhitespace().escapeHTML();
+    var className = node.getAttribute("class");
+    if (className) {
+        var selector = "." + className.replace(/\s+/, ".");
+        return (justSelector ? selector : lowerCaseName + selector);
     }
 
-    return info;
-}
+    if (lowerCaseName === "input" && node.getAttribute("type"))
+        return lowerCaseName + "[type=\"" + node.getAttribute("type") + "\"]";
 
-function getDocumentForNode(node) {
-    return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
+    return lowerCaseName;
 }
 
-function parentNodeOrFrameElement(node) {
-    var parent = node.parentNode;
-    if (parent)
-        return parent;
-
-    return getDocumentForNode(node).defaultView.frameElement;
+function getDocumentForNode(node)
+{
+    return node.nodeType == Node.DOCUMENT_NODE ? node : node.ownerDocument;
 }
 
-function isAncestorIncludingParentFrames(a, b) {
-    if (objectsAreSame(a, b))
-        return false;
-    for (var node = b; node; node = getDocumentForNode(node).defaultView.frameElement)
-        if (objectsAreSame(a, node) || isAncestorNode.call(a, node))
-            return true;
-    return false;
+function parentNode(node)
+{
+    return node.parentNode;
 }
 
 Number.secondsToString = function(seconds, formatterFunction, higherResolution)
@@ -790,20 +563,27 @@ Number.secondsToString = function(seconds, formatterFunction, higherResolution)
     return formatterFunction("%.1f days", days);
 }
 
-Number.bytesToString = function(bytes, formatterFunction)
+Number.bytesToString = function(bytes, formatterFunction, higherResolution)
 {
     if (!formatterFunction)
         formatterFunction = String.sprintf;
+    if (typeof higherResolution === "undefined")
+        higherResolution = true;
 
     if (bytes < 1024)
         return formatterFunction("%.0fB", bytes);
 
     var kilobytes = bytes / 1024;
-    if (kilobytes < 1024)
+    if (higherResolution && kilobytes < 1024)
         return formatterFunction("%.2fKB", kilobytes);
+    else if (kilobytes < 1024)
+        return formatterFunction("%.0fKB", kilobytes);
 
     var megabytes = kilobytes / 1024;
-    return formatterFunction("%.3fMB", megabytes);
+    if (higherResolution)
+        return formatterFunction("%.3fMB", megabytes);
+    else
+        return formatterFunction("%.0fMB", megabytes);
 }
 
 Number.constrain = function(num, min, max)
@@ -942,12 +722,16 @@ String.tokenizeFormatString = function(format)
 String.standardFormatters = {
     d: function(substitution)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) === "number")
+            substitution = substitution.description;
         substitution = parseInt(substitution);
         return !isNaN(substitution) ? substitution : 0;
     },
 
     f: function(substitution, token)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) === "number")
+            substitution = substitution.description;
         substitution = parseFloat(substitution);
         if (substitution && token.precision > -1)
             substitution = substitution.toFixed(token.precision);
@@ -956,6 +740,8 @@ String.standardFormatters = {
 
     s: function(substitution)
     {
+        if (typeof substitution == "object" && Object.proxyType(substitution) !== "null")
+            substitution = substitution.description;
         return substitution;
     },
 };
diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 6eeba77..1f28709 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -34,6 +34,7 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include <stdio.h>
 #include <wtf/CurrentTime.h>
 
@@ -105,7 +106,7 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource && requestIsPreload && !resource->isPreloaded())
         return 0;
     
-    if (FrameLoader::restrictAccessToLocal() && !FrameLoader::canLoad(url, String(), docLoader->doc())) {
+    if (SecurityOrigin::restrictAccessToLocal() && !SecurityOrigin::canLoad(url, String(), docLoader->doc())) {
         Document* doc = docLoader->doc();
         if (doc && !requestIsPreload)
             FrameLoader::reportLocalLoadFailed(doc->frame(), url.string());
@@ -183,6 +184,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
     ASSERT(resource->inCache());
+    ASSERT(resource == m_resources.get(resource->url()));
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -191,7 +193,7 @@ void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
         return;
     }
     const String& url = resource->url();
-    CachedResource* newResource = createResource(resource->type(), KURL(url), resource->encoding());
+    CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
     newResource->setResourceToRevalidate(resource);
     evict(resource);
     m_resources.set(url, newResource);
@@ -206,6 +208,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
     ASSERT(resource);
     ASSERT(!resource->inCache());
     ASSERT(resource->isLoaded());
+    ASSERT(revalidatingResource->inCache());
     
     evict(revalidatingResource);
 
@@ -352,7 +355,7 @@ void Cache::pruneDeadResources()
         current = m_allResources[i].m_tail;
         while (current) {
             CachedResource* prev = current->m_prevInAllResourcesList;
-            if (!current->hasClients() && !current->isPreloaded()) {
+            if (!current->hasClients() && !current->isPreloaded() && !current->isCacheValidator()) {
                 evict(current);
                 // If evict() caused pruneDeadResources() to be re-entered, bail out. This can happen when removing an
                 // SVG CachedImage that has subresources.
diff --git a/WebCore/loader/CachedFont.cpp b/WebCore/loader/CachedFont.cpp
index dfb9dd8..9cf152d 100644
--- a/WebCore/loader/CachedFont.cpp
+++ b/WebCore/loader/CachedFont.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,12 +27,16 @@
 #include "config.h"
 #include "CachedFont.h"
 
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX))) || PLATFORM(HAIKU) || PLATFORM(WINCE)
+#define STORE_FONT_CUSTOM_PLATFORM_DATA
+#endif
+
 #include "Cache.h"
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
 #include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #include "FontCustomPlatformData.h"
 #endif
 #include "TextResourceDecoder.h"
@@ -60,7 +65,7 @@ CachedFont::CachedFont(const String &url)
 
 CachedFont::~CachedFont()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     delete m_fontData;
 #endif
 }
@@ -98,7 +103,7 @@ void CachedFont::beginLoadIfNeeded(DocLoader* dl)
 
 bool CachedFont::ensureCustomFontData()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
 #if ENABLE(SVG_FONTS)
     ASSERT(!m_isSVGFont);
 #endif
@@ -117,7 +122,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
     if (m_externalSVGDocument)
         return FontPlatformData(size, bold, italic);
 #endif
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     ASSERT(m_fontData);
     return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, renderingMode);
 #else
@@ -173,7 +178,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 
 void CachedFont::allClientsRemoved()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && (PLATFORM(WIN_OS) || PLATFORM(LINUX)))
+#ifdef STORE_FONT_CUSTOM_PLATFORM_DATA
     if (m_fontData) {
         delete m_fontData;
         m_fontData = 0;
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index 478873f..43de633 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -59,7 +59,7 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_docLoader(0)
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
-    , m_isBeingRevalidated(false)
+    , m_proxyResource(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -89,6 +89,8 @@ CachedResource::CachedResource(const String& url, Type type)
 
 CachedResource::~CachedResource()
 {
+    ASSERT(!m_resourceToRevalidate); // Should be true because canDelete() checks this.
+    ASSERT(canDelete());
     ASSERT(!inCache());
     ASSERT(!m_deleted);
     ASSERT(url().isNull() || cache()->resourceForURL(url()) != this);
@@ -97,9 +99,6 @@ CachedResource::~CachedResource()
     cachedResourceLeakCounter.decrement();
 #endif
 
-    if (m_resourceToRevalidate)
-        m_resourceToRevalidate->m_isBeingRevalidated = false;
-
     if (m_docLoader)
         m_docLoader->removeCachedResource(this);
 }
@@ -298,18 +297,26 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
     ASSERT(resource);
     ASSERT(!m_resourceToRevalidate);
     ASSERT(resource != this);
-    ASSERT(!resource->m_isBeingRevalidated);
     ASSERT(m_handlesToRevalidate.isEmpty());
     ASSERT(resource->type() == type());
-    resource->m_isBeingRevalidated = true;
+
+    // The following assert should be investigated whenever it occurs. Although it should never fire, it currently does in rare circumstances.
+    // https://bugs.webkit.org/show_bug.cgi?id=28604.
+    // So the code needs to be robust to this assert failing thus the "if (m_resourceToRevalidate->m_proxyResource == this)" in CachedResource::clearResourceToRevalidate.
+    ASSERT(!resource->m_proxyResource);
+
+    resource->m_proxyResource = this;
     m_resourceToRevalidate = resource;
 }
 
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    m_resourceToRevalidate->m_isBeingRevalidated = false;
-    m_resourceToRevalidate->deleteIfPossible();
+    // A resource may start revalidation before this method has been called, so check that this resource is still the proxy resource before clearing it out.
+    if (m_resourceToRevalidate->m_proxyResource == this) {
+        m_resourceToRevalidate->m_proxyResource = 0;
+        m_resourceToRevalidate->deleteIfPossible();
+    }
     m_handlesToRevalidate.clear();
     m_resourceToRevalidate = 0;
     deleteIfPossible();
@@ -403,7 +410,7 @@ bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 
 bool CachedResource::isSafeToMakePurgeable() const
 { 
-    return !hasClients() && !m_isBeingRevalidated && !m_resourceToRevalidate; 
+    return !hasClients() && !m_proxyResource && !m_resourceToRevalidate;
 }
 
 bool CachedResource::makePurgeable(bool purgeable) 
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index babdf89..05d24fc 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -129,7 +129,7 @@ public:
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
     // The resource can be brought back to cache after successful revalidation.
-    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
+    void setInCache(bool inCache) { m_inCache = inCache; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -142,7 +142,7 @@ public:
     void setResponse(const ResourceResponse&);
     const ResourceResponse& response() const { return m_response; }
 
-    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_isBeingRevalidated; }
+    bool canDelete() const { return !hasClients() && !m_request && !m_preloadCount && !m_handleCount && !m_resourceToRevalidate && !m_proxyResource; }
 
     bool isExpired() const;
 
@@ -251,7 +251,10 @@ private:
     // to to be clients of m_resourceToRevalidate and the resource is deleted. If not, the field is zeroed and this
     // resources becomes normal resource load.
     CachedResource* m_resourceToRevalidate;
-    bool m_isBeingRevalidated;
+
+    // If this field is non-null, the resource has a proxy for checking whether it is still up to date (see m_resourceToRevalidate).
+    CachedResource* m_proxyResource;
+
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
 };
diff --git a/WebCore/loader/CachedResourceClient.h b/WebCore/loader/CachedResourceClient.h
index 2e0b15b..dd9bb94 100644
--- a/WebCore/loader/CachedResourceClient.h
+++ b/WebCore/loader/CachedResourceClient.h
@@ -25,6 +25,8 @@
 #ifndef CachedResourceClient_h
 #define CachedResourceClient_h
 
+#include <wtf/FastAllocBase.h>
+
 #if ENABLE(XBL)
 namespace XBL {
     class XBLDocument;
@@ -48,7 +50,7 @@ namespace WebCore {
      * inherit from this class and overload one of the 3 functions
      *
      */
-    class CachedResourceClient
+    class CachedResourceClient : public FastAllocBase
     {
     public:
         virtual ~CachedResourceClient() { }
diff --git a/WebCore/loader/CachedResourceHandle.h b/WebCore/loader/CachedResourceHandle.h
index 13c03c7..9d45b94 100644
--- a/WebCore/loader/CachedResourceHandle.h
+++ b/WebCore/loader/CachedResourceHandle.h
@@ -38,7 +38,8 @@ namespace WebCore {
         bool operator!() const { return !m_resource; }
         
         // This conversion operator allows implicit conversion to bool but not to other integer types.
-        typedef CachedResource* CachedResourceHandleBase::*UnspecifiedBoolType;
+        // Parenthesis is needed for winscw compiler to resolve class qualifier in this case.
+        typedef CachedResource* (CachedResourceHandleBase::*UnspecifiedBoolType);
         operator UnspecifiedBoolType() const { return m_resource ? &CachedResourceHandleBase::m_resource : 0; }
 
     protected:
diff --git a/WebCore/loader/CrossOriginPreflightResultCache.cpp b/WebCore/loader/CrossOriginPreflightResultCache.cpp
index 4bd05b2..cea66b1 100644
--- a/WebCore/loader/CrossOriginPreflightResultCache.cpp
+++ b/WebCore/loader/CrossOriginPreflightResultCache.cpp
@@ -30,6 +30,8 @@
 #include "CrossOriginAccessControl.h"
 #include "ResourceResponse.h"
 #include <wtf/CurrentTime.h>
+#include <wtf/StdLibExtras.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -64,8 +66,7 @@ static void addToAccessControlAllowList(const String& string, unsigned start, un
     while (end && isSpaceOrNewline((*stringImpl)[end]))
         --end;
 
-    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
-    set.add(string.substringCopy(start, end - start + 1));
+    set.add(string.substring(start, end - start + 1));
 }
 
 template<class HashType>
@@ -137,20 +138,20 @@ bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials,
 
 CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
 {
-    AtomicallyInitializedStatic(CrossOriginPreflightResultCache&, cache = *new CrossOriginPreflightResultCache);
+    DEFINE_STATIC_LOCAL(CrossOriginPreflightResultCache, cache, ());
+    ASSERT(isMainThread());
     return cache;
 }
 
 void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
 {
-    MutexLocker lock(m_mutex);
-    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
-    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
+    ASSERT(isMainThread());
+    m_preflightHashMap.set(std::make_pair(origin, url), preflightResult);
 }
 
 bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
     if (cacheIt == m_preflightHashMap.end())
         return false;
@@ -165,7 +166,7 @@ bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, con
 
 void CrossOriginPreflightResultCache::empty()
 {
-    MutexLocker lock(m_mutex);
+    ASSERT(isMainThread());
     deleteAllValues(m_preflightHashMap);
     m_preflightHashMap.clear();
 }
diff --git a/WebCore/loader/CrossOriginPreflightResultCache.h b/WebCore/loader/CrossOriginPreflightResultCache.h
index f71d1c8..97b526a 100644
--- a/WebCore/loader/CrossOriginPreflightResultCache.h
+++ b/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -72,7 +72,6 @@ namespace WebCore {
         typedef HashMap<std::pair<String, KURL>, CrossOriginPreflightResultCacheItem*> CrossOriginPreflightResultHashMap;
 
         CrossOriginPreflightResultHashMap m_preflightHashMap;
-        Mutex m_mutex;
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/DocLoader.cpp b/WebCore/loader/DocLoader.cpp
index 9c11a88..9e97354 100644
--- a/WebCore/loader/DocLoader.cpp
+++ b/WebCore/loader/DocLoader.cpp
@@ -200,6 +200,41 @@ bool DocLoader::canRequest(CachedResource::Type type, const KURL& url)
         ASSERT_NOT_REACHED();
         break;
     }
+
+    // Given that the load is allowed by the same-origin policy, we should
+    // check whether the load passes the mixed-content policy.
+    //
+    // Note: Currently, we always allow mixed content, but we generate a
+    //       callback to the FrameLoaderClient in case the embedder wants to
+    //       update any security indicators.
+    // 
+    switch (type) {
+    case CachedResource::Script:
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+#if ENABLE(XBL)
+    case CachedResource::XBL:
+#endif
+        // These resource can inject script into the current document.
+        if (Frame* f = frame())
+            f->loader()->checkIfRunInsecureContent(m_doc->securityOrigin(), url);
+        break;
+    case CachedResource::ImageResource:
+    case CachedResource::CSSStyleSheet:
+    case CachedResource::FontResource: {
+        // These resources can corrupt only the frame's pixels.
+        if (Frame* f = frame()) {
+            Frame* top = f->tree()->top();
+            top->loader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), url);
+        }
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    // FIXME: Consider letting the embedder block mixed content loads.
     return true;
 }
 
@@ -224,7 +259,7 @@ CachedResource* DocLoader::requestResource(CachedResource::Type type, const Stri
     if (resource) {
         // Check final URL of resource to catch redirects.
         // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
-        if (!canRequest(type, KURL(resource->url())))
+        if (fullURL != resource->url() && !canRequest(type, KURL(ParsedURLString, resource->url())))
             return 0;
 
         m_documentResources.set(resource->url(), resource);
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 4ec69a7..5ca6e58 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -148,7 +148,6 @@ DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData&
     , m_gotFirstByte(false)
     , m_primaryLoadComplete(false)
     , m_isClientRedirect(false)
-    , m_loadingFromCachedPage(false)
     , m_stopRecordingResponses(false)
     , m_substituteResourceDeliveryTimer(this, &DocumentLoader::substituteResourceDeliveryTimerFired)
     , m_didCreateGlobalHistoryEntry(false)
@@ -278,7 +277,7 @@ void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
         Document* doc = m_frame->document();
         
         if (loading || doc->parsing())
-            m_frame->loader()->stopLoading(false, databasePolicy);
+            m_frame->loader()->stopLoading(UnloadEventPolicyNone, databasePolicy);
     }
 
     // Always cancel multipart loaders
@@ -568,7 +567,7 @@ void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subre
     const DocLoader::DocumentResourceMap& allResources = document->docLoader()->allCachedResources();
     DocLoader::DocumentResourceMap::const_iterator end = allResources.end();
     for (DocLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
-        RefPtr<ArchiveResource> subresource = this->subresource(KURL(it->second->url()));
+        RefPtr<ArchiveResource> subresource = this->subresource(KURL(ParsedURLString, it->second->url()));
         if (subresource)
             subresources.append(subresource.release());
     }
@@ -697,16 +696,6 @@ bool DocumentLoader::urlForHistoryReflectsFailure() const
     return m_substituteData.isValid() || m_response.httpStatusCode() >= 400;
 }
 
-void DocumentLoader::loadFromCachedPage(PassRefPtr<CachedPage> cachedPage)
-{
-    LOG(PageCache, "WebCorePageCache: DocumentLoader %p loading from cached page %p", this, cachedPage.get());
-    
-    prepareForLoadStart();
-    setLoadingFromCachedPage(true);
-    setCommitted(true);
-    frameLoader()->commitProvisionalLoad(cachedPage);
-}
-
 const KURL& DocumentLoader::originalURL() const
 {
     return m_originalRequestCopy.url();
diff --git a/WebCore/loader/DocumentLoader.h b/WebCore/loader/DocumentLoader.h
index 134d954..1220a0e 100644
--- a/WebCore/loader/DocumentLoader.h
+++ b/WebCore/loader/DocumentLoader.h
@@ -43,8 +43,11 @@ namespace WebCore {
     class Archive;
     class ArchiveResource;
     class ArchiveResourceCollection;
+<<<<<<< HEAD:WebCore/loader/DocumentLoader.h
 #endif
     class CachedPage;
+=======
+>>>>>>> webkit.org at 49305:WebCore/loader/DocumentLoader.h
     class Frame;
     class FrameLoader;
     class MainResourceLoader;
@@ -174,10 +177,6 @@ namespace WebCore {
         bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
         void setDidCreateGlobalHistoryEntry(bool didCreateGlobalHistoryEntry) { m_didCreateGlobalHistoryEntry = didCreateGlobalHistoryEntry; }
         
-        void loadFromCachedPage(PassRefPtr<CachedPage>);
-        void setLoadingFromCachedPage(bool loading) { m_loadingFromCachedPage = loading; }
-        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
-        
         void setDefersLoading(bool);
 
         bool startLoadingMainResource(unsigned long identifier);
@@ -264,7 +263,6 @@ namespace WebCore {
         bool m_gotFirstByte;
         bool m_primaryLoadComplete;
         bool m_isClientRedirect;
-        bool m_loadingFromCachedPage;
 
         String m_pageTitle;
 
diff --git a/WebCore/loader/DocumentThreadableLoader.cpp b/WebCore/loader/DocumentThreadableLoader.cpp
index dd5ca76..8a223fd 100644
--- a/WebCore/loader/DocumentThreadableLoader.cpp
+++ b/WebCore/loader/DocumentThreadableLoader.cpp
@@ -32,8 +32,9 @@
 #include "DocumentThreadableLoader.h"
 
 #include "AuthenticationChallenge.h"
+#include "CrossOriginAccessControl.h"
+#include "CrossOriginPreflightResultCache.h"
 #include "Document.h"
-#include "DocumentThreadableLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceRequest.h"
@@ -43,61 +44,106 @@
 
 namespace WebCore {
 
-void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
-    bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
-
-    Vector<char> data;
-    ResourceError error;
-    ResourceResponse response;
-    unsigned long identifier = std::numeric_limits<unsigned long>::max();
-    if (document->frame())
-        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
-
-    // No exception for file:/// resources, see <rdar://problem/4962298>.
-    // Also, if we have an HTTP response, then it wasn't a network error in fact.
-    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
-        client.didFail(error);
-        return;
-    }
-
-    // FIXME: This check along with the one in willSendRequest is specific to xhr and
-    // should be made more generic.
-    if (sameOriginRequest && !document->securityOrigin()->canRequest(response.url())) {
-        client.didFailRedirectCheck();
-        return;
-    }
-
-    client.didReceiveResponse(response);
-
-    const char* bytes = static_cast<const char*>(data.data());
-    int len = static_cast<int>(data.size());
-    client.didReceiveData(bytes, len);
-
-    client.didFinishLoading(identifier);
+    // The loader will be deleted as soon as this function exits.
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, &client, LoadSynchronously, request, options));
+    ASSERT(loader->hasOneRef());
 }
 
-PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options)
 {
-    ASSERT(document);
-    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, LoadAsynchronously, request, options));
     if (!loader->m_loader)
         loader = 0;
     return loader.release();
 }
 
-DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, BlockingBehavior blockingBehavior, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_client(client)
     , m_document(document)
-    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_options(options)
     , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
-    , m_denyCrossOriginRedirect(crossOriginRedirectPolicy == DenyCrossOriginRedirect)
+    , m_async(blockingBehavior == LoadAsynchronously)
 {
     ASSERT(document);
     ASSERT(client);
-    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
-    ASSERT(crossOriginRedirectPolicy == DenyCrossOriginRedirect || crossOriginRedirectPolicy == AllowCrossOriginRedirect);
-    m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
+
+    if (m_sameOriginRequest || m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) {
+        bool skipCanLoadCheck = false;
+        loadRequest(request, skipCanLoadCheck);
+        return;
+    }
+
+    if (m_options.crossOriginRequestPolicy == DenyCrossOriginRequests) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+    
+    ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+
+    if (!m_options.forcePreflight && isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()))
+        makeSimpleCrossOriginAccessRequest(request);
+    else {
+        m_actualRequest.set(new ResourceRequest(request));
+        m_actualRequest->setAllowCookies(m_options.allowCredentials);
+
+        if (CrossOriginPreflightResultCache::shared().canSkipPreflight(document->securityOrigin()->toString(), request.url(), m_options.allowCredentials, request.httpMethod(), request.httpHeaderFields()))
+            preflightSuccess();
+        else
+            makeCrossOriginAccessRequestWithPreflight(request);
+    }
+}
+
+void DocumentThreadableLoader::makeSimpleCrossOriginAccessRequest(const ResourceRequest& request)
+{
+    ASSERT(isSimpleCrossOriginAccessRequest(request.httpMethod(), request.httpHeaderFields()));
+
+    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
+    if (!request.url().protocolInHTTPFamily()) {
+        m_client->didFail(ResourceError());
+        return;
+    }
+
+    // Make a copy of the passed request so that we can modify some details.
+    ResourceRequest crossOriginRequest(request);
+    crossOriginRequest.removeCredentials();
+    crossOriginRequest.setAllowCookies(m_options.allowCredentials);
+    crossOriginRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+
+    bool skipCanLoadCheck = false;
+    loadRequest(crossOriginRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request)
+{
+    ResourceRequest preflightRequest(request.url());
+    preflightRequest.removeCredentials();
+    preflightRequest.setHTTPOrigin(m_document->securityOrigin()->toString());
+    preflightRequest.setAllowCookies(m_options.allowCredentials);
+    preflightRequest.setHTTPMethod("OPTIONS");
+    preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", request.httpMethod());
+
+    const HTTPHeaderMap& requestHeaderFields = request.httpHeaderFields();
+
+    if (requestHeaderFields.size() > 0) {
+        Vector<UChar> headerBuffer;
+        HTTPHeaderMap::const_iterator it = requestHeaderFields.begin();
+        append(headerBuffer, it->first);
+        ++it;
+
+        HTTPHeaderMap::const_iterator end = requestHeaderFields.end();
+        for (; it != end; ++it) {
+            headerBuffer.append(',');
+            headerBuffer.append(' ');
+            append(headerBuffer, it->first);
+        }
+
+        preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
+    }
+
+    bool skipCanLoadCheck = false;
+    loadRequest(preflightRequest, skipCanLoadCheck);
 }
 
 DocumentThreadableLoader::~DocumentThreadableLoader()
@@ -122,8 +168,7 @@ void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, Resour
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
-    if (m_denyCrossOriginRedirect && !m_document->securityOrigin()->canRequest(request.url())) {
+    if (!isAllowedRedirect(request.url())) {
         RefPtr<DocumentThreadableLoader> protect(this);
         m_client->didFailRedirectCheck();
         request = ResourceRequest();
@@ -143,7 +188,31 @@ void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, con
     ASSERT(m_client);
     ASSERT_UNUSED(loader, loader == m_loader);
 
-    m_client->didReceiveResponse(response);
+    if (m_actualRequest) {
+        if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+            preflightFailure();
+            return;
+        }
+
+        OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_options.allowCredentials));
+        if (!preflightResult->parse(response)
+            || !preflightResult->allowsCrossOriginMethod(m_actualRequest->httpMethod())
+            || !preflightResult->allowsCrossOriginHeaders(m_actualRequest->httpHeaderFields())) {
+            preflightFailure();
+            return;
+        }
+
+        CrossOriginPreflightResultCache::shared().appendEntry(m_document->securityOrigin()->toString(), m_actualRequest->url(), preflightResult.release());
+    } else {
+        if (!m_sameOriginRequest && m_options.crossOriginRequestPolicy == UseAccessControl) {
+            if (!passesAccessControlCheck(response, m_options.allowCredentials, m_document->securityOrigin())) {
+                m_client->didFail(ResourceError());
+                return;
+            }
+        }
+
+        m_client->didReceiveResponse(response);
+    }
 }
 
 void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
@@ -158,7 +227,17 @@ void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
 {
     ASSERT(loader == m_loader);
     ASSERT(m_client);
-    m_client->didFinishLoading(loader->identifier());
+    didFinishLoading(loader->identifier());
+}
+
+void DocumentThreadableLoader::didFinishLoading(unsigned long identifier)
+{
+    if (m_actualRequest) {
+        ASSERT(!m_sameOriginRequest);
+        ASSERT(m_options.crossOriginRequestPolicy == UseAccessControl);
+        preflightSuccess();
+    } else
+        m_client->didFinishLoading(identifier);
 }
 
 void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
@@ -172,9 +251,9 @@ void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const Resource
 
 bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
 {
-    ASSERT_UNUSED(loader, loader == m_loader);
+    ASSERT_UNUSED(loader, loader == m_loader || !m_loader);
 
-    if (!m_allowStoredCredentials) {
+    if (!m_options.allowCredentials) {
         shouldUseCredentialStorage = false;
         return true;
     }
@@ -200,4 +279,76 @@ void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, c
     m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
 }
 
+void DocumentThreadableLoader::preflightSuccess()
+{
+    OwnPtr<ResourceRequest> actualRequest;
+    actualRequest.swap(m_actualRequest);
+
+    bool skipCanLoadCheck = true;  // ok to skip load check since we already asked about the preflight request
+    loadRequest(*actualRequest, skipCanLoadCheck);
+}
+
+void DocumentThreadableLoader::preflightFailure()
+{
+    m_client->didFail(ResourceError());
+}
+
+void DocumentThreadableLoader::loadRequest(const ResourceRequest& request, bool skipCanLoadCheck)
+{
+    if (m_async) {
+        // Don't sniff content or send load callbacks for the preflight request.
+        bool sendLoadCallbacks = m_options.sendLoadCallbacks && !m_actualRequest;
+        bool sniffContent = m_options.sniffContent && !m_actualRequest;
+
+        // Clear the loader so that any callbacks from SubresourceLoader::create will not have the old loader.
+        m_loader = 0;
+        m_loader = SubresourceLoader::create(m_document->frame(), this, request, skipCanLoadCheck, sendLoadCallbacks, sniffContent);
+        return;
+    }
+    
+    // FIXME: ThreadableLoaderOptions.sniffContent is not supported for synchronous requests.
+    StoredCredentials storedCredentials = m_options.allowCredentials ? AllowStoredCredentials : DoNotAllowStoredCredentials;
+
+    Vector<char> data;
+    ResourceError error;
+    ResourceResponse response;
+    unsigned long identifier = std::numeric_limits<unsigned long>::max();
+    if (m_document->frame())
+        identifier = m_document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
+
+    // No exception for file:/// resources, see <rdar://problem/4962298>.
+    // Also, if we have an HTTP response, then it wasn't a network error in fact.
+    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+        m_client->didFail(error);
+        return;
+    }
+
+    // FIXME: FrameLoader::loadSynchronously() does not tell us whether a redirect happened or not, so we guess by comparing the
+    // request and response URLs. This isn't a perfect test though, since a server can serve a redirect to the same URL that was
+    // requested.
+    if (request.url() != response.url() && !isAllowedRedirect(response.url())) {
+        m_client->didFailRedirectCheck();
+        return;
+    }
+
+    didReceiveResponse(0, response);
+
+    const char* bytes = static_cast<const char*>(data.data());
+    int len = static_cast<int>(data.size());
+    didReceiveData(0, bytes, len);
+
+    didFinishLoading(identifier);
+}
+
+bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url)
+{
+    if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)
+        return true;
+
+    // FIXME: We need to implement access control for each redirect. This will require some refactoring though, because the code
+    // that processes redirects doesn't know about access control and expects a synchronous answer from its client about whether
+    // a redirect should proceed.
+    return m_sameOriginRequest && m_document->securityOrigin()->canRequest(url);
+}
+
 } // namespace WebCore
diff --git a/WebCore/loader/DocumentThreadableLoader.h b/WebCore/loader/DocumentThreadableLoader.h
index 465475f..64b1a22 100644
--- a/WebCore/loader/DocumentThreadableLoader.h
+++ b/WebCore/loader/DocumentThreadableLoader.h
@@ -33,19 +33,21 @@
 
 #include "SubresourceLoaderClient.h"
 #include "ThreadableLoader.h"
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
     class Document;
+    class KURL;
     struct ResourceRequest;
     class ThreadableLoaderClient;
 
     class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
     public:
-        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
         virtual ~DocumentThreadableLoader();
 
         virtual void cancel();
@@ -58,7 +60,13 @@ namespace WebCore {
         virtual void derefThreadableLoader() { deref(); }
 
     private:
-        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        enum BlockingBehavior {
+            LoadSynchronously,
+            LoadAsynchronously
+        };
+
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, BlockingBehavior blockingBehavior, const ResourceRequest&, const ThreadableLoaderOptions& options);
+
         virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
         virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
 
@@ -71,12 +79,22 @@ namespace WebCore {
         virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
         virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
 
+        void didFinishLoading(unsigned long identifier);
+        void makeSimpleCrossOriginAccessRequest(const ResourceRequest& request);
+        void makeCrossOriginAccessRequestWithPreflight(const ResourceRequest& request);
+        void preflightSuccess();
+        void preflightFailure();
+
+        void loadRequest(const ResourceRequest&, bool skipCanLoadCheck);
+        bool isAllowedRedirect(const KURL&);
+
         RefPtr<SubresourceLoader> m_loader;
         ThreadableLoaderClient* m_client;
         Document* m_document;
-        bool m_allowStoredCredentials;
+        ThreadableLoaderOptions m_options;
         bool m_sameOriginRequest;
-        bool m_denyCrossOriginRedirect;
+        bool m_async;
+        OwnPtr<ResourceRequest> m_actualRequest;  // non-null during Access Control preflight checks
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/EmptyClients.h b/WebCore/loader/EmptyClients.h
index 3f70c43..d9e09fb 100644
--- a/WebCore/loader/EmptyClients.h
+++ b/WebCore/loader/EmptyClients.h
@@ -39,6 +39,7 @@
 #include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
+#include "PluginHalterClient.h"
 #include "ResourceError.h"
 #include "SharedBuffer.h"
 
@@ -120,9 +121,10 @@ public:
     virtual void scroll(const IntSize&, const IntRect&, const IntRect&) { }
     virtual IntPoint screenToWindow(const IntPoint& p) const { return p; }
     virtual IntRect windowToScreen(const IntRect& r) const { return r; }
-    virtual PlatformWidget platformWindow() const { return 0; }
+    virtual PlatformPageClient platformPageClient() const { return 0; }
     virtual void contentsSizeChanged(Frame*, const IntSize&) const { }
 
+    virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned) { }
 
     virtual void setToolTip(const String&, TextDirection) { }
@@ -137,6 +139,10 @@ public:
     virtual void reachedMaxAppCacheSize(int64_t) { }
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    virtual NotificationPresenter* notificationPresenter() const { return 0; }
+#endif
+
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
@@ -280,7 +286,8 @@ public:
 #endif
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
-
+    virtual void didDisplayInsecureContent() { }
+    virtual void didRunInsecureContent(SecurityOrigin*) { }
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
     virtual PassRefPtr<Widget> createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
     virtual PassRefPtr<Widget> createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
@@ -414,6 +421,7 @@ public:
 
 };
 
+#if ENABLE(CONTEXT_MENUS)
 class EmptyContextMenuClient : public ContextMenuClient {
 public:
     virtual ~EmptyContextMenuClient() {  }
@@ -434,7 +442,9 @@ public:
     virtual void searchWithSpotlight() { }
 #endif
 };
+#endif // ENABLE(CONTEXT_MENUS)
 
+#if ENABLE(DRAG_SUPPORT)
 class EmptyDragClient : public DragClient {
 public:
     virtual ~EmptyDragClient() {}
@@ -446,6 +456,7 @@ public:
     virtual DragImageRef createDragImageForLink(KURL&, const String&, Frame*) { return 0; }
     virtual void dragControllerDestroyed() { }
 };
+#endif // ENABLE(DRAG_SUPPORT)
 
 class EmptyInspectorClient : public InspectorClient {
 public:
@@ -478,6 +489,12 @@ public:
     virtual void inspectorWindowObjectCleared() { }
 };
 
+class EmptyPluginHalterClient : public PluginHalterClient
+{
+public:
+    virtual bool shouldHaltPlugin(Node*) const { return false; }
+};
+
 }
 
 #endif // EmptyClients_h
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index ace4cfe..ee0f4ca 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -118,7 +118,7 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->setAttribute("class", "ftpDirectoryEntryRow", ec);
    
     RefPtr<Element> element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, String(&noBreakSpace, 1)), ec);
+    element->appendChild(Text::create(m_doc, String(&noBreakSpace, 1)), ec);
     if (isDirectory)
         element->setAttribute("class", "ftpDirectoryIcon ftpDirectoryTypeDirectory", ec);
     else
@@ -130,12 +130,12 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, date), ec);
+    element->appendChild(Text::create(m_doc, date), ec);
     element->setAttribute("class", "ftpDirectoryFileDate", ec);
     rowElement->appendChild(element, ec);
     
     element = m_doc->createElement(tdTag, false);
-    element->appendChild(new Text(m_doc, size), ec);
+    element->appendChild(Text::create(m_doc, size), ec);
     element->setAttribute("class", "ftpDirectoryFileSize", ec);
     rowElement->appendChild(element, ec);
 }
@@ -152,7 +152,7 @@ PassRefPtr<Element> FTPDirectoryTokenizer::createTDForFilename(const String& fil
 
     RefPtr<Element> anchorElement = m_doc->createElement(aTag, false);
     anchorElement->setAttribute("href", fullURL, ec);
-    anchorElement->appendChild(new Text(m_doc, filename), ec);
+    anchorElement->appendChild(Text::create(m_doc, filename), ec);
     
     RefPtr<Element> tdElement = m_doc->createElement(tdTag, false);
     tdElement->appendChild(anchorElement, ec);
diff --git a/WebCore/loader/FTPDirectoryDocument.h b/WebCore/loader/FTPDirectoryDocument.h
index ecc6f73..b208c4e 100644
--- a/WebCore/loader/FTPDirectoryDocument.h
+++ b/WebCore/loader/FTPDirectoryDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class FTPDirectoryDocument : public HTMLDocument {
 public:
     static PassRefPtr<FTPDirectoryDocument> create(Frame* frame)
     {
-        return new FTPDirectoryDocument(frame);
+        return adoptRef(new FTPDirectoryDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/FTPDirectoryParser.cpp b/WebCore/loader/FTPDirectoryParser.cpp
index 6573fb6..40bd714 100644
--- a/WebCore/loader/FTPDirectoryParser.cpp
+++ b/WebCore/loader/FTPDirectoryParser.cpp
@@ -57,6 +57,13 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 #endif
 #endif
 
+static inline FTPEntryType ParsingFailed(ListState& state)
+{
+  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
+    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
+  return FTPMiscEntry;        /* its part of a comment or error message */
+}
+
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
 {
   result.clear();
@@ -126,6 +133,9 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
       }
     }    
 
+    if (!numtoks)
+      return ParsingFailed(state);
+
     linelen_sans_wsp = &(tokens[numtoks-1][toklen[numtoks-1]]) - tokens[0];
     if (numtoks == (sizeof(tokens)/sizeof(tokens[0])) )
     {
@@ -356,11 +366,16 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
               pos++;
               p++;
             }
-            if (lstyle && pos < (toklen[0]-1) && *p == ']')
+            if (lstyle && pos < (toklen[0]-1))
             {
+              /* ']' was found and there is at least one character after it */
+              ASSERT(*p == ']');
               pos++;
               p++;
               tokmarker = pos; /* length of leading "[DIR1.DIR2.etc]" */
+            } else {
+              /* not a CMU style listing */
+              lstyle = 0;
             }
           }
           while (lstyle && pos < toklen[0] && *p != ';')
@@ -387,7 +402,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           pos -= tokmarker;      /* => fnlength sans "[DIR1.DIR2.etc]" */
           p = &(tokens[0][tokmarker]); /* offset of basename */
 
-          if (!lstyle || pos > 80) /* VMS filenames can't be longer than that */
+          if (!lstyle || pos == 0 || pos > 80) /* VMS filenames can't be longer than that */
           {
             lstyle = 0;
           }
@@ -780,7 +795,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
         state.parsedOne = true;
         state.listStyle = lstyle;
 
-        p = &(line[linelen_sans_wsp]); /* line end sans wsp */
+        p = &(line[linelen]); /* line end */
         result.caseSensitive = true;
         result.filename = tokens[3];
         result.filenameLength = p - tokens[3];
@@ -788,29 +803,46 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
         if (*tokens[2] != '<') /* not <DIR> or <JUNCTION> */
         {
+          // try to handle correctly spaces at the beginning of the filename
+          // filesize (token[2]) must end at offset 38
+          if (tokens[2] + toklen[2] - line == 38) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
           result.type = FTPFileEntry;
           pos = toklen[2];
           result.fileSize = String(tokens[2], pos);
         }
-        else if ((tokens[2][1]) != 'D') /* not <DIR> */
-        {
-          result.type = FTPJunkEntry; /* unknown until junc for sure */
-          if (result.filenameLength > 4)
+        else {
+          // try to handle correctly spaces at the beginning of the filename
+          // token[2] must begin at offset 24, the length is 5 or 10
+          // token[3] must begin at offset 39 or higher
+          if (tokens[2] - line == 24 && (toklen[2] == 5 || toklen[2] == 10) &&
+              tokens[3] - line >= 39) {
+            result.filename = &(line[39]);
+            result.filenameLength = p - result.filename;
+          }
+
+          if ((tokens[2][1]) != 'D') /* not <DIR> */
           {
-            p = result.filename;
-            for (pos = result.filenameLength - 4; pos > 0; pos--)
+            result.type = FTPJunkEntry; /* unknown until junc for sure */
+            if (result.filenameLength > 4)
             {
-              if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
-                  (p[1] == '=' || p[1] == '-'))
+              p = result.filename;
+              for (pos = result.filenameLength - 4; pos > 0; pos--)
               {
-                result.type = FTPLinkEntry;
-                result.filenameLength = p - result.filename;
-                result.linkname = p + 4;
-                result.linknameLength = &(line[linelen_sans_wsp]) 
-                                   - result.linkname;
-                break;
+                if (p[0] == ' ' && p[3] == ' ' && p[2] == '>' &&
+                    (p[1] == '=' || p[1] == '-'))
+                {
+                  result.type = FTPLinkEntry;
+                  result.filenameLength = p - result.filename;
+                  result.linkname = p + 4;
+                  result.linknameLength = &(line[linelen]) 
+                                     - result.linkname;
+                  break;
+                }
+                p++;
               }
-              p++;
             }    
           }
         }
@@ -821,8 +853,13 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
           result.modifiedTime.tm_mon--;
           result.modifiedTime.tm_mday = atoi(tokens[0]+3);
           result.modifiedTime.tm_year = atoi(tokens[0]+6);
+          /* if year has only two digits then assume that
+               00-79 is 2000-2079
+               80-99 is 1980-1999 */
           if (result.modifiedTime.tm_year < 80)
-            result.modifiedTime.tm_year += 100;
+            result.modifiedTime.tm_year += 2000;
+          else if (result.modifiedTime.tm_year < 100)
+            result.modifiedTime.tm_year += 1900;
         }
 
         result.modifiedTime.tm_hour = atoi(tokens[1]+0);
@@ -974,6 +1011,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        * "drwxr-xr-x  2 0  0  512 May 28 22:17 etc"
       */
     
+      bool isOldHellsoft = false;
+    
       if (numtoks >= 6)
       {
         /* there are two perm formats (Hellsoft/NetWare and *IX strmode(3)).
@@ -999,6 +1038,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               /* rest is FMA[S] or AFM[S] */
               lstyle = 'U'; /* very likely one of the NetWare servers */
+              if (toklen[0] == 10)
+                isOldHellsoft = true;
             }
           }
         }
@@ -1063,7 +1104,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
             /* check that size is numeric */
             p = tokens[tokmarker];
-            for (pos = 0; lstyle && pos < toklen[tokmarker]; pos++)
+            for (unsigned int i = 0; lstyle && i < toklen[tokmarker]; ++i)
             {
               if (!isASCIIDigit(*p++))
                 lstyle = 0;
@@ -1072,11 +1113,11 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
             {
               month_num = 0;
               p = tokens[tokmarker+1];
-              for (pos = 0;pos < (12*3); pos+=3)
+              for (unsigned int i = 0; i < (12*3); i+=3)
               {
-                if (p[0] == month_names[pos+0] && 
-                    p[1] == month_names[pos+1] && 
-                    p[2] == month_names[pos+2])
+                if (p[0] == month_names[i+0] && 
+                    p[1] == month_names[i+1] && 
+                    p[2] == month_names[i+2])
                   break;
                 month_num++;
               }
@@ -1084,8 +1125,8 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
                 lstyle = 0;
             }
           } /* relative position test */
-        } /* while (pos+5) < numtoks */
-      } /* if (numtoks >= 4) */
+        } /* for (pos = (numtoks-5); !lstyle && pos > 1; pos--) */
+      } /* if (lstyle == 'U') */
 
       if (lstyle == 'U')
       {
@@ -1144,24 +1185,49 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
        
         } /* time/year */
         
-        result.filename = tokens[tokmarker+4];
-        result.filenameLength = (&(line[linelen_sans_wsp]))
+        // there is exacly 1 space between filename and previous token in all
+        // outputs except old Hellsoft
+        if (!isOldHellsoft)
+          result.filename = tokens[tokmarker+3] + toklen[tokmarker+3] + 1;
+        else
+          result.filename = tokens[tokmarker+4];
+
+        result.filenameLength = (&(line[linelen]))
                            - (result.filename);
 
         if (result.type == FTPLinkEntry && result.filenameLength > 4)
         {
-          p = result.filename + 1;
-          for (pos = 1; pos < (result.filenameLength - 4); pos++)
+          /* First try to use result.fe_size to find " -> " sequence.
+             This can give proper result for cases like "aaa -> bbb -> ccc". */
+          unsigned int fileSize = result.fileSize.toUInt();
+
+          if (result.filenameLength > (fileSize + 4) &&
+              strncmp(result.filename + result.filenameLength - fileSize - 4, " -> ", 4) == 0)
+          {
+            result.linkname = result.filename + (result.filenameLength - fileSize);
+            result.linknameLength = (&(line[linelen])) - (result.linkname);
+            result.filenameLength -= fileSize + 4;
+          }
+          else
           {
-            if (*p == ' ' && p[1] == '-' && p[2] == '>' && p[3] == ' ')
+            /* Search for sequence " -> " from the end for case when there are
+               more occurrences. F.e. if ftpd returns "a -> b -> c" assume
+               "a -> b" as a name. Powerusers can remove unnecessary parts
+               manually but there is no way to follow the link when some
+               essential part is missing. */
+            p = result.filename + (result.filenameLength - 5);
+            for (pos = (result.filenameLength - 5); pos > 0; pos--)
             {
-              result.linkname = p + 4;
-              result.linknameLength = (&(line[linelen_sans_wsp]))
-                               - (result.linkname);
-              result.filenameLength = pos;
-              break;
+              if (strncmp(p, " -> ", 4) == 0)
+              {
+                result.linkname = p + 4;
+                result.linknameLength = (&(line[linelen]))
+                                 - (result.linkname);
+                result.filenameLength = pos;
+                break;
+              }
+              p--;
             }
-            p++;
           }
         }
 
@@ -1618,9 +1684,7 @@ FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& res
 
   } /* if (linelen > 0) */
 
-  if (state.parsedOne || state.listStyle) /* junk if we fail to parse */
-    return FTPJunkEntry;      /* this time but had previously parsed sucessfully */
-  return FTPMiscEntry;        /* its part of a comment or error message */
+  return ParsingFailed(state);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index c28040f..9dfefcd 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -73,6 +73,7 @@
 #include "Page.h"
 #include "PageCache.h"
 #include "PageGroup.h"
+#include "PageTransitionEvent.h"
 #include "PlaceholderDocument.h"
 #include "PluginData.h"
 #include "PluginDocument.h"
@@ -89,6 +90,11 @@
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
+
+#if ENABLE(SHARED_WORKERS)
+#include "SharedWorkerRepository.h"
+#endif
+
 #include "TextResourceDecoder.h"
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
@@ -108,6 +114,7 @@
 #include "SVGViewSpec.h"
 #endif
 
+<<<<<<< HEAD:WebCore/loader/FrameLoader.cpp
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
 #include "RenderArena.h"
@@ -115,6 +122,10 @@
 
 #if PLATFORM(ANDROID)
 #include "WebCoreFrameBridge.h"
+=======
+#if PLATFORM(MAC) || PLATFORM(WIN)
+#define PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+>>>>>>> webkit.org at 49305:WebCore/loader/FrameLoader.cpp
 #endif
 
 namespace WebCore {
@@ -124,91 +135,12 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, formSubmission };
-
-    const Type type;
-    const double delay;
-    const String url;
-    const String referrer;
-    const FrameLoadRequest frameRequest;
-    const RefPtr<Event> event;
-    const RefPtr<FormState> formState;
-    const int historySteps;
-    const bool lockHistory;
-    const bool lockBackForwardList;
-    const bool wasUserGesture;
-    const bool wasRefresh;
-    const bool wasDuringLoad;
-
-    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
-        : type(redirection)
-        , delay(delay)
-        , url(url)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(false)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
-        : type(locationChange)
-        , delay(0)
-        , url(url)
-        , referrer(referrer)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(wasUserGesture)
-        , wasRefresh(refresh)
-        , wasDuringLoad(duringLoad)
-    {
-        ASSERT(!url.isEmpty());
-    }
-
-    explicit ScheduledRedirection(int historyNavigationSteps)
-        : type(historyNavigation)
-        , delay(0)
-        , historySteps(historyNavigationSteps)
-        , lockHistory(false)
-        , lockBackForwardList(false)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(false)
-    {
-    }
-
-    ScheduledRedirection(const FrameLoadRequest& frameRequest,
-            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
-            bool duringLoad)
-        : type(formSubmission)
-        , delay(0)
-        , frameRequest(frameRequest)
-        , event(event)
-        , formState(formState)
-        , historySteps(0)
-        , lockHistory(lockHistory)
-        , lockBackForwardList(lockBackForwardList)
-        , wasUserGesture(false)
-        , wasRefresh(false)
-        , wasDuringLoad(duringLoad)
-    {
-        ASSERT(!frameRequest.isEmpty());
-        ASSERT(this->formState);
-    }
-};
- 
 #if ENABLE(XHTMLMP)
 static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #else
 static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
 #endif
 static double storedTimeOfLastCompletedLoad;
-static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
 bool isBackForwardLoadType(FrameLoadType type)
 {
@@ -246,12 +178,10 @@ static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
+    , m_policyChecker(frame)
     , m_state(FrameStateCommittedPage)
     , m_loadType(FrameLoadTypeStandard)
-    , m_policyLoadType(FrameLoadTypeStandard)
     , m_delegateIsHandlingProvisionalLoadError(false)
-    , m_delegateIsDecidingNavigationPolicy(false)
-    , m_delegateIsHandlingUnimplementablePolicy(false)
     , m_firstLayoutDone(false)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
@@ -263,20 +193,19 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
-    , m_cancellingWithLoadInProgress(false)
     , m_needsClear(false)
     , m_receivedData(false)
     , m_encodingWasChosenByUser(false)
     , m_containsPlugIns(false)
-    , m_redirectionTimer(this, &FrameLoader::redirectionTimerFired)
-    , m_checkCompletedTimer(this, &FrameLoader::checkCompletedTimerFired)
-    , m_checkLoadCompleteTimer(this, &FrameLoader::checkLoadCompleteTimerFired)
+    , m_checkTimer(this, &FrameLoader::checkTimerFired)
+    , m_shouldCallCheckCompleted(false)
+    , m_shouldCallCheckLoadComplete(false)
     , m_opener(0)
-    , m_openedByDOM(false)
     , m_creatingInitialEmptyDocument(false)
     , m_isDisplayingInitialEmptyDocument(false)
     , m_committedFirstRealDocumentLoad(false)
     , m_didPerformFirstNavigation(false)
+    , m_loadingFromCachedPage(false)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
@@ -299,7 +228,7 @@ void FrameLoader::init()
     // this somewhat odd set of steps is needed to give the frame an initial empty document
     m_isDisplayingInitialEmptyDocument = false;
     m_creatingInitialEmptyDocument = true;
-    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL("")), SubstituteData()).get());
+    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL(ParsedURLString, "")), SubstituteData()).get());
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
@@ -319,6 +248,11 @@ void FrameLoader::setDefersLoading(bool defers)
         m_provisionalDocumentLoader->setDefersLoading(defers);
     if (m_policyDocumentLoader)
         m_policyDocumentLoader->setDefersLoading(defers);
+
+    if (!defers) {
+        m_frame->redirectScheduler()->startTimer();
+        startCheckCompleteTimer();
+    }
 }
 
 Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest& request, const WindowFeatures& features, bool& created)
@@ -433,7 +367,7 @@ bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
+        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, isProcessingUserGesture());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -458,12 +392,12 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
         marginHeight = o->getMarginHeight();
     }
 
-    if (!canLoad(url, referrer)) {
+    if (!SecurityOrigin::canLoad(url, referrer, 0)) {
         FrameLoader::reportLocalLoadFailed(m_frame, url.string());
         return 0;
     }
 
-    bool hideReferrer = shouldHideReferrer(url, referrer);
+    bool hideReferrer = SecurityOrigin::shouldHideReferrer(url, referrer);
     RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
@@ -571,23 +505,27 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
+    targetFrame->redirectScheduler()->scheduleFormSubmission(frameRequest, lockHistory, event, formState);
 }
 
-void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
+void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
 {
     if (m_frame->document() && m_frame->document()->tokenizer())
         m_frame->document()->tokenizer()->stopParsing();
 
-    if (sendUnload) {
+    if (unloadEventPolicy != UnloadEventPolicyNone) {
         if (m_frame->document()) {
             if (m_didCallImplicitClose && !m_wasUnloadEventEmitted) {
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
                 m_unloadEventBeingDispatched = true;
-                if (m_frame->domWindow())
-                    m_frame->domWindow()->dispatchUnloadEvent();
+                if (m_frame->domWindow()) {
+                    if (unloadEventPolicy == UnloadEventPolicyUnloadAndPageHide)
+                        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, m_frame->document()->inPageCache()), m_frame->document());
+                    if (!m_frame->document()->inPageCache())
+                        m_frame->domWindow()->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), m_frame->domWindow()->document());
+                }
                 m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
                     m_frame->document()->updateStyleIfNeeded();
@@ -600,7 +538,7 @@ void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
             m_frame->document()->removeAllEventListeners();
     }
 
-    m_isComplete = true; // to avoid calling completed() in finishedParsing() (David)
+    m_isComplete = true; // to avoid calling completed() in finishedParsing()
     m_isLoadingMainResource = false;
     m_didCallImplicitClose = true; // don't want that one either
 
@@ -623,9 +561,9 @@ void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
 
     // tell all subframes to stop as well
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->stopLoading(sendUnload);
+        child->loader()->stopLoading(unloadEventPolicy);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 }
 
 void FrameLoader::stop()
@@ -645,20 +583,15 @@ void FrameLoader::stop()
 bool FrameLoader::closeURL()
 {
     saveDocumentState();
-    stopLoading(true);
+    
+    // Should only send the pagehide event here if the current document exists and has not been placed in the page cache.    
+    Document* currentDocument = m_frame->document();
+    stopLoading(currentDocument && !currentDocument->inPageCache() ? UnloadEventPolicyUnloadAndPageHide : UnloadEventPolicyUnloadOnly);
+    
     m_frame->editor()->clearUndoRedoOperations();
     return true;
 }
 
-void FrameLoader::cancelRedirection(bool cancelWithLoadInProgress)
-{
-    m_cancellingWithLoadInProgress = cancelWithLoadInProgress;
-
-    stopRedirectionTimer();
-
-    m_scheduledRedirection.clear();
-}
-
 KURL FrameLoader::iconURL()
 {
     // If this isn't a top level frame, return nothing
@@ -667,7 +600,7 @@ KURL FrameLoader::iconURL()
 
     // If we have an iconURL from a Link element, return that
     if (!m_frame->document()->iconURL().isEmpty())
-        return KURL(m_frame->document()->iconURL());
+        return KURL(ParsedURLString, m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
     if (!m_URL.protocolInHTTPFamily())
@@ -684,13 +617,13 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
+    if (m_frame->redirectScheduler()->redirectScheduledDuringLoad()) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
     }
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
     closeURL();
 
@@ -727,7 +660,7 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Cancelling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    cancelRedirection(); 
+    m_frame->redirectScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
         m_URL = m_frame->document()->url();
 }
@@ -742,8 +675,10 @@ bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool
 
     const int javascriptSchemeLength = sizeof("javascript:") - 1;
 
-    String script = decodeURLEscapeSequences(url.string().substring(javascriptSchemeLength));
-    ScriptValue result = executeScript(script, userGesture);
+    String script = url.string().substring(javascriptSchemeLength);
+    ScriptValue result;
+    if (m_frame->script()->xssAuditor()->canEvaluateJavaScriptURL(script))
+        result = executeScript(decodeURLEscapeSequences(script), userGesture);
 
     String scriptResult;
     if (!result.getString(scriptResult))
@@ -789,7 +724,7 @@ ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
 
 void FrameLoader::cancelAndClear()
 {
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     if (!m_isComplete)
         closeURL();
@@ -798,7 +733,7 @@ void FrameLoader::cancelAndClear()
     m_frame->script()->updatePlatformScriptObjects();
 }
 
-void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
+void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, bool clearFrameView)
 {
     m_frame->editor()->clear();
 
@@ -825,7 +760,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
 
     m_frame->selection()->clear();
     m_frame->eventHandler()->clear();
-    if (m_frame->view())
+    if (clearFrameView && m_frame->view())
         m_frame->view()->clear();
 
     m_frame->setSelectionGranularity(CharacterGranularity);
@@ -840,11 +775,11 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
     if (clearScriptObjects)
         m_frame->script()->clearScriptObjects();
 
-    m_redirectionTimer.stop();
-    m_scheduledRedirection.clear();
+    m_frame->redirectScheduler()->clear();
 
-    m_checkCompletedTimer.stop();
-    m_checkLoadCompleteTimer.stop();
+    m_checkTimer.stop();
+    m_shouldCallCheckCompleted = false;
+    m_shouldCallCheckLoadComplete = false;
 
     m_receivedData = false;
     m_isDisplayingInitialEmptyDocument = false;
@@ -881,7 +816,7 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    scheduleHTTPRedirection(delay, url);
+    m_frame->redirectScheduler()->scheduleRedirect(delay, url);
 }
 
 const String& FrameLoader::responseMIMEType() const
@@ -933,12 +868,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
+    document->setURL(m_URL);
     m_frame->setDocument(document);
 
-    if (dispatch)
-        dispatchWindowObjectAvailable();
-
-    document->setURL(m_URL);
     if (m_decoder)
         document->setDecoder(m_decoder.get());
     if (forcedSecurityOrigin)
@@ -947,6 +879,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
+    if (dispatch)
+        dispatchWindowObjectAvailable();
+    
     updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
@@ -961,12 +896,6 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
             document->parseDNSPrefetchControlHeader(dnsPrefetchControl);
     }
 
-#if FRAME_LOADS_USER_STYLESHEET
-    KURL userStyleSheet = settings ? settings->userStyleSheetLocation() : KURL();
-    if (!userStyleSheet.isEmpty())
-        m_frame->setUserStyleSheetLocation(userStyleSheet);
-#endif
-
     restoreDocumentState();
 
     document->implicitOpen();
@@ -1146,21 +1075,6 @@ void FrameLoader::startIconLoader()
     m_iconLoader->startLoading();
 }
 
-void FrameLoader::setLocalLoadPolicy(LocalLoadPolicy policy)
-{
-    localLoadPolicy = policy;
-}
-
-bool FrameLoader::restrictAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForAll;
-}
-
-bool FrameLoader::allowSubstituteDataAccessToLocal()
-{
-    return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1220,6 +1134,8 @@ void FrameLoader::finishedParsing()
     if (m_creatingInitialEmptyDocument)
         return;
 
+    m_frame->injectUserScripts(InjectAtDocumentEnd);
+
     // This can be called from the Frame's destructor, in which case we shouldn't protect ourselves
     // because doing so will cause us to re-enter the destructor when protector goes out of scope.
     // Null-checking the FrameView indicates whether or not we're in the destructor.
@@ -1244,15 +1160,34 @@ void FrameLoader::loadDone()
     checkCompleted();
 }
 
+bool FrameLoader::allChildrenAreComplete() const
+{
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        if (!child->loader()->m_isComplete)
+            return false;
+    }
+    return true;
+}
+
+bool FrameLoader::allAncestorsAreComplete() const
+{
+    for (Frame* ancestor = m_frame; ancestor; ancestor = ancestor->tree()->parent()) {
+        if (!ancestor->loader()->m_isComplete)
+            return false;
+    }
+    return true;
+}
+
 void FrameLoader::checkCompleted()
 {
+    m_shouldCallCheckCompleted = false;
+
     if (m_frame->view())
         m_frame->view()->checkStopDelayingDeferredRepaints();
 
     // Any frame that hasn't completed yet?
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!child->loader()->m_isComplete)
-            return;
+    if (!allChildrenAreComplete())
+        return;
 
     // Have we completed before?
     if (m_isComplete)
@@ -1272,38 +1207,44 @@ void FrameLoader::checkCompleted()
     RefPtr<Frame> protect(m_frame);
     checkCallImplicitClose(); // if we didn't do it before
 
-    // Do not start a redirection timer for subframes here.
-    // That is deferred until the parent is completed.
-    if (m_scheduledRedirection && !m_frame->tree()->parent())
-        startRedirectionTimer();
+    m_frame->redirectScheduler()->startTimer();
 
     completed();
     if (m_frame->page())
         checkLoadComplete();
 }
 
-void FrameLoader::checkCompletedTimerFired(Timer<FrameLoader>*)
+void FrameLoader::checkTimerFired(Timer<FrameLoader>*)
 {
-    checkCompleted();
+    if (Page* page = m_frame->page()) {
+        if (page->defersLoading())
+            return;
+    }
+    if (m_shouldCallCheckCompleted)
+        checkCompleted();
+    if (m_shouldCallCheckLoadComplete)
+        checkLoadComplete();
 }
 
-void FrameLoader::scheduleCheckCompleted()
+void FrameLoader::startCheckCompleteTimer()
 {
-    if (!m_checkCompletedTimer.isActive())
-        m_checkCompletedTimer.startOneShot(0);
+    if (!(m_shouldCallCheckCompleted || m_shouldCallCheckLoadComplete))
+        return;
+    if (m_checkTimer.isActive())
+        return;
+    m_checkTimer.startOneShot(0);
 }
 
-void FrameLoader::checkLoadCompleteTimerFired(Timer<FrameLoader>*)
+void FrameLoader::scheduleCheckCompleted()
 {
-    if (!m_frame->page())
-        return;
-    checkLoadComplete();
+    m_shouldCallCheckCompleted = true;
+    startCheckCompleteTimer();
 }
 
 void FrameLoader::scheduleCheckLoadComplete()
 {
-    if (!m_checkLoadCompleteTimer.isActive())
-        m_checkLoadCompleteTimer.startOneShot(0);
+    m_shouldCallCheckLoadComplete = true;
+    startCheckCompleteTimer();
 }
 
 void FrameLoader::checkCallImplicitClose()
@@ -1311,9 +1252,8 @@ void FrameLoader::checkCallImplicitClose()
     if (m_didCallImplicitClose || m_frame->document()->parsing())
         return;
 
-    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!child->loader()->m_isComplete) // still got a frame running -> too early
-            return;
+    if (!allChildrenAreComplete())
+        return; // still got a frame running -> too early
 
     m_didCallImplicitClose = true;
     m_wasUnloadEventEmitted = false;
@@ -1332,183 +1272,6 @@ KURL FrameLoader::completeURL(const String& url)
     return m_frame->document()->completeURL(url);
 }
 
-void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
-{
-    if (delay < 0 || delay > INT_MAX / 1000)
-        return;
-        
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    // We want a new history item if the refresh timeout is > 1 second.
-    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
-}
-
-static bool mustLockBackForwardList(Frame* targetFrame)
-{
-    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
-    // The definition of "during load" is any time before all handlers for the load event have been run.
-    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
-    
-    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
-        Document* document = ancestor->document();
-        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
-            return true;
-    }
-    return false;
-}    
-
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (url.isEmpty())
-        return;
-
-    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
-
-    // If the URL we're going to navigate to is the same as the current one, except for the
-    // fragment part, we don't need to schedule the location change.
-    KURL parsedURL(url);
-    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(m_URL, parsedURL)) {
-        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
-        return;
-    }
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
-}
-
-void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
-    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
-{
-    ASSERT(m_frame->page());
-    ASSERT(!frameRequest.isEmpty());
-
-    // FIXME: Do we need special handling for form submissions where the URL is the same
-    // as the current one except for the fragment part? See scheduleLocationChange above.
-
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame changes the location of another frame.
-    bool duringLoad = !m_committedFirstRealDocumentLoad;
-
-    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
-}
-
-void FrameLoader::scheduleRefresh(bool wasUserGesture)
-{
-    if (!m_frame->page())
-        return;
-
-    if (m_URL.isEmpty())
-        return;
-
-    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
-}
-
-bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
-{
-    switch (redirection.type) {
-        case ScheduledRedirection::redirection:
-            return false;
-        case ScheduledRedirection::historyNavigation:
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::formSubmission:
-            return true;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::scheduleHistoryNavigation(int steps)
-{
-    if (!m_frame->page())
-        return;
-
-    // navigation will always be allowed in the 0 steps case, which is OK because that's supposed to force a reload.
-    if (!canGoBackOrForward(steps)) {
-        cancelRedirection();
-        return;
-    }
-
-    scheduleRedirection(new ScheduledRedirection(steps));
-}
-
-void FrameLoader::goBackOrForward(int distance)
-{
-    if (distance == 0)
-        return;
-        
-    Page* page = m_frame->page();
-    if (!page)
-        return;
-    BackForwardList* list = page->backForwardList();
-    if (!list)
-        return;
-    
-    HistoryItem* item = list->itemAtIndex(distance);
-    if (!item) {
-        if (distance > 0) {
-            int forwardListCount = list->forwardListCount();
-            if (forwardListCount > 0) 
-                item = list->itemAtIndex(forwardListCount);
-        } else {
-            int backListCount = list->backListCount();
-            if (backListCount > 0)
-                item = list->itemAtIndex(-backListCount);
-        }
-    }
-    
-    ASSERT(item); // we should not reach this line with an empty back/forward list
-    if (item)
-        page->goToItem(item, FrameLoadTypeIndexedBackForward);
-}
-
-void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
-{
-    ASSERT(m_frame->page());
-
-    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
-
-    switch (redirection->type) {
-        case ScheduledRedirection::redirection:
-        case ScheduledRedirection::locationChange:
-            changeLocation(KURL(redirection->url), redirection->referrer,
-                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
-            return;
-        case ScheduledRedirection::historyNavigation:
-            if (redirection->historySteps == 0) {
-                // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
-                return;
-            }
-            // go(i!=0) from a frame navigates into the history of the frame only,
-            // in both IE and NS (but not in Mozilla). We can't easily do that.
-            goBackOrForward(redirection->historySteps);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // The submitForm function will find a target frame before using the redirection timer.
-            // Now that the timer has fired, we need to repeat the security check which normally is done when
-            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
-            // without leaving a time window. If we fail the check just silently drop the form submission.
-            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
-                return;
-            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
-                redirection->event, redirection->formState);
-            return;
-    }
-
-    ASSERT_NOT_REACHED();
-}
-
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
@@ -1527,7 +1290,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
-            workingURL = KURL(childItem->originalURLString());
+            workingURL = KURL(ParsedURLString, childItem->originalURLString());
             childLoadType = loadType;
             childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
@@ -1716,7 +1479,7 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     if (renderer && !useFallback) {
         HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
-        if (!canLoad(url, String(), frame()->document())) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
@@ -1733,12 +1496,6 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     return widget != 0;
 }
 
-void FrameLoader::parentCompleted()
-{
-    if (m_scheduledRedirection && !m_redirectionTimer.isActive())
-        startRedirectionTimer();
-}
-
 String FrameLoader::outgoingReferrer() const
 {
     return m_outgoingReferrer;
@@ -1749,6 +1506,33 @@ String FrameLoader::outgoingOrigin() const
     return m_frame->document()->securityOrigin()->toString();
 }
 
+bool FrameLoader::isMixedContent(SecurityOrigin* context, const KURL& url)
+{
+    if (context->protocol() != "https")
+        return false;  // We only care about HTTPS security origins.
+
+    if (url.protocolIs("https") || url.protocolIs("about") || url.protocolIs("data"))
+        return false;  // Loading these protocols is secure.
+
+    return true;
+}
+
+void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didDisplayInsecureContent();
+}
+
+void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL& url)
+{
+    if (!isMixedContent(context, url))
+        return;
+
+    m_client->didRunInsecureContent(context);
+}
+
 Frame* FrameLoader::opener()
 {
     return m_opener;
@@ -1768,16 +1552,6 @@ void FrameLoader::setOpener(Frame* opener)
     }
 }
 
-bool FrameLoader::openedByDOM() const
-{
-    return m_openedByDOM;
-}
-
-void FrameLoader::setOpenedByDOM()
-{
-    m_openedByDOM = true;
-}
-
 void FrameLoader::handleFallbackContent()
 {
     HTMLFrameOwnerElement* owner = m_frame->ownerElement();
@@ -1793,7 +1567,7 @@ void FrameLoader::provisionalLoadStarted()
         android::TimeCounter::reset();
 #endif
     m_firstLayoutDone = false;
-    cancelRedirection(true);
+    m_frame->redirectScheduler()->cancel(true);
     m_client->provisionalLoadStarted();
 }
 
@@ -1839,9 +1613,13 @@ static inline bool frameContainsWMLContent(Frame* frame)
 
 bool FrameLoader::canCachePageContainingThisFrame()
 {
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling()) {
+        if (!child->loader()->canCachePageContainingThisFrame())
+            return false;
+    }
+            
     return m_documentLoader
         && m_documentLoader->mainDocumentError().isNull()
-        && !m_frame->tree()->childCount()
         // FIXME: If we ever change this so that frames with plug-ins will be cached,
         // we need to make sure that we don't cache frames that have outstanding NPObjects
         // (objects created by the plug-in). Since there is no way to pause/resume a Netscape plug-in,
@@ -1849,10 +1627,15 @@ bool FrameLoader::canCachePageContainingThisFrame()
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
+#endif
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
+#if ENABLE(SHARED_WORKERS)
+        && !SharedWorkerRepository::hasSharedWorkers(m_frame->document())
+#endif
         && !m_frame->document()->usingGeolocation()
         && m_currentHistoryItem
         && !m_quickRedirectComing
@@ -1987,18 +1770,22 @@ bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
         }
         if (!m_documentLoader->mainDocumentError().isNull())
             { PCLOG("   -Main document has an error"); cannotCache = true; }
-        if (m_frame->tree()->childCount())
-            { PCLOG("   -Frame has child frames"); cannotCache = true; }
         if (m_containsPlugIns)
             { PCLOG("   -Frame contains plugins"); cannotCache = true; }
         if (m_URL.protocolIs("https"))
             { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
-        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+#ifndef PAGE_CACHE_ACCEPTS_UNLOAD_HANDLERS
+        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
             { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
+#endif
 #if ENABLE(DATABASE)
         if (m_frame->document()->hasOpenDatabases())
             { PCLOG("   -Frame has open database handles"); cannotCache = true; }
 #endif
+#if ENABLE(SHARED_WORKERS)
+        if (SharedWorkerRepository::hasSharedWorkers(m_frame->document()))
+            { PCLOG("   -Frame has associated SharedWorkers"); cannotCache = true; }
+#endif
         if (m_frame->document()->usingGeolocation())
             { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
         if (!m_currentHistoryItem)
@@ -2055,7 +1842,7 @@ public:
     virtual void performTask(ScriptExecutionContext* context)
     {
         ASSERT_UNUSED(context, context->isDocument());
-        m_document->dispatchWindowEvent(eventNames().hashchangeEvent, false, false);
+        m_document->dispatchWindowEvent(Event::create(eventNames().hashchangeEvent, false, false));
     }
     
 private:
@@ -2067,7 +1854,7 @@ private:
     
     RefPtr<Document> m_document;
 };
-    
+
 // This does the same kind of work that didOpenURL does, except it relies on the fact
 // that a higher level already checked that the URLs match and the scrolling is the right thing to do.
 void FrameLoader::scrollToAnchor(const KURL& url)
@@ -2097,86 +1884,11 @@ bool FrameLoader::isComplete() const
     return m_isComplete;
 }
 
-void FrameLoader::scheduleRedirection(ScheduledRedirection* redirection)
-{
-    ASSERT(m_frame->page());
-
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (redirection->wasDuringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
-    }
-
-    stopRedirectionTimer();
-    m_scheduledRedirection.set(redirection);
-    if (!m_isComplete && redirection->type != ScheduledRedirection::redirection)
-        completed();
-    if (m_isComplete || redirection->type != ScheduledRedirection::redirection)
-        startRedirectionTimer();
-}
-
-void FrameLoader::startRedirectionTimer()
-{
-    ASSERT(m_frame->page());
-    ASSERT(m_scheduledRedirection);
-
-    m_redirectionTimer.stop();
-    m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
-
-    switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::redirection:
-            clientRedirected(KURL(m_scheduledRedirection->url),
-                m_scheduledRedirection->delay,
-                currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockBackForwardList);
-            return;
-        case ScheduledRedirection::formSubmission:
-            // FIXME: It would make sense to report form submissions as client redirects too.
-            // But we didn't do that in the past when form submission used a separate delay
-            // mechanism, so doing it will be a behavior change.
-            return;
-        case ScheduledRedirection::historyNavigation:
-            // Don't report history navigations.
-            return;
-    }
-    ASSERT_NOT_REACHED();
-}
-
-void FrameLoader::stopRedirectionTimer()
-{
-    if (!m_redirectionTimer.isActive())
-        return;
-
-    m_redirectionTimer.stop();
-
-    if (m_scheduledRedirection) {
-        switch (m_scheduledRedirection->type) {
-            case ScheduledRedirection::locationChange:
-            case ScheduledRedirection::redirection:
-                clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
-                return;
-            case ScheduledRedirection::formSubmission:
-                // FIXME: It would make sense to report form submissions as client redirects too.
-                // But we didn't do that in the past when form submission used a separate delay
-                // mechanism, so doing it will be a behavior change.
-                return;
-            case ScheduledRedirection::historyNavigation:
-                // Don't report history navigations.
-                return;
-        }
-        ASSERT_NOT_REACHED();
-    }
-}
-
 void FrameLoader::completed()
 {
     RefPtr<Frame> protect(m_frame);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->parentCompleted();
+        child->redirectScheduler()->startTimer();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
     if (m_frame->view())
@@ -2243,13 +1955,13 @@ void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHis
 
     ASSERT(frame()->document());
     if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
-        if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
+        if (!SecurityOrigin::canLoad(url, String(), frame()->document()) && !SecurityOrigin::canLoad(url, referrer, 0)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
         }
     }
 
-    if (shouldHideReferrer(url, referrer))
+    if (SecurityOrigin::shouldHideReferrer(url, referrer))
         referrer = String();
     
     FrameLoadType loadType;
@@ -2319,10 +2031,14 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
         return;
     }
 
+    if (m_unloadEventBeingDispatched)
+        return;
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
     if (!targetFrame && !frameName.isEmpty()) {
-        checkNewWindowPolicy(action, request, formState.release(), frameName);
+        policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy,
+            request, formState.release(), frameName, this);
         return;
     }
 
@@ -2335,8 +2051,9 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     // work properly.
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
+        policyChecker()->stopCheck();
+        policyChecker()->setLoadType(newLoadType);
+        policyChecker()->checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
@@ -2385,7 +2102,7 @@ void FrameLoader::load(const ResourceRequest& request, const String& frameName,
         return;
     }
 
-    checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
+    policyChecker()->checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), FrameLoader::callContinueLoadAfterNewWindowPolicy, request, 0, frameName, this);
 }
 
 void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
@@ -2440,54 +2157,37 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
     ASSERT(m_frame->view());
 
-    m_policyLoadType = type;
+    if (m_unloadEventBeingDispatched)
+        return;
+
+    policyChecker()->setLoadType(type);
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
 
     const KURL& newURL = loader->request().url();
 
-    if (shouldScrollToAnchor(isFormSubmission, m_policyLoadType, newURL)) {
+    if (shouldScrollToAnchor(isFormSubmission, policyChecker()->loadType(), newURL)) {
         RefPtr<DocumentLoader> oldDocumentLoader = m_documentLoader;
-        NavigationAction action(newURL, m_policyLoadType, isFormSubmission);
+        NavigationAction action(newURL, policyChecker()->loadType(), isFormSubmission);
 
         oldDocumentLoader->setTriggeringAction(action);
-        stopPolicyCheck();
-        checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
+        policyChecker()->stopCheck();
+        policyChecker()->checkNavigationPolicy(loader->request(), oldDocumentLoader.get(), formState,
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         if (Frame* parent = m_frame->tree()->parent())
             loader->setOverrideEncoding(parent->loader()->documentLoader()->overrideEncoding());
 
-        stopPolicyCheck();
+        policyChecker()->stopCheck();
         setPolicyDocumentLoader(loader);
         if (loader->triggeringAction().isEmpty())
-            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
+            loader->setTriggeringAction(NavigationAction(newURL, policyChecker()->loadType(), isFormSubmission));
 
-        checkNavigationPolicy(loader->request(), loader, formState,
+        policyChecker()->checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
     }
 }
 
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
-{
-    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
-}
-
-bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
-{
-    // We can always load any URL that isn't considered local (e.g. http URLs).
-    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
-        return true;
-
-    // If we were provided a document, we let its local file policy dictate the result,
-    // otherwise we allow local loads only if the supplied referrer is also local.
-    if (securityOrigin)
-        return securityOrigin->canLoadLocalResources();
-    if (!referrer.isEmpty())
-        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
-    return false;
-}
-
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
 {
     ASSERT(!url.isEmpty());
@@ -2497,22 +2197,6 @@ void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
     frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Not allowed to load local resource: " + url, 0, String());
 }
 
-bool FrameLoader::shouldHideReferrer(const KURL& url, const String& referrer)
-{
-    bool referrerIsSecureURL = protocolIs(referrer, "https");
-    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
-
-    if (!referrerIsWebURL)
-        return true;
-
-    if (!referrerIsSecureURL)
-        return false;
-
-    bool URLIsSecureURL = url.protocolIs("https");
-
-    return !URLIsSecureURL;
-}
-
 const ResourceRequest& FrameLoader::initialRequest() const
 {
     return activeDocumentLoader()->originalRequest();
@@ -2523,50 +2207,26 @@ void FrameLoader::receivedData(const char* data, int length)
     activeDocumentLoader()->receivedData(data, length);
 }
 
-void FrameLoader::handleUnimplementablePolicy(const ResourceError& error)
+bool FrameLoader::willLoadMediaElementURL(KURL& url)
 {
-    m_delegateIsHandlingUnimplementablePolicy = true;
-    m_client->dispatchUnableToImplementPolicy(error);
-    m_delegateIsHandlingUnimplementablePolicy = false;
-}
+    if (!m_client->shouldLoadMediaElementURL(url))
+        return false;
 
-void FrameLoader::cannotShowMIMEType(const ResourceResponse& response)
-{
-    handleUnimplementablePolicy(m_client->cannotShowMIMETypeError(response));
-}
+    ResourceRequest request(url);
 
-ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
-{
-    return m_client->interruptForPolicyChangeError(request);
-}
+    unsigned long identifier;
+    ResourceError error;
+    requestFromDelegate(request, identifier, error);
+    sendRemainingDelegateMessages(identifier, ResourceResponse(url, String(), -1, String(), String()), -1, error);
 
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
-{
-    checkNavigationPolicy(newRequest, activeDocumentLoader(), 0, function, argument);
+    url = request.url();
+
+    return error.isNull();
 }
 
-void FrameLoader::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+ResourceError FrameLoader::interruptionForPolicyChangeError(const ResourceRequest& request)
 {
-    ASSERT(activeDocumentLoader());
-    
-    // Always show content with valid substitute data.
-    if (activeDocumentLoader()->substituteData().isValid()) {
-        function(argument, PolicyUse);
-        return;
-    }
-
-#if ENABLE(FTPDIR)
-    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
-    Settings* settings = m_frame->settings();
-    if (settings && settings->forceFTPDirectoryListings() && MIMEType == "application/x-ftp-directory") {
-        function(argument, PolicyUse);
-        return;
-    }
-#endif
-
-    m_policyCheck.set(function, argument);
-    m_client->dispatchDecidePolicyForMIMEType(&FrameLoader::continueAfterContentPolicy,
-        MIMEType, activeDocumentLoader()->request());
+    return m_client->interruptForPolicyChangeError(request);
 }
 
 bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
@@ -2576,7 +2236,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     if (unreachableURL.isEmpty())
         return false;
 
-    if (!isBackForwardLoadType(m_policyLoadType))
+    if (!isBackForwardLoadType(policyChecker()->loadType()))
         return false;
 
     // We only treat unreachableURLs specially during the delegate callbacks
@@ -2585,7 +2245,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     // case handles malformed URLs and unknown schemes. Loading alternate content
     // at other times behaves like a standard load.
     DocumentLoader* compareDocumentLoader = 0;
-    if (m_delegateIsDecidingNavigationPolicy || m_delegateIsHandlingUnimplementablePolicy)
+    if (policyChecker()->delegateIsDecidingNavigationPolicy() || policyChecker()->delegateIsHandlingUnimplementablePolicy())
         compareDocumentLoader = m_policyDocumentLoader.get();
     else if (m_delegateIsHandlingProvisionalLoadError)
         compareDocumentLoader = m_provisionalDocumentLoader.get();
@@ -2676,7 +2336,8 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     //
     // Or the target frame is:
     //   - a top-level frame in the frame hierarchy and the active frame can
-    //     navigate the target frame's opener per above.
+    //     navigate the target frame's opener per above or it is the opener of
+    //     the target frame.
 
     if (!targetFrame)
         return true;
@@ -2691,6 +2352,10 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (targetFrame == m_frame->tree()->top())
         return true;
 
+    // Let a frame navigate its opener if the opener is a top-level window.
+    if (!targetFrame->tree()->parent() && m_frame->loader()->opener() == targetFrame)
+        return true;
+
     Document* activeDocument = m_frame->document();
     ASSERT(activeDocument);
     const SecurityOrigin* activeSecurityOrigin = activeDocument->securityOrigin();
@@ -2725,6 +2390,7 @@ void FrameLoader::stopLoadingSubframes()
 
 void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    ASSERT(!m_frame->document() || !m_frame->document()->inPageCache());
     if (m_unloadEventBeingDispatched)
         return;
 
@@ -2734,7 +2400,7 @@ void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 
     m_inStopAllLoaders = true;
 
-    stopPolicyCheck();
+    policyChecker()->stopCheck();
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
@@ -2862,7 +2528,8 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     RefPtr<CachedPage> cachedPage = prpCachedPage;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
 
-    LOG(Loading, "WebCoreLoading %s: About to commit provisional load from previous URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+    LOG(PageCache, "WebCoreLoading %s: About to commit provisional load from previous URL '%s' to new URL '%s'", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data(), 
+        pdl ? pdl->url().string().utf8().data() : "<no provisional DocumentLoader>");
 
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
@@ -2883,10 +2550,9 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_sentRedirectNotification)
         clientRedirectCancelledOrFinished(false);
     
-    if (cachedPage && cachedPage->document()) {
+    if (cachedPage && cachedPage->document())
         open(*cachedPage);
-        cachedPage->clear();
-    } else {        
+    else {        
         KURL url = pdl->substituteData().responseURL();
         if (url.isEmpty())
             url = pdl->url();
@@ -2903,11 +2569,11 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
     if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
         updateHistoryForClientRedirect();
 
-    if (m_documentLoader->isLoadingFromCachedPage()) {
+    if (m_loadingFromCachedPage) {
         m_frame->document()->documentDidBecomeActive();
         
         // Force a layout to update view size and thereby update scrollbars.
-        m_client->forceLayout();
+        m_frame->view()->forceLayout();
 
         const ResponseVector& responses = m_documentLoader->responses();
         size_t count = responses.size();
@@ -3104,7 +2770,7 @@ void FrameLoader::open(CachedPage& cachedPage)
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
-    cancelRedirection();
+    m_frame->redirectScheduler()->cancel();
 
     // We still have to close the previous part page.
     closeURL();
@@ -3115,13 +2781,12 @@ void FrameLoader::open(CachedPage& cachedPage)
         m_frame->setJSDefaultStatusBarText(String());
     }
 
-    open(*cachedPage.cachedMainFrame());
     cachedPage.restore(m_frame->page());
 
     checkCompleted();
 }
 
-void FrameLoader::open(CachedFrame& cachedFrame)
+void FrameLoader::open(CachedFrameBase& cachedFrame)
 {
     m_isComplete = false;
     
@@ -3137,8 +2802,7 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     m_workingURL = url;
 
     started();
-
-    clear();
+    clear(true, true, cachedFrame.isMainFrame());
 
     Document* document = cachedFrame.document();
     ASSERT(document);
@@ -3153,8 +2817,11 @@ void FrameLoader::open(CachedFrame& cachedFrame)
     
     // When navigating to a CachedFrame its FrameView should never be null.  If it is we'll crash in creative ways downstream.
     ASSERT(view);
-    if (view)
-        view->setWasScrolledByUser(false);
+    view->setWasScrolledByUser(false);
+
+    // Use the current ScrollView's frame rect.
+    if (m_frame->view())
+        view->setFrameRect(m_frame->view()->frameRect());
     m_frame->setView(view);
     
     m_frame->setDocument(document);
@@ -3215,12 +2882,6 @@ String FrameLoader::generatedMIMETypeForURLScheme(const String& URLScheme)
     return m_client->generatedMIMETypeForURLScheme(URLScheme);
 }
 
-void FrameLoader::cancelContentPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    m_policyCheck.clear();
-}
-
 void FrameLoader::didReceiveServerRedirectForProvisionalLoadForFrame()
 {
     m_client->dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -3344,14 +3005,6 @@ CachePolicy FrameLoader::subresourceCachePolicy() const
     return CachePolicyVerify;
 }
 
-void FrameLoader::stopPolicyCheck()
-{
-    m_client->cancelPolicyCheck();
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.cancel();
-}
-
 void FrameLoader::checkLoadCompleteForThisFrame()
 {
     ASSERT(m_client->hasWebView());
@@ -3456,14 +3109,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
     ASSERT_NOT_REACHED();
 }
 
-void FrameLoader::continueAfterContentPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-    check.call(policy);
-}
-
-void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
+void FrameLoader::continueLoadAfterWillSubmitForm()
 {
     if (!m_provisionalDocumentLoader)
         return;
@@ -3480,7 +3126,7 @@ void FrameLoader::continueLoadAfterWillSubmitForm(PolicyAction)
     if (activeDocLoader && activeDocLoader->isLoadingMainResource())
         return;
 
-    m_provisionalDocumentLoader->setLoadingFromCachedPage(false);
+    m_loadingFromCachedPage = false;
 
     unsigned long identifier = 0;
 
@@ -3544,7 +3190,7 @@ void FrameLoader::closeAndRemoveChild(Frame* child)
     child->tree()->detachFromParent();
 
     child->setView(0);
-    if (child->ownerElement())
+    if (child->ownerElement() && child->page())
         child->page()->decrementFrameCount();
     child->pageDestroyed();
 
@@ -3570,6 +3216,8 @@ void FrameLoader::checkLoadComplete()
 {
     ASSERT(m_client->hasWebView());
     
+    m_shouldCallCheckLoadComplete = false;
+
     // FIXME: Always traversing the entire frame tree is a bit inefficient, but 
     // is currently needed in order to null out the previous history item for all frames.
     if (Page* page = m_frame->page())
@@ -3618,12 +3266,13 @@ void FrameLoader::detachFromParent()
     saveScrollPositionAndViewStateToItem(currentHistoryItem());
     detachChildren();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->frameDetachedFromParent(m_frame);
+#endif
+
+    detachViewsAndDocumentLoader();
 
-    m_client->detachedFromParent2();
-    setDocumentLoader(0);
-    m_client->detachedFromParent3();
     if (Frame* parent = m_frame->tree()->parent()) {
         parent->loader()->closeAndRemoveChild(m_frame);
         parent->loader()->scheduleCheckCompleted();
@@ -3632,6 +3281,13 @@ void FrameLoader::detachFromParent()
         m_frame->pageDestroyed();
     }
 }
+
+void FrameLoader::detachViewsAndDocumentLoader()
+{
+    m_client->detachedFromParent2();
+    setDocumentLoader(0);
+    m_client->detachedFromParent3();
+}
     
 void FrameLoader::addExtraFieldsToSubresourceRequest(ResourceRequest& request)
 {
@@ -3759,7 +3415,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
         if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
             targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
-            checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
+            policyChecker()->checkNewWindowPolicy(action, FrameLoader::callContinueLoadAfterNewWindowPolicy, workingResourceRequest, formState.release(), frameName, this);
     } else
         loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
@@ -3767,7 +3423,7 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
 unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
     String referrer = m_outgoingReferrer;
-    if (shouldHideReferrer(request.url(), referrer))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), referrer))
         referrer = String();
     
     ResourceRequest initialRequest = request;
@@ -3898,7 +3554,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
+    bool isRedirect = m_quickRedirectComing || policyChecker()->loadType() == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3961,101 +3617,6 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !m_frame->document()->isFrameSet();
 }
 
-void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
-    PassRefPtr<FormState> formState, const String& frameName)
-{
-    m_policyCheck.set(request, formState, frameName,
-        callContinueLoadAfterNewWindowPolicy, this);
-    m_client->dispatchDecidePolicyForNewWindowAction(&FrameLoader::continueAfterNewWindowPolicy,
-        action, request, formState, frameName);
-}
-
-void FrameLoader::continueAfterNewWindowPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse:
-            break;
-    }
-
-    check.call(policy == PolicyUse);
-}
-
-void FrameLoader::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
-    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
-{
-    NavigationAction action = loader->triggeringAction();
-    if (action.isEmpty()) {
-        action = NavigationAction(request.url(), NavigationTypeOther);
-        loader->setTriggeringAction(action);
-    }
-        
-    // Don't ask more than once for the same request or if we are loading an empty URL.
-    // This avoids confusion on the part of the client.
-    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
-        function(argument, request, 0, true);
-        loader->setLastCheckedRequest(request);
-        return;
-    }
-    
-    // We are always willing to show alternate content for unreachable URLs;
-    // treat it like a reload so it maintains the right state for b/f list.
-    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
-        if (isBackForwardLoadType(m_policyLoadType))
-            m_policyLoadType = FrameLoadTypeReload;
-        function(argument, request, 0, true);
-        return;
-    }
-    
-    loader->setLastCheckedRequest(request);
-
-    m_policyCheck.set(request, formState.get(), function, argument);
-
-    m_delegateIsDecidingNavigationPolicy = true;
-    m_client->dispatchDecidePolicyForNavigationAction(&FrameLoader::continueAfterNavigationPolicy,
-        action, request, formState);
-    m_delegateIsDecidingNavigationPolicy = false;
-}
-
-void FrameLoader::continueAfterNavigationPolicy(PolicyAction policy)
-{
-    PolicyCheck check = m_policyCheck;
-    m_policyCheck.clear();
-
-    bool shouldContinue = policy == PolicyUse;
-    
-    switch (policy) {
-        case PolicyIgnore:
-            check.clearRequest();
-            break;
-        case PolicyDownload:
-            m_client->startDownload(check.request());
-            check.clearRequest();
-            break;
-        case PolicyUse: {
-            ResourceRequest request(check.request());
-            
-            if (!m_client->canHandleRequest(request)) {
-                handleUnimplementablePolicy(m_client->cannotShowURLError(check.request()));
-                check.clearRequest();
-                shouldContinue = false;
-            }
-            break;
-        }
-    }
-
-    check.call(shouldContinue);
-}
-
 void FrameLoader::callContinueLoadAfterNavigationPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, bool shouldContinue)
 {
@@ -4090,7 +3651,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         // If the navigation request came from the back/forward menu, and we punt on it, we have the 
         // problem that we have optimistically moved the b/f cursor already, so move it back.  For sanity, 
         // we only do this when punting a navigation for the target frame or top-level frame.  
-        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(m_policyLoadType))
+        if ((isTargetItem || isLoadingMainFrame()) && isBackForwardLoadType(policyChecker()->loadType()))
             if (Page* page = m_frame->page()) {
                 Frame* mainFrame = page->mainFrame();
                 if (HistoryItem* resetItem = mainFrame->loader()->m_currentHistoryItem.get()) {
@@ -4102,7 +3663,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
     }
 
-    FrameLoadType type = m_policyLoadType;
+    FrameLoadType type = policyChecker()->loadType();
     stopAllLoaders();
     
     // <rdar://problem/6250856> - In certain circumstances on pages with multiple frames, stopAllLoaders()
@@ -4110,7 +3671,7 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     if (!m_frame->page())
         return;
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
+#if ENABLE(JAVASCRIPT_DEBUGGER) && ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (page->mainFrame() == m_frame)
             page->inspectorController()->resumeDebugger();
@@ -4127,12 +3688,11 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
         return;
 
     if (formState)
-        m_client->dispatchWillSubmitForm(&FrameLoader::continueLoadAfterWillSubmitForm, formState);
+        m_client->dispatchWillSubmitForm(&PolicyChecker::continueLoadAfterWillSubmitForm, formState);
     else
         continueLoadAfterWillSubmitForm();
 }
 
-
 void FrameLoader::callContinueLoadAfterNewWindowPolicy(void* argument,
     const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, bool shouldContinue)
 {
@@ -4154,7 +3714,7 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     if (frameName != "_blank")
         mainFrame->tree()->setName(frameName);
 
-    mainFrame->loader()->setOpenedByDOM();
+    mainFrame->page()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
     mainFrame->loader()->setOpener(frame.get());
     mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
@@ -4201,7 +3761,9 @@ void FrameLoader::loadedResourceFromMemoryCache(const CachedResource* resource)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didLoadResourceFromMemoryCache(m_documentLoader.get(), resource);
+#endif
 
     if (!resource->sendResourceLoadCallbacks() || m_documentLoader->haveToldClientAboutLoad(resource->url()))
         return;
@@ -4249,26 +3811,6 @@ bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, con
     return false;
 }
 
-bool FrameLoader::canGoBackOrForward(int distance) const
-{
-    if (Page* page = m_frame->page()) {
-        if (distance == 0)
-            return true;
-        if (distance > 0 && distance <= page->backForwardList()->forwardListCount())
-            return true;
-        if (distance < 0 && -distance <= page->backForwardList()->backListCount())
-            return true;
-    }
-    return false;
-}
-
-int FrameLoader::getHistoryLength()
-{
-    if (Page* page = m_frame->page())
-        return page->backForwardList()->backListCount() + 1;
-    return 0;
-}
-
 void FrameLoader::addHistoryItemForFragmentScroll()
 {
     addBackForwardItemClippedAtTarget(false);
@@ -4279,7 +3821,17 @@ bool FrameLoader::loadProvisionalItemFromCachedPage()
     RefPtr<CachedPage> cachedPage = pageCache()->get(m_provisionalHistoryItem.get());
     if (!cachedPage || !cachedPage->document())
         return false;
-    provisionalDocumentLoader()->loadFromCachedPage(cachedPage.release());
+
+    DocumentLoader *provisionalLoader = provisionalDocumentLoader();
+    LOG(PageCache, "WebCorePageCache: FrameLoader %p loading provisional DocumentLoader %p with URL '%s' from CachedPage %p", this, provisionalLoader, provisionalLoader->url().string().utf8().data(), cachedPage.get());
+    
+    provisionalLoader->prepareForLoadStart();
+
+    m_loadingFromCachedPage = true;
+
+    provisionalLoader->setCommitted(true);
+    commitProvisionalLoad(cachedPage);
+    
     return true;
 }
 
@@ -4288,12 +3840,26 @@ void FrameLoader::cachePageForHistoryItem(HistoryItem* item)
     if (!canCachePage() || item->isInPageCache())
         return;
 
+    pageHidden();
+    
     if (Page* page = m_frame->page()) {
         RefPtr<CachedPage> cachedPage = CachedPage::create(page);
         pageCache()->add(item, cachedPage.release());
     }
 }
 
+void FrameLoader::pageHidden()
+{
+    m_unloadEventBeingDispatched = true;
+    if (m_frame->domWindow())
+        m_frame->domWindow()->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, true), m_frame->document());
+    m_unloadEventBeingDispatched = false;
+
+    // Send pagehide event for subframes as well
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        child->loader()->pageHidden();
+}
+
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const
 {
     if (!m_currentHistoryItem)
@@ -5038,94 +4604,6 @@ void FrameLoader::didCancelAuthenticationChallenge(ResourceLoader* loader, const
     m_client->dispatchDidCancelAuthenticationChallenge(loader->documentLoader(), loader->identifier(), currentWebChallenge);
 }
 
-PolicyCheck::PolicyCheck()
-    : m_navigationFunction(0)
-    , m_newWindowFunction(0)
-    , m_contentFunction(0)
-{
-}
-
-void PolicyCheck::clear()
-{
-    clearRequest();
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    NavigationPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = String();
-
-    m_navigationFunction = function;
-    m_newWindowFunction = 0;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
-    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
-{
-    m_request = request;
-    m_formState = formState;
-    m_frameName = frameName;
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = function;
-    m_contentFunction = 0;
-    m_argument = argument;
-}
-
-void PolicyCheck::set(ContentPolicyDecisionFunction function, void* argument)
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-
-    m_navigationFunction = 0;
-    m_newWindowFunction = 0;
-    m_contentFunction = function;
-    m_argument = argument;
-}
-
-void PolicyCheck::call(bool shouldContinue)
-{
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
-    ASSERT(!m_contentFunction);
-}
-
-void PolicyCheck::call(PolicyAction action)
-{
-    ASSERT(!m_navigationFunction);
-    ASSERT(!m_newWindowFunction);
-    ASSERT(m_contentFunction);
-    m_contentFunction(m_argument, action);
-}
-
-void PolicyCheck::clearRequest()
-{
-    m_request = ResourceRequest();
-    m_formState = 0;
-    m_frameName = String();
-}
-
-void PolicyCheck::cancel()
-{
-    clearRequest();
-    if (m_navigationFunction)
-        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
-    if (m_newWindowFunction)
-        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
-    if (m_contentFunction)
-        m_contentFunction(m_argument, PolicyIgnore);
-}
-
 void FrameLoader::setTitle(const String& title)
 {
     documentLoader()->setTitle(title);
@@ -5143,6 +4621,7 @@ String FrameLoader::referrer() const
 
 void FrameLoader::dispatchDocumentElementAvailable()
 {
+    m_frame->injectUserScripts(InjectAtDocumentStart);
     m_client->documentElementAvailable();
 }
 
@@ -5153,12 +4632,14 @@ void FrameLoader::dispatchWindowObjectAvailable()
 
     m_client->windowObjectCleared();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         if (InspectorController* inspector = page->inspectorController())
             inspector->inspectedWindowScriptObjectCleared(m_frame);
         if (InspectorController* inspector = page->parentInspectorController())
             inspector->windowScriptObjectAvailable();
     }
+#endif
 }
 
 PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
@@ -5179,7 +4660,7 @@ PassRefPtr<Widget> FrameLoader::createJavaAppletWidget(const IntSize& size, HTML
 
     if (!codeBaseURLString.isEmpty()) {
         KURL codeBaseURL = completeURL(codeBaseURLString);
-        if (!canLoad(codeBaseURL, String(), element->document())) {
+        if (!SecurityOrigin::canLoad(codeBaseURL, String(), element->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
             return 0;
         }
@@ -5223,16 +4704,20 @@ void FrameLoader::dispatchDidCommitLoad()
 
     m_client->dispatchDidCommitLoad();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didCommitLoad(m_documentLoader.get());
+#endif
 }
 
 void FrameLoader::dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     m_client->assignIdentifierToInitialRequest(identifier, loader, request);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->identifierForInitialRequest(identifier, loader, request);
+#endif
 }
 
 void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
@@ -5246,32 +4731,40 @@ void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long
     if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_documentLoader->didTellClientAboutLoad(request.url());
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->willSendRequest(loader, identifier, request, redirectResponse);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveResponse(DocumentLoader* loader, unsigned long identifier, const ResourceResponse& r)
 {
     m_client->dispatchDidReceiveResponse(loader, identifier, r);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveResponse(loader, identifier, r);
+#endif
 }
 
 void FrameLoader::dispatchDidReceiveContentLength(DocumentLoader* loader, unsigned long identifier, int length)
 {
     m_client->dispatchDidReceiveContentLength(loader, identifier, length);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didReceiveContentLength(loader, identifier, length);
+#endif
 }
 
 void FrameLoader::dispatchDidFinishLoading(DocumentLoader* loader, unsigned long identifier)
 {
     m_client->dispatchDidFinishLoading(loader, identifier);
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
         page->inspectorController()->didFinishLoading(loader, identifier);
+#endif
 }
 
 void FrameLoader::tellClientAboutPastMemoryCacheLoads()
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 3d3f9c3..3a1d27f 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -32,9 +32,13 @@
 
 #include "CachePolicy.h"
 #include "FrameLoaderTypes.h"
+#include "PolicyCallback.h"
+#include "PolicyChecker.h"
+#include "RedirectScheduler.h"
 #include "ResourceRequest.h"
 #include "ThreadableLoader.h"
 #include "Timer.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -42,7 +46,7 @@ namespace WebCore {
     class Archive;
 #endif
     class AuthenticationChallenge;
-    class CachedFrame;
+    class CachedFrameBase;
     class CachedPage;
     class CachedResource;
     class Document;
@@ -73,46 +77,10 @@ namespace WebCore {
     class Widget;
 
     struct FrameLoadRequest;
-    struct ScheduledRedirection;
     struct WindowFeatures;
 
     bool isBackForwardLoadType(FrameLoadType);
 
-    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
-        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
-
-    class PolicyCheck {
-    public:
-        PolicyCheck();
-
-        void clear();
-        void set(const ResourceRequest&, PassRefPtr<FormState>,
-            NavigationPolicyDecisionFunction, void* argument);
-        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
-            NewWindowPolicyDecisionFunction, void* argument);
-        void set(ContentPolicyDecisionFunction, void* argument);
-
-        const ResourceRequest& request() const { return m_request; }
-        void clearRequest();
-
-        void call(bool shouldContinue);
-        void call(PolicyAction);
-        void cancel();
-
-    private:
-        ResourceRequest m_request;
-        RefPtr<FormState> m_formState;
-        String m_frameName;
-
-        NavigationPolicyDecisionFunction m_navigationFunction;
-        NewWindowPolicyDecisionFunction m_newWindowFunction;
-        ContentPolicyDecisionFunction m_contentFunction;
-        void* m_argument;
-    };
-
     class FrameLoader : public Noncopyable {
     public:
         FrameLoader(Frame*, FrameLoaderClient*);
@@ -122,6 +90,8 @@ namespace WebCore {
 
         Frame* frame() const { return m_frame; }
 
+        PolicyChecker* policyChecker() { return &m_policyChecker; }
+
         // FIXME: This is not cool, people. There are too many different functions that all start loads.
         // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
         // the logic by extracting common code paths.
@@ -144,14 +114,8 @@ namespace WebCore {
         void loadArchive(PassRefPtr<Archive>);
 #endif
 
-        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
-        // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document*);
-        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
         static void reportLocalLoadFailed(Frame*, const String& url);
 
-        static bool shouldHideReferrer(const KURL&, const String& referrer);
-
         // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
         Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
@@ -195,6 +159,8 @@ namespace WebCore {
         void receivedMainResourceError(const ResourceError&, bool isComplete);
         void receivedData(const char*, int);
 
+        bool willLoadMediaElementURL(KURL&);
+
         void handleFallbackContent();
         bool isStopping() const;
 
@@ -204,8 +170,6 @@ namespace WebCore {
         ResourceError fileDoesNotExistError(const ResourceResponse&) const;
         ResourceError blockedError(const ResourceRequest&) const;
         ResourceError cannotShowURLError(const ResourceRequest&) const;
-
-        void cannotShowMIMEType(const ResourceResponse&);
         ResourceError interruptionForPolicyChangeError(const ResourceRequest&);
 
         bool isHostedByObjectElement() const;
@@ -214,10 +178,6 @@ namespace WebCore {
         bool representationExistsForURLScheme(const String& URLScheme);
         String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
-        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
-        void cancelContentPolicyCheck();
-
         void reload(bool endToEndReload = false);
         void reloadWithOverrideEncoding(const String& overrideEncoding);
 
@@ -246,6 +206,7 @@ namespace WebCore {
 
         void checkLoadComplete();
         void detachFromParent();
+        void detachViewsAndDocumentLoader();
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
@@ -265,7 +226,7 @@ namespace WebCore {
             bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
-        void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
+        void stopLoading(UnloadEventPolicy, DatabasePolicy = DatabasePolicyStop);
         bool closeURL();
 
         void didExplicitOpen();
@@ -275,16 +236,6 @@ namespace WebCore {
 
         KURL baseURL() const;
 
-        bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
-        void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
-        void scheduleRefresh(bool userGesture = false);
-        void scheduleHistoryNavigation(int steps);
-
-        bool canGoBackOrForward(int distance) const;
-        void goBackOrForward(int distance);
-        int getHistoryLength();
-
         void begin();
         void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
@@ -312,10 +263,13 @@ namespace WebCore {
         void dispatchDocumentElementAvailable();
         void restoreDocumentState();
 
+        // Mixed content related functions.
+        static bool isMixedContent(SecurityOrigin* context, const KURL&);
+        void checkIfDisplayInsecureContent(SecurityOrigin* context, const KURL&);
+        void checkIfRunInsecureContent(SecurityOrigin* context, const KURL&);
+
         Frame* opener();
         void setOpener(Frame*);
-        bool openedByDOM() const;
-        void setOpenedByDOM();
 
         bool isProcessingUserGesture();
 
@@ -350,6 +304,7 @@ namespace WebCore {
         void setTitle(const String&);
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
+        bool isLoadingFromCachedPage() const { return m_loadingFromCachedPage; }
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
@@ -357,16 +312,8 @@ namespace WebCore {
         HistoryItem* currentHistoryItem();
         void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
 
-        enum LocalLoadPolicy {
-            AllowLocalLoadsForAll,  // No restriction on local loads.
-            AllowLocalLoadsForLocalAndSubstituteData,
-            AllowLocalLoadsForLocalOnly,
-        };
-        static void setLocalLoadPolicy(LocalLoadPolicy);
-        static bool restrictAccessToLocal();
-        static bool allowSubstituteDataAccessToLocal();
-
         bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
+        bool committedFirstRealDocumentLoad() const { return m_committedFirstRealDocumentLoad; }
 
         void iconLoadDecisionAvailable();
 
@@ -379,6 +326,20 @@ namespace WebCore {
 
         bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
 
+        void open(CachedFrameBase&);
+
+        // FIXME: Should these really be public?
+        void completed();
+        bool allAncestorsAreComplete() const; // including this
+        bool allChildrenAreComplete() const; // immediate children, not all descendants
+        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+
+        // FIXME: This is public because this asynchronous callback from the FrameLoaderClient
+        // uses the policy machinery (and therefore is called via the PolicyChecker).  Once we
+        // introduce a proper callback type for this function, we should make it private again.
+        void continueLoadAfterWillSubmitForm();
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
@@ -405,17 +366,10 @@ namespace WebCore {
         void updateHistoryForClientRedirect();
         void updateHistoryForCommit();
         void updateHistoryForAnchorScroll();
-    
-        void redirectionTimerFired(Timer<FrameLoader>*);
-        void checkCompletedTimerFired(Timer<FrameLoader>*);
-        void checkLoadCompleteTimerFired(Timer<FrameLoader>*);
-        
-        void cancelRedirection(bool newLoadInProgress = false);
 
-        void started();
+        void checkTimerFired(Timer<FrameLoader>*);
 
-        void completed();
-        void parentCompleted();
+        void started();
 
         bool shouldUsePlugin(const KURL&, const String& mimeType, bool hasFallback, bool& useFallback);
         bool loadPlugin(RenderPart*, const KURL&, const String& mimeType,
@@ -423,6 +377,7 @@ namespace WebCore {
         
         bool loadProvisionalItemFromCachedPage();
         void cachePageForHistoryItem(HistoryItem*);
+        void pageHidden();
 
         void receivedFirstData();
 
@@ -443,25 +398,17 @@ namespace WebCore {
 
         void setLoadType(FrameLoadType);
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
-
-        void continueAfterNavigationPolicy(PolicyAction);
-        void continueAfterNewWindowPolicy(PolicyAction);
-        void continueAfterContentPolicy(PolicyAction);
-        void continueLoadAfterWillSubmitForm(PolicyAction = PolicyUse);
-
         static void callContinueLoadAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
-        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
         static void callContinueLoadAfterNewWindowPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
-        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+
+        void continueLoadAfterNavigationPolicy(const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+        void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
+
         bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
         void addHistoryItemForFragmentScroll();
 
-        void stopPolicyCheck();
-
         void checkLoadCompleteForThisFrame();
 
         void setDocumentLoader(DocumentLoader*);
@@ -472,18 +419,12 @@ namespace WebCore {
 
         void closeOldDataSources();
         void open(CachedPage&);
-        void open(CachedFrame&);
 
         void updateHistoryAfterClientRedirect();
 
-        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true);
+        void clear(bool clearWindowProperties = true, bool clearScriptObjects = true, bool clearFrameView = true);
 
         bool shouldReloadToHandleUnreachableURL(DocumentLoader*);
-        void handleUnimplementablePolicy(const ResourceError&);
-
-        void scheduleRedirection(ScheduledRedirection*);
-        void startRedirectionTimer();
-        void stopRedirectionTimer();
 
         void dispatchDidCommitLoad();
         void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
@@ -492,9 +433,6 @@ namespace WebCore {
         void dispatchDidReceiveContentLength(DocumentLoader*, unsigned long identifier, int length);
         void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
 
-        static bool isLocationChange(const ScheduledRedirection&);
-        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
-
         void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
         void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
 
@@ -513,8 +451,6 @@ namespace WebCore {
             bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
 #endif
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
         bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 
         void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
@@ -541,6 +477,7 @@ namespace WebCore {
 
         void scheduleCheckCompleted();
         void scheduleCheckLoadComplete();
+        void startCheckCompleteTimer();
 
         KURL originalRequestURL() const;
 
@@ -551,6 +488,8 @@ namespace WebCore {
         Frame* m_frame;
         FrameLoaderClient* m_client;
 
+        PolicyChecker m_policyChecker;
+
         FrameState m_state;
         FrameLoadType m_loadType;
 
@@ -562,15 +501,7 @@ namespace WebCore {
         RefPtr<DocumentLoader> m_provisionalDocumentLoader;
         RefPtr<DocumentLoader> m_policyDocumentLoader;
 
-        // This identifies the type of navigation action which prompted this load. Note 
-        // that WebKit conveys this value as the WebActionNavigationTypeKey value
-        // on navigation action delegate callbacks.
-        FrameLoadType m_policyLoadType;
-        PolicyCheck m_policyCheck;
-
         bool m_delegateIsHandlingProvisionalLoadError;
-        bool m_delegateIsDecidingNavigationPolicy;
-        bool m_delegateIsHandlingUnimplementablePolicy;
 
         bool m_firstLayoutDone;
         bool m_quickRedirectComing;
@@ -598,8 +529,6 @@ namespace WebCore {
 
         bool m_cancellingWithLoadInProgress;
 
-        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
-
         bool m_needsClear;
         bool m_receivedData;
 
@@ -610,16 +539,14 @@ namespace WebCore {
         bool m_containsPlugIns;
 
         KURL m_submittedFormURL;
-    
-        Timer<FrameLoader> m_redirectionTimer;
-        Timer<FrameLoader> m_checkCompletedTimer;
-        Timer<FrameLoader> m_checkLoadCompleteTimer;
+
+        Timer<FrameLoader> m_checkTimer;
+        bool m_shouldCallCheckCompleted;
+        bool m_shouldCallCheckLoadComplete;
 
         Frame* m_opener;
         HashSet<Frame*> m_openedFrames;
 
-        bool m_openedByDOM;
-
         bool m_creatingInitialEmptyDocument;
         bool m_isDisplayingInitialEmptyDocument;
         bool m_committedFirstRealDocumentLoad;
@@ -629,6 +556,7 @@ namespace WebCore {
         RefPtr<HistoryItem> m_provisionalHistoryItem;
         
         bool m_didPerformFirstNavigation;
+        bool m_loadingFromCachedPage;
         
 #ifndef NDEBUG
         bool m_didDispatchDidCommitLoad;
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index bca0d0b..7973ca5 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -60,22 +60,28 @@ namespace WebCore {
     class KURL;
     class NavigationAction;
     class PluginView;
+    class PolicyChecker;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
     struct ResourceRequest;
     class ResourceResponse;
     class ScriptString;
+    class SecurityOrigin;
     class SharedBuffer;
     class SubstituteData;
     class String;
     class Widget;
 
+<<<<<<< HEAD:WebCore/loader/FrameLoaderClient.h
 #ifdef ANDROID_HISTORY_CLIENT
     class BackForwardList;
 #endif
 
     typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
+=======
+    typedef void (PolicyChecker::*FramePolicyFunction)(PolicyAction);
+>>>>>>> webkit.org at 49305:WebCore/loader/FrameLoaderClient.h
 
     class FrameLoaderClient {
     public:
@@ -173,6 +179,15 @@ namespace WebCore {
         virtual void dispatchDidChangeHistoryIndex(BackForwardList*) const = 0;
 #endif
 
+        // This frame has displayed inactive content (such as an image) from an
+        // insecure source.  Inactive content cannot spread to other frames.
+        virtual void didDisplayInsecureContent() = 0;
+
+        // The indicated security origin has run active content (such as a
+        // script) from an insecure source.  Note that the insecure content can
+        // spread to other frames in the same origin.
+        virtual void didRunInsecureContent(SecurityOrigin*) = 0;
+
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
         virtual ResourceError blockedError(const ResourceRequest&) = 0;
         virtual ResourceError cannotShowURLError(const ResourceRequest&) = 0;
@@ -246,6 +261,7 @@ namespace WebCore {
 #endif
 
         virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
+        virtual bool shouldLoadMediaElementURL(const KURL&) const { return true; }
     };
 
 } // namespace WebCore
diff --git a/WebCore/loader/FrameLoaderTypes.h b/WebCore/loader/FrameLoaderTypes.h
index 940bb7f..76299f5 100644
--- a/WebCore/loader/FrameLoaderTypes.h
+++ b/WebCore/loader/FrameLoaderTypes.h
@@ -81,6 +81,12 @@ namespace WebCore {
         ObjectContentNetscapePlugin,
         ObjectContentOtherPlugin
     };
+    
+    enum UnloadEventPolicy {
+        UnloadEventPolicyNone,
+        UnloadEventPolicyUnloadOnly,
+        UnloadEventPolicyUnloadAndPageHide
+    };
 }
 
 #endif
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index 08f2e9a..9b5598d 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -54,10 +54,24 @@ using namespace HTMLNames;
 class ImageEventListener : public EventListener {
 public:
     static PassRefPtr<ImageEventListener> create(ImageDocument* document) { return adoptRef(new ImageEventListener(document)); }
-    virtual void handleEvent(Event*, bool isWindowEvent);
+    static const ImageEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ImageEventListenerType
+            ? static_cast<const ImageEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
 
 private:
-    ImageEventListener(ImageDocument* document) : m_doc(document) { }
+    ImageEventListener(ImageDocument* document)
+        : EventListener(ImageEventListenerType)
+        , m_doc(document)
+    {
+    }
+
+    virtual void handleEvent(ScriptExecutionContext*, Event*);
+
     ImageDocument* m_doc;
 };
     
@@ -344,7 +358,7 @@ bool ImageDocument::shouldShrinkToFit() const
 
 // --------
 
-void ImageEventListener::handleEvent(Event* event, bool)
+void ImageEventListener::handleEvent(ScriptExecutionContext*, Event* event)
 {
     if (event->type() == eventNames().resizeEvent)
         m_doc->windowSizeChanged();
@@ -354,6 +368,13 @@ void ImageEventListener::handleEvent(Event* event, bool)
     }
 }
 
+bool ImageEventListener::operator==(const EventListener& listener)
+{
+    if (const ImageEventListener* imageEventListener = ImageEventListener::cast(&listener))
+        return m_doc == imageEventListener->m_doc;
+    return false;
+}
+
 // --------
 
 ImageDocumentElement::~ImageDocumentElement()
diff --git a/WebCore/loader/ImageDocument.h b/WebCore/loader/ImageDocument.h
index 1bc5245..080b250 100644
--- a/WebCore/loader/ImageDocument.h
+++ b/WebCore/loader/ImageDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class ImageDocument : public HTMLDocument {
 public:
     static PassRefPtr<ImageDocument> create(Frame* frame)
     {
-        return new ImageDocument(frame);
+        return adoptRef(new ImageDocument(frame));
     }
 
     CachedImage* cachedImage();
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index 6c843e9..e7bdbcb 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -93,7 +93,7 @@ void MainResourceLoader::didCancel(const ResourceError& error)
     RefPtr<MainResourceLoader> protect(this);
 
     if (m_waitingForContentPolicy) {
-        frameLoader()->cancelContentPolicyCheck();
+        frameLoader()->policyChecker()->cancelCheck();
         ASSERT(m_waitingForContentPolicy);
         m_waitingForContentPolicy = false;
         deref(); // balances ref in didReceiveResponse
@@ -172,13 +172,17 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // Don't set this on the first request. It is set when the main load was started.
     m_documentLoader->setRequest(newRequest);
 
+    Frame* top = m_frame->tree()->top();
+    if (top != m_frame)
+        frameLoader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), newRequest.url());
+
     // FIXME: Ideally we'd stop the I/O until we hear back from the navigation policy delegate
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
     // synchronously for these redirect cases.
     if (!redirectResponse.isNull()) {
         ref(); // balanced by deref in continueAfterNavigationPolicy
-        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+        frameLoader()->policyChecker()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
     }
 }
 
@@ -201,7 +205,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
         // Prevent remote web archives from loading because they can claim to be from any domain and thus avoid cross-domain security checks (4120255).
         bool isRemoteWebArchive = equalIgnoringCase("application/x-webarchive", mimeType) && !m_substituteData.isValid() && !url.isLocalFile();
         if (!frameLoader()->canShowMIMEType(mimeType) || isRemoteWebArchive) {
-            frameLoader()->cannotShowMIMEType(r);
+            frameLoader()->policyChecker()->cannotShowMIMEType(r);
             // Check reachedTerminalState since the load may have already been cancelled inside of _handleUnimplementablePolicyWithErrorCode::.
             if (!reachedTerminalState())
                 stopLoadingForPolicyChange();
@@ -316,7 +320,25 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     ASSERT(!m_waitingForContentPolicy);
     m_waitingForContentPolicy = true;
     ref(); // balanced by deref in continueAfterContentPolicy and didCancel
-    frameLoader()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
+
+    ASSERT(frameLoader()->activeDocumentLoader());
+
+    // Always show content with valid substitute data.
+    if (frameLoader()->activeDocumentLoader()->substituteData().isValid()) {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+
+#if ENABLE(FTPDIR)
+    // Respect the hidden FTP Directory Listing pref so it can be tested even if the policy delegate might otherwise disallow it
+    Settings* settings = m_frame->settings();
+    if (settings && settings->forceFTPDirectoryListings() && m_response.mimeType() == "application/x-ftp-directory") {
+        callContinueAfterContentPolicy(this, PolicyUse);
+        return;
+    }
+#endif
+
+    frameLoader()->policyChecker()->checkContentPolicy(m_response.mimeType(), callContinueAfterContentPolicy, this);
 }
 
 void MainResourceLoader::didReceiveData(const char* data, int length, long long lengthReceived, bool allAtOnce)
diff --git a/WebCore/loader/MediaDocument.cpp b/WebCore/loader/MediaDocument.cpp
index 0b1fd59..656d0a0 100644
--- a/WebCore/loader/MediaDocument.cpp
+++ b/WebCore/loader/MediaDocument.cpp
@@ -226,8 +226,8 @@ void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
         embedElement->setAttribute(widthAttr, "100%");
         embedElement->setAttribute(heightAttr, "100%");
         embedElement->setAttribute(nameAttr, "plugin");
-        embedElement->setSrc(url().string());
-        embedElement->setType(frame()->loader()->responseMIMEType());
+        embedElement->setAttribute(srcAttr, url().string());
+        embedElement->setAttribute(typeAttr, frame()->loader()->responseMIMEType());
 
         ExceptionCode ec;
         videoElement->parent()->replaceChild(embedElement, videoElement, ec);
diff --git a/WebCore/loader/MediaDocument.h b/WebCore/loader/MediaDocument.h
index ac286f0..aa751ab 100644
--- a/WebCore/loader/MediaDocument.h
+++ b/WebCore/loader/MediaDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008,2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -36,22 +36,23 @@ class MediaDocument : public HTMLDocument {
 public:
     static PassRefPtr<MediaDocument> create(Frame* frame)
     {
-        return new MediaDocument(frame);
+        return adoptRef(new MediaDocument(frame));
     }
-
-    virtual void defaultEventHandler(Event*);
+    virtual ~MediaDocument();
 
     void mediaElementSawUnsupportedTracks();
 
 private:
     MediaDocument(Frame*);
-    virtual ~MediaDocument();
-    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
 
+    virtual void defaultEventHandler(Event*);
+
     void replaceMediaElementTimerFired(Timer<MediaDocument>*);
+
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 };
     
 }
diff --git a/WebCore/loader/PlaceholderDocument.cpp b/WebCore/loader/PlaceholderDocument.cpp
index e071aa8..af14c72 100644
--- a/WebCore/loader/PlaceholderDocument.cpp
+++ b/WebCore/loader/PlaceholderDocument.cpp
@@ -37,7 +37,7 @@ void PlaceholderDocument::attach()
 
     if (!styleSelector()) {
         RefPtr<StyleSheetList> styleSheetList = StyleSheetList::create(this);
-        setStyleSelector(new CSSStyleSelector(this, userStyleSheet(), styleSheetList.get(), 0, true, false));
+        setStyleSelector(new CSSStyleSelector(this, styleSheetList.get(), 0, pageUserSheet(), pageGroupUserSheets(), true, false));
     }
 
     // Skipping Document::attach().
diff --git a/WebCore/loader/PlaceholderDocument.h b/WebCore/loader/PlaceholderDocument.h
index c542370..a759266 100644
--- a/WebCore/loader/PlaceholderDocument.h
+++ b/WebCore/loader/PlaceholderDocument.h
@@ -34,7 +34,7 @@ class PlaceholderDocument : public Document {
 public:
     static PassRefPtr<PlaceholderDocument> create(Frame* frame)
     {
-        return new PlaceholderDocument(frame);
+        return adoptRef(new PlaceholderDocument(frame));
     }
 
     virtual void attach();
diff --git a/WebCore/loader/PluginDocument.cpp b/WebCore/loader/PluginDocument.cpp
index 3500c98..788691f 100644
--- a/WebCore/loader/PluginDocument.cpp
+++ b/WebCore/loader/PluginDocument.cpp
@@ -88,8 +88,8 @@ void PluginTokenizer::createDocumentStructure()
     m_embedElement->setAttribute(heightAttr, "100%");
     
     m_embedElement->setAttribute(nameAttr, "plugin");
-    m_embedElement->setSrc(m_doc->url().string());
-    m_embedElement->setType(m_doc->frame()->loader()->responseMIMEType());
+    m_embedElement->setAttribute(srcAttr, m_doc->url().string());
+    m_embedElement->setAttribute(typeAttr, m_doc->frame()->loader()->responseMIMEType());
     
     body->appendChild(embedElement, ec);    
 }
diff --git a/WebCore/loader/PluginDocument.h b/WebCore/loader/PluginDocument.h
index 35e4038..1d5c964 100644
--- a/WebCore/loader/PluginDocument.h
+++ b/WebCore/loader/PluginDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@ class PluginDocument : public HTMLDocument {
 public:
     static PassRefPtr<PluginDocument> create(Frame* frame)
     {
-        return new PluginDocument(frame);
+        return adoptRef(new PluginDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/PolicyCallback.cpp b/WebCore/loader/PolicyCallback.cpp
new file mode 100644
index 0000000..14799cf
--- /dev/null
+++ b/WebCore/loader/PolicyCallback.cpp
@@ -0,0 +1,133 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyCallback.h"
+
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyCallback::PolicyCallback()
+    : m_navigationFunction(0)
+    , m_newWindowFunction(0)
+    , m_contentFunction(0)
+{
+}
+
+PolicyCallback::~PolicyCallback()
+{
+}
+
+void PolicyCallback::clear()
+{
+    clearRequest();
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    NavigationPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = String();
+
+    m_navigationFunction = function;
+    m_newWindowFunction = 0;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(const ResourceRequest& request, PassRefPtr<FormState> formState,
+    const String& frameName, NewWindowPolicyDecisionFunction function, void* argument)
+{
+    m_request = request;
+    m_formState = formState;
+    m_frameName = frameName;
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = function;
+    m_contentFunction = 0;
+    m_argument = argument;
+}
+
+void PolicyCallback::set(ContentPolicyDecisionFunction function, void* argument)
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+
+    m_navigationFunction = 0;
+    m_newWindowFunction = 0;
+    m_contentFunction = function;
+    m_argument = argument;
+}
+
+void PolicyCallback::call(bool shouldContinue)
+{
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), shouldContinue);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, shouldContinue);
+    ASSERT(!m_contentFunction);
+}
+
+void PolicyCallback::call(PolicyAction action)
+{
+    ASSERT(!m_navigationFunction);
+    ASSERT(!m_newWindowFunction);
+    ASSERT(m_contentFunction);
+    m_contentFunction(m_argument, action);
+}
+
+void PolicyCallback::clearRequest()
+{
+    m_request = ResourceRequest();
+    m_formState = 0;
+    m_frameName = String();
+}
+
+void PolicyCallback::cancel()
+{
+    clearRequest();
+    if (m_navigationFunction)
+        m_navigationFunction(m_argument, m_request, m_formState.get(), false);
+    if (m_newWindowFunction)
+        m_newWindowFunction(m_argument, m_request, m_formState.get(), m_frameName, false);
+    if (m_contentFunction)
+        m_contentFunction(m_argument, PolicyIgnore);
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/PolicyCallback.h b/WebCore/loader/PolicyCallback.h
new file mode 100644
index 0000000..2aa7c7c
--- /dev/null
+++ b/WebCore/loader/PolicyCallback.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyCallback_h
+#define PolicyCallback_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "ResourceRequest.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class FormState;
+
+    typedef void (*NavigationPolicyDecisionFunction)(void* argument,
+        const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
+    typedef void (*NewWindowPolicyDecisionFunction)(void* argument,
+        const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
+    typedef void (*ContentPolicyDecisionFunction)(void* argument, PolicyAction);
+
+    class PolicyCallback {
+    public:
+        PolicyCallback();
+        ~PolicyCallback();
+
+        void clear();
+        void set(const ResourceRequest&, PassRefPtr<FormState>,
+            NavigationPolicyDecisionFunction, void* argument);
+        void set(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName,
+            NewWindowPolicyDecisionFunction, void* argument);
+        void set(ContentPolicyDecisionFunction, void* argument);
+
+        const ResourceRequest& request() const { return m_request; }
+        void clearRequest();
+
+        void call(bool shouldContinue);
+        void call(PolicyAction);
+        void cancel();
+
+    private:
+        ResourceRequest m_request;
+        RefPtr<FormState> m_formState;
+        String m_frameName;
+
+        NavigationPolicyDecisionFunction m_navigationFunction;
+        NewWindowPolicyDecisionFunction m_newWindowFunction;
+        ContentPolicyDecisionFunction m_contentFunction;
+        void* m_argument;
+    };
+
+} // namespace WebCore
+
+#endif // PolicyCallback_h
diff --git a/WebCore/loader/PolicyChecker.cpp b/WebCore/loader/PolicyChecker.cpp
new file mode 100644
index 0000000..196ab4f
--- /dev/null
+++ b/WebCore/loader/PolicyChecker.cpp
@@ -0,0 +1,197 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PolicyChecker.h"
+
+#include "DocumentLoader.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+#include "HTMLFormElement.h"
+
+namespace WebCore {
+
+PolicyChecker::PolicyChecker(Frame* frame)
+    : m_frame(frame)
+    , m_delegateIsDecidingNavigationPolicy(false)
+    , m_delegateIsHandlingUnimplementablePolicy(false)
+    , m_loadType(FrameLoadTypeStandard)
+{
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& newRequest, NavigationPolicyDecisionFunction function, void* argument)
+{
+    checkNavigationPolicy(newRequest, m_frame->loader()->activeDocumentLoader(), 0, function, argument);
+}
+
+void PolicyChecker::checkNavigationPolicy(const ResourceRequest& request, DocumentLoader* loader,
+    PassRefPtr<FormState> formState, NavigationPolicyDecisionFunction function, void* argument)
+{
+    NavigationAction action = loader->triggeringAction();
+    if (action.isEmpty()) {
+        action = NavigationAction(request.url(), NavigationTypeOther);
+        loader->setTriggeringAction(action);
+    }
+
+    // Don't ask more than once for the same request or if we are loading an empty URL.
+    // This avoids confusion on the part of the client.
+    if (equalIgnoringHeaderFields(request, loader->lastCheckedRequest()) || (!request.isNull() && request.url().isEmpty())) {
+        function(argument, request, 0, true);
+        loader->setLastCheckedRequest(request);
+        return;
+    }
+    
+    // We are always willing to show alternate content for unreachable URLs;
+    // treat it like a reload so it maintains the right state for b/f list.
+    if (loader->substituteData().isValid() && !loader->substituteData().failingURL().isEmpty()) {
+        if (isBackForwardLoadType(m_loadType))
+            m_loadType = FrameLoadTypeReload;
+        function(argument, request, 0, true);
+        return;
+    }
+    
+    loader->setLastCheckedRequest(request);
+
+    m_callback.set(request, formState.get(), function, argument);
+
+    m_delegateIsDecidingNavigationPolicy = true;
+    m_frame->loader()->client()->dispatchDecidePolicyForNavigationAction(&PolicyChecker::continueAfterNavigationPolicy,
+        action, request, formState);
+    m_delegateIsDecidingNavigationPolicy = false;
+}
+
+void PolicyChecker::checkNewWindowPolicy(const NavigationAction& action, NewWindowPolicyDecisionFunction function,
+    const ResourceRequest& request, PassRefPtr<FormState> formState, const String& frameName, void* argument)
+{
+    m_callback.set(request, formState, frameName, function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForNewWindowAction(&PolicyChecker::continueAfterNewWindowPolicy,
+        action, request, formState, frameName);
+}
+
+void PolicyChecker::checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction function, void* argument)
+{
+    m_callback.set(function, argument);
+    m_frame->loader()->client()->dispatchDecidePolicyForMIMEType(&PolicyChecker::continueAfterContentPolicy,
+        MIMEType, m_frame->loader()->activeDocumentLoader()->request());
+}
+
+void PolicyChecker::cancelCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    m_callback.clear();
+}
+
+void PolicyChecker::stopCheck()
+{
+    m_frame->loader()->client()->cancelPolicyCheck();
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.cancel();
+}
+
+void PolicyChecker::cannotShowMIMEType(const ResourceResponse& response)
+{
+    handleUnimplementablePolicy(m_frame->loader()->client()->cannotShowMIMETypeError(response));
+}
+
+void PolicyChecker::continueLoadAfterWillSubmitForm(PolicyAction)
+{
+    // See header file for an explaination of why this function
+    // isn't like the others.
+    m_frame->loader()->continueLoadAfterWillSubmitForm();
+}
+
+void PolicyChecker::continueAfterNavigationPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    bool shouldContinue = policy == PolicyUse;
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse: {
+            ResourceRequest request(callback.request());
+
+            if (!m_frame->loader()->client()->canHandleRequest(request)) {
+                handleUnimplementablePolicy(m_frame->loader()->cannotShowURLError(callback.request()));
+                callback.clearRequest();
+                shouldContinue = false;
+            }
+            break;
+        }
+    }
+
+    callback.call(shouldContinue);
+}
+
+void PolicyChecker::continueAfterNewWindowPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+
+    switch (policy) {
+        case PolicyIgnore:
+            callback.clearRequest();
+            break;
+        case PolicyDownload:
+            m_frame->loader()->client()->startDownload(callback.request());
+            callback.clearRequest();
+            break;
+        case PolicyUse:
+            break;
+    }
+
+    callback.call(policy == PolicyUse);
+}
+
+void PolicyChecker::continueAfterContentPolicy(PolicyAction policy)
+{
+    PolicyCallback callback = m_callback;
+    m_callback.clear();
+    callback.call(policy);
+}
+
+void PolicyChecker::handleUnimplementablePolicy(const ResourceError& error)
+{
+    m_delegateIsHandlingUnimplementablePolicy = true;
+    m_frame->loader()->client()->dispatchUnableToImplementPolicy(error);
+    m_delegateIsHandlingUnimplementablePolicy = false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/loader/PolicyChecker.h b/WebCore/loader/PolicyChecker.h
new file mode 100644
index 0000000..c667f5b
--- /dev/null
+++ b/WebCore/loader/PolicyChecker.h
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PolicyChecker_h
+#define PolicyChecker_h
+
+#include "FrameLoaderTypes.h"
+#include "PlatformString.h"
+#include "PolicyCallback.h"
+#include "ResourceRequest.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class DocumentLoader;
+    class FormState;
+    class Frame;
+    class NavigationAction;
+    class ResourceError;
+    class ResourceResponse;
+
+    class PolicyChecker : public Noncopyable {
+    public:
+        PolicyChecker(Frame*);
+
+        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+        void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction, void* argument);
+        void checkNewWindowPolicy(const NavigationAction&, NewWindowPolicyDecisionFunction, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, void* argument);
+        void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
+
+        // FIXME: These are different.  They could use better names.
+        void cancelCheck();
+        void stopCheck();
+
+        void cannotShowMIMEType(const ResourceResponse&);
+
+        FrameLoadType loadType() const { return m_loadType; }
+        void setLoadType(FrameLoadType loadType) { m_loadType = loadType; }
+
+        bool delegateIsDecidingNavigationPolicy() const { return m_delegateIsDecidingNavigationPolicy; }
+        bool delegateIsHandlingUnimplementablePolicy() const { return m_delegateIsHandlingUnimplementablePolicy; }
+
+        // FIXME: This function is a cheat.  Basically, this is just an asynchronouc callback
+        // from the FrameLoaderClient, but this callback uses the policy types and so has to
+        // live on this object.  In the long term, we should create a type for non-policy
+        // callbacks from the FrameLoaderClient and remove this vestige.  I just don't have
+        // the heart to hack on all the platforms to make that happen right now.
+        void continueLoadAfterWillSubmitForm(PolicyAction);
+
+    private:
+        void continueAfterNavigationPolicy(PolicyAction);
+        void continueAfterNewWindowPolicy(PolicyAction);
+        void continueAfterContentPolicy(PolicyAction);
+
+        void handleUnimplementablePolicy(const ResourceError&);
+
+        Frame* m_frame;
+
+        bool m_delegateIsDecidingNavigationPolicy;
+        bool m_delegateIsHandlingUnimplementablePolicy;
+
+        // This identifies the type of navigation action which prompted this load. Note 
+        // that WebKit conveys this value as the WebActionNavigationTypeKey value
+        // on navigation action delegate callbacks.
+        FrameLoadType m_loadType;
+        PolicyCallback m_callback;
+    };
+
+} // namespace WebCore
+
+#endif // PolicyChecker_h
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/RedirectScheduler.cpp
new file mode 100644
index 0000000..819cbdd
--- /dev/null
+++ b/WebCore/loader/RedirectScheduler.cpp
@@ -0,0 +1,374 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RedirectScheduler.h"
+
+#include "DocumentLoader.h"
+#include "Event.h"
+#include "FormState.h"
+#include "Frame.h"
+#include "FrameLoadRequest.h"
+#include "FrameLoader.h"
+#include "HTMLFormElement.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+struct ScheduledRedirection {
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+    bool toldClient;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
+        : type(redirection)
+        , delay(delay)
+        , url(url)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
+        , delay(0)
+        , url(url)
+        , referrer(referrer)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
+        , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!url.isEmpty());
+    }
+
+    explicit ScheduledRedirection(int historyNavigationSteps)
+        : type(historyNavigation)
+        , delay(0)
+        , historySteps(historyNavigationSteps)
+        , lockHistory(false)
+        , lockBackForwardList(false)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(false)
+        , toldClient(false)
+    {
+    }
+
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+        , toldClient(false)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+
+RedirectScheduler::RedirectScheduler(Frame* frame)
+    : m_frame(frame)
+    , m_timer(this, &RedirectScheduler::timerFired)
+{
+}
+
+RedirectScheduler::~RedirectScheduler()
+{
+}
+
+bool RedirectScheduler::redirectScheduledDuringLoad()
+{
+    return m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad;
+}
+
+void RedirectScheduler::clear()
+{
+    m_timer.stop();
+    m_scheduledRedirection.clear();
+}
+
+void RedirectScheduler::scheduleRedirect(double delay, const String& url)
+{
+    if (delay < 0 || delay > INT_MAX / 1000)
+        return;
+        
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    // We want a new history item if the refresh timeout is > 1 second.
+    if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
+        schedule(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
+}
+
+bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame)
+{
+    // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
+    // The definition of "during load" is any time before all handlers for the load event have been run.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    
+    for (Frame* ancestor = targetFrame->tree()->parent(); ancestor; ancestor = ancestor->tree()->parent()) {
+        Document* document = ancestor->document();
+        if (!ancestor->loader()->isComplete() || document && document->processingLoadEvent())
+            return true;
+    }
+    return false;
+}
+
+void RedirectScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+
+    if (url.isEmpty())
+        return;
+
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
+
+    FrameLoader* loader = m_frame->loader();
+    
+    // If the URL we're going to navigate to is the same as the current one, except for the
+    // fragment part, we don't need to schedule the location change.
+    KURL parsedURL(ParsedURLString, url);
+    if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
+        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        return;
+    }
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !loader->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void RedirectScheduler::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
+
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_frame->loader()->committedFirstRealDocumentLoad();
+
+    schedule(new ScheduledRedirection(frameRequest, lockHistory, mustLockBackForwardList(m_frame), event, formState, duringLoad));
+}
+
+void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
+{
+    if (!m_frame->page())
+        return;
+    
+    const KURL& url = m_frame->loader()->url();
+
+    if (url.isEmpty())
+        return;
+
+    schedule(new ScheduledRedirection(url.string(), m_frame->loader()->outgoingReferrer(), true, true, wasUserGesture, true, false));
+}
+
+bool RedirectScheduler::locationChangePending()
+{
+    if (!m_scheduledRedirection)
+        return false;
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::redirection:
+            return false;
+        case ScheduledRedirection::historyNavigation:
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::formSubmission:
+            return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void RedirectScheduler::scheduleHistoryNavigation(int steps)
+{
+    if (!m_frame->page())
+        return;
+
+    schedule(new ScheduledRedirection(steps));
+}
+
+void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
+{
+    ASSERT(m_frame->page());
+
+    if (m_frame->page()->defersLoading())
+        return;
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    FrameLoader* loader = m_frame->loader();
+
+    switch (redirection->type) {
+        case ScheduledRedirection::redirection:
+        case ScheduledRedirection::locationChange:
+            loader->changeLocation(KURL(ParsedURLString, redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
+            return;
+        case ScheduledRedirection::historyNavigation:
+            if (redirection->historySteps == 0) {
+                // Special case for go(0) from a frame -> reload only the frame
+                loader->urlSelected(loader->url(), "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
+                return;
+            }
+            // go(i!=0) from a frame navigates into the history of the frame only,
+            // in both IE and NS (but not in Mozilla). We can't easily do that.
+            if (m_frame->page()->canGoBackOrForward(redirection->historySteps))
+                m_frame->page()->goBackOrForward(redirection->historySteps);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loader->loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState);
+            return;
+    }
+
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::schedule(PassOwnPtr<ScheduledRedirection> redirection)
+{
+    ASSERT(m_frame->page());
+    FrameLoader* loader = m_frame->loader();
+
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (DocumentLoader* provisionalDocumentLoader = loader->provisionalDocumentLoader())
+            provisionalDocumentLoader->stopLoading();
+        loader->stopLoading(UnloadEventPolicyUnloadAndPageHide);   
+    }
+
+    cancel();
+    m_scheduledRedirection = redirection;
+    if (!loader->isComplete() && m_scheduledRedirection->type != ScheduledRedirection::redirection)
+        loader->completed();
+    startTimer();
+}
+
+void RedirectScheduler::startTimer()
+{
+    if (!m_scheduledRedirection)
+        return;
+
+    ASSERT(m_frame->page());
+    
+    FrameLoader* loader = m_frame->loader();
+
+    if (m_timer.isActive())
+        return;
+
+    if (m_scheduledRedirection->type == ScheduledRedirection::redirection && !loader->allAncestorsAreComplete())
+        return;
+
+    m_timer.startOneShot(m_scheduledRedirection->delay);
+
+    switch (m_scheduledRedirection->type) {
+        case ScheduledRedirection::locationChange:
+        case ScheduledRedirection::redirection:
+            if (m_scheduledRedirection->toldClient)
+                return;
+            m_scheduledRedirection->toldClient = true;
+            loader->clientRedirected(KURL(ParsedURLString, m_scheduledRedirection->url),
+                m_scheduledRedirection->delay,
+                currentTime() + m_timer.nextFireInterval(),
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
+            return;
+        case ScheduledRedirection::historyNavigation:
+            // Don't report history navigations.
+            return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void RedirectScheduler::cancel(bool newLoadInProgress)
+{
+    m_timer.stop();
+
+    OwnPtr<ScheduledRedirection> redirection(m_scheduledRedirection.release());
+    if (redirection && redirection->toldClient)
+        m_frame->loader()->clientRedirectCancelledOrFinished(newLoadInProgress);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/loader/RedirectScheduler.h b/WebCore/loader/RedirectScheduler.h
new file mode 100644
index 0000000..bf076d6
--- /dev/null
+++ b/WebCore/loader/RedirectScheduler.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Adam Barth. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RedirectScheduler_h
+#define RedirectScheduler_h
+
+#include "Event.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class FormState;
+    class Frame;
+    class String;
+
+    struct FrameLoadRequest;
+    struct ScheduledRedirection;
+
+    class RedirectScheduler : public Noncopyable {
+    public:
+        RedirectScheduler(Frame*);
+        ~RedirectScheduler();
+
+        bool redirectScheduledDuringLoad();
+        bool locationChangePending();
+
+        void scheduleRedirect(double delay, const String& url);
+        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, PassRefPtr<Event>, PassRefPtr<FormState>);
+        void scheduleRefresh(bool userGesture = false);
+        void scheduleHistoryNavigation(int steps);
+
+        void startTimer();
+
+        void cancel(bool newLoadInProgress = false);
+        void clear();
+
+    private:
+        void timerFired(Timer<RedirectScheduler>*);
+        void schedule(PassOwnPtr<ScheduledRedirection>);
+
+        static bool mustLockBackForwardList(Frame* targetFrame);
+
+        Frame* m_frame;
+        Timer<RedirectScheduler> m_timer;
+        OwnPtr<ScheduledRedirection> m_scheduledRedirection;
+    };
+
+} // namespace WebCore
+
+#endif // FrameLoader_h
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index 5ad181b..2dac844 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -94,8 +94,9 @@ void ResourceLoader::releaseResources()
 
     if (m_handle) {
         // Clear out the ResourceHandle's client so that it doesn't try to call
-        // us back after we release it.
-        m_handle->setClient(0);
+        // us back after we release it, unless it has been replaced by someone else.
+        if (m_handle->client() == this)
+            m_handle->setClient(0);
         m_handle = 0;
     }
 
diff --git a/WebCore/loader/SubresourceLoader.cpp b/WebCore/loader/SubresourceLoader.cpp
index 047cc6d..2ee4626 100644
--- a/WebCore/loader/SubresourceLoader.cpp
+++ b/WebCore/loader/SubresourceLoader.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "ResourceHandle.h"
+#include "SecurityOrigin.h"
 #include "SubresourceLoaderClient.h"
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -72,13 +73,13 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
     ResourceRequest newRequest = request;
 
     if (!skipCanLoadCheck
-            && FrameLoader::restrictAccessToLocal()
-            && !FrameLoader::canLoad(request.url(), String(), frame->document())) {
+            && SecurityOrigin::restrictAccessToLocal()
+            && !SecurityOrigin::canLoad(request.url(), String(), frame->document())) {
         FrameLoader::reportLocalLoadFailed(frame, request.url().string());
         return 0;
     }
     
-    if (FrameLoader::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
+    if (SecurityOrigin::shouldHideReferrer(request.url(), fl->outgoingReferrer()))
         newRequest.clearHTTPReferrer();
     else if (!request.httpReferrer())
         newRequest.setHTTPReferrer(fl->outgoingReferrer());
diff --git a/WebCore/loader/TextDocument.h b/WebCore/loader/TextDocument.h
index c67fea5..53e3074 100644
--- a/WebCore/loader/TextDocument.h
+++ b/WebCore/loader/TextDocument.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,7 +35,7 @@ class TextDocument : public HTMLDocument {
 public:
     static PassRefPtr<TextDocument> create(Frame* frame)
     {
-        return new TextDocument(frame);
+        return adoptRef(new TextDocument(frame));
     }
 
 private:
diff --git a/WebCore/loader/TextResourceDecoder.cpp b/WebCore/loader/TextResourceDecoder.cpp
index db68441..6ddd604 100644
--- a/WebCore/loader/TextResourceDecoder.cpp
+++ b/WebCore/loader/TextResourceDecoder.cpp
@@ -798,23 +798,15 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         if (!checkForHeadCharset(data, len, movedDataToBuffer))
             return "";
 
-    // FIXME: It seems wrong to change our encoding downstream after
-    // we have already done some decoding. However, it's not possible
-    // to avoid in a sense in two cases below because triggering conditions
-    // for both cases depend on the information that won't be available
-    // until we do partial read. 
-    // The first case had better be removed altogether (see bug 21990)
-    // or at least be made to be invoked only when the encoding detection
-    // is turned on. 
-    // Do the auto-detect 1) using Japanese detector if our default encoding is
-    // one of the Japanese detector or 2) using detectTextEncoding if encoding
-    // detection is turned on.
-    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && m_encoding.isJapanese())
-        detectJapaneseEncoding(data, len);
-    else if (shouldAutoDetect()) {
-        TextEncoding detectedEncoding;
-        if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
-            setEncoding(detectedEncoding, AutoDetectedEncoding);
+    // FIXME: It is wrong to change the encoding downstream after we have already done some decoding.
+    if (shouldAutoDetect()) {
+        if (m_encoding.isJapanese())
+            detectJapaneseEncoding(data, len); // FIXME: We should use detectTextEncoding() for all languages.
+        else {
+            TextEncoding detectedEncoding;
+            if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
+                setEncoding(detectedEncoding, AutoDetectedEncoding);
+        }
     }
 
     ASSERT(m_encoding.isValid());
diff --git a/WebCore/loader/ThreadableLoader.cpp b/WebCore/loader/ThreadableLoader.cpp
index b174af7..720ba4e 100644
--- a/WebCore/loader/ThreadableLoader.cpp
+++ b/WebCore/loader/ThreadableLoader.cpp
@@ -40,33 +40,33 @@
 
 namespace WebCore {
 
-PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy) 
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, const ThreadableLoaderOptions& options) 
 {
     ASSERT(client);
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext())
-        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, options);
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, options);
 }
 
-void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     ASSERT(context);
 
 #if ENABLE(WORKERS)
     if (context->isWorkerContext()) {
-        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, DenyCrossOriginRedirect);
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, options);
         return;
     }
 #endif // ENABLE(WORKERS)
 
     ASSERT(context->isDocument());
-    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, options);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/ThreadableLoader.h b/WebCore/loader/ThreadableLoader.h
index 1ac12cb..a52bfad 100644
--- a/WebCore/loader/ThreadableLoader.h
+++ b/WebCore/loader/ThreadableLoader.h
@@ -43,32 +43,32 @@ namespace WebCore {
     class ScriptExecutionContext;
     class ThreadableLoaderClient;
 
-    enum LoadCallbacks {
-        SendLoadCallbacks,
-        DoNotSendLoadCallbacks
-    };
-
-    enum ContentSniff {
-        SniffContent,
-        DoNotSniffContent
-    };
-
     enum StoredCredentials {
         AllowStoredCredentials,
         DoNotAllowStoredCredentials
     };
-
-    enum CrossOriginRedirectPolicy {
-        DenyCrossOriginRedirect,
-        AllowCrossOriginRedirect
+    
+    enum CrossOriginRequestPolicy {
+        DenyCrossOriginRequests,
+        UseAccessControl,
+        AllowCrossOriginRequests
+    };
+    
+    struct ThreadableLoaderOptions {
+        ThreadableLoaderOptions() : sendLoadCallbacks(false), sniffContent(false), allowCredentials(false), forcePreflight(false), crossOriginRequestPolicy(DenyCrossOriginRequests) { }
+        bool sendLoadCallbacks;
+        bool sniffContent;
+        bool allowCredentials;  // Whether HTTP credentials and cookies are sent with the request.
+        bool forcePreflight;  // If AccessControl is used, whether to force a preflight.
+        CrossOriginRequestPolicy crossOriginRequestPolicy;
     };
 
     // Useful for doing loader operations from any thread (not threadsafe, 
     // just able to run on threads other than the main thread).
     class ThreadableLoader : public Noncopyable {
     public:
-        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
-        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         virtual void cancel() = 0;
         void ref() { refThreadableLoader(); }
diff --git a/WebCore/loader/WorkerThreadableLoader.cpp b/WebCore/loader/WorkerThreadableLoader.cpp
index 4d12b8d..bd362f4 100644
--- a/WebCore/loader/WorkerThreadableLoader.cpp
+++ b/WebCore/loader/WorkerThreadableLoader.cpp
@@ -53,11 +53,10 @@ namespace WebCore {
 
 static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
 
-WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
-                                               ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerContext(workerContext)
     , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
-    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy)))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, options)))
 {
 }
 
@@ -66,7 +65,7 @@ WorkerThreadableLoader::~WorkerThreadableLoader()
     m_bridge.destroy();
 }
 
-void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, const ThreadableLoaderOptions& options)
 {
     WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
 
@@ -74,9 +73,7 @@ void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerCont
     String mode = loadResourceSynchronouslyMode;
     mode.append(String::number(runLoop.createUniqueId()));
 
-    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
-    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, crossOriginRedirectPolicy);
-
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, options);
     MessageQueueWaitResult result = MessageQueueMessageReceived;
     while (!loader->done() && result != MessageQueueTerminated)
         result = runLoop.runInMode(workerContext, mode);
@@ -91,21 +88,20 @@ void WorkerThreadableLoader::cancel()
 }
 
 WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
-                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
-                                                           CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+                                                           const ResourceRequest& request, const ThreadableLoaderOptions& options)
     : m_workerClientWrapper(workerClientWrapper)
     , m_loaderProxy(loaderProxy)
-    , m_taskMode(taskMode.copy())
+    , m_taskMode(taskMode.crossThreadString())
 {
     ASSERT(m_workerClientWrapper.get());
-    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, options));
 }
 
 WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
 {
 }
 
-void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, ThreadableLoaderOptions options)
 {
     ASSERT(isMainThread());
     ASSERT(context->isDocument());
@@ -117,7 +113,7 @@ void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExec
     // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
     // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
     // a failure.
-    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, options);
     ASSERT(thisPtr->m_mainThreadLoader);
 }
 
diff --git a/WebCore/loader/WorkerThreadableLoader.h b/WebCore/loader/WorkerThreadableLoader.h
index 8b11b70..230c77d 100644
--- a/WebCore/loader/WorkerThreadableLoader.h
+++ b/WebCore/loader/WorkerThreadableLoader.h
@@ -55,10 +55,10 @@ namespace WebCore {
 
     class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
     public:
-        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, CrossOriginRedirectPolicy);
-        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, const ThreadableLoaderOptions&);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, const ThreadableLoaderOptions& options)
         {
-            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, options));
         }
 
         ~WorkerThreadableLoader();
@@ -97,7 +97,7 @@ namespace WebCore {
         class MainThreadBridge : ThreadableLoaderClient {
         public:
             // All executed on the worker context's thread.
-            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
             void cancel();
             void destroy();
 
@@ -109,7 +109,7 @@ namespace WebCore {
             static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
             ~MainThreadBridge();
 
-            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, ThreadableLoaderOptions);
             static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
             virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
             virtual void didReceiveResponse(const ResourceResponse&);
@@ -133,7 +133,7 @@ namespace WebCore {
             String m_taskMode;
         };
 
-        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, const ThreadableLoaderOptions&);
 
         RefPtr<WorkerContext> m_workerContext;
         RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
diff --git a/WebCore/loader/appcache/ApplicationCache.cpp b/WebCore/loader/appcache/ApplicationCache.cpp
index 34dace4..c0cd3ea 100644
--- a/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/WebCore/loader/appcache/ApplicationCache.cpp
@@ -111,7 +111,7 @@ unsigned ApplicationCache::removeResource(const String& url)
     
 ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 {
-    ASSERT(!KURL(url).hasFragmentIdentifier());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     return m_resources.get(url).get();
 }    
 
@@ -147,6 +147,9 @@ void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
 
 bool ApplicationCache::isURLInOnlineWhitelist(const KURL& url)
 {
+    if (m_allowAllNetworkRequests)
+        return true;
+
     size_t whitelistSize = m_onlineWhitelist.size();
     for (size_t i = 0; i < whitelistSize; ++i) {
         if (protocolHostAndPortAreEqual(url, m_onlineWhitelist[i]) && url.string().startsWith(m_onlineWhitelist[i].string()))
diff --git a/WebCore/loader/appcache/ApplicationCache.h b/WebCore/loader/appcache/ApplicationCache.h
index b1753be..d1444c0 100644
--- a/WebCore/loader/appcache/ApplicationCache.h
+++ b/WebCore/loader/appcache/ApplicationCache.h
@@ -65,6 +65,8 @@ public:
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
+    void setAllowsAllNetworkRequests(bool value) { m_allowAllNetworkRequests = value; }
+    bool allowsAllNetworkRequests() const { return m_allowAllNetworkRequests; }
     void setOnlineWhitelist(const Vector<KURL>& onlineWhitelist);
     const Vector<KURL>& onlineWhitelist() const { return m_onlineWhitelist; }
     bool isURLInOnlineWhitelist(const KURL&); // There is an entry in online whitelist that has the same origin as the resource's URL and that is a prefix match for the resource's URL.
@@ -96,6 +98,7 @@ private:
     ResourceMap m_resources;
     ApplicationCacheResource* m_manifest;
 
+    bool m_allowAllNetworkRequests;
     Vector<KURL> m_onlineWhitelist;
     FallbackURLVector m_fallbackURLs;
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 41c5cac..a3d551b 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -158,7 +158,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
             // Restart the current navigation from the top of the navigation algorithm, undoing any changes that were made
             // as part of the initial load.
             // The navigation will not result in the same resource being loaded, because "foreign" entries are never picked during navigation.
-            frame->loader()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
+            frame->redirectScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
         }
         
         return;
@@ -672,6 +672,7 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
     
     m_cacheBeingUpdated->setOnlineWhitelist(manifest.onlineWhitelistedURLs);
     m_cacheBeingUpdated->setFallbackURLs(manifest.fallbackURLs);
+    m_cacheBeingUpdated->setAllowsAllNetworkRequests(manifest.allowAllNetworkRequests);
     
     startLoadingEntry();
 }
@@ -852,7 +853,7 @@ void ApplicationCacheGroup::startLoadingEntry()
 
     ASSERT(!m_currentHandle);
     
-    m_currentHandle = createResourceHandle(KURL(it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
+    m_currentHandle = createResourceHandle(KURL(ParsedURLString, it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
 }
 
 void ApplicationCacheGroup::deliverDelayedMainResources()
@@ -879,7 +880,7 @@ void ApplicationCacheGroup::deliverDelayedMainResources()
 void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 {
     ASSERT(m_cacheBeingUpdated);
-    ASSERT(!KURL(url).hasFragmentIdentifier());
+    ASSERT(!KURL(ParsedURLString, url).hasFragmentIdentifier());
     
     // Don't add the URL if we already have an master resource in the cache
     // (i.e., the main resource finished loading before the manifest).
@@ -962,7 +963,7 @@ public:
     
         ASSERT(frame->loader()->documentLoader() == m_documentLoader.get());
 
-        m_documentLoader->applicationCacheHost()->notifyEventListener(m_eventID);
+        m_documentLoader->applicationCacheHost()->notifyDOMApplicationCache(m_eventID);
     }
 
 private:
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.h b/WebCore/loader/appcache/ApplicationCacheGroup.h
index 939646f..8df52cc 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -97,6 +97,10 @@ private:
 
     PassRefPtr<ResourceHandle> createResourceHandle(const KURL&, ApplicationCacheResource* newestCachedResource);
 
+    // For normal resource loading, WebKit client is asked about each resource individually. Since application cache does not belong to any particular document,
+    // the existing client callback cannot be used, so assume that any client that enables application cache also wants it to use credential storage.
+    virtual bool shouldUseCredentialStorage(ResourceHandle*) { return true; }
+
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
     virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
     virtual void didFinishLoading(ResourceHandle*);
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.cpp b/WebCore/loader/appcache/ApplicationCacheHost.cpp
index b0c9e74..751efc1 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -227,10 +227,13 @@ void ApplicationCacheHost::setDOMApplicationCache(DOMApplicationCache* domApplic
     m_domApplicationCache = domApplicationCache;
 }
 
-void ApplicationCacheHost::notifyEventListener(EventID id)
+void ApplicationCacheHost::notifyDOMApplicationCache(EventID id)
 {
-    if (m_domApplicationCache)
-        m_domApplicationCache->callEventListener(id);
+    if (m_domApplicationCache) {
+        ExceptionCode ec = 0;
+        m_domApplicationCache->dispatchEvent(Event::create(DOMApplicationCache::toEventType(id), false, false), ec);
+        ASSERT(!ec);    
+    }
 }
 
 void ApplicationCacheHost::setCandidateApplicationCacheGroup(ApplicationCacheGroup* group)
@@ -255,8 +258,9 @@ bool ApplicationCacheHost::shouldLoadResourceFromApplicationCache(const Resource
     if (!cache || !cache->isComplete())
         return false;
 
-    // If the resource is not a HTTP/HTTPS GET, then abort
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
+    // If the resource is not to be fetched using the HTTP GET mechanism or equivalent, or if its URL has a different
+    // <scheme> component than the application cache's manifest, then fetch the resource normally.
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request) || !equalIgnoringCase(request.url().protocol(), cache->manifestResource()->url().protocol()))
         return false;
 
     // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index cb68862..236013d 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -108,7 +108,7 @@ namespace WebCore {
         bool swapCache();
 
         void setDOMApplicationCache(DOMApplicationCache* domApplicationCache);
-        void notifyEventListener(EventID id);
+        void notifyDOMApplicationCache(EventID id);
 
     private:
         bool isApplicationCacheEnabled();
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5a2b642..d6ee723 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -216,7 +216,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -284,7 +284,7 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
     
     int result;
     while ((result = statement.step()) == SQLResultRow) {
-        KURL manifestURL = KURL(statement.getColumnText(1));
+        KURL manifestURL = KURL(ParsedURLString, statement.getColumnText(1));
 
         if (m_cachesInMemory.contains(manifestURL))
             continue;
@@ -427,7 +427,7 @@ bool ApplicationCacheStorage::executeSQLCommand(const String& sql)
     return result;
 }
 
-static const int schemaVersion = 4;
+static const int schemaVersion = 5;
     
 void ApplicationCacheStorage::verifySchemaVersion()
 {
@@ -479,6 +479,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       "manifestHostHash INTEGER NOT NULL ON CONFLICT FAIL, manifestURL TEXT UNIQUE ON CONFLICT FAIL, newestCache INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS Caches (id INTEGER PRIMARY KEY AUTOINCREMENT, cacheGroup INTEGER, size INTEGER)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheWhitelistURLs (url TEXT NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
+    executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheAllowsAllNetworkRequests (wildcard INTEGER NOT NULL ON CONFLICT FAIL, cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS FallbackURLs (namespace TEXT NOT NULL ON CONFLICT FAIL, fallbackURL TEXT NOT NULL ON CONFLICT FAIL, "
                       "cache INTEGER NOT NULL ON CONFLICT FAIL)");
     executeSQLCommand("CREATE TABLE IF NOT EXISTS CacheEntries (cache INTEGER NOT NULL ON CONFLICT FAIL, type INTEGER, resource INTEGER NOT NULL)");
@@ -491,6 +492,7 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       " FOR EACH ROW BEGIN"
                       "  DELETE FROM CacheEntries WHERE cache = OLD.id;"
                       "  DELETE FROM CacheWhitelistURLs WHERE cache = OLD.id;"
+                      "  DELETE FROM CacheAllowsAllNetworkRequests WHERE cache = OLD.id;"
                       "  DELETE FROM FallbackURLs WHERE cache = OLD.id;"
                       " END");
 
@@ -584,6 +586,18 @@ bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJo
                 return false;
         }
     }
+
+    // Store online whitelist wildcard flag.
+    {
+        SQLiteStatement statement(m_database, "INSERT INTO CacheAllowsAllNetworkRequests (wildcard, cache) VALUES (?, ?)");
+        statement.prepare();
+
+        statement.bindInt64(1, cache->allowsAllNetworkRequests());
+        statement.bindInt64(2, cacheStorageID);
+
+        if (!executeStatement(statement))
+            return false;
+    }
     
     // Store fallback URLs.
     const FallbackURLVector& fallbackURLs = cache->fallbackURLs();
@@ -821,7 +835,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     int result;
     while ((result = cacheStatement.step()) == SQLResultRow) {
-        KURL url(cacheStatement.getColumnText(0));
+        KURL url(ParsedURLString, cacheStatement.getColumnText(0));
         
         unsigned type = static_cast<unsigned>(cacheStatement.getColumnInt64(1));
 
@@ -857,13 +871,28 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     Vector<KURL> whitelist;
     while ((result = whitelistStatement.step()) == SQLResultRow) 
-        whitelist.append(whitelistStatement.getColumnText(0));
+        whitelist.append(KURL(ParsedURLString, whitelistStatement.getColumnText(0)));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load cache online whitelist, error \"%s\"", m_database.lastErrorMsg());
 
     cache->setOnlineWhitelist(whitelist);
 
+    // Load online whitelist wildcard flag.
+    SQLiteStatement whitelistWildcardStatement(m_database, "SELECT wildcard FROM CacheAllowsAllNetworkRequests WHERE cache=?");
+    if (whitelistWildcardStatement.prepare() != SQLResultOk)
+        return 0;
+    whitelistWildcardStatement.bindInt64(1, storageID);
+    
+    result = whitelistWildcardStatement.step();
+    if (result != SQLResultRow)
+        LOG_ERROR("Could not load cache online whitelist wildcard flag, error \"%s\"", m_database.lastErrorMsg());
+
+    cache->setAllowsAllNetworkRequests(whitelistWildcardStatement.getColumnInt64(0));
+
+    if (whitelistWildcardStatement.step() != SQLResultDone)
+        LOG_ERROR("Too many rows for online whitelist wildcard flag");
+
     // Load fallback URLs.
     SQLiteStatement fallbackStatement(m_database, "SELECT namespace, fallbackURL FROM FallbackURLs WHERE cache=?");
     if (fallbackStatement.prepare() != SQLResultOk)
@@ -872,7 +901,7 @@ PassRefPtr<ApplicationCache> ApplicationCacheStorage::loadCache(unsigned storage
     
     FallbackURLVector fallbackURLs;
     while ((result = fallbackStatement.step()) == SQLResultRow) 
-        fallbackURLs.append(make_pair(fallbackStatement.getColumnText(0), fallbackStatement.getColumnText(1)));
+        fallbackURLs.append(make_pair(KURL(ParsedURLString, fallbackStatement.getColumnText(0)), KURL(ParsedURLString, fallbackStatement.getColumnText(1))));
 
     if (result != SQLResultDone)
         LOG_ERROR("Could not load fallback URLs, error \"%s\"", m_database.lastErrorMsg());
@@ -987,7 +1016,7 @@ bool ApplicationCacheStorage::manifestURLs(Vector<KURL>* urls)
         return false;
 
     while (selectURLs.step() == SQLResultRow)
-        urls->append(selectURLs.getColumnText(0));
+        urls->append(KURL(ParsedURLString, selectURLs.getColumnText(0)));
 
     return true;
 }
diff --git a/WebCore/loader/appcache/DOMApplicationCache.cpp b/WebCore/loader/appcache/DOMApplicationCache.cpp
index ab5802f..1496b8a 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -42,8 +42,10 @@ namespace WebCore {
 DOMApplicationCache::DOMApplicationCache(Frame* frame)
     : m_frame(frame)
 {
-    ASSERT(applicationCacheHost());
-    applicationCacheHost()->setDOMApplicationCache(this);
+    ASSERT(!m_frame || applicationCacheHost());
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (cacheHost)
+        cacheHost->setDOMApplicationCache(this);
 }
 
 void DOMApplicationCache::disconnectFrame()
@@ -76,90 +78,17 @@ void DOMApplicationCache::update(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
 }
 
-bool DOMApplicationCache::swapCache()
-{
-    ApplicationCacheHost* cacheHost = applicationCacheHost();
-    if (!cacheHost)
-        return false;
-    return cacheHost->swapCache();
-}
-    
 void DOMApplicationCache::swapCache(ExceptionCode& ec)
 {
-    if (!swapCache())
+    ApplicationCacheHost* cacheHost = applicationCacheHost();
+    if (!cacheHost || !cacheHost->swapCache())
         ec = INVALID_STATE_ERR;
 }
 
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
-    return m_frame->document();
-}
-
-void DOMApplicationCache::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
-}
-
-void DOMApplicationCache::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool DOMApplicationCache::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-    
-    return !event->defaultPrevented();
-}
-
-void DOMApplicationCache::callListener(const AtomicString& eventType, EventListener* listener)
-{
     ASSERT(m_frame);
-    
-    RefPtr<Event> event = Event::create(eventType, false, false);
-    if (listener) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listener->handleEvent(event.get(), false);
-    }
-    
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);    
+    return m_frame->document();
 }
 
 const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::EventID id)
@@ -186,29 +115,19 @@ const AtomicString& DOMApplicationCache::toEventType(ApplicationCacheHost::Event
     return eventNames().errorEvent;
 }
 
-ApplicationCacheHost::EventID DOMApplicationCache::toEventID(const AtomicString& eventType)
+EventTargetData* DOMApplicationCache::eventTargetData()
 {
-    if (eventType == eventNames().checkingEvent)
-        return ApplicationCacheHost::CHECKING_EVENT;
-    if (eventType == eventNames().errorEvent)
-        return ApplicationCacheHost::ERROR_EVENT;
-    if (eventType == eventNames().noupdateEvent)
-        return ApplicationCacheHost::NOUPDATE_EVENT;
-    if (eventType == eventNames().downloadingEvent)
-        return ApplicationCacheHost::DOWNLOADING_EVENT;
-    if (eventType == eventNames().progressEvent)
-        return ApplicationCacheHost::PROGRESS_EVENT;
-    if (eventType == eventNames().updatereadyEvent)
-        return ApplicationCacheHost::UPDATEREADY_EVENT;
-    if (eventType == eventNames().cachedEvent)
-        return ApplicationCacheHost::CACHED_EVENT;
-    if (eventType == eventNames().obsoleteEvent)
-        return ApplicationCacheHost::OBSOLETE_EVENT;
-  
-    ASSERT_NOT_REACHED();
-    return ApplicationCacheHost::ERROR_EVENT;
+    return &m_eventTargetData;
+}
+
+<<<<<<< HEAD:WebCore/loader/appcache/DOMApplicationCache.cpp
+=======
+EventTargetData* DOMApplicationCache::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
+>>>>>>> webkit.org at 49305:WebCore/loader/appcache/DOMApplicationCache.cpp
 } // namespace WebCore
 
 #endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/WebCore/loader/appcache/DOMApplicationCache.h b/WebCore/loader/appcache/DOMApplicationCache.h
index 276f50e..077cae0 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/WebCore/loader/appcache/DOMApplicationCache.h
@@ -30,8 +30,9 @@
 
 #include "ApplicationCacheHost.h"
 #include "AtomicStringHash.h"
-#include "EventTarget.h"
 #include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -55,73 +56,39 @@ public:
     void update(ExceptionCode&);
     void swapCache(ExceptionCode&);
 
-    // Event listener attributes by EventID
-
-    void setAttributeEventListener(ApplicationCacheHost::EventID id, PassRefPtr<EventListener> eventListener) { m_attributeEventListeners[id] = eventListener; }
-    EventListener* getAttributeEventListener(ApplicationCacheHost::EventID id) const { return m_attributeEventListeners[id].get(); }
-    void clearAttributeEventListener(ApplicationCacheHost::EventID id) { m_attributeEventListeners[id] = 0; }
-    void callEventListener(ApplicationCacheHost::EventID id) { callListener(toEventType(id), getAttributeEventListener(id)); }
-
     // EventTarget impl
 
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    typedef Vector<RefPtr<EventListener> > ListenerVector;
-    typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-    EventListenersMap& eventListeners() { return m_eventListeners; }
-
     using RefCounted<DOMApplicationCache>::ref;
     using RefCounted<DOMApplicationCache>::deref;
 
     // Explicitly named attribute event listener helpers
 
-    void setOnchecking(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT, listener); }
-    EventListener* onchecking() const { return getAttributeEventListener(ApplicationCacheHost::CHECKING_EVENT); }
-
-    void setOnerror(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::ERROR_EVENT, listener);}
-    EventListener* onerror() const { return getAttributeEventListener(ApplicationCacheHost::ERROR_EVENT); }
-
-    void setOnnoupdate(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT, listener); }
-    EventListener* onnoupdate() const { return getAttributeEventListener(ApplicationCacheHost::NOUPDATE_EVENT); }
-
-    void setOndownloading(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT, listener); }
-    EventListener* ondownloading() const { return getAttributeEventListener(ApplicationCacheHost::DOWNLOADING_EVENT); }
-
-    void setOnprogress(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT, listener); }
-    EventListener* onprogress() const { return getAttributeEventListener(ApplicationCacheHost::PROGRESS_EVENT); }
-
-    void setOnupdateready(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT, listener); }
-    EventListener* onupdateready() const { return getAttributeEventListener(ApplicationCacheHost::UPDATEREADY_EVENT); }
-
-    void setOncached(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::CACHED_EVENT, listener); }
-    EventListener* oncached() const { return getAttributeEventListener(ApplicationCacheHost::CACHED_EVENT); }
-
-    void setOnobsolete(PassRefPtr<EventListener> listener) { setAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT, listener); }
-    EventListener* onobsolete() const { return getAttributeEventListener(ApplicationCacheHost::OBSOLETE_EVENT); }
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(checking);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(noupdate);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(downloading);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(updateready);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(cached);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(obsolete);
 
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     DOMApplicationCache* toDOMApplicationCache() { return this; }
 
     static const AtomicString& toEventType(ApplicationCacheHost::EventID id);
-    static ApplicationCacheHost::EventID toEventID(const AtomicString& eventType);
 
 private:
     DOMApplicationCache(Frame*);
 
-    void callListener(const AtomicString& eventType, EventListener*);
-    
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
 
     ApplicationCacheHost* applicationCacheHost() const;
-    bool swapCache();
-    
-    RefPtr<EventListener> m_attributeEventListeners[ApplicationCacheHost::OBSOLETE_EVENT + 1];
-
-    EventListenersMap m_eventListeners;
 
     Frame* m_frame;
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/WebCore/loader/appcache/DOMApplicationCache.idl b/WebCore/loader/appcache/DOMApplicationCache.idl
index ebc1d19..dd5468a 100644
--- a/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -27,7 +27,7 @@ module offline {
  
     interface [
         Conditional=OFFLINE_WEB_APPLICATIONS,
-        CustomMarkFunction
+        EventTarget
     ] DOMApplicationCache {
         // update status
         const unsigned short UNCACHED = 0;
diff --git a/WebCore/loader/appcache/ManifestParser.cpp b/WebCore/loader/appcache/ManifestParser.cpp
index a2df825..b001bff 100644
--- a/WebCore/loader/appcache/ManifestParser.cpp
+++ b/WebCore/loader/appcache/ManifestParser.cpp
@@ -43,7 +43,8 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
     ASSERT(manifest.explicitURLs.isEmpty());
     ASSERT(manifest.onlineWhitelistedURLs.isEmpty());
     ASSERT(manifest.fallbackURLs.isEmpty());
-    
+    manifest.allowAllNetworkRequests = false;
+
     Mode mode = Explicit;
 
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/cache-manifest", "UTF-8");
@@ -109,6 +110,12 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
             while (p < lineEnd && *p != '\t' && *p != ' ') 
                 p++;
 
+            if (mode == OnlineWhitelist && p - line.characters() == 1 && *line.characters() == '*') {
+                // Wildcard was found.
+                manifest.allowAllNetworkRequests = true;
+                continue;
+            }
+
             KURL url(manifestURL, String(line.characters(), p - line.characters()));
             
             if (!url.isValid())
diff --git a/WebCore/loader/appcache/ManifestParser.h b/WebCore/loader/appcache/ManifestParser.h
index c03cf27..f0369ee 100644
--- a/WebCore/loader/appcache/ManifestParser.h
+++ b/WebCore/loader/appcache/ManifestParser.h
@@ -38,6 +38,7 @@ namespace WebCore {
         Vector<KURL> onlineWhitelistedURLs;
         HashSet<String> explicitURLs;
         FallbackURLVector fallbackURLs;
+        bool allowAllNetworkRequests; // Wildcard found in NETWORK section.
     };
 
     bool parseManifest(const KURL& manifestURL, const char* data, int length, Manifest&);
diff --git a/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index d1269cc..3141e98 100644
--- a/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -233,7 +233,7 @@ PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dic
         response = createResourceResponseFromPropertyListData(resourceResponseData, resourceResponseVersion);
     }
     
-    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(url), mimeType, textEncoding, frameName, response);
+    return ArchiveResource::create(SharedBuffer::create(CFDataGetBytePtr(resourceData), CFDataGetLength(resourceData)), KURL(ParsedURLString, url), mimeType, textEncoding, frameName, response);
 }
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
@@ -489,7 +489,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
     // it's possible to have a response without a URL here
     // <rdar://problem/5454935>
     if (responseURL.isNull())
-        responseURL = KURL("");
+        responseURL = KURL(ParsedURLString, "");
         
     PassRefPtr<ArchiveResource> mainResource = ArchiveResource::create(utf8Buffer(markupString), responseURL, response.mimeType(), "UTF-8", frame->tree()->name());
 
@@ -548,7 +548,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
         const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
         if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
             if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
-                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(iconURL), "image/x-icon", "", ""))
+                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(ParsedURLString, iconURL), "image/x-icon", "", ""))
                     subresources.append(resource.release());
             }
         }
diff --git a/WebCore/loader/icon/IconDatabase.cpp b/WebCore/loader/icon/IconDatabase.cpp
index c0af78f..8982cda 100644
--- a/WebCore/loader/icon/IconDatabase.cpp
+++ b/WebCore/loader/icon/IconDatabase.cpp
@@ -137,7 +137,7 @@ bool IconDatabase::open(const String& databasePath)
         return false;
     }
 
-    m_databaseDirectory = databasePath.copy();
+    m_databaseDirectory = databasePath.crossThreadString();
 
     // Formulate the full path for the database file
     m_completeDatabasePath = pathByAppendingComponent(m_databaseDirectory, defaultDatabaseFilename());
@@ -241,7 +241,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord) {
-        pageURLCopy = pageURLOriginal.copy();
+        pageURLCopy = pageURLOriginal.crossThreadString();
         pageRecord = getOrCreatePageURLRecord(pageURLCopy);
     }
     
@@ -277,7 +277,7 @@ Image* IconDatabase::iconForPageURL(const String& pageURLOriginal, const IntSize
     // mark it to be read by the background thread
     if (iconRecord->imageDataStatus() == ImageDataStatusUnknown) {
         if (pageURLCopy.isNull())
-            pageURLCopy = pageURLOriginal.copy();
+            pageURLCopy = pageURLOriginal.crossThreadString();
     
         MutexLocker locker(m_pendingReadingLock);
         m_pageURLsInterestedInIcons.add(pageURLCopy);
@@ -326,7 +326,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
     
     PageURLRecord* pageRecord = m_pageURLToRecordMap.get(pageURLOriginal);
     if (!pageRecord)
-        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.copy());
+        pageRecord = getOrCreatePageURLRecord(pageURLOriginal.crossThreadString());
     
     // If pageRecord is NULL, one of two things is true -
     // 1 - The initial url import is incomplete and this pageURL has already been marked to be notified once it is complete if an iconURL exists
@@ -335,7 +335,7 @@ String IconDatabase::iconURLForPageURL(const String& pageURLOriginal)
         return String();
     
     // Possible the pageRecord is around because it's a retained pageURL with no iconURL, so we have to check
-    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().copy() : String();
+    return pageRecord->iconRecord() ? pageRecord->iconRecord()->iconURL().threadsafeCopy() : String();
 }
 
 #ifdef CAN_THEME_URL_ICON
@@ -419,7 +419,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     String pageURL;
     
     if (!record) {
-        pageURL = pageURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
 
         record = new PageURLRecord(pageURL);
         m_pageURLToRecordMap.set(pageURL, record);
@@ -427,7 +427,7 @@ void IconDatabase::retainIconForPageURL(const String& pageURLOriginal)
     
     if (!record->retain()) {
         if (pageURL.isNull())
-            pageURL = pageURLOriginal.copy();
+            pageURL = pageURLOriginal.crossThreadString();
 
         // This page just had its retain count bumped from 0 to 1 - Record that fact
         m_retainedPageURLs.add(pageURL);
@@ -502,7 +502,7 @@ void IconDatabase::releaseIconForPageURL(const String& pageURLOriginal)
     // Mark stuff for deletion from the database only if we're not in private browsing
     if (!m_privateBrowsingEnabled) {
         MutexLocker locker(m_pendingSyncLock);
-        m_pageURLsPendingSync.set(pageURLOriginal.copy(), pageRecord->snapshot(true));
+        m_pageURLsPendingSync.set(pageURLOriginal.crossThreadString(), pageRecord->snapshot(true));
     
         // If this page is the last page to refer to a particular IconRecord, that IconRecord needs to
         // be marked for deletion
@@ -526,7 +526,7 @@ void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> dataOriginal,
         return;
     
     RefPtr<SharedBuffer> data = dataOriginal ? dataOriginal->copy() : 0;
-    String iconURL = iconURLOriginal.copy();
+    String iconURL = iconURLOriginal.crossThreadString();
     
     Vector<String> pageURLs;
     {
@@ -603,8 +603,8 @@ void IconDatabase::setIconURLForPageURL(const String& iconURLOriginal, const Str
         if (pageRecord && pageRecord->iconRecord() && pageRecord->iconRecord()->iconURL() == iconURLOriginal)
             return;
             
-        pageURL = pageURLOriginal.copy();
-        iconURL = iconURLOriginal.copy();
+        pageURL = pageURLOriginal.crossThreadString();
+        iconURL = iconURLOriginal.crossThreadString();
 
         if (!pageRecord) {
             pageRecord = new PageURLRecord(pageURL);
@@ -861,13 +861,13 @@ bool IconDatabase::isOpen() const
 String IconDatabase::databasePath() const
 {
     MutexLocker locker(m_syncLock);
-    return m_completeDatabasePath.copy();
+    return m_completeDatabasePath.threadsafeCopy();
 }
 
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("WebpageIcons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 // Unlike getOrCreatePageURLRecord(), getOrCreateIconRecord() does not mark the icon as "interested in import"
diff --git a/WebCore/loader/icon/IconDatabaseNone.cpp b/WebCore/loader/icon/IconDatabaseNone.cpp
index 03a7964..7b7cc9f 100644
--- a/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -53,7 +53,7 @@ const int updateTimerDelay = 5;
 String IconDatabase::defaultDatabaseFilename()
 {
     DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
-    return defaultDatabaseFilename.copy();
+    return defaultDatabaseFilename.threadsafeCopy();
 }
 
 IconDatabase* iconDatabase()
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index 65d15a5..eb606d8 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -102,7 +102,7 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
     RefPtr<Host> host;
-    KURL url(resource->url());
+    KURL url(ParsedURLString, resource->url());
     if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
@@ -355,7 +355,7 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -403,7 +403,7 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
     DocLoader* docLoader = request->docLoader();
     // Prevent the document from being destroyed before we are done with
     // the docLoader that it will delete when the document gets deleted.
-    DocPtr<Document> protector(docLoader->doc());
+    RefPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
diff --git a/WebCore/make-generated-sources.sh b/WebCore/make-generated-sources.sh
index 88173d5..96b2112 100755
--- a/WebCore/make-generated-sources.sh
+++ b/WebCore/make-generated-sources.sh
@@ -2,7 +2,6 @@
 export SOURCE_ROOT=$PWD
 export SRCROOT=$PWD
 export WebCore=$PWD
-export CREATE_HASH_TABLE="$SRCROOT/../JavaScriptCore/create_hash_table"
 
 mkdir -p DerivedSources/WebCore &&
 make -C DerivedSources/WebCore -f ../../DerivedSources.make $@
diff --git a/WebCore/manual-tests/audio-volume.html b/WebCore/manual-tests/audio-volume.html
new file mode 100644
index 0000000..f7e698c
--- /dev/null
+++ b/WebCore/manual-tests/audio-volume.html
@@ -0,0 +1,28 @@
+<html>
+    <script>
+        function load()
+        {
+            var url="http://movies.apple.com/movies/us/apple/ipoditunes/2007/touch/ads/apple_ipodtouch_touch_r640-9cie.mov";
+            var vid = document.getElementById('vid')
+            vid.src = url;
+            vid.volume = 0.05;
+            vid.load();
+        }
+        function setVolume(vol)
+        {
+            var vid = document.getElementById('vid')
+            vid.volume = vol;
+        }
+    </script>
+            
+    <body>
+
+        <video id=vid controls autoplay>
+        </video>
+        <p>TEST: Audio volume should be 0.05 when the movie begins playing.</p>
+        <input type="button" value="Load movie" onclick="load()">
+        <br>
+        <input type="button" value="volume=1.0" onclick="setVolume(1.0)">
+        <input type="button" value="volume=0.05" onclick="setVolume(0.05)">
+    </body>
+</html?
diff --git a/WebCore/manual-tests/autofill-popup-width-and-item-direction.html b/WebCore/manual-tests/autofill-popup-width-and-item-direction.html
new file mode 100644
index 0000000..fa0a80a
--- /dev/null
+++ b/WebCore/manual-tests/autofill-popup-width-and-item-direction.html
@@ -0,0 +1,37 @@
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test the popup list box's width and its items' display directionality
+</title>
+</head>
+<body>
+<p>
+Autofill popup list box should have the same width as its input field's width.
+If the submitted input text is longer, it will be truncated to fit in the 
+input field's width
+<p> Try type some long text in the "Last name" input box,
+   Say "abcd abcd abcd abcd abcd abcd".
+then click "Submit". Open the file again, and type the first letter "a",
+the form autofill pop-up should show up now with the width the same as
+the width of the input field, and the text "abcd abcd abcd abcd abcd abcd" got
+truncated to fit in.
+<p> Try type the following text into the "First name" and "Last name".
+<ul>
+<li>abcd efg
+<li>שששששש ננננננ בבבבבבבבב
+<li>abc אאא defghijklmnopq
+<li>אאאאאאאאאא  abcdefghijklmn בבבבבבב
+<li>hi!
+<li>אא!
+</ul>
+They should be displayed as RTL in the popup of "First name", 
+and should be displayed as LTR in the popup of the "Last name".
+<br>
+<form action="form_action.asp" method="get">
+  First name: <input type="text" name="fname" dir="rtl"/><br />
+  Last name: <input type="text" name="lname" /><br />
+  <input type="submit" value="Submit" />
+</form>
+</body>
+</html>
diff --git a/WebCore/manual-tests/autofill_alignment.html b/WebCore/manual-tests/autofill_alignment.html
new file mode 100644
index 0000000..4863e41
--- /dev/null
+++ b/WebCore/manual-tests/autofill_alignment.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test auto-fill drop-down items' alignment
+</title>
+</head>
+<body>
+<p>
+Autofill drop-down item's alignment should be the same as the input field.
+It should align left if the input field's direction is ltr. It should 
+align right if the input field's direction is rtl.
+<p> Try type some text in the "First name" and "Last name" input box,
+then click "Submit". Open the file again, double click the "First name"
+field, the drop-down box should be opened with the items aligned right.
+Double click the "Last name" field, the drop-down box should be opened
+with the items aligned left.
+<br>
+<form action="form_action.asp" method="get">
+  First name: <input type="text" name="fname" dir="rtl"/><br />
+  Last name: <input type="text" name="lname" /><br />
+  <input type="submit" value="Submit" />
+</form>
+</body>
+</html>
diff --git a/WebCore/manual-tests/drag-cursor-notallowed.html b/WebCore/manual-tests/drag-cursor-notallowed.html
new file mode 100644
index 0000000..e6cb6d4
--- /dev/null
+++ b/WebCore/manual-tests/drag-cursor-notallowed.html
@@ -0,0 +1,111 @@
+<html>
+<head>
+<style>
+#dropTarget, #dragMe { text-align: center; display: table-cell; vertical-align: middle }
+#dropTarget {width: 256px; height: 256px; border: 1px dashed}
+#dragMe {-webkit-user-drag: element; -webkit-user-select: none; background: #ff0000; width: 64px; height: 64px; color: white}
+.pass { font-weight: bold; color: green; }
+.fail { font-weight: bold; color: red; }
+</style>
+<script>
+    var dragMe;
+    var dropTarget;
+    var messageElm;
+    var defaultMessageElm;
+    var event;
+    
+    var ALLOWED_EFFECTS = 'move';
+    var DROP_EFFECT = 'copy';
+    
+    window.onload = function()
+    {
+        dragMe = document.getElementById("dragMe");
+        dropTarget = document.getElementById("dropTarget");
+        messageElm = document.getElementById("message");
+        defaultMessageElm = document.getElementById("default-message");
+        
+        if (!dragMe || !dropTarget || !messageElm || !defaultMessageElm)
+            return;
+        
+        dragMe.ondragstart = dragStart;
+        dragMe.ondragend = dragEnd;
+        
+        dropTarget.ondragenter = dragEntered;
+        dropTarget.ondragover = dragOver;
+        dropTarget.ondrop = drop;
+    }
+    
+    function dragStart(e)
+    {
+        event = e;
+        e.dataTransfer.effectAllowed = ALLOWED_EFFECTS;
+        e.dataTransfer.setData('Text', e.target.textContent);
+    }
+    
+    function dragEnd(e)
+    {
+        messageElm.style.visibility = "hidden";
+        defaultMessageElm.style.visibility = "visible";
+        return;
+    }
+    
+    function dragEntered(e)
+    {
+        messageElm.style.visibility = "visible";
+        defaultMessageElm.style.visibility = "hidden";
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragOver(e)
+    {
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragEnteredAndUpdated(e)
+    {
+        event = e;
+        e.dataTransfer.dropEffect = DROP_EFFECT;
+        cancelDrag(e);
+    }
+    
+    function drop(e)
+    {
+        cancelDrag(e);
+    }
+    
+    function cancelDrag(e)
+    {
+        if (e.preventDefault)
+            e.preventDefault();
+        else {
+            // Assume this script is executing within Internet Explorer
+            e.returnValue = false;
+        }
+    }
+</script>
+</head>
+<body>
+    <p id="description">This test can be used to verify that the not-allowed cursor is shown during an invalid drag-and-drop operation. 
+        In particular, if the effectAllowed is <code><script>document.write(ALLOWED_EFFECTS)</script></code> and the dropEffect of the 
+        drop target is <code><script>document.write(DROP_EFFECT)</script></code> then the drop is not allowed and the cursor should
+        change to the not-allowed cursor. Note, this test only pertains to the Windows build since the Mac build does not show a drop cursor
+        for a not-allowed drop operation (see bug #25925).
+        <br/><br/>
+        Drag the red square over the drop target (demarcated by the dashed boundary). While hovering over the drop target, if the cursor 
+        is <img alt="not-allowed" src="data:image/gif;base64,R0lGODlhEgASAIAAAAAAAP///yH5BAAAAAAALAAAAAASABIAAAIvjA+px6ifmnmM1ijDmlbuuHmAhoWXaTqYKq7sObZw3HwgXd8cPr8yDGxBXEJioAAAOw=="> then the test <span class="pass">PASSED</span>. Otherwise, the test <span class="fail">FAILED</span>.</p>
+    <div id="test-container">
+        <label for="effectAllowed">effectAllowed:</label> <code><script>document.write(ALLOWED_EFFECTS)</script></code>
+        <br/><br/>
+        <div id="dropTarget">
+            <div id="default-message">Drag the red square over me.<br/><br/>
+                <label for="dropEffect">Expects dropEffect:</label> <code><script>document.write(DROP_EFFECT)</script></code>
+            </div>
+            <div id="message" style="visibility:hidden">The cursor should be <img alt="not-allowed" src="data:image/gif;base64,R0lGODlhEgASAIAAAAAAAP///yH5BAAAAAAALAAAAAASABIAAAIvjA+px6ifmnmM1ijDmlbuuHmAhoWXaTqYKq7sObZw3HwgXd8cPr8yDGxBXEJioAAAOw==">. Is it?</div>
+        </div>
+        <hr/>
+        <p>Items that can be dragged to the drop target:</p>
+        <div id="dragMe" draggable="true">Square</div>
+        <hr/>
+    </div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/go-back-after-alert.html b/WebCore/manual-tests/go-back-after-alert.html
new file mode 100644
index 0000000..b3a1e1a
--- /dev/null
+++ b/WebCore/manual-tests/go-back-after-alert.html
@@ -0,0 +1,7 @@
+<html>
+<body>
+This tests a bug where going back just before putting up an alert can lead to a crash.
+<hr>
+<a href="resources/alert-and-go-back.html">Click this link to run the test.</a>
+</body>
+</html>
diff --git a/WebCore/manual-tests/gtk/caret-browsing.html b/WebCore/manual-tests/gtk/caret-browsing.html
new file mode 100644
index 0000000..182b043
--- /dev/null
+++ b/WebCore/manual-tests/gtk/caret-browsing.html
@@ -0,0 +1,7 @@
+<html>
+<body>
+<p>Manual test for Caret Browsing. Resize your window until the first paragraph fills at least two lines of text . Enable caret browsing mode (usually by pressing theF7 key). Press down. Now you should be on the second line of the first paragraph. Press up. Now you should be on the first line again. Now press Ctrl+Down.</p>
+<p>You should be on the first line of the second paragraph now. Press Ctrl+Down again.</p>
+<p>You should be on the first line of the third paragraph now. Press Ctrl+Up, and you should be back on the second paragraph.</p>
+</body>
+</html>
diff --git a/WebCore/manual-tests/gtk/copy-htmltext.html b/WebCore/manual-tests/gtk/copy-htmltext.html
new file mode 100644
index 0000000..0b811f6
--- /dev/null
+++ b/WebCore/manual-tests/gtk/copy-htmltext.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+        <title>Copy HTML content</title>
+    </head>
+    <body>
+        <h1>Copy HTML content from currently editable area</h1>
+        <div title="EditableArea" contentEditable="true" 
+            style="display: block; border: 2px solid black; margin: 5px; padding: 15px;">
+            Here is a Editable Area,<br />
+            <img title="It's the test image" src="http://webkit.org/images/icon-gold.png" /><br /><br />
+            <b>STEPS TO TEST:</b><br />
+            <ol>
+                <li>Select all that text or picture in this editable area (type <b>Ctrl-A</b> / Option-A)</li>
+                <li><b>Copy</b> them use <b>Ctrl-C</b> / Option-C</li>
+                <li>Move the cursor to a blank line below</li>
+                <li>Paste them use <b>Ctrl-V</b> / Option-V</li>
+            </ol>
+            <p><b>Ensure</b> that text and image has been pasted with formats and no garbled.</p>
+            <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br />
+        </div>       
+    </body>
+</html>
diff --git a/WebCore/manual-tests/gtk/cursor-image.html b/WebCore/manual-tests/gtk/cursor-image.html
new file mode 100644
index 0000000..a231337
--- /dev/null
+++ b/WebCore/manual-tests/gtk/cursor-image.html
@@ -0,0 +1,4 @@
+<div>Mouse over the grey block below to change the cursor to a small cross.</div>
+<div style="width: 100px; height: 100px; background: lightblue; cursor:url(resources/cell.cur), default;">&nbsp;</div>
+<div>Mouse over the grey block below to change the cursor to three small crosses.</div>
+<div style="width: 100px; height: 100px; background: lightblue; cursor:url(resources/long_cell.cur), default;">&nbsp;</div>
diff --git a/WebCore/manual-tests/gtk/resources/cell.cur b/WebCore/manual-tests/gtk/resources/cell.cur
new file mode 100644
index 0000000..decfbdc
--- /dev/null
+++ b/WebCore/manual-tests/gtk/resources/cell.cur
diff --git a/WebCore/manual-tests/gtk/resources/long_cell.cur b/WebCore/manual-tests/gtk/resources/long_cell.cur
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/WebCore/manual-tests/gtk/resources/long_cell.cur
diff --git a/WebCore/manual-tests/input-starved-by-timers.html b/WebCore/manual-tests/input-starved-by-timers.html
new file mode 100644
index 0000000..f26cfa7
--- /dev/null
+++ b/WebCore/manual-tests/input-starved-by-timers.html
@@ -0,0 +1,51 @@
+<html>
+<head>
+<script>
+function log(m) {
+    document.getElementById("log").innerHTML += m + "<br>";
+}
+
+var multiplyFactor = 2;   // Create this many timers in every timer callback.
+var targetLatency = 10000; // Multiply timers until it takes this much to fire all their callbacks.
+var timerCount = 1;
+
+function timerCallback(creationTimestamp) {
+    --timerCount;
+
+    if (!multiplyFactor) {
+        if (timerCount == 0)
+            log("No more timers - UI should be responsive now.");
+        return;
+    }
+
+    // Create more timers. Capture the current time so when callbacks are fired,
+    // we can check how long it actually took (latency caused by a long timer queue).
+    var timestamp = new Date().getTime();
+    for (i = 0; i < multiplyFactor; ++i) {
+        setTimeout(function() { timerCallback(timestamp); }, 0);
+        ++timerCount;
+    }
+
+    // Once the timer queue gets long enough for the timer firing latency to be over the limit,
+    // stop multplying them and keep the number of timers constant.
+    if (multiplyFactor > 1 && new Date().getTime() - creationTimestamp > targetLatency)
+        multiplyFactor = 1;
+}
+
+function runTest() {
+    log("Freezing UI...");
+    setTimeout(function() { timerCallback(new Date().getTime()); }, 0);
+    setTimeout("multiplyFactor = 0; log('Finishing. Started to drain timers.');", 10000);
+}
+
+</script>
+</head>
+<body onload="runTest()">
+This test will create enough timers to freeze browser UI. After 10 seconds, it
+will start drain the timers so the UI becomes responsive again in a few seconds.
+You don't need to kill the browser.<br>If the bug is fixed, there will be no
+UI freeze. Refresh the page to repeat the experiment.<br>Try to click at this
+button (or browser's menu) while UI is frozen: <button onclick="log('clicked')">Click Me</button> <hr>
+<div id="log"></div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/inspector/debugger-watch-expressions.html b/WebCore/manual-tests/inspector/debugger-watch-expressions.html
new file mode 100644
index 0000000..eb883c9
--- /dev/null
+++ b/WebCore/manual-tests/inspector/debugger-watch-expressions.html
@@ -0,0 +1,115 @@
+<p>Test for 
+<a href="https://bugs.webkit.org/show_bug.cgi?id=27514">Bug 27514 - add support for watched expression</a>.
+
+<p>To begin test, open web inspector, go the scripts panel 
+(enabling script debugging if necccessary), and then click this link:
+<a href="javascript:runTest()">[begin test]</a>.
+
+<p>Perform the following steps, and note the expected results:
+    
+<ol>
+    
+<li><p>After clicking the link above, you should now be paused in the body of 
+the test method, thanks to the <code>debugger</code> statement.
+
+<li><p>Add the following expressions to the "Watch Expressions" section of the
+Scripts panel sidebar pane: "<code>this</code>", "<code>a</code>", 
+"<code>b</code>", "<code>c</code>" and "<code>d</code>". Do <b>NOT</b> enter the quotes.
+
+<li><p>The values of the expressions as shown in the window should a 
+<code>DOMWindow</code> for <code>this</code>, <code>undefined</code> for
+the <code>a</code>, <code>b</code>, and <code>c</code> variables, and a 
+value of <code>ReferenceError: Can't find variable: d</code>
+for the <code>d</code> variable.
+
+<li><p>Note that the value for <code>d</code> should not change for the life of 
+the test, as the variable <code>d</code> is never introduced in the program.
+
+<li><p>Step through the code, and you'll see the values of <code>a</code>,
+<code>b</code>, and <code>c</code> change, as the variables are assigned.
+Also note that as the scope changes due to the function invocation, values
+will be changed to refer to their current scope.  The <code>this</code>
+expression will change when the method is invoked on the object constructed by
+the test.
+
+<li><p>Click different stack frames in the Call Stack section to ensure the
+expressions change value appropriately as the current stack frame changes.
+
+<li><p>Drive the debugger through the end of the outermost function, so that
+the debugger is no longer in paused state.  The values of 
+<code>a</code>, <code>b</code>, and <code>c</code> should all be a
+ReferenceError like <code>d</code>, since these variables are defined in the
+<code>runTest()</code> function, and the expressions are being evaluated against
+the global object.
+
+<li><p>From the console, execute the statement "<code>a = 1</code>".  The
+watch expressions do not currently refresh, so the value for <code>a</code>
+should still be ReferenceError.
+
+<li><p>Click the "Refresh" button in the Watch Expressions section and the
+value for "<code>a</code>" should now be "<code>1</code>".
+
+<li><p>Close down the browser, start it back up, traverse to a web site,
+bring up web inspector, go to the Scripts panel.  You should see the same
+set of Watch Expressions in the list as you had when you last used web
+inspector.
+
+<li><p>Delete an expression by moving the mouse into the Watch Expression
+section, and clicking the X icon which appears to the right of an 
+expression (on hover).
+
+<li><p>Delete an expression by double-clicking anywhere on a top-level line
+of a watch expression, and changing the expression to an empty string or 
+nothing but white-space.
+
+<li><p>Modify an entry by double-clicking anywhere on a top-level line
+of a watch expression, and changing the expression.
+
+<li><p>Enter a new expression, "<code>new Date()</code>".  The value should be
+a toString() version of the date.  Repeatedly press the Refresh button to see
+the value updated with the current time.
+
+</ol>
+
+<script>
+function runTest() {
+    
+    // a nested function
+    function subFunction() {
+        debugger;
+        var a = "a in subFunction()";
+        
+        subSubFunction();
+        
+        // another nested function
+        function subSubFunction() {
+            debugger;
+            var b = "b in subSubFunction()";
+        }
+    }
+    
+    // a class
+    function aClass() {
+        this.x = "xxx";
+        this.y = "yyy";
+    }
+    
+    aClass.prototype.aMethod = function() {
+        debugger;
+        var c = "c in aMethod()";
+    }
+    
+    // main logic
+    debugger;
+    
+    var a = "a in runTest()";
+    var b = "b in runTest()";
+    var c = "c in runTest()";
+    
+    subFunction();
+    
+    var object = new aClass();
+    object.aMethod();
+    
+}
+</script>
diff --git a/WebCore/manual-tests/inspector/display-form-data.html b/WebCore/manual-tests/inspector/display-form-data.html
new file mode 100644
index 0000000..48cd817
--- /dev/null
+++ b/WebCore/manual-tests/inspector/display-form-data.html
@@ -0,0 +1,249 @@
+<html>
+<head>
+<title>Tests for Bug 22920</title>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8" >
+</head>
+
+<body>
+<p>Tests for 
+<ul>    
+<li><p><a href="https://bugs.webkit.org/show_bug.cgi?id=22920">Bug 22920: Inspector Request Headers Should Show Data/Variables/Parameters Sent With Request</a>
+<li><p><a href="https://bugs.webkit.org/show_bug.cgi?id=28970">Bug 28970: content-type parameters not taken into account when building form-data</a>
+</ul>
+
+<p>To test, open the Inspector on this page, go to the Resources panel,
+and select the various resources created by this page in the left column of the
+Resources panel.  Note that for test-4 ...
+test-11, the -sync and -async versions should show the same Form Data,
+Request Payload and/or Query String Parameter values.
+
+<ul>
+
+<li><p><b>test-1</b>:
+<br>no Form Data, Request Payload or Query String Parameters
+
+<li><p><b>test-2</b>:
+<br>Query String Parameters (1): "parm1: abc"
+
+<li><p><b>test-3</b>:
+<br>Query String Parameters (2): "parm1: def" and "parm2: g h i";
+Hovering over either parm should yield a tooltip:
+<i>"Double-Click to toggle between URL encoded and decoded formats"</i>.
+Double-clicking on either parm should toggle between encoded and decoded
+versions of the string.  The decoded form is initially displayed.
+The encoded form of parm2 is "g%20h+i".
+
+<li><p><b>test-4</b>:
+<br>no Form Data, Request Payload or Query String Parameters
+
+<li><p><b>test-5</b>:
+<br>Query String Parameters (1): "parm1: abc"
+
+<li><p><b>test-6</b>:
+<br>Query String Parameters (3): "parm1: def" and "parm2: g h i" and "parm3: jj kk ll"
+
+<li><p><b>test-7</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line which should wrap
+
+<li><p><b>test-8</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line which should wrap
+
+<li><p><b>test-9</b>:
+<br>Request Payload: 3 lines of text data with a very long 2nd line of binary data which should wrap
+
+<li><p><b>test-10</b>:
+<br>Form Data (1): "parm1: abc"
+
+<li><p><b>test-11</b>:
+<br>Form Data (2): "parm1: def" and "parm2: g h i"
+
+<li><p><b>test-12</b>:
+<br>Query String Parameters (2): "parm1: abc" and "parm2: d e f"
+<br>Form Data (2): "parm1: ghi" and "parm2: j k l"
+
+<li><p><b>test-13</b>:
+<br>Query String Parameters (2): "parm1: &auml;bc" and "parm2: d &#x11B; f"
+<br>Form Data (2): "parm1: ghi" and "parm2: j k l"
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values should be:
+<pre>
+parm1: %C3%A4bc
+parm2: d%20%C4%9B+f
+</pre>
+
+<li><p><b>test-14</b>:
+<br>Same results as for test-13, a slightly different but compatible Content-Type
+is used for the form data.
+
+<li><p><b>test-15</b>:
+<br>Query String Parameters (2): "parm1: % (unable to decode value)" and "parm2: % (unable to decode value)",
+with the parenthesized part in red.
+<br>Form Data (2): "parm1: % (unable to decode value)" and "parm2: % (unable to decode value)",
+with the parenthesized part in red.
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values for all four parameters should be "%".
+
+<li><p><b>test-form</b>:
+<br>For this test, invoke the form at the bottom of the page
+by pressing the submit button.  The Resources panel should have a "test-form"
+resource, with the following data:
+<p>Form Data (2): "field1: value &auml;;b;c" and "field2:value d;&#x11B;;f"
+<p>Note that you should view the encoded values of the query string parameters
+by double-clicking on one of the parameters.  The values should be:
+<pre>
+field1: value+%C3%A4%3Bb%3Bc
+field2: value+d%3B%C4%9B%3Bf</pre>
+</ul>
+
+<p><b>test-form</b>
+<form id="form" action="http://example.org/test-form" method="post" enctype="application/x-www-form-urlencoded">
+<span style="font-size:200%">field1:</span> <input style="font-size:200%" type="text" name="field1" value="value &auml;;b;c"><br>
+<span style="font-size:200%">field2:</span> <input style="font-size:200%" type="text" name="field2" value="value d;&#x11B;;f"><br>
+<input type="submit">
+</form>
+
+<div style="display:none">
+
+<img src="http://example.org/test-1">
+<img src="http://example.org/test-2?parm1=abc">
+<img src="http://example.org/test-3?parm1=def&amp;parm2=g%20h+i">
+
+</div>
+
+<hr>
+
+<p><b>NLS sample info</b>
+
+<pre>
+<span style="font-size:300%">&auml;</span> - LATIN SMALL LETTER A WITH DIAERESIS
+Unicode: 0x00E4 == 228    
+UTF8:    C3 A4 
+HTML:    &amp;auml;
+
+<span style="font-size:300%">&#x11B;</span> - LATIN SMALL LETTER E WITH CARON
+Unicode: 0x011B == 283    
+UTF8:    C4 9B
+HTML:    &amp;#x11B;
+</pre>
+    
+<script>
+
+function getReadyState(num) {
+    switch(num) {
+        case 0: return "uninitialized";
+        case 1: return "loading";
+        case 2: return "loaded";
+        case 3: return "interactive";
+        case 4: return "complete";
+        default: return "unknown: " + num;
+    }
+}
+
+function getProcessXHR(request) {
+    return function() {
+        if (true) return;
+        var rs = getReadyState(request.readyState);
+        console.log("ready state change for " + request.url);
+        console.log("   ready state:   " + rs);
+        console.log("   response text: " + request.responseText);
+        if (request.readyState == 4) {
+            console.log("   status:        " + request.status);
+            console.log("   status text:   " + request.statusText);
+        }
+    }
+}
+
+function sendXHR(url, method, headers, body) {
+    if (!method) method = "GET";
+    if (!headers) headers = [];
+    if (!body) body="";
+
+    // copy headers
+    var headersNew = [];
+    for (var i=0; i<headers.length; i++) {
+        headersNew.push(headers[i]);
+    }
+    headers = headersNew;
+
+    if (body != "") {
+        headers.push(["Content-Length", body.length.toString()]);
+    }
+
+    // sync
+    var req = new XMLHttpRequest();
+
+    req.url = url.replace("^","-sync");
+    req.onreadystatechange = getProcessXHR(req);
+    req.open(method, req.url, false);
+
+    for (var i=0; i<headers.length; i++) {
+        req.setRequestHeader(headers[i][0], headers[i][1]);
+    }
+
+    req.send(body);
+
+    // async
+    var req = new XMLHttpRequest();
+
+    req.url = url.replace("^","-async");
+    req.onreadystatechange = getProcessXHR(req);
+    req.open(method, req.url, true);
+
+    for (var i=0; i<headers.length; i++) {
+        req.setRequestHeader(headers[i][0], headers[i][1]);
+    }
+
+    req.send(body);
+}
+
+var headersPlain = [
+    ["Content-Type", "text/plain"]
+];
+
+var headersForm = [
+    ["Content-Type", "application/x-www-form-urlencoded"]
+];
+
+var headersFormExtra1 = [
+    ["Content-Type", "application/x-www-form-urlencoded;something-else=here"]
+];
+
+var headersFormExtra2 = [
+    ["Content-Type", "application/x-www-form-urlencoded ; something-else=here"]
+];
+
+var headersBinary = [
+    ["Content-Type", "application/octet-stream"]
+];
+
+var longText = "some text with a \n";
+for (var i=0; i<40; i++) {
+    longText += "very-";
+}
+longText += "long\nline in it";
+
+var binaryData = "some text with binary data\n";
+for (var i=0; i<256; i++) {
+    binaryData += String.fromCharCode(i);
+}
+binaryData += "\nin the middle of it";
+
+
+sendXHR("http://example.org/test-4^");
+sendXHR("http://example.org/test-5^?parm1=abc");
+sendXHR("http://example.org/test-6^?parm1=def&parm2=g%20h+i&parm3=jj++kk%20%20ll");
+
+sendXHR("http://example.org/test-7^", "POST", null, longText);
+sendXHR("http://example.org/test-8^", "POST", headersPlain, longText);
+sendXHR("http://example.org/test-9^", "POST", headersBinary, binaryData);
+sendXHR("http://example.org/test-10^", "POST", headersForm, "parm1=abc");
+sendXHR("http://example.org/test-11^", "POST", headersForm, "parm1=def&parm2=g%20h+i");
+sendXHR("http://example.org/test-12^?parm1=abc&parm2=d%20e+f", "POST", headersForm, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-13^?parm1=%C3%A4bc&parm2=d%20%C4%9B+f", "POST", headersFormExtra1, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-14^?parm1=%C3%A4bc&parm2=d%20%C4%9B+f", "POST", headersFormExtra2, "parm1=ghi&parm2=j%20k+l");
+sendXHR("http://example.org/test-15^?parm1=%&parm2=%", "POST", headersForm, "parm1=%&parm2=%");
+
+</script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/WebCore/manual-tests/inspector/webinspector-log.html b/WebCore/manual-tests/inspector/webinspector-log.html
new file mode 100644
index 0000000..cdc5663
--- /dev/null
+++ b/WebCore/manual-tests/inspector/webinspector-log.html
@@ -0,0 +1,22 @@
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=28047">Bug 28047: add utility method to enable logging messages for inspector development</a>.</p>
+
+<ul>
+<li>Open a browser, go to any web page.
+<li>Open web inspector
+<li>Open the console panel
+<li>Open a web inspector on the web inspector
+<li>Open that inspector's console panel
+<li>In that panel, run the code:
+<pre>
+   WebInspector.log("hello, world")
+</pre>
+</ul>
+
+<p>Results:
+<br>In the original inspector window, there should now be a message
+in the console with the text "hello, world".  There will be a blue
+maginifying glass icon to the left of the message.  Run the same 
+command again, and you should see the repeat count go to 2.
+The message and repeat count are blue.
+
+
diff --git a/WebCore/manual-tests/js-timers-beneath-modal-dialog.html b/WebCore/manual-tests/js-timers-beneath-modal-dialog.html
new file mode 100644
index 0000000..6d5f2c7
--- /dev/null
+++ b/WebCore/manual-tests/js-timers-beneath-modal-dialog.html
@@ -0,0 +1,19 @@
+<p>JS timers should be paused while a modal dialog (or alert) is displayed.</p>
+<p>Please disable popup blocker for this test.</p>
+<div>0</div>
+<script>
+function f()
+{
+    var d = document.getElementsByTagName("div")[0];
+    d.innerHTML = parseInt(d.innerHTML) + 1;
+}
+
+var timerId = setInterval(f, 100);
+
+alert("Numbers in main window should not increase while this alert is displayed");
+showModalDialog("data:text/html,<p>Numbers in main window should not increase while this modal dialog is displayed</p>");
+document.getElementsByTagName("div")[0].innerHTML = "DONE";
+
+clearInterval(timerId);
+
+</script>
diff --git a/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html b/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html
new file mode 100644
index 0000000..8e3c102
--- /dev/null
+++ b/WebCore/manual-tests/keyboard_select_elements_with_same_beginning.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+<title>
+Test select on elements with same beginning letter
+</title>
+</head>
+<body>
+See bug:<a href="https://bugs.webkit.org/show_bug.cgi?id=28205">28205</a>.
+<p>
+Click the drop-down to show selections (not navigate to the selection box).
+Type the first letter 'A' to go to the elements start with 'A'.
+It should select the first item starts with 'A'.
+In windows, Continue typing 'A', it should continue to select the next item starts with 'A'.
+<p>
+<select name="selOrigin"> 
+    <option value="">Select Station</option> 
+    <option value="37169_NJCL">Aberdeen Matawan</option> 
+    <option value="2_ATLC">Absecon</option> 
+    <option value="3_MNBN">Allendale</option> 
+    <option value="4_NJCL">Allenhurst</option> 
+    <option value="12_MNE">Basking Ridge</option> 
+    <option value="13_NJCL">Bay Head</option> 
+    <option value="14_BNTN">Bay Street</option> 
+    <option value="15_NJCL">Belmar</option> 
+</select>
+</body>
+</html>
diff --git a/WebCore/manual-tests/resources/alert-and-go-back.html b/WebCore/manual-tests/resources/alert-and-go-back.html
new file mode 100644
index 0000000..55a5b50
--- /dev/null
+++ b/WebCore/manual-tests/resources/alert-and-go-back.html
@@ -0,0 +1,4 @@
+<script>
+history.back();
+alert("Wait a moment and then dismiss this alert. If there is no crash, the test succeeded.");
+</script>
diff --git a/WebCore/manual-tests/select-popup-on-spacebar.html b/WebCore/manual-tests/select-popup-on-spacebar.html
index dfcee40..7503eca 100644
--- a/WebCore/manual-tests/select-popup-on-spacebar.html
+++ b/WebCore/manual-tests/select-popup-on-spacebar.html
@@ -6,8 +6,8 @@
 <body onload="document.getElementById('selectId').focus()">
 <p><b>BUG ID:<a href="https://bugs.webkit.org/show_bug.cgi?id=18363">18363</a>.</p>
 <p id="description">
-This test ensures that pressing spacebar on Mac and Gtk ports or pressing
-return in Gtk port will popup the select control when focused.
+This test ensures that pressing spacebar on Mac, Gtk and Chromium ports or pressing
+return in Gtk and Chromium ports will popup the select control when focused.
 </p>
 
 <p id="test" style="background-color:skyblue; padding:3px;"><b>STEPS TO TEST:</b> <br>
diff --git a/WebCore/manual-tests/select_alignment.html b/WebCore/manual-tests/select_alignment.html
new file mode 100644
index 0000000..7c1bc0e
--- /dev/null
+++ b/WebCore/manual-tests/select_alignment.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" >
+<head>
+<title>Test drop-down item's alignment in <select>/<option></title>
+<META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-8">
+</head>
+<body>
+<p>
+select drop-down items' alignment should be determined by the directionality of
+&lt;select&gt; tag.
+<p>
+The drop-down items in the following &lt;select&gt; should be left-aligned.
+<br>
+<select>
+<option>abc def</option>
+<option>שנב גקכ</option>
+<option dir="rtl">abc שנב def</option>
+<option dir="ltr">שנב abc גקכ</option>
+<option dir="rtl">hi!</option>
+<option dir="ltr">hi!</option>
+</select>
+<br>
+The drop-down items in the second &lt;select&gt; should be right-aligned.
+<p>
+<select dir="rtl">
+<option>abc def</option>
+<option>שנב גקכ</option>
+<option dir="rtl">abc שנב def</option>
+<option dir="ltr">שנב abc גקכ</option>
+<option dir="rtl">hi!</option>
+<option dir="ltr">hi!</option>
+</select>
+</body>
+</html>
diff --git a/WebCore/manual-tests/showModalDialog-returnValue.html b/WebCore/manual-tests/showModalDialog-returnValue.html
new file mode 100644
index 0000000..fbc3ee3
--- /dev/null
+++ b/WebCore/manual-tests/showModalDialog-returnValue.html
@@ -0,0 +1,13 @@
+This test makes sure we don't crash when storing the return value from showModalDialog.  Popup blocking needs to be disabled for this test to run.<br>
+<script>
+if (showModalDialog("data:text/html,<script>returnValue={value:'PASS'}; close()</"+"script>").value == "PASS")
+    document.write("<span style='color:green'>Test passed.<br>");
+else
+    document.write("<span style='color:red'>Test failed due to incorrect result.<br>");
+value = showModalDialog("data:text/html,<script>close()</"+"script>");
+if (!value)
+    document.write("<span style='color:green'>Test passed.<br>");
+else
+    document.write("<span style='color:red'>Test failed due to incorrect result.<br>");
+
+</script>
\ No newline at end of file
diff --git a/WebCore/manual-tests/video-waiting-seeking.html b/WebCore/manual-tests/video-waiting-seeking.html
new file mode 100644
index 0000000..508df1d
--- /dev/null
+++ b/WebCore/manual-tests/video-waiting-seeking.html
@@ -0,0 +1,81 @@
+<html>
+    <head>
+        <script src="../../LayoutTests/media/video-test.js"></script>
+        <script>
+
+            var seekedCount = 0;
+            var counter = 0;
+
+            function trySeek(seekTo)
+            {
+                if (isInTimeRanges(video.seekable, seekTo)) {
+                    if (isInTimeRanges(video.buffered, seekTo)) {
+                        consoleWrite("Warining: Seeking into buffered region. May not generate waiting or seeking events.");
+                    }
+                    run("video.currentTime = " + seekTo);
+                } else {
+                    failTest("Cannot seek to " + seekTo + ". Does engine support seeking into unbuffered region?");
+                }
+            }
+
+            function seeked()
+            { 
+                ++seekedCount; 
+                consoleWrite("");
+            }
+
+            function scheduleSeek() {
+                setTimeout(someTimeLater, 200);
+            }
+
+            function someTimeLater()
+            {
+                consoleWrite("Running scheduled seek");
+                testExpected("seekedCount", counter);
+                testExpected("video.currentTime", counter, ">=");
+
+                if (counter == 3)
+                {
+                    consoleWrite("");
+                    return;
+                    endTest();
+                }
+
+                ++counter;
+
+                scheduleSeek();
+                trySeek(counter);
+                consoleWrite("");
+            }
+
+            function start()
+            {
+                findMediaElement();
+
+                waitForEvent('waiting');
+                waitForEvent('seeking');
+                waitForEvent('seeked', seeked);
+                waitForEvent('play', someTimeLater);
+
+                consoleWrite("Start Load");
+                video.src = "http://127.0.0.1:8000/media/video-throttled-load.cgi?name=../../../media/content/test.mp4&throttle=25";
+                video.load();
+                video.play();
+            }
+        </script>
+    </head>
+    <body onload="start()">
+        <video controls></video>
+
+        <p>Attempt to seek out of the buffered range.  If supported, this
+        should cause a waiting and seeking event to be fired for each seek.
+        This test makes assumptions on the size of the input file, the bitrate
+        of delivery, and the duration of the file.
+        </p>
+        <p>
+        Source is assumed to be about 188k with a uniform bitrate, &gt; 4
+        seconds in length, and served at 25kb/s.  This should make seeking one
+        second ahead every 200ms always leave the buffered region.
+        </p>
+    </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/Earth.html b/WebCore/manual-tests/webgl/Earth.html
new file mode 100644
index 0000000..fa59a20
--- /dev/null
+++ b/WebCore/manual-tests/webgl/Earth.html
@@ -0,0 +1,166 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 u_modelViewMatrix;
+        uniform mat4 u_modelViewProjMatrix;
+        uniform mat4 u_normalMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vTexCoord;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            gl_Position = u_modelViewProjMatrix * vPosition;
+            v_texCoord = vTexCoord.st;
+            vec4 transNormal = u_normalMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D sampler2d;
+
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            vec4 color = texture2D(sampler2d,v_texCoord);
+            color += vec4(0.1,0.1,0.1,1);
+            gl_FragColor = vec4(color.xyz * v_Dot, color.a);
+        }
+    </script>
+
+    <script>
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vTexCoord", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            gl.uniform1i(gl.getUniformLocation(gl.program, "sampler2d"), 0);
+
+            gl.enable(gl.TEXTURE_2D);
+
+            gl.sphere = makeSphere(gl, 1, 30, 30);
+            
+            // get the images
+            earthTexture = loadImageTexture(gl, "resources/earthmap1k.jpg");
+            marsTexture = loadImageTexture(gl, "resources/mars500x250.png");
+
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,6, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawOne(ctx, angle, x, y, z, scale, texture)
+        {
+            // setup VBOs
+            ctx.enableVertexAttribArray(0);
+            ctx.enableVertexAttribArray(1);
+            ctx.enableVertexAttribArray(2);
+
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.vertexObject);
+            ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.normalObject);
+            ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.texCoordObject);
+            ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+            ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, ctx.sphere.indexObject);
+
+            // generate the model-view matrix
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.scale(scale, scale, scale);
+            mvMatrix.rotate(angle, 0,1,0);
+            mvMatrix.rotate(30, 1,0,0);
+            mvMatrix.translate(x,y,z);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            var normalMatrix = new CanvasMatrix4(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            // construct the model-view * projection matrix
+            var mvpMatrix = new CanvasMatrix4(mvMatrix);
+            mvpMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvpMatrix.getAsCanvasFloatArray());
+
+            ctx.bindTexture(ctx.TEXTURE_2D, texture);
+            ctx.drawElements(ctx.TRIANGLES, ctx.sphere.numIndices, ctx.UNSIGNED_SHORT, 0);
+        }
+        
+        function drawPicture(ctx)
+        {
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+            
+            drawOne(ctx, currentAngle, -1, 0, 0, 1, earthTexture);
+            drawOne(ctx, -currentAngle, 1, 0, 0, 0.6, marsTexture);
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+            framerate = new Framerate("framerate");
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+    <div id="console"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/ManyPlanetsDeep.html b/WebCore/manual-tests/webgl/ManyPlanetsDeep.html
new file mode 100644
index 0000000..e5bb773
--- /dev/null
+++ b/WebCore/manual-tests/webgl/ManyPlanetsDeep.html
@@ -0,0 +1,202 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 u_modelViewMatrix;
+        uniform mat4 u_modelViewProjMatrix;
+        uniform mat4 u_normalMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vTexCoord;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            gl_Position = u_modelViewProjMatrix * vPosition;
+            v_texCoord = vTexCoord.st;
+            vec4 transNormal = u_normalMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D sampler2d;
+
+        varying float v_Dot;
+        varying vec2 v_texCoord;
+        
+        void main()
+        {
+            vec4 color = texture2D(sampler2d,v_texCoord);
+            color += vec4(0.1,0.1,0.1,1);
+            gl_FragColor = vec4(color.xyz * v_Dot, color.a);
+        }
+    </script>
+
+    <script>
+        const numRowCols = 4;
+        const numLayers = 3;
+        const layoutWidth = 10;
+        const layoutHeight = 8;
+        const globeSize = 25;
+        const minIncAngle = 0.2;
+        const maxIncAngle = 2;
+    
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vTexCoord", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            gl.uniform1i(gl.getUniformLocation(gl.program, "sampler2d"), 0);
+
+            gl.enable(gl.TEXTURE_2D);
+
+            gl.sphere = makeSphere(gl, 1, 30, 30);
+            
+            // get the images
+            earthTexture = loadImageTexture(gl, "resources/earthmap1k.jpg");
+            marsTexture = loadImageTexture(gl, "resources/mars500x250.png");
+
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,20, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawOne(ctx, angle, x, y, z, scale, texture)
+        {
+            // setup VBOs
+            ctx.enableVertexAttribArray(0);
+            ctx.enableVertexAttribArray(1);
+            ctx.enableVertexAttribArray(2);
+
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.vertexObject);
+            ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.normalObject);
+            ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+            
+            ctx.bindBuffer(ctx.ARRAY_BUFFER, ctx.sphere.texCoordObject);
+            ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+            ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, ctx.sphere.indexObject);
+
+            // generate the model-view matrix
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.scale(scale, scale, scale);
+            mvMatrix.rotate(angle, 0,1,0);
+            mvMatrix.rotate(30, 1,0,0);
+            mvMatrix.translate(x,y,z);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            var normalMatrix = new CanvasMatrix4(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            // construct the model-view * projection matrix
+            var mvpMatrix = new CanvasMatrix4(mvMatrix);
+            mvpMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvpMatrix.getAsCanvasFloatArray());
+
+            ctx.bindTexture(ctx.TEXTURE_2D, texture);
+            ctx.drawElements(ctx.TRIANGLES, ctx.sphere.numIndices, ctx.UNSIGNED_SHORT, 0);
+        }
+        
+        function drawPicture(ctx)
+        {
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+    
+            var startX = -layoutWidth/2;
+            var startY = -layoutHeight/2;
+            var startZ = 0;
+            var incX = layoutWidth / (numRowCols-1);
+            var incY = layoutHeight / (numRowCols-1);
+            var incZ = -5;
+            
+            for (i = 0; i < numLayers; ++i) {
+                for (j = 0; j < numRowCols; ++j) {
+                    for (k = 0; k < numRowCols; ++k) {
+                        var index = i * numLayers * numRowCols + j * numRowCols + k;
+                    
+                        drawOne(ctx, currentAngles[index], 
+                                startX + incX * k, 
+                                startY + incY * j, 
+                                startZ + incZ * i, 
+                                showEarth[index] ? 1 : 0.6, showEarth[index] ? earthTexture : marsTexture);
+                    
+                        currentAngles[index] += incAngles[i];
+                        if (currentAngles[index] > 360)
+                            currentAngles[index] -= 360;
+                    }
+                }
+            }
+
+            ctx.bindTexture(ctx.TEXTURE_2D, 0);
+            ctx.flush();
+            
+            framerate.snapshot();
+        }
+
+        function start()
+        {
+            var ctx = init();
+            currentAngles = [ ];
+            incAngles = [ ];
+            showEarth = [ ];
+            
+            for (var i = 0; i < numRowCols * numRowCols * numLayers; ++i) {
+                currentAngles[i] = 0;
+                incAngles[i] = Math.random() * (maxIncAngle - minIncAngle) + minIncAngle;
+                showEarth[i] = Math.random() > 0.5;
+            }
+                
+            framerate = new Framerate("framerate");
+
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/SpinningBox.html b/WebCore/manual-tests/webgl/SpinningBox.html
new file mode 100644
index 0000000..203d7bd
--- /dev/null
+++ b/WebCore/manual-tests/webgl/SpinningBox.html
@@ -0,0 +1,149 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        uniform mat4 pMatrix;
+        uniform mat4 mvMatrix;
+        uniform vec3 lightDir;
+
+        attribute vec3 vNormal;
+        attribute vec4 vColor;
+        attribute vec4 vPosition;
+        
+        varying float v_Dot;
+        
+        void main()
+        {
+            gl_FrontColor = vColor;
+            vec4 transNormal = mvMatrix * vec4(vNormal,1);
+            v_Dot = max(dot(transNormal.xyz, lightDir), 0.0);
+            gl_Position = pMatrix * mvMatrix * vPosition;
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        varying float v_Dot;
+        
+        void main()
+        {
+            gl_FragColor = vec4(gl_Color.xyz * v_Dot, gl_Color.a);
+        }
+    </script>
+
+    <script>
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "vNormal", "vColor", "vPosition"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform3f(gl.getUniformLocation(gl.program, "lightDir"), 0, 0, 1);
+            
+            gl.box = makeBox(gl);
+
+            // color array
+            var colors = new CanvasUnsignedByteArray(
+                [  0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,   0, 0, 1, 1,     // v0-v1-v2-v3 front
+                   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,   1, 0, 0, 1,     // v0-v3-v4-v5 right
+                   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,   0, 1, 0, 1,     // v0-v5-v6-v1 top
+                   1, 1, 0, 1,   1, 1, 0, 1,   1, 1, 0, 1,   1, 1, 0, 1,     // v1-v6-v7-v2 left
+                   1, 0, 1, 1,   1, 0, 1, 1,   1, 0, 1, 1,   1, 0, 1, 1,     // v7-v4-v3-v2 bottom
+                   0, 1, 1, 1,   0, 1, 1, 1,   0, 1, 1, 1,   0, 1, 1, 1 ]    // v4-v7-v6-v5 back
+            );
+            
+            gl.box.colorObject = gl.createBuffer();
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.colorObject);
+            gl.bufferData(gl.ARRAY_BUFFER, colors, gl.STATIC_DRAW);
+                                    
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        
+        function reshape(gl)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            gl.viewport(0, 0, width, height);
+            var pMatrix = new CanvasMatrix4();
+            pMatrix.lookat(0,0,10, 0, 0, 0, 0, 1, 0);
+            pMatrix.perspective(30, width/height, 1, 10000);
+            gl.uniformMatrix4fv(gl.getUniformLocation(gl.program, "pMatrix"), false, pMatrix.getAsCanvasFloatArray());
+        }
+        
+        function drawPicture(gl)
+        {
+            reshape(gl);
+            gl.clear(gl.COLOR_BUFFER_BIT | gl.DEPTH_BUFFER_BIT);
+
+            var mvMatrix = new CanvasMatrix4();
+            mvMatrix.rotate(currentAngle, 0,1,0);
+            mvMatrix.rotate(20, 1,0,0);
+            gl.uniformMatrix4fv(gl.getUniformLocation(gl.program, "mvMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            gl.enableVertexAttribArray(0);
+            gl.enableVertexAttribArray(1);
+            gl.enableVertexAttribArray(2);
+
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.vertexObject);
+            gl.vertexAttribPointer(2, 3, gl.FLOAT, false, 0, 0);
+            
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.normalObject);
+            gl.vertexAttribPointer(0, 3, gl.FLOAT, false, 0, 0);
+            
+            gl.bindBuffer(gl.ARRAY_BUFFER, gl.box.colorObject);
+            gl.vertexAttribPointer(1, 4, gl.UNSIGNED_BYTE, false, 0, 0);
+
+            gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, gl.box.indexObject);
+            gl.drawElements(gl.TRIANGLES, gl.box.numIndices, gl.UNSIGNED_BYTE, 0);
+
+            gl.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var gl = init();
+            currentAngle = 0;
+            incAngle = 0.5;
+            framerate = new Framerate("framerate");
+            setInterval(function() { drawPicture(gl) }, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+        .text {
+            position:absolute;
+            top:100px;
+            left:20px;
+            font-size:2em;
+            color: blue;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div class="text">This is some text under the canvas</div>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/TeapotPerPixel.html b/WebCore/manual-tests/webgl/TeapotPerPixel.html
new file mode 100644
index 0000000..6274c8b
--- /dev/null
+++ b/WebCore/manual-tests/webgl/TeapotPerPixel.html
@@ -0,0 +1,332 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        /*
+          Copyright (c) 2008 Seneca College
+          Licenced under the MIT License (http://www.c3dl.org/index.php/mit-license/)
+        */
+        
+        // We need to create our own light structure since we can't access 
+        // the light() function in the 2.0 context.
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+            
+            vec3 halfVector;
+        };
+        
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+
+        //
+        // vertex attributes
+        //
+        attribute vec4 a_vertex; 
+        attribute vec3 a_normal; 
+        attribute vec4 a_texCoord; 
+
+        // for every model we multiply the projection, view and model matrices
+        // once to prevent having to do it for every vertex, however we still need
+        // the view matrix to calculate lighting.
+        uniform mat4 u_modelViewMatrix;
+
+        // we can calculate this once per model to speed up processing done on the js side.
+        uniform mat4 u_modelViewProjMatrix;
+
+        // matrix to transform the vertex normals
+        uniform mat4 u_normalMatrix;
+
+         // custom light structures need to be used since we don't have access to 
+        // light states.
+        uniform Light u_light;
+        
+        // material
+        uniform vec4 u_globalAmbientColor;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        // passed to fragment shader
+        varying vec4 v_diffuse, v_ambient;
+        varying vec3 v_normal, v_lightDir;
+        varying vec2 v_texCoord;
+
+        /*
+            Given a reference to the ambient and diffuse  lighting variables,
+            this function will calculate how much each component contributes to the scene.
+
+            Light light - the light in view space
+            vec3 normal - 
+            vec4 ambient - 
+            vec4 diffuse - 
+        */
+        vec3 directionalLight(inout vec4 ambient, inout vec4 diffuse)
+        {
+            ambient += u_light.ambient;
+            diffuse += u_light.diffuse;
+            return normalize(vec3(u_light.position));
+        }
+
+        void main()
+        { 
+            v_normal = normalize(u_normalMatrix * vec4(a_normal, 1)).xyz; 
+
+            vec4 ambient = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 diffuse = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 specular = vec4(0.0, 0.0, 0.0, 1.0); 
+
+            // place the current vertex into view space
+            // ecPos = eye coordinate position.
+            vec4 ecPos4 = u_modelViewMatrix * a_vertex;
+
+            // the current vertex in eye coordinate space
+            vec3 ecPos = ecPos4.xyz/ecPos4.w;
+            v_lightDir = directionalLight(ambient, diffuse);
+            
+            v_ambient = u_frontMaterial.ambient * ambient;
+            v_ambient += u_globalAmbientColor * u_frontMaterial.ambient;
+            v_diffuse = u_frontMaterial.diffuse * diffuse;
+
+            gl_Position =  u_modelViewProjMatrix * a_vertex;
+            v_texCoord = a_texCoord.st; 
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+        
+            vec3 halfVector;
+        };
+    
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+        
+        uniform sampler2D u_sampler2d;
+        uniform Light u_light;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        varying vec4 v_diffuse, v_ambient;
+        varying vec3 v_normal, v_lightDir;
+        varying vec2 v_texCoord;
+
+        void main()
+        {
+            vec4 color = v_diffuse;
+                
+            vec3 n = normalize(v_normal);
+
+            Light light = u_light;
+            vec3 lightDir = v_lightDir;
+            float nDotL = max(dot(n, lightDir), 0.0);
+            if (nDotL > 0.0) {
+                color = vec4(color.rgb * nDotL, color.a);
+                float nDotHV = max(dot(n, light.halfVector), 0.0);
+                vec4 specular = u_frontMaterial.specular * light.specular;
+                color += vec4(specular.rgb * pow(nDotHV, u_frontMaterial.shininess), specular.a);
+            }
+            
+            gl_FragColor = color + v_ambient;
+        }
+    </script>
+
+    <script>
+    console.log("Hello");
+    function setDirectionalLight(ctx, program, eyeVector, direction, ambient, diffuse, specular)
+    {
+        var lightString = "u_light.";
+        
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"ambient"), 
+                                                ambient[0], ambient[1], ambient[2], ambient[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"diffuse"), 
+                                                diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"specular"), 
+                                                specular[0], specular[1], specular[2], specular[3]);
+        ctx.uniform4f(ctx.getUniformLocation(program, lightString+"position"), 
+                                                direction[0], direction[1], direction[2], direction[3]);
+                                                
+        // compute the half vector
+        var halfVector = [ eyeVector[0] + direction[0], eyeVector[1] + direction[1], eyeVector[2] + direction[2] ];
+        var length = Math.sqrt(halfVector[0] * halfVector[0] + 
+                               halfVector[1] * halfVector[1] + 
+                               halfVector[2] * halfVector[2]);
+        if (length == 0)
+            halfVector = [ 0, 0, 1 ];
+        else {
+            halfVector[0] /= length;
+            halfVector[1] /= length;
+            halfVector[2] /= length;
+        }
+
+        ctx.uniform3f(ctx.getUniformLocation(program, lightString+"halfVector"), 
+                                                halfVector[0], halfVector[1], halfVector[2]);
+    }
+        
+        function setMaterial(ctx, program, emission, ambient, diffuse, specular, shininess)
+        {
+            var matString = "u_frontMaterial.";
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"emission"), 
+                                                    emission[0], emission[1], emission[2], emission[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform1f(ctx.getUniformLocation(program, matString+"shininess"), shininess);
+        }
+
+        function init()
+        {
+           var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "a_normal", "a_texCoord", "a_vertex"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform1i(gl.getUniformLocation(gl.program, "u_sampler2d"), 0);
+            gl.uniform4f(gl.getUniformLocation(gl.program, "u_globalAmbientColor"), 0.2, 0.2, 0.2, 1);
+
+            setDirectionalLight(gl, gl.program, 
+                                [ 0, 0, 1 ],            // eyeVector
+                                [0, 0, 1, 1],           // position
+                                [0.1, 0.1, 0.1, 1],     // ambient
+                                [1, 1, 1, 1],           // diffuse
+                                [1, 1, 1, 1]);          // specular
+
+            setMaterial(gl, gl.program, 
+                [ 0, 0, 0, 0 ],         // emission
+                [ 0.1, 0.1, 0.1, 1 ],   // ambient
+                [ 0.8, 0.2, 0, 1 ], // diffuse
+                [ 0, 0, 1, 1 ],     // specular
+                32);                    // shininess
+            
+            obj = loadObj(gl, "resources/teapot.obj");
+
+            mvMatrix = new CanvasMatrix4();
+            normalMatrix = new CanvasMatrix4();
+            
+            return gl;
+        }
+                
+        width = -1;
+        height = -1;
+        loaded = false;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+    
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,50, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawPicture(ctx)
+        {
+            var startRenderTime = new Date().getTime();
+            
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+
+            if (!loaded && obj.loaded) {
+                loaded = true;
+
+                ctx.enableVertexAttribArray(0);
+                ctx.enableVertexAttribArray(1);
+                ctx.enableVertexAttribArray(2);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.vertexObject);
+                ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.normalObject);
+                ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.texCoordObject);
+                ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+            }
+            
+            if (!loaded)
+                return;
+            
+            // generate the model-view matrix
+            mvMatrix.makeIdentity();
+            mvMatrix.rotate(currentAngle, 0, 1, 0);
+            mvMatrix.rotate(10, 1,0,0);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            normalMatrix.load(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            mvMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            ctx.drawElements(ctx.TRIANGLES, obj.numIndices, ctx.UNSIGNED_SHORT, 0);
+            
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            framerate = new Framerate("framerate");
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/TeapotPerVertex.html b/WebCore/manual-tests/webgl/TeapotPerVertex.html
new file mode 100644
index 0000000..d2544a3
--- /dev/null
+++ b/WebCore/manual-tests/webgl/TeapotPerVertex.html
@@ -0,0 +1,305 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Canvas3d example</title>
+    <script src="resources/CanvasMatrix.js"> </script>
+    <script src="resources/utils3d.js"> </script>
+    <script id="vshader" type="x-shader/x-vertex">
+        /*
+          Copyright (c) 2008 Seneca College
+          Licenced under the MIT License (http://www.c3dl.org/index.php/mit-license/)
+        */
+        
+        // We need to create our own light structure since we can't access 
+        // the light() function in the 2.0 context.
+        struct Light 
+        { 
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            vec4 position;
+            
+            vec3 halfVector;
+        };
+        
+        struct Material
+        {
+            vec4 emission;
+            vec4 ambient;
+            vec4 diffuse;
+            vec4 specular;
+            float shininess;
+        };
+
+        //
+        // vertex attributes
+        //
+        attribute vec3 a_normal; 
+        attribute vec4 a_texCoord; 
+        attribute vec4 a_vertex; 
+
+        // for every model we multiply the projection, view and model matrices
+        // once to prevent having to do it for every vertex, however we still need
+        // the view matrix to calculate lighting.
+        uniform mat4 u_modelViewMatrix;
+
+        // we can calculate this once per model to speed up processing done on the js side.
+        uniform mat4 u_modelViewProjMatrix;
+
+        // matrix to transform the vertex normals
+        uniform mat4 u_normalMatrix;
+
+        // custom light structures need to be used since we don't have access to 
+        // light states.
+        uniform Light u_light;
+        
+        // material
+        uniform vec4 u_globalAmbientColor;
+        uniform Material u_frontMaterial;
+        uniform Material u_backMaterial;
+        
+        // passed to fragment shader
+        varying vec4 v_diffuse, v_specular;
+        varying vec2 v_texCoord;
+
+        /*
+            Given a reference to the ambient and diffuse  lighting variables,
+            this function will calculate how much each component contributes to the scene.
+
+            Light light - the light in view space
+            vec3 normal - 
+            vec4 ambient - 
+            vec4 diffuse - 
+        */
+        void directionalLight(in vec3 normal, inout vec4 ambient, inout vec4 diffuse, inout vec4 specular)
+        {
+            vec3 lightDir = normalize(vec3(u_light.position));
+            ambient += u_light.ambient;
+            
+            float nDotL = max(dot(normal, lightDir), 0.0);
+            if (nDotL > 0.0) {
+                diffuse += u_light.diffuse * nDotL;
+                float nDotHV = max(dot(normal, u_light.halfVector), 0.0);
+                nDotHV += 0.3;
+                vec4 specularColor = u_frontMaterial.specular * u_light.specular;
+                specular += vec4(specularColor.rgb * pow(nDotHV, u_frontMaterial.shininess), specularColor.a);
+            }
+        }
+
+        void main()
+        { 
+            vec3 normal = normalize(u_normalMatrix * vec4(a_normal, 1)).xyz; 
+
+            vec4 ambient = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 diffuse = vec4(0.0, 0.0, 0.0, 1.0); 
+            vec4 specular = vec4(0.0, 0.0, 0.0, 1.0); 
+
+            // place the current vertex into view space
+            // ecPos = eye coordinate position.
+            vec4 ecPos4 = u_modelViewMatrix * a_vertex;
+
+            // the current vertex in eye coordinate space
+            vec3 ecPos = ecPos4.xyz/ecPos4.w;
+            directionalLight(normal, ambient, diffuse, specular);
+            
+            ambient = u_frontMaterial.ambient * ambient;
+            ambient += u_globalAmbientColor * u_frontMaterial.ambient;
+            diffuse = u_frontMaterial.diffuse * diffuse;
+
+            v_diffuse = diffuse;
+            v_specular = specular + ambient;
+            gl_Position =  u_modelViewProjMatrix * a_vertex;
+            v_texCoord = a_texCoord.st;
+        }
+    </script>
+
+    <script id="fshader" type="x-shader/x-fragment">
+        uniform sampler2D u_sampler2d;
+
+        varying vec4 v_diffuse, v_specular;
+        varying vec2 v_texCoord;
+
+        void main()
+        {
+            vec4 color = v_diffuse;
+            
+            gl_FragColor = color + v_specular;
+        }
+    </script>
+
+    <script>
+        function setDirectionalLight(ctx, program, eyeVector, direction, ambient, diffuse, specular)
+        {
+            var lightString = "u_light.";
+            
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, lightString+"position"), 
+                                                    direction[0], direction[1], direction[2], direction[3]);
+                                                    
+            // compute the half vector
+            var halfVector = [ eyeVector[0] + direction[0], eyeVector[1] + direction[1], eyeVector[2] + direction[2] ];
+            var length = Math.sqrt(halfVector[0] * halfVector[0] + 
+                                   halfVector[1] * halfVector[1] + 
+                                   halfVector[2] * halfVector[2]);
+            if (length == 0)
+                halfVector = [ 0, 0, 1 ];
+            else {
+                halfVector[0] /= length;
+                halfVector[1] /= length;
+                halfVector[2] /= length;
+            }
+
+            ctx.uniform3f(ctx.getUniformLocation(program, lightString+"halfVector"), 
+                                                    halfVector[0], halfVector[1], halfVector[2]);
+        }
+        
+        function setMaterial(ctx, program, emission, ambient, diffuse, specular, shininess)
+        {
+            var matString = "u_frontMaterial.";
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"emission"), 
+                                                    emission[0], emission[1], emission[2], emission[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"ambient"), 
+                                                    ambient[0], ambient[1], ambient[2], ambient[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"diffuse"), 
+                                                    diffuse[0], diffuse[1], diffuse[2], diffuse[3]);
+            ctx.uniform4f(ctx.getUniformLocation(program, matString+"specular"), 
+                                                    specular[0], specular[1], specular[2], specular[3]);
+            ctx.uniform1f(ctx.getUniformLocation(program, matString+"shininess"), shininess);
+        }
+
+        function init()
+        {
+            var gl = initWebGL("example", "vshader", "fshader", 
+                                [ "a_normal", "a_texCoord", "a_vertex"],
+                                [ 0, 0, 0, 1 ], 10000);
+
+            gl.uniform1i(gl.getUniformLocation(gl.program, "u_sampler2d"), 0);
+            gl.uniform4f(gl.getUniformLocation(gl.program, "u_globalAmbientColor"), 0.2, 0.2, 0.2, 1);
+
+            setDirectionalLight(gl, gl.program, 
+                                [ 0, 0, 1 ],            // eyeVector
+                                [0, 0, 1, 1],           // position
+                                [0.1, 0.1, 0.1, 1],     // ambient
+                                [1, 1, 1, 1],           // diffuse
+                                [1, 1, 1, 1]);          // specular
+
+            setMaterial(gl, gl.program, 
+                [ 0, 0, 0, 0 ],         // emission
+                [ 0.1, 0.1, 0.1, 1 ],   // ambient
+                [ 0.8, 0.2, 0, 1 ], // diffuse
+                [ 0, 0, 1, 1 ],     // specular
+                32);                    // shininess
+            
+            obj = loadObj(gl, "resources/teapot.obj");
+
+            mvMatrix = new CanvasMatrix4();
+            normalMatrix = new CanvasMatrix4();
+            
+            return gl;
+        }
+        
+        width = -1;
+        height = -1;
+        loaded = false;
+        
+        function reshape(ctx)
+        {
+            var canvas = document.getElementById('example');
+            if (canvas.clientWidth == width && canvas.clientHeight == height)
+                return;
+
+            width = canvas.clientWidth;
+            height = canvas.clientHeight;
+            
+            ctx.viewport(0, 0, width, height);
+    
+            ctx.perspectiveMatrix = new CanvasMatrix4();
+            ctx.perspectiveMatrix.lookat(0,0,50, 0, 0, 0, 0, 1, 0);
+            ctx.perspectiveMatrix.perspective(30, width/height, 1, 10000);
+        }
+        
+        function drawPicture(ctx)
+        {
+            var startRenderTime = new Date().getTime();
+            
+            reshape(ctx);
+            ctx.clear(ctx.COLOR_BUFFER_BIT | ctx.DEPTH_BUFFER_BIT);
+
+            if (!loaded && obj.loaded) {
+                loaded = true;
+
+                ctx.enableVertexAttribArray(0);
+                ctx.enableVertexAttribArray(1);
+                ctx.enableVertexAttribArray(2);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.normalObject);
+                ctx.vertexAttribPointer(0, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.texCoordObject);
+                ctx.vertexAttribPointer(1, 2, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ARRAY_BUFFER, obj.vertexObject);
+                ctx.vertexAttribPointer(2, 3, ctx.FLOAT, false, 0, 0);
+
+                ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+            }
+            
+            if (!loaded)
+                return;
+            
+            // generate the model-view matrix
+            mvMatrix.makeIdentity();
+            mvMatrix.rotate(currentAngle, 0, 1, 0);
+            mvMatrix.rotate(10, 1,0,0);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            // construct the normal matrix from the model-view matrix
+            normalMatrix.load(mvMatrix);
+            normalMatrix.invert();
+            normalMatrix.transpose();
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_normalMatrix"), false, normalMatrix.getAsCanvasFloatArray());
+            
+            mvMatrix.multRight(ctx.perspectiveMatrix);
+            ctx.uniformMatrix4fv(ctx.getUniformLocation(ctx.program, "u_modelViewProjMatrix"), false, mvMatrix.getAsCanvasFloatArray());
+
+            ctx.drawElements(ctx.TRIANGLES, obj.numIndices, ctx.UNSIGNED_SHORT, 0);
+            
+            ctx.flush();
+            
+            framerate.snapshot();
+            
+            currentAngle += incAngle;
+            if (currentAngle > 360)
+                currentAngle -= 360;
+        }
+        
+        function start()
+        {
+            var ctx = init();
+            currentAngle = 0;
+            incAngle = 0.2;
+            framerate = new Framerate("framerate");
+            var f = function() { drawPicture(ctx) };
+            setInterval(f, 10);
+        }
+    </script>
+    <style type="text/css">
+        canvas {
+            border: 2px solid black;
+            width:90%;
+            height:90%;
+        }
+    </style>
+  </head>
+  <body onload="start()">
+    <canvas id="example">
+    There is supposed to be an example drawing here, but it's not important.
+    </canvas>
+    <div id="framerate"></div>
+  </body>
+</html>
diff --git a/WebCore/manual-tests/webgl/resources/CanvasMatrix.js b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
new file mode 100644
index 0000000..f35727f
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/CanvasMatrix.js
@@ -0,0 +1,698 @@
+/*
+    CanvasMatrix4 class
+    
+    This class implements a 4x4 matrix. It has functions which
+    duplicate the functionality of the OpenGL matrix stack and
+    glut functions.
+    
+    IDL:
+    
+    [
+        Constructor(in CanvasMatrix4 matrix),           // copy passed matrix into new CanvasMatrix4
+        Constructor(in sequence<float> array)           // create new CanvasMatrix4 with 16 floats (row major)
+        Constructor()                                   // create new CanvasMatrix4 with identity matrix
+    ]
+    interface CanvasMatrix4 {
+        attribute float m11;
+        attribute float m12;
+        attribute float m13;
+        attribute float m14;
+        attribute float m21;
+        attribute float m22;
+        attribute float m23;
+        attribute float m24;
+        attribute float m31;
+        attribute float m32;
+        attribute float m33;
+        attribute float m34;
+        attribute float m41;
+        attribute float m42;
+        attribute float m43;
+        attribute float m44;
+
+        void load(in CanvasMatrix4 matrix);                 // copy the values from the passed matrix
+        void load(in sequence<float> array);                // copy 16 floats into the matrix
+        sequence<float> getAsArray();                       // return the matrix as an array of 16 floats
+        CanvasFloatArray getAsCanvasFloatArray();           // return the matrix as a CanvasFloatArray with 16 values
+        void makeIdentity();                                // replace the matrix with identity
+        void transpose();                                   // replace the matrix with its transpose
+        void invert();                                      // replace the matrix with its inverse
+        
+        void translate(in float x, in float y, in float z); // multiply the matrix by passed translation values on the right
+        void scale(in float x, in float y, in float z);     // multiply the matrix by passed scale values on the right
+        void rotate(in float angle,                         // multiply the matrix by passed rotation values on the right
+                    in float x, in float y, in float z);    // (angle is in degrees)
+        void multRight(in CanvasMatrix matrix);             // multiply the matrix by the passed matrix on the right
+        void multLeft(in CanvasMatrix matrix);              // multiply the matrix by the passed matrix on the left
+        void ortho(in float left, in float right,           // multiply the matrix by the passed ortho values on the right
+                   in float bottom, in float top, 
+                   in float near, in float far);
+        void frustum(in float left, in float right,         // multiply the matrix by the passed frustum values on the right
+                     in float bottom, in float top, 
+                     in float near, in float far);
+        void perspective(in float fovy, in float aspect,    // multiply the matrix by the passed perspective values on the right
+                         in float zNear, in float zFar);
+        void lookat(in float eyex, in float eyey, in float eyez,    // multiply the matrix by the passed lookat 
+                    in float ctrx, in float ctry, in float ctrz,    // values on the right
+                    in float upx, in float upy, in float upz);
+    }
+*/
+
+CanvasMatrix4 = function(m)
+{
+    if (typeof m == 'object') {
+        if ("length" in m && m.length >= 16) {
+            this.load(m[0], m[1], m[2], m[3], m[4], m[5], m[6], m[7], m[8], m[9], m[10], m[11], m[12], m[13], m[14], m[15]);
+            return;
+        }
+        else if (m instanceof CanvasMatrix4) {
+            this.load(m);
+            return;
+        }
+    }
+    this.makeIdentity();
+}
+
+CanvasMatrix4.prototype.load = function()
+{
+    if (arguments.length == 1 && typeof arguments[0] == 'object') {
+        var matrix = arguments[0];
+        
+        if ("length" in matrix && matrix.length == 16) {
+            this.m11 = matrix[0];
+            this.m12 = matrix[1];
+            this.m13 = matrix[2];
+            this.m14 = matrix[3];
+
+            this.m21 = matrix[4];
+            this.m22 = matrix[5];
+            this.m23 = matrix[6];
+            this.m24 = matrix[7];
+
+            this.m31 = matrix[8];
+            this.m32 = matrix[9];
+            this.m33 = matrix[10];
+            this.m34 = matrix[11];
+
+            this.m41 = matrix[12];
+            this.m42 = matrix[13];
+            this.m43 = matrix[14];
+            this.m44 = matrix[15];
+            return;
+        }
+            
+        if (arguments[0] instanceof CanvasMatrix4) {
+        
+            this.m11 = matrix.m11;
+            this.m12 = matrix.m12;
+            this.m13 = matrix.m13;
+            this.m14 = matrix.m14;
+
+            this.m21 = matrix.m21;
+            this.m22 = matrix.m22;
+            this.m23 = matrix.m23;
+            this.m24 = matrix.m24;
+
+            this.m31 = matrix.m31;
+            this.m32 = matrix.m32;
+            this.m33 = matrix.m33;
+            this.m34 = matrix.m34;
+
+            this.m41 = matrix.m41;
+            this.m42 = matrix.m42;
+            this.m43 = matrix.m43;
+            this.m44 = matrix.m44;
+            return;
+        }
+    }
+    
+    this.makeIdentity();
+}
+
+CanvasMatrix4.prototype.getAsArray = function()
+{
+    return [
+        this.m11, this.m12, this.m13, this.m14, 
+        this.m21, this.m22, this.m23, this.m24, 
+        this.m31, this.m32, this.m33, this.m34, 
+        this.m41, this.m42, this.m43, this.m44
+    ];
+}
+
+CanvasMatrix4.prototype.getAsCanvasFloatArray = function()
+{
+    return new CanvasFloatArray(this.getAsArray());
+}
+
+CanvasMatrix4.prototype.makeIdentity = function()
+{
+    this.m11 = 1;
+    this.m12 = 0;
+    this.m13 = 0;
+    this.m14 = 0;
+    
+    this.m21 = 0;
+    this.m22 = 1;
+    this.m23 = 0;
+    this.m24 = 0;
+    
+    this.m31 = 0;
+    this.m32 = 0;
+    this.m33 = 1;
+    this.m34 = 0;
+    
+    this.m41 = 0;
+    this.m42 = 0;
+    this.m43 = 0;
+    this.m44 = 1;
+}
+
+CanvasMatrix4.prototype.transpose = function()
+{
+    var tmp = this.m12;
+    this.m12 = this.m21;
+    this.m21 = tmp;
+    
+    tmp = this.m13;
+    this.m13 = this.m31;
+    this.m31 = tmp;
+    
+    tmp = this.m14;
+    this.m14 = this.m41;
+    this.m41 = tmp;
+    
+    tmp = this.m23;
+    this.m23 = this.m32;
+    this.m32 = tmp;
+    
+    tmp = this.m24;
+    this.m24 = this.m42;
+    this.m42 = tmp;
+    
+    tmp = this.m34;
+    this.m34 = this.m43;
+    this.m43 = tmp;
+}
+
+CanvasMatrix4.prototype.invert = function()
+{
+    // Calculate the 4x4 determinant
+    // If the determinant is zero, 
+    // then the inverse matrix is not unique.
+    var det = this._determinant4x4();
+
+    if (Math.abs(det) < 1e-8)
+        return null;
+
+    this._makeAdjoint();
+
+    // Scale the adjoint matrix to get the inverse
+    this.m11 /= det;
+    this.m12 /= det;
+    this.m13 /= det;
+    this.m14 /= det;
+    
+    this.m21 /= det;
+    this.m22 /= det;
+    this.m23 /= det;
+    this.m24 /= det;
+    
+    this.m31 /= det;
+    this.m32 /= det;
+    this.m33 /= det;
+    this.m34 /= det;
+    
+    this.m41 /= det;
+    this.m42 /= det;
+    this.m43 /= det;
+    this.m44 /= det;
+}
+
+CanvasMatrix4.prototype.translate = function(x,y,z)
+{
+    if (x == undefined)
+        x = 0;
+        if (y == undefined)
+            y = 0;
+    if (z == undefined)
+        z = 0;
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m41 = x;
+    matrix.m42 = y;
+    matrix.m43 = z;
+
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.scale = function(x,y,z)
+{
+    if (x == undefined)
+        x = 1;
+    if (z == undefined) {
+        if (y == undefined) {
+            y = x;
+            z = x;
+        }
+        else
+            z = 1;
+    }
+    else if (y == undefined)
+        y = x;
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m11 = x;
+    matrix.m22 = y;
+    matrix.m33 = z;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.rotate = function(angle,x,y,z)
+{
+    // angles are in degrees. Switch to radians
+    angle = angle / 180 * Math.PI;
+    
+    angle /= 2;
+    var sinA = Math.sin(angle);
+    var cosA = Math.cos(angle);
+    var sinA2 = sinA * sinA;
+    
+    // normalize
+    var length = Math.sqrt(x * x + y * y + z * z);
+    if (length == 0) {
+        // bad vector, just use something reasonable
+        x = 0;
+        y = 0;
+        z = 1;
+    } else if (length != 1) {
+        x /= length;
+        y /= length;
+        z /= length;
+    }
+    
+    var mat = new CanvasMatrix4();
+
+    // optimize case where axis is along major axis
+    if (x == 1 && y == 0 && z == 0) {
+        mat.m11 = 1;
+        mat.m12 = 0;
+        mat.m13 = 0;
+        mat.m21 = 0;
+        mat.m22 = 1 - 2 * sinA2;
+        mat.m23 = 2 * sinA * cosA;
+        mat.m31 = 0;
+        mat.m32 = -2 * sinA * cosA;
+        mat.m33 = 1 - 2 * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else if (x == 0 && y == 1 && z == 0) {
+        mat.m11 = 1 - 2 * sinA2;
+        mat.m12 = 0;
+        mat.m13 = -2 * sinA * cosA;
+        mat.m21 = 0;
+        mat.m22 = 1;
+        mat.m23 = 0;
+        mat.m31 = 2 * sinA * cosA;
+        mat.m32 = 0;
+        mat.m33 = 1 - 2 * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else if (x == 0 && y == 0 && z == 1) {
+        mat.m11 = 1 - 2 * sinA2;
+        mat.m12 = 2 * sinA * cosA;
+        mat.m13 = 0;
+        mat.m21 = -2 * sinA * cosA;
+        mat.m22 = 1 - 2 * sinA2;
+        mat.m23 = 0;
+        mat.m31 = 0;
+        mat.m32 = 0;
+        mat.m33 = 1;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    } else {
+        var x2 = x*x;
+        var y2 = y*y;
+        var z2 = z*z;
+    
+        mat.m11 = 1 - 2 * (y2 + z2) * sinA2;
+        mat.m12 = 2 * (x * y * sinA2 + z * sinA * cosA);
+        mat.m13 = 2 * (x * z * sinA2 - y * sinA * cosA);
+        mat.m21 = 2 * (y * x * sinA2 - z * sinA * cosA);
+        mat.m22 = 1 - 2 * (z2 + x2) * sinA2;
+        mat.m23 = 2 * (y * z * sinA2 + x * sinA * cosA);
+        mat.m31 = 2 * (z * x * sinA2 + y * sinA * cosA);
+        mat.m32 = 2 * (z * y * sinA2 - x * sinA * cosA);
+        mat.m33 = 1 - 2 * (x2 + y2) * sinA2;
+        mat.m14 = mat.m24 = mat.m34 = 0;
+        mat.m41 = mat.m42 = mat.m43 = 0;
+        mat.m44 = 1;
+    }
+    this.multRight(mat);
+}
+
+CanvasMatrix4.prototype.multRight = function(mat)
+{
+    var m11 = (this.m11 * mat.m11 + this.m12 * mat.m21
+               + this.m13 * mat.m31 + this.m14 * mat.m41);
+    var m12 = (this.m11 * mat.m12 + this.m12 * mat.m22
+               + this.m13 * mat.m32 + this.m14 * mat.m42);
+    var m13 = (this.m11 * mat.m13 + this.m12 * mat.m23
+               + this.m13 * mat.m33 + this.m14 * mat.m43);
+    var m14 = (this.m11 * mat.m14 + this.m12 * mat.m24
+               + this.m13 * mat.m34 + this.m14 * mat.m44);
+
+    var m21 = (this.m21 * mat.m11 + this.m22 * mat.m21
+               + this.m23 * mat.m31 + this.m24 * mat.m41);
+    var m22 = (this.m21 * mat.m12 + this.m22 * mat.m22
+               + this.m23 * mat.m32 + this.m24 * mat.m42);
+    var m23 = (this.m21 * mat.m13 + this.m22 * mat.m23
+               + this.m23 * mat.m33 + this.m24 * mat.m43);
+    var m24 = (this.m21 * mat.m14 + this.m22 * mat.m24
+               + this.m23 * mat.m34 + this.m24 * mat.m44);
+
+    var m31 = (this.m31 * mat.m11 + this.m32 * mat.m21
+               + this.m33 * mat.m31 + this.m34 * mat.m41);
+    var m32 = (this.m31 * mat.m12 + this.m32 * mat.m22
+               + this.m33 * mat.m32 + this.m34 * mat.m42);
+    var m33 = (this.m31 * mat.m13 + this.m32 * mat.m23
+               + this.m33 * mat.m33 + this.m34 * mat.m43);
+    var m34 = (this.m31 * mat.m14 + this.m32 * mat.m24
+               + this.m33 * mat.m34 + this.m34 * mat.m44);
+
+    var m41 = (this.m41 * mat.m11 + this.m42 * mat.m21
+               + this.m43 * mat.m31 + this.m44 * mat.m41);
+    var m42 = (this.m41 * mat.m12 + this.m42 * mat.m22
+               + this.m43 * mat.m32 + this.m44 * mat.m42);
+    var m43 = (this.m41 * mat.m13 + this.m42 * mat.m23
+               + this.m43 * mat.m33 + this.m44 * mat.m43);
+    var m44 = (this.m41 * mat.m14 + this.m42 * mat.m24
+               + this.m43 * mat.m34 + this.m44 * mat.m44);
+    
+    this.m11 = m11;
+    this.m12 = m12;
+    this.m13 = m13;
+    this.m14 = m14;
+    
+    this.m21 = m21;
+    this.m22 = m22;
+    this.m23 = m23;
+    this.m24 = m24;
+    
+    this.m31 = m31;
+    this.m32 = m32;
+    this.m33 = m33;
+    this.m34 = m34;
+    
+    this.m41 = m41;
+    this.m42 = m42;
+    this.m43 = m43;
+    this.m44 = m44;
+}
+
+CanvasMatrix4.prototype.multLeft = function(mat)
+{
+    var m11 = (mat.m11 * this.m11 + mat.m12 * this.m21
+               + mat.m13 * this.m31 + mat.m14 * this.m41);
+    var m12 = (mat.m11 * this.m12 + mat.m12 * this.m22
+               + mat.m13 * this.m32 + mat.m14 * this.m42);
+    var m13 = (mat.m11 * this.m13 + mat.m12 * this.m23
+               + mat.m13 * this.m33 + mat.m14 * this.m43);
+    var m14 = (mat.m11 * this.m14 + mat.m12 * this.m24
+               + mat.m13 * this.m34 + mat.m14 * this.m44);
+
+    var m21 = (mat.m21 * this.m11 + mat.m22 * this.m21
+               + mat.m23 * this.m31 + mat.m24 * this.m41);
+    var m22 = (mat.m21 * this.m12 + mat.m22 * this.m22
+               + mat.m23 * this.m32 + mat.m24 * this.m42);
+    var m23 = (mat.m21 * this.m13 + mat.m22 * this.m23
+               + mat.m23 * this.m33 + mat.m24 * this.m43);
+    var m24 = (mat.m21 * this.m14 + mat.m22 * this.m24
+               + mat.m23 * this.m34 + mat.m24 * this.m44);
+
+    var m31 = (mat.m31 * this.m11 + mat.m32 * this.m21
+               + mat.m33 * this.m31 + mat.m34 * this.m41);
+    var m32 = (mat.m31 * this.m12 + mat.m32 * this.m22
+               + mat.m33 * this.m32 + mat.m34 * this.m42);
+    var m33 = (mat.m31 * this.m13 + mat.m32 * this.m23
+               + mat.m33 * this.m33 + mat.m34 * this.m43);
+    var m34 = (mat.m31 * this.m14 + mat.m32 * this.m24
+               + mat.m33 * this.m34 + mat.m34 * this.m44);
+
+    var m41 = (mat.m41 * this.m11 + mat.m42 * this.m21
+               + mat.m43 * this.m31 + mat.m44 * this.m41);
+    var m42 = (mat.m41 * this.m12 + mat.m42 * this.m22
+               + mat.m43 * this.m32 + mat.m44 * this.m42);
+    var m43 = (mat.m41 * this.m13 + mat.m42 * this.m23
+               + mat.m43 * this.m33 + mat.m44 * this.m43);
+    var m44 = (mat.m41 * this.m14 + mat.m42 * this.m24
+               + mat.m43 * this.m34 + mat.m44 * this.m44);
+    
+    this.m11 = m11;
+    this.m12 = m12;
+    this.m13 = m13;
+    this.m14 = m14;
+
+    this.m21 = m21;
+    this.m22 = m22;
+    this.m23 = m23;
+    this.m24 = m24;
+
+    this.m31 = m31;
+    this.m32 = m32;
+    this.m33 = m33;
+    this.m34 = m34;
+
+    this.m41 = m41;
+    this.m42 = m42;
+    this.m43 = m43;
+    this.m44 = m44;
+}
+
+CanvasMatrix4.prototype.ortho = function(left, right, bottom, top, near, far)
+{
+    var tx = (left + right) / (left - right);
+    var ty = (top + bottom) / (top - bottom);
+    var tz = (far + near) / (far - near);
+    
+    var matrix = new CanvasMatrix4();
+    matrix.m11 = 2 / (left - right);
+    matrix.m12 = 0;
+    matrix.m13 = 0;
+    matrix.m14 = 0;
+    matrix.m21 = 0;
+    matrix.m22 = 2 / (top - bottom);
+    matrix.m23 = 0;
+    matrix.m24 = 0;
+    matrix.m31 = 0;
+    matrix.m32 = 0;
+    matrix.m33 = -2 / (far - near);
+    matrix.m34 = 0;
+    matrix.m41 = tx;
+    matrix.m42 = ty;
+    matrix.m43 = tz;
+    matrix.m44 = 1;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.frustum = function(left, right, bottom, top, near, far)
+{
+    var matrix = new CanvasMatrix4();
+    var A = (right + left) / (right - left);
+    var B = (top + bottom) / (top - bottom);
+    var C = -(far + near) / (far - near);
+    var D = -(2 * far * near) / (far - near);
+    
+    matrix.m11 = (2 * near) / (right - left);
+    matrix.m12 = 0;
+    matrix.m13 = 0;
+    matrix.m14 = 0;
+    
+    matrix.m21 = 0;
+    matrix.m22 = 2 * near / (top - bottom);
+    matrix.m23 = 0;
+    matrix.m24 = 0;
+    
+    matrix.m31 = A;
+    matrix.m32 = B;
+    matrix.m33 = C;
+    matrix.m34 = -1;
+    
+    matrix.m41 = 0;
+    matrix.m42 = 0;
+    matrix.m43 = D;
+    matrix.m44 = 0;
+    
+    this.multRight(matrix);
+}
+
+CanvasMatrix4.prototype.perspective = function(fovy, aspect, zNear, zFar)
+{
+    var top = Math.tan(fovy * Math.PI / 360) * zNear;
+    var bottom = -top;
+    var left = aspect * bottom;
+    var right = aspect * top;
+    this.frustum(left, right, bottom, top, zNear, zFar);
+}
+
+CanvasMatrix4.prototype.lookat = function(eyex, eyey, eyez, centerx, centery, centerz, upx, upy, upz)
+{
+    var matrix = new CanvasMatrix4();
+    
+    // Make rotation matrix
+
+    // Z vector
+    var zx = eyex - centerx;
+    var zy = eyey - centery;
+    var zz = eyez - centerz;
+    var mag = Math.sqrt(zx * zx + zy * zy + zz * zz);
+    if (mag) {
+        zx /= mag;
+        zy /= mag;
+        zz /= mag;
+    }
+
+    // Y vector
+    var yx = upx;
+    var yy = upy;
+    var yz = upz;
+
+    // X vector = Y cross Z
+    xx =  yy * zz - yz * zy;
+    xy = -yx * zz + yz * zx;
+    xz =  yx * zy - yy * zx;
+
+    // Recompute Y = Z cross X
+    yx = zy * xz - zz * xy;
+    yy = -zx * xz + zz * xx;
+    yx = zx * xy - zy * xx;
+
+    // cross product gives area of parallelogram, which is < 1.0 for
+    // non-perpendicular unit-length vectors; so normalize x, y here
+
+    mag = Math.sqrt(xx * xx + xy * xy + xz * xz);
+    if (mag) {
+        xx /= mag;
+        xy /= mag;
+        xz /= mag;
+    }
+
+    mag = Math.sqrt(yx * yx + yy * yy + yz * yz);
+    if (mag) {
+        yx /= mag;
+        yy /= mag;
+        yz /= mag;
+    }
+
+    matrix.m11 = xx;
+    matrix.m12 = xy;
+    matrix.m13 = xz;
+    matrix.m14 = 0;
+    
+    matrix.m21 = yx;
+    matrix.m22 = yy;
+    matrix.m23 = yz;
+    matrix.m24 = 0;
+    
+    matrix.m31 = zx;
+    matrix.m32 = zy;
+    matrix.m33 = zz;
+    matrix.m34 = 0;
+    
+    matrix.m41 = 0;
+    matrix.m42 = 0;
+    matrix.m43 = 0;
+    matrix.m44 = 1;
+    matrix.translate(-eyex, -eyey, -eyez);
+    
+    this.multRight(matrix);
+}
+
+// Support functions
+CanvasMatrix4.prototype._determinant2x2 = function(a, b, c, d)
+{
+    return a * d - b * c;
+}
+
+CanvasMatrix4.prototype._determinant3x3 = function(a1, a2, a3, b1, b2, b3, c1, c2, c3)
+{
+    return a1 * this._determinant2x2(b2, b3, c2, c3)
+         - b1 * this._determinant2x2(a2, a3, c2, c3)
+         + c1 * this._determinant2x2(a2, a3, b2, b3);
+}
+
+CanvasMatrix4.prototype._determinant4x4 = function()
+{
+    var a1 = this.m11;
+    var b1 = this.m12; 
+    var c1 = this.m13;
+    var d1 = this.m14;
+
+    var a2 = this.m21;
+    var b2 = this.m22; 
+    var c2 = this.m23;
+    var d2 = this.m24;
+
+    var a3 = this.m31;
+    var b3 = this.m32; 
+    var c3 = this.m33;
+    var d3 = this.m34;
+
+    var a4 = this.m41;
+    var b4 = this.m42; 
+    var c4 = this.m43;
+    var d4 = this.m44;
+
+    return a1 * this._determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4)
+         - b1 * this._determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4)
+         + c1 * this._determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4)
+         - d1 * this._determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+}
+
+CanvasMatrix4.prototype._makeAdjoint = function()
+{
+    var a1 = this.m11;
+    var b1 = this.m12; 
+    var c1 = this.m13;
+    var d1 = this.m14;
+
+    var a2 = this.m21;
+    var b2 = this.m22; 
+    var c2 = this.m23;
+    var d2 = this.m24;
+
+    var a3 = this.m31;
+    var b3 = this.m32; 
+    var c3 = this.m33;
+    var d3 = this.m34;
+
+    var a4 = this.m41;
+    var b4 = this.m42; 
+    var c4 = this.m43;
+    var d4 = this.m44;
+
+    // Row column labeling reversed since we transpose rows & columns
+    this.m11  =   this._determinant3x3(b2, b3, b4, c2, c3, c4, d2, d3, d4);
+    this.m21  = - this._determinant3x3(a2, a3, a4, c2, c3, c4, d2, d3, d4);
+    this.m31  =   this._determinant3x3(a2, a3, a4, b2, b3, b4, d2, d3, d4);
+    this.m41  = - this._determinant3x3(a2, a3, a4, b2, b3, b4, c2, c3, c4);
+        
+    this.m12  = - this._determinant3x3(b1, b3, b4, c1, c3, c4, d1, d3, d4);
+    this.m22  =   this._determinant3x3(a1, a3, a4, c1, c3, c4, d1, d3, d4);
+    this.m32  = - this._determinant3x3(a1, a3, a4, b1, b3, b4, d1, d3, d4);
+    this.m42  =   this._determinant3x3(a1, a3, a4, b1, b3, b4, c1, c3, c4);
+        
+    this.m13  =   this._determinant3x3(b1, b2, b4, c1, c2, c4, d1, d2, d4);
+    this.m23  = - this._determinant3x3(a1, a2, a4, c1, c2, c4, d1, d2, d4);
+    this.m33  =   this._determinant3x3(a1, a2, a4, b1, b2, b4, d1, d2, d4);
+    this.m43  = - this._determinant3x3(a1, a2, a4, b1, b2, b4, c1, c2, c4);
+        
+    this.m14  = - this._determinant3x3(b1, b2, b3, c1, c2, c3, d1, d2, d3);
+    this.m24  =   this._determinant3x3(a1, a2, a3, c1, c2, c3, d1, d2, d3);
+    this.m34  = - this._determinant3x3(a1, a2, a3, b1, b2, b3, d1, d2, d3);
+    this.m44  =   this._determinant3x3(a1, a2, a3, b1, b2, b3, c1, c2, c3);
+}
diff --git a/WebCore/manual-tests/webgl/resources/earthmap1k.jpg b/WebCore/manual-tests/webgl/resources/earthmap1k.jpg
new file mode 100644
index 0000000..7dcab8a
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/earthmap1k.jpg
diff --git a/WebCore/manual-tests/webgl/resources/mars500x250.png b/WebCore/manual-tests/webgl/resources/mars500x250.png
new file mode 100644
index 0000000..f38ef09
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/mars500x250.png
diff --git a/WebCore/manual-tests/webgl/resources/teapot.obj b/WebCore/manual-tests/webgl/resources/teapot.obj
new file mode 100644
index 0000000..b6c6810
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/teapot.obj
@@ -0,0 +1,2866 @@
+# Max2Obj Version 4.0 Mar 10th, 2001
+#
+# object Teapot01 to come ...
+#
+v  5.929688 4.125000 0.000000
+v  5.832031 4.494141 0.000000
+v  5.945313 4.617188 0.000000
+v  6.175781 4.494141 0.000000
+v  6.429688 4.125000 0.000000
+v  5.387188 4.125000 2.747500
+v  5.297100 4.494141 2.709170
+v  5.401602 4.617188 2.753633
+v  5.614209 4.494141 2.844092
+v  5.848437 4.125000 2.943750
+v  3.899688 4.125000 4.970000
+v  3.830352 4.494141 4.900664
+v  3.910782 4.617188 4.981094
+v  4.074414 4.494141 5.144727
+v  4.254687 4.125000 5.325000
+v  1.677188 4.125000 6.457500
+v  1.638858 4.494141 6.367412
+v  1.683320 4.617188 6.471914
+v  1.773780 4.494141 6.684522
+v  1.873438 4.125000 6.918750
+v  -1.070312 4.125000 7.000000
+v  -1.070312 4.494141 6.902344
+v  -1.070312 4.617188 7.015625
+v  -1.070312 4.494141 7.246094
+v  -1.070312 4.125000 7.500000
+v  -4.007656 4.125000 6.457500
+v  -3.859572 4.494141 6.367412
+v  -3.847676 4.617188 6.471914
+v  -3.917371 4.494141 6.684522
+v  -4.014062 4.125000 6.918750
+v  -6.209063 4.125000 4.970000
+v  -6.042168 4.494141 4.900664
+v  -6.072500 4.617188 4.981094
+v  -6.217675 4.494141 5.144727
+v  -6.395312 4.125000 5.325000
+v  -7.591093 4.125000 2.747500
+v  -7.464421 4.494141 2.709170
+v  -7.550137 4.617188 2.753633
+v  -7.755822 4.494141 2.844092
+v  -7.989062 4.125000 2.943750
+v  -8.070313 4.125000 0.000000
+v  -7.972656 4.494141 0.000000
+v  -8.085938 4.617188 0.000000
+v  -8.316406 4.494141 0.000000
+v  -8.570313 4.125000 0.000000
+v  -7.527812 4.125000 -2.747500
+v  -7.437724 4.494141 -2.709170
+v  -7.542227 4.617188 -2.753633
+v  -7.754834 4.494141 -2.844092
+v  -7.989062 4.125000 -2.943750
+v  -6.040312 4.125000 -4.970000
+v  -5.970977 4.494141 -4.900664
+v  -6.051406 4.617188 -4.981094
+v  -6.215039 4.494141 -5.144727
+v  -6.395312 4.125000 -5.325000
+v  -3.817812 4.125000 -6.457500
+v  -3.779482 4.494141 -6.367412
+v  -3.823945 4.617188 -6.471914
+v  -3.914404 4.494141 -6.684522
+v  -4.014062 4.125000 -6.918750
+v  -1.070312 4.125000 -7.000000
+v  -1.070312 4.494141 -6.902344
+v  -1.070312 4.617188 -7.015625
+v  -1.070312 4.494141 -7.246094
+v  -1.070312 4.125000 -7.500000
+v  1.677188 4.125000 -6.457500
+v  1.638858 4.494141 -6.367412
+v  1.683320 4.617188 -6.471914
+v  1.773780 4.494141 -6.684522
+v  1.873438 4.125000 -6.918750
+v  3.899688 4.125000 -4.970000
+v  3.830352 4.494141 -4.900664
+v  3.910782 4.617188 -4.981094
+v  4.074414 4.494141 -5.144727
+v  4.254687 4.125000 -5.325000
+v  5.387188 4.125000 -2.747500
+v  5.297100 4.494141 -2.709170
+v  5.401602 4.617188 -2.753633
+v  5.614209 4.494141 -2.844092
+v  5.848437 4.125000 -2.943750
+v  7.347656 2.162109 0.000000
+v  8.148438 0.234375 0.000000
+v  8.714844 -1.623047 0.000000
+v  8.929688 -3.375000 0.000000
+v  6.695264 2.162109 3.304053
+v  7.433985 0.234375 3.618360
+v  7.956494 -1.623047 3.840674
+v  8.154688 -3.375000 3.925000
+v  4.906446 2.162109 5.976758
+v  5.475000 0.234375 6.545312
+v  5.877149 -1.623047 6.947461
+v  6.029688 -3.375000 7.100000
+v  2.233740 2.162109 7.765576
+v  2.548047 0.234375 8.504297
+v  2.770362 -1.623047 9.026807
+v  2.854688 -3.375000 9.225000
+v  -1.070312 2.162109 8.417969
+v  -1.070312 0.234375 9.218750
+v  -1.070312 -1.623047 9.785156
+v  -1.070312 -3.375000 10.000000
+v  -4.374365 2.162109 7.765576
+v  -4.688672 0.234375 8.504297
+v  -4.910986 -1.623047 9.026807
+v  -4.995313 -3.375000 9.225000
+v  -7.047071 2.162109 5.976758
+v  -7.615624 0.234375 6.545312
+v  -8.017773 -1.623047 6.947461
+v  -8.170312 -3.375000 7.100000
+v  -8.835889 2.162109 3.304053
+v  -9.574610 0.234375 3.618360
+v  -10.097119 -1.623047 3.840674
+v  -10.295313 -3.375000 3.925000
+v  -9.488281 2.162109 0.000000
+v  -10.289063 0.234375 0.000000
+v  -10.855469 -1.623047 0.000000
+v  -11.070313 -3.375000 0.000000
+v  -8.835889 2.162109 -3.304053
+v  -9.574610 0.234375 -3.618360
+v  -10.097119 -1.623047 -3.840674
+v  -10.295313 -3.375000 -3.925000
+v  -7.047071 2.162109 -5.976758
+v  -7.615624 0.234375 -6.545312
+v  -8.017773 -1.623047 -6.947461
+v  -8.170312 -3.375000 -7.100000
+v  -4.374365 2.162109 -7.765576
+v  -4.688672 0.234375 -8.504297
+v  -4.910986 -1.623047 -9.026807
+v  -4.995313 -3.375000 -9.225000
+v  -1.070312 2.162109 -8.417969
+v  -1.070312 0.234375 -9.218750
+v  -1.070312 -1.623047 -9.785156
+v  -1.070312 -3.375000 -10.000000
+v  2.233740 2.162109 -7.765576
+v  2.548047 0.234375 -8.504297
+v  2.770362 -1.623047 -9.026807
+v  2.854688 -3.375000 -9.225000
+v  4.906446 2.162109 -5.976758
+v  5.475000 0.234375 -6.545312
+v  5.877149 -1.623047 -6.947461
+v  6.029688 -3.375000 -7.100000
+v  6.695264 2.162109 -3.304053
+v  7.433985 0.234375 -3.618360
+v  7.956494 -1.623047 -3.840674
+v  8.154688 -3.375000 -3.925000
+v  8.539063 -4.857422 0.000000
+v  7.679688 -5.953125 0.000000
+v  6.820313 -6.697266 0.000000
+v  6.429688 -7.125000 0.000000
+v  7.794336 -4.857422 3.771680
+v  7.001562 -5.953125 3.434375
+v  6.208789 -6.697266 3.097070
+v  5.848437 -7.125000 2.943750
+v  5.752343 -4.857422 6.822656
+v  5.142187 -5.953125 6.212500
+v  4.532031 -6.697266 5.602344
+v  4.254687 -7.125000 5.325000
+v  2.701367 -4.857422 8.864649
+v  2.364063 -5.953125 8.071875
+v  2.026758 -6.697266 7.279101
+v  1.873438 -7.125000 6.918750
+v  -1.070312 -4.857422 9.609375
+v  -1.070312 -5.953125 8.750000
+v  -1.070312 -6.697266 7.890625
+v  -1.070312 -7.125000 7.500000
+v  -4.841992 -4.857422 8.864649
+v  -4.504687 -5.953125 8.071875
+v  -4.167383 -6.697266 7.279101
+v  -4.014062 -7.125000 6.918750
+v  -7.892968 -4.857422 6.822656
+v  -7.282812 -5.953125 6.212500
+v  -6.672656 -6.697266 5.602344
+v  -6.395312 -7.125000 5.325000
+v  -9.934961 -4.857422 3.771680
+v  -9.142187 -5.953125 3.434375
+v  -8.349414 -6.697266 3.097070
+v  -7.989062 -7.125000 2.943750
+v  -10.679688 -4.857422 0.000000
+v  -9.820313 -5.953125 0.000000
+v  -8.960938 -6.697266 0.000000
+v  -8.570313 -7.125000 0.000000
+v  -9.934961 -4.857422 -3.771680
+v  -9.142187 -5.953125 -3.434375
+v  -8.349414 -6.697266 -3.097070
+v  -7.989062 -7.125000 -2.943750
+v  -7.892968 -4.857422 -6.822656
+v  -7.282812 -5.953125 -6.212500
+v  -6.672656 -6.697266 -5.602344
+v  -6.395312 -7.125000 -5.325000
+v  -4.841992 -4.857422 -8.864649
+v  -4.504687 -5.953125 -8.071875
+v  -4.167383 -6.697266 -7.279101
+v  -4.014062 -7.125000 -6.918750
+v  -1.070312 -4.857422 -9.609375
+v  -1.070312 -5.953125 -8.750000
+v  -1.070312 -6.697266 -7.890625
+v  -1.070312 -7.125000 -7.500000
+v  2.701367 -4.857422 -8.864649
+v  2.364063 -5.953125 -8.071875
+v  2.026758 -6.697266 -7.279101
+v  1.873438 -7.125000 -6.918750
+v  5.752343 -4.857422 -6.822656
+v  5.142187 -5.953125 -6.212500
+v  4.532031 -6.697266 -5.602344
+v  4.254687 -7.125000 -5.325000
+v  7.794336 -4.857422 -3.771680
+v  7.001562 -5.953125 -3.434375
+v  6.208789 -6.697266 -3.097070
+v  5.848437 -7.125000 -2.943750
+v  6.259766 -7.400391 0.000000
+v  5.351563 -7.640625 0.000000
+v  3.107422 -7.810547 0.000000
+v  -1.070312 -7.875000 0.000000
+v  5.691685 -7.400391 2.877056
+v  4.853868 -7.640625 2.520586
+v  2.783648 -7.810547 1.639761
+v  4.134043 -7.400391 5.204355
+v  3.489219 -7.640625 4.559531
+v  1.895879 -7.810547 2.966191
+v  1.806743 -7.400391 6.761997
+v  1.450274 -7.640625 5.924180
+v  0.569448 -7.810547 3.853960
+v  -1.070312 -7.400391 7.330078
+v  -1.070312 -7.640625 6.421875
+v  -1.070312 -7.810547 4.177734
+v  -3.947368 -7.400391 6.761997
+v  -3.590898 -7.640625 5.924180
+v  -2.710073 -7.810547 3.853960
+v  -6.274668 -7.400391 5.204355
+v  -5.629844 -7.640625 4.559531
+v  -4.036504 -7.810547 2.966191
+v  -7.832309 -7.400391 2.877056
+v  -6.994492 -7.640625 2.520586
+v  -4.924272 -7.810547 1.639761
+v  -8.400391 -7.400391 0.000000
+v  -7.492188 -7.640625 0.000000
+v  -5.248047 -7.810547 0.000000
+v  -7.832309 -7.400391 -2.877056
+v  -6.994492 -7.640625 -2.520586
+v  -4.924272 -7.810547 -1.639761
+v  -6.274668 -7.400391 -5.204355
+v  -5.629844 -7.640625 -4.559531
+v  -4.036504 -7.810547 -2.966191
+v  -3.947368 -7.400391 -6.761997
+v  -3.590898 -7.640625 -5.924180
+v  -2.710073 -7.810547 -3.853960
+v  -1.070312 -7.400391 -7.330078
+v  -1.070312 -7.640625 -6.421875
+v  -1.070312 -7.810547 -4.177734
+v  1.806743 -7.400391 -6.761997
+v  1.450274 -7.640625 -5.924180
+v  0.569448 -7.810547 -3.853960
+v  4.134043 -7.400391 -5.204355
+v  3.489219 -7.640625 -4.559531
+v  1.895879 -7.810547 -2.966191
+v  5.691685 -7.400391 -2.877056
+v  4.853868 -7.640625 -2.520586
+v  2.783648 -7.810547 -1.639761
+v  -9.070313 2.250000 0.000000
+v  -11.406250 2.232422 0.000000
+v  -13.132813 2.109375 0.000000
+v  -14.203125 1.775391 0.000000
+v  -14.570313 1.125000 0.000000
+v  -8.992188 2.425781 0.843750
+v  -11.475830 2.405457 0.843750
+v  -13.298828 2.263184 0.843750
+v  -14.421631 1.877014 0.843750
+v  -14.804688 1.125000 0.843750
+v  -8.820313 2.812500 1.125000
+v  -11.628906 2.786134 1.125000
+v  -13.664063 2.601563 1.125000
+v  -14.902344 2.100586 1.125000
+v  -15.320313 1.125000 1.125000
+v  -8.648438 3.199219 0.843750
+v  -11.781982 3.166809 0.843750
+v  -14.029297 2.939941 0.843750
+v  -15.383057 2.324158 0.843750
+v  -15.835938 1.125000 0.843750
+v  -8.570313 3.375000 0.000000
+v  -11.851563 3.339844 0.000000
+v  -14.195313 3.093750 0.000000
+v  -15.601563 2.425781 0.000000
+v  -16.070313 1.125000 0.000000
+v  -8.648438 3.199219 -0.843750
+v  -11.781982 3.166809 -0.843750
+v  -14.029297 2.939941 -0.843750
+v  -15.383057 2.324158 -0.843750
+v  -15.835938 1.125000 -0.843750
+v  -8.820313 2.812500 -1.125000
+v  -11.628906 2.786134 -1.125000
+v  -13.664063 2.601563 -1.125000
+v  -14.902344 2.100586 -1.125000
+v  -15.320313 1.125000 -1.125000
+v  -8.992188 2.425781 -0.843750
+v  -11.475830 2.405457 -0.843750
+v  -13.298828 2.263184 -0.843750
+v  -14.421631 1.877014 -0.843750
+v  -14.804688 1.125000 -0.843750
+v  -14.375000 0.105469 0.000000
+v  -13.757813 -1.125000 0.000000
+v  -12.671875 -2.355469 0.000000
+v  -11.070313 -3.375000 0.000000
+v  -14.588013 0.007050 0.843750
+v  -13.909180 -1.275146 0.843750
+v  -12.724976 -2.540863 0.843750
+v  -10.992188 -3.609375 0.843750
+v  -15.056641 -0.209473 1.125000
+v  -14.242188 -1.605469 1.125000
+v  -12.841797 -2.948730 1.125000
+v  -10.820313 -4.125000 1.125000
+v  -15.525269 -0.425995 0.843750
+v  -14.575195 -1.935791 0.843750
+v  -12.958618 -3.356598 0.843750
+v  -10.648438 -4.640625 0.843750
+v  -15.738281 -0.524414 0.000000
+v  -14.726563 -2.085938 0.000000
+v  -13.011719 -3.541992 0.000000
+v  -10.570313 -4.875000 0.000000
+v  -15.525269 -0.425995 -0.843750
+v  -14.575195 -1.935791 -0.843750
+v  -12.958618 -3.356598 -0.843750
+v  -10.648438 -4.640625 -0.843750
+v  -15.056641 -0.209473 -1.125000
+v  -14.242188 -1.605469 -1.125000
+v  -12.841797 -2.948730 -1.125000
+v  -10.820313 -4.125000 -1.125000
+v  -14.588013 0.007050 -0.843750
+v  -13.909180 -1.275146 -0.843750
+v  -12.724976 -2.540863 -0.843750
+v  -10.992188 -3.609375 -0.843750
+v  7.429688 -0.750000 0.000000
+v  9.828125 -0.199219 0.000000
+v  10.867188 1.125000 0.000000
+v  11.437500 2.730469 0.000000
+v  12.429688 4.125000 0.000000
+v  7.429688 -1.394531 1.856250
+v  10.011230 -0.677124 1.676074
+v  11.101563 0.846680 1.279688
+v  11.723145 2.629761 0.883301
+v  12.898438 4.125000 0.703125
+v  7.429688 -2.812500 2.475000
+v  10.414063 -1.728516 2.234766
+v  11.617188 0.234375 1.706250
+v  12.351563 2.408203 1.177734
+v  13.929688 4.125000 0.937500
+v  7.429688 -4.230469 1.856250
+v  10.816895 -2.779907 1.676074
+v  12.132813 -0.377930 1.279688
+v  12.979980 2.186646 0.883301
+v  14.960938 4.125000 0.703125
+v  7.429688 -4.875000 0.000000
+v  11.000000 -3.257813 0.000000
+v  12.367188 -0.656250 0.000000
+v  13.265625 2.085938 0.000000
+v  15.429688 4.125000 0.000000
+v  7.429688 -4.230469 -1.856250
+v  10.816895 -2.779907 -1.676074
+v  12.132813 -0.377930 -1.279688
+v  12.979980 2.186646 -0.883301
+v  14.960938 4.125000 -0.703125
+v  7.429688 -2.812500 -2.475000
+v  10.414063 -1.728516 -2.234766
+v  11.617188 0.234375 -1.706250
+v  12.351563 2.408203 -1.177734
+v  13.929688 4.125000 -0.937500
+v  7.429688 -1.394531 -1.856250
+v  10.011230 -0.677124 -1.676074
+v  11.101563 0.846680 -1.279688
+v  11.723145 2.629761 -0.883301
+v  12.898438 4.125000 -0.703125
+v  12.789063 4.335938 0.000000
+v  13.054688 4.406250 0.000000
+v  13.132813 4.335938 0.000000
+v  12.929688 4.125000 0.000000
+v  13.291077 4.346237 0.659180
+v  13.525879 4.422729 0.562500
+v  13.532898 4.350357 0.465820
+v  13.242188 4.125000 0.421875
+v  14.395508 4.368896 0.878906
+v  14.562500 4.458984 0.750000
+v  14.413086 4.382080 0.621094
+v  13.929688 4.125000 0.562500
+v  15.499939 4.391556 0.659180
+v  15.599121 4.495239 0.562500
+v  15.293274 4.413804 0.465820
+v  14.617188 4.125000 0.421875
+v  16.001953 4.401855 0.000000
+v  16.070313 4.511719 0.000000
+v  15.693359 4.428224 0.000000
+v  14.929688 4.125000 0.000000
+v  15.499939 4.391556 -0.659180
+v  15.599121 4.495239 -0.562500
+v  15.293274 4.413804 -0.465820
+v  14.617188 4.125000 -0.421875
+v  14.395508 4.368896 -0.878906
+v  14.562500 4.458984 -0.750000
+v  14.413086 4.382080 -0.621094
+v  13.929688 4.125000 -0.562500
+v  13.291077 4.346237 -0.659180
+v  13.525879 4.422729 -0.562500
+v  13.532898 4.350357 -0.465820
+v  13.242188 4.125000 -0.421875
+v  -1.070312 7.875000 0.000000
+v  0.632813 7.628906 0.000000
+v  0.554688 7.031250 0.000000
+v  -0.085937 6.292969 0.000000
+v  -0.070312 5.625000 0.000000
+v  0.501414 7.628906 0.670256
+v  0.429278 7.031250 0.639395
+v  -0.162029 6.292969 0.386960
+v  -0.147812 5.625000 0.392500
+v  0.140489 7.628906 1.210801
+v  0.084844 7.031250 1.155156
+v  -0.370879 6.292969 0.699434
+v  -0.360312 5.625000 0.710000
+v  -0.400056 7.628906 1.571726
+v  -0.430918 7.031250 1.499590
+v  -0.683352 6.292969 0.908284
+v  -0.677812 5.625000 0.922500
+v  -1.070312 7.628906 1.703125
+v  -1.070312 7.031250 1.625000
+v  -1.070312 6.292969 0.984375
+v  -1.070312 5.625000 1.000000
+v  -1.740569 7.628906 1.571726
+v  -1.709707 7.031250 1.499590
+v  -1.457273 6.292969 0.908284
+v  -1.462812 5.625000 0.922500
+v  -2.281113 7.628906 1.210801
+v  -2.225469 7.031250 1.155156
+v  -1.769746 6.292969 0.699434
+v  -1.780312 5.625000 0.710000
+v  -2.642038 7.628906 0.670256
+v  -2.569902 7.031250 0.639395
+v  -1.978596 6.292969 0.386960
+v  -1.992812 5.625000 0.392500
+v  -2.773438 7.628906 0.000000
+v  -2.695313 7.031250 0.000000
+v  -2.054687 6.292969 0.000000
+v  -2.070312 5.625000 0.000000
+v  -2.642038 7.628906 -0.670256
+v  -2.569902 7.031250 -0.639395
+v  -1.978596 6.292969 -0.386960
+v  -1.992812 5.625000 -0.392500
+v  -2.281113 7.628906 -1.210801
+v  -2.225469 7.031250 -1.155156
+v  -1.769746 6.292969 -0.699434
+v  -1.780312 5.625000 -0.710000
+v  -1.740569 7.628906 -1.571726
+v  -1.709707 7.031250 -1.499590
+v  -1.457273 6.292969 -0.908284
+v  -1.462812 5.625000 -0.922500
+v  -1.070312 7.628906 -1.703125
+v  -1.070312 7.031250 -1.625000
+v  -1.070312 6.292969 -0.984375
+v  -1.070312 5.625000 -1.000000
+v  -0.400056 7.628906 -1.571726
+v  -0.430918 7.031250 -1.499590
+v  -0.683352 6.292969 -0.908284
+v  -0.677812 5.625000 -0.922500
+v  0.140489 7.628906 -1.210801
+v  0.084844 7.031250 -1.155156
+v  -0.370879 6.292969 -0.699434
+v  -0.360312 5.625000 -0.710000
+v  0.501414 7.628906 -0.670256
+v  0.429278 7.031250 -0.639395
+v  -0.162029 6.292969 -0.386960
+v  -0.147812 5.625000 -0.392500
+v  1.210938 5.179688 0.000000
+v  3.054688 4.875000 0.000000
+v  4.710938 4.570313 0.000000
+v  5.429688 4.125000 0.000000
+v  1.034141 5.179688 0.895391
+v  2.735000 4.875000 1.619062
+v  4.262891 4.570313 2.269140
+v  4.925938 4.125000 2.551250
+v  0.549375 5.179688 1.619688
+v  1.858438 4.875000 2.928750
+v  3.034375 4.570313 4.104687
+v  3.544688 4.125000 4.615000
+v  -0.174922 5.179688 2.104453
+v  0.548750 4.875000 3.805313
+v  1.198828 4.570313 5.333203
+v  1.480938 4.125000 5.996250
+v  -1.070312 5.179688 2.281250
+v  -1.070312 4.875000 4.125000
+v  -1.070312 4.570313 5.781250
+v  -1.070312 4.125000 6.500000
+v  -1.965703 5.179688 2.104453
+v  -2.689375 4.875000 3.805313
+v  -3.339453 4.570313 5.333203
+v  -3.621562 4.125000 5.996250
+v  -2.690000 5.179688 1.619688
+v  -3.999062 4.875000 2.928750
+v  -5.174999 4.570313 4.104687
+v  -5.685312 4.125000 4.615000
+v  -3.174765 5.179688 0.895391
+v  -4.875625 4.875000 1.619062
+v  -6.403516 4.570313 2.269140
+v  -7.066563 4.125000 2.551250
+v  -3.351562 5.179688 0.000000
+v  -5.195313 4.875000 0.000000
+v  -6.851563 4.570313 0.000000
+v  -7.570313 4.125000 0.000000
+v  -3.174765 5.179688 -0.895391
+v  -4.875625 4.875000 -1.619062
+v  -6.403516 4.570313 -2.269140
+v  -7.066563 4.125000 -2.551250
+v  -2.690000 5.179688 -1.619688
+v  -3.999062 4.875000 -2.928750
+v  -5.174999 4.570313 -4.104687
+v  -5.685312 4.125000 -4.615000
+v  -1.965703 5.179688 -2.104453
+v  -2.689375 4.875000 -3.805313
+v  -3.339453 4.570313 -5.333203
+v  -3.621562 4.125000 -5.996250
+v  -1.070312 5.179688 -2.281250
+v  -1.070312 4.875000 -4.125000
+v  -1.070312 4.570313 -5.781250
+v  -1.070312 4.125000 -6.500000
+v  -0.174922 5.179688 -2.104453
+v  0.548750 4.875000 -3.805313
+v  1.198828 4.570313 -5.333203
+v  1.480938 4.125000 -5.996250
+v  0.549375 5.179688 -1.619688
+v  1.858438 4.875000 -2.928750
+v  3.034375 4.570313 -4.104687
+v  3.544688 4.125000 -4.615000
+v  1.034141 5.179688 -0.895391
+v  2.735000 4.875000 -1.619062
+v  4.262891 4.570313 -2.269140
+v  4.925938 4.125000 -2.551250
+# 530 vertices
+
+vt  2.000000 2.000000 0.000000
+vt  2.000000 1.975000 0.000000
+vt  2.000000 1.950000 0.000000
+vt  2.000000 1.925000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  1.750000 2.000000 0.000000
+vt  1.750000 1.975000 0.000000
+vt  1.750000 1.950000 0.000000
+vt  1.750000 1.925000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.500000 2.000000 0.000000
+vt  1.500000 1.975000 0.000000
+vt  1.500000 1.950000 0.000000
+vt  1.500000 1.925000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.250000 2.000000 0.000000
+vt  1.250000 1.975000 0.000000
+vt  1.250000 1.950000 0.000000
+vt  1.250000 1.925000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  0.750000 2.000000 0.000000
+vt  0.750000 1.975000 0.000000
+vt  0.750000 1.950000 0.000000
+vt  0.750000 1.925000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.500000 2.000000 0.000000
+vt  0.500000 1.975000 0.000000
+vt  0.500000 1.950000 0.000000
+vt  0.500000 1.925000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.250000 2.000000 0.000000
+vt  0.250000 1.975000 0.000000
+vt  0.250000 1.950000 0.000000
+vt  0.250000 1.925000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.000000 2.000000 0.000000
+vt  0.000000 1.975000 0.000000
+vt  0.000000 1.950000 0.000000
+vt  0.000000 1.925000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  2.000000 2.000000 0.000000
+vt  2.000000 1.975000 0.000000
+vt  2.000000 1.950000 0.000000
+vt  2.000000 1.925000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  1.750000 2.000000 0.000000
+vt  1.750000 1.975000 0.000000
+vt  1.750000 1.950000 0.000000
+vt  1.750000 1.925000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.500000 2.000000 0.000000
+vt  1.500000 1.975000 0.000000
+vt  1.500000 1.950000 0.000000
+vt  1.500000 1.925000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.250000 2.000000 0.000000
+vt  1.250000 1.975000 0.000000
+vt  1.250000 1.950000 0.000000
+vt  1.250000 1.925000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 2.000000 0.000000
+vt  1.000000 1.975000 0.000000
+vt  1.000000 1.950000 0.000000
+vt  1.000000 1.925000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  0.750000 2.000000 0.000000
+vt  0.750000 1.975000 0.000000
+vt  0.750000 1.950000 0.000000
+vt  0.750000 1.925000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.500000 2.000000 0.000000
+vt  0.500000 1.975000 0.000000
+vt  0.500000 1.950000 0.000000
+vt  0.500000 1.925000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.250000 2.000000 0.000000
+vt  0.250000 1.975000 0.000000
+vt  0.250000 1.950000 0.000000
+vt  0.250000 1.925000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.000000 2.000000 0.000000
+vt  0.000000 1.975000 0.000000
+vt  0.000000 1.950000 0.000000
+vt  0.000000 1.925000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  2.000000 1.675000 0.000000
+vt  2.000000 1.450000 0.000000
+vt  2.000000 1.225000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.750000 1.675000 0.000000
+vt  1.750000 1.450000 0.000000
+vt  1.750000 1.225000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.500000 1.675000 0.000000
+vt  1.500000 1.450000 0.000000
+vt  1.500000 1.225000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.250000 1.675000 0.000000
+vt  1.250000 1.450000 0.000000
+vt  1.250000 1.225000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.750000 1.675000 0.000000
+vt  0.750000 1.450000 0.000000
+vt  0.750000 1.225000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.500000 1.675000 0.000000
+vt  0.500000 1.450000 0.000000
+vt  0.500000 1.225000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.250000 1.675000 0.000000
+vt  0.250000 1.450000 0.000000
+vt  0.250000 1.225000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  0.000000 1.675000 0.000000
+vt  0.000000 1.450000 0.000000
+vt  0.000000 1.225000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  2.000000 1.900000 0.000000
+vt  2.000000 1.675000 0.000000
+vt  2.000000 1.450000 0.000000
+vt  2.000000 1.225000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  1.750000 1.900000 0.000000
+vt  1.750000 1.675000 0.000000
+vt  1.750000 1.450000 0.000000
+vt  1.750000 1.225000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.500000 1.900000 0.000000
+vt  1.500000 1.675000 0.000000
+vt  1.500000 1.450000 0.000000
+vt  1.500000 1.225000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.250000 1.900000 0.000000
+vt  1.250000 1.675000 0.000000
+vt  1.250000 1.450000 0.000000
+vt  1.250000 1.225000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 1.900000 0.000000
+vt  1.000000 1.675000 0.000000
+vt  1.000000 1.450000 0.000000
+vt  1.000000 1.225000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.750000 1.900000 0.000000
+vt  0.750000 1.675000 0.000000
+vt  0.750000 1.450000 0.000000
+vt  0.750000 1.225000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.500000 1.900000 0.000000
+vt  0.500000 1.675000 0.000000
+vt  0.500000 1.450000 0.000000
+vt  0.500000 1.225000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.250000 1.900000 0.000000
+vt  0.250000 1.675000 0.000000
+vt  0.250000 1.450000 0.000000
+vt  0.250000 1.225000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.000000 1.900000 0.000000
+vt  0.000000 1.675000 0.000000
+vt  0.000000 1.450000 0.000000
+vt  0.000000 1.225000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  2.000000 0.850000 0.000000
+vt  2.000000 0.700000 0.000000
+vt  2.000000 0.550000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.750000 0.850000 0.000000
+vt  1.750000 0.700000 0.000000
+vt  1.750000 0.550000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.500000 0.850000 0.000000
+vt  1.500000 0.700000 0.000000
+vt  1.500000 0.550000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.250000 0.850000 0.000000
+vt  1.250000 0.700000 0.000000
+vt  1.250000 0.550000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.850000 0.000000
+vt  0.750000 0.700000 0.000000
+vt  0.750000 0.550000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.850000 0.000000
+vt  0.500000 0.700000 0.000000
+vt  0.500000 0.550000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.850000 0.000000
+vt  0.250000 0.700000 0.000000
+vt  0.250000 0.550000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.850000 0.000000
+vt  0.000000 0.700000 0.000000
+vt  0.000000 0.550000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  2.000000 1.000000 0.000000
+vt  2.000000 0.850000 0.000000
+vt  2.000000 0.700000 0.000000
+vt  2.000000 0.550000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  1.750000 1.000000 0.000000
+vt  1.750000 0.850000 0.000000
+vt  1.750000 0.700000 0.000000
+vt  1.750000 0.550000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.500000 1.000000 0.000000
+vt  1.500000 0.850000 0.000000
+vt  1.500000 0.700000 0.000000
+vt  1.500000 0.550000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.250000 1.000000 0.000000
+vt  1.250000 0.850000 0.000000
+vt  1.250000 0.700000 0.000000
+vt  1.250000 0.550000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.850000 0.000000
+vt  1.000000 0.700000 0.000000
+vt  1.000000 0.550000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.850000 0.000000
+vt  0.750000 0.700000 0.000000
+vt  0.750000 0.550000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.850000 0.000000
+vt  0.500000 0.700000 0.000000
+vt  0.500000 0.550000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.850000 0.000000
+vt  0.250000 0.700000 0.000000
+vt  0.250000 0.550000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.850000 0.000000
+vt  0.000000 0.700000 0.000000
+vt  0.000000 0.550000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  2.000000 0.300000 0.000000
+vt  2.000000 0.200000 0.000000
+vt  2.000000 0.100000 0.000000
+vt  2.000000 0.000000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.750000 0.300000 0.000000
+vt  1.750000 0.200000 0.000000
+vt  1.750000 0.100000 0.000000
+vt  1.750000 0.000000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.500000 0.300000 0.000000
+vt  1.500000 0.200000 0.000000
+vt  1.500000 0.100000 0.000000
+vt  1.500000 0.000000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.250000 0.300000 0.000000
+vt  1.250000 0.200000 0.000000
+vt  1.250000 0.100000 0.000000
+vt  1.250000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.750000 0.300000 0.000000
+vt  0.750000 0.200000 0.000000
+vt  0.750000 0.100000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.500000 0.300000 0.000000
+vt  0.500000 0.200000 0.000000
+vt  0.500000 0.100000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.250000 0.300000 0.000000
+vt  0.250000 0.200000 0.000000
+vt  0.250000 0.100000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  0.000000 0.300000 0.000000
+vt  0.000000 0.200000 0.000000
+vt  0.000000 0.100000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  2.000000 0.400000 0.000000
+vt  2.000000 0.300000 0.000000
+vt  2.000000 0.200000 0.000000
+vt  2.000000 0.100000 0.000000
+vt  2.000000 0.000000 0.000000
+vt  1.750000 0.400000 0.000000
+vt  1.750000 0.300000 0.000000
+vt  1.750000 0.200000 0.000000
+vt  1.750000 0.100000 0.000000
+vt  1.750000 0.000000 0.000000
+vt  1.500000 0.400000 0.000000
+vt  1.500000 0.300000 0.000000
+vt  1.500000 0.200000 0.000000
+vt  1.500000 0.100000 0.000000
+vt  1.500000 0.000000 0.000000
+vt  1.250000 0.400000 0.000000
+vt  1.250000 0.300000 0.000000
+vt  1.250000 0.200000 0.000000
+vt  1.250000 0.100000 0.000000
+vt  1.250000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.400000 0.000000
+vt  1.000000 0.300000 0.000000
+vt  1.000000 0.200000 0.000000
+vt  1.000000 0.100000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.750000 0.400000 0.000000
+vt  0.750000 0.300000 0.000000
+vt  0.750000 0.200000 0.000000
+vt  0.750000 0.100000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.500000 0.400000 0.000000
+vt  0.500000 0.300000 0.000000
+vt  0.500000 0.200000 0.000000
+vt  0.500000 0.100000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.250000 0.400000 0.000000
+vt  0.250000 0.300000 0.000000
+vt  0.250000 0.200000 0.000000
+vt  0.250000 0.100000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.000000 0.400000 0.000000
+vt  0.000000 0.300000 0.000000
+vt  0.000000 0.200000 0.000000
+vt  0.000000 0.100000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.875000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.625000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.875000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.625000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.875000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.625000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.875000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.625000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.875000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.625000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.875000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.625000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.875000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.625000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.875000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.625000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.875000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.625000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.875000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.625000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.375000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.125000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.375000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.125000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.375000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.125000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.375000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.125000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.375000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.125000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.375000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.125000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.375000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.125000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.375000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.125000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.375000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.125000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.375000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.125000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.225000 0.000000
+vt  0.500000 0.450000 0.000000
+vt  0.500000 0.675000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.625000 0.225000 0.000000
+vt  0.625000 0.450000 0.000000
+vt  0.625000 0.675000 0.000000
+vt  0.625000 0.900000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.750000 0.225000 0.000000
+vt  0.750000 0.450000 0.000000
+vt  0.750000 0.675000 0.000000
+vt  0.750000 0.900000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.875000 0.225000 0.000000
+vt  0.875000 0.450000 0.000000
+vt  0.875000 0.675000 0.000000
+vt  0.875000 0.900000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  1.000000 0.225000 0.000000
+vt  1.000000 0.450000 0.000000
+vt  1.000000 0.675000 0.000000
+vt  1.000000 0.900000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  0.000000 0.225000 0.000000
+vt  0.000000 0.450000 0.000000
+vt  0.000000 0.675000 0.000000
+vt  0.000000 0.900000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.125000 0.225000 0.000000
+vt  0.125000 0.450000 0.000000
+vt  0.125000 0.675000 0.000000
+vt  0.125000 0.900000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.250000 0.225000 0.000000
+vt  0.250000 0.450000 0.000000
+vt  0.250000 0.675000 0.000000
+vt  0.250000 0.900000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.375000 0.225000 0.000000
+vt  0.375000 0.450000 0.000000
+vt  0.375000 0.675000 0.000000
+vt  0.375000 0.900000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 0.225000 0.000000
+vt  0.500000 0.450000 0.000000
+vt  0.500000 0.675000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.925000 0.000000
+vt  0.500000 0.950000 0.000000
+vt  0.500000 0.975000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.625000 0.900000 0.000000
+vt  0.625000 0.925000 0.000000
+vt  0.625000 0.950000 0.000000
+vt  0.625000 0.975000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.750000 0.900000 0.000000
+vt  0.750000 0.925000 0.000000
+vt  0.750000 0.950000 0.000000
+vt  0.750000 0.975000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.875000 0.900000 0.000000
+vt  0.875000 0.925000 0.000000
+vt  0.875000 0.950000 0.000000
+vt  0.875000 0.975000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  1.000000 0.900000 0.000000
+vt  1.000000 0.925000 0.000000
+vt  1.000000 0.950000 0.000000
+vt  1.000000 0.975000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  0.000000 0.900000 0.000000
+vt  0.000000 0.925000 0.000000
+vt  0.000000 0.950000 0.000000
+vt  0.000000 0.975000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.125000 0.900000 0.000000
+vt  0.125000 0.925000 0.000000
+vt  0.125000 0.950000 0.000000
+vt  0.125000 0.975000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.250000 0.900000 0.000000
+vt  0.250000 0.925000 0.000000
+vt  0.250000 0.950000 0.000000
+vt  0.250000 0.975000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.375000 0.900000 0.000000
+vt  0.375000 0.925000 0.000000
+vt  0.375000 0.950000 0.000000
+vt  0.375000 0.975000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.500000 0.900000 0.000000
+vt  0.500000 0.925000 0.000000
+vt  0.500000 0.950000 0.000000
+vt  0.500000 0.975000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+vt  1.000000 1.000000 0.000000
+vt  1.000000 0.750000 0.000000
+vt  1.000000 0.500000 0.000000
+vt  1.000000 0.250000 0.000000
+vt  1.000000 0.000000 0.000000
+vt  0.875000 1.000000 0.000000
+vt  0.875000 0.750000 0.000000
+vt  0.875000 0.500000 0.000000
+vt  0.875000 0.250000 0.000000
+vt  0.875000 0.000000 0.000000
+vt  0.750000 1.000000 0.000000
+vt  0.750000 0.750000 0.000000
+vt  0.750000 0.500000 0.000000
+vt  0.750000 0.250000 0.000000
+vt  0.750000 0.000000 0.000000
+vt  0.625000 1.000000 0.000000
+vt  0.625000 0.750000 0.000000
+vt  0.625000 0.500000 0.000000
+vt  0.625000 0.250000 0.000000
+vt  0.625000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.500000 1.000000 0.000000
+vt  0.500000 0.750000 0.000000
+vt  0.500000 0.500000 0.000000
+vt  0.500000 0.250000 0.000000
+vt  0.500000 0.000000 0.000000
+vt  0.375000 1.000000 0.000000
+vt  0.375000 0.750000 0.000000
+vt  0.375000 0.500000 0.000000
+vt  0.375000 0.250000 0.000000
+vt  0.375000 0.000000 0.000000
+vt  0.250000 1.000000 0.000000
+vt  0.250000 0.750000 0.000000
+vt  0.250000 0.500000 0.000000
+vt  0.250000 0.250000 0.000000
+vt  0.250000 0.000000 0.000000
+vt  0.125000 1.000000 0.000000
+vt  0.125000 0.750000 0.000000
+vt  0.125000 0.500000 0.000000
+vt  0.125000 0.250000 0.000000
+vt  0.125000 0.000000 0.000000
+vt  0.000000 1.000000 0.000000
+vt  0.000000 0.750000 0.000000
+vt  0.000000 0.500000 0.000000
+vt  0.000000 0.250000 0.000000
+vt  0.000000 0.000000 0.000000
+# 800 texture vertices
+
+vn  -0.966742 -0.255752 0.000000
+vn  -0.966824 0.255443 0.000000
+vn  -0.092052 0.995754 0.000000
+vn  0.682050 0.731305 0.000000
+vn  0.870301 0.492521 0.000000
+vn  -0.893014 -0.256345 -0.369882
+vn  -0.893437 0.255996 -0.369102
+vn  -0.083877 0.995843 -0.035507
+vn  0.629724 0.731860 0.260439
+vn  0.803725 0.493370 0.332584
+vn  -0.683407 -0.256728 -0.683407
+vn  -0.683531 0.256068 -0.683531
+vn  -0.064925 0.995776 -0.064925
+vn  0.481399 0.732469 0.481399
+vn  0.614804 0.493997 0.614804
+vn  -0.369882 -0.256345 -0.893014
+vn  -0.369102 0.255996 -0.893437
+vn  -0.035507 0.995843 -0.083877
+vn  0.260439 0.731860 0.629724
+vn  0.332584 0.493369 0.803725
+vn  -0.002848 -0.257863 -0.966177
+vn  -0.001923 0.254736 -0.967009
+vn  -0.000266 0.995734 -0.092270
+vn  0.000024 0.731295 0.682061
+vn  -0.000000 0.492521 0.870301
+vn  0.379058 -0.359300 -0.852771
+vn  0.377110 0.149085 -0.914091
+vn  0.027502 0.992081 -0.122552
+vn  -0.261010 0.726762 0.635367
+vn  -0.332485 0.492546 0.804271
+vn  0.663548 -0.410790 -0.625264
+vn  0.712664 0.073722 -0.697621
+vn  0.099726 0.987509 -0.121983
+vn  -0.487320 0.723754 0.488569
+vn  -0.615242 0.492602 0.615484
+vn  0.880028 -0.332906 -0.338709
+vn  0.917276 0.167113 -0.361493
+vn  0.113584 0.992365 -0.048070
+vn  -0.634150 0.727508 0.261889
+vn  -0.804126 0.492634 0.332705
+vn  0.966690 -0.255738 0.010454
+vn  0.967442 0.252962 0.008103
+vn  0.093436 0.995624 0.001281
+vn  -0.682167 0.731196 -0.000343
+vn  -0.870322 0.492483 -0.000054
+vn  0.893014 -0.256345 0.369882
+vn  0.893437 0.255996 0.369102
+vn  0.083877 0.995843 0.035507
+vn  -0.629724 0.731860 -0.260439
+vn  -0.803725 0.493370 -0.332584
+vn  0.683407 -0.256728 0.683407
+vn  0.683531 0.256068 0.683531
+vn  0.064925 0.995776 0.064925
+vn  -0.481399 0.732469 -0.481399
+vn  -0.614804 0.493997 -0.614804
+vn  0.369882 -0.256345 0.893014
+vn  0.369102 0.255996 0.893437
+vn  0.035507 0.995843 0.083877
+vn  -0.260439 0.731860 -0.629724
+vn  -0.332584 0.493369 -0.803725
+vn  0.000000 -0.255752 0.966742
+vn  0.000000 0.255443 0.966824
+vn  0.000000 0.995754 0.092052
+vn  0.000000 0.731305 -0.682050
+vn  0.000000 0.492521 -0.870301
+vn  -0.369882 -0.256345 0.893014
+vn  -0.369102 0.255996 0.893437
+vn  -0.035507 0.995843 0.083877
+vn  0.260439 0.731860 -0.629724
+vn  0.332584 0.493370 -0.803725
+vn  -0.683407 -0.256728 0.683407
+vn  -0.683531 0.256068 0.683531
+vn  -0.064925 0.995776 0.064925
+vn  0.481399 0.732469 -0.481399
+vn  0.614804 0.493997 -0.614804
+vn  -0.893014 -0.256345 0.369882
+vn  -0.893437 0.255996 0.369102
+vn  -0.083877 0.995843 0.035507
+vn  0.629724 0.731860 -0.260439
+vn  0.803725 0.493369 -0.332584
+vn  0.915321 0.402725 -0.000000
+vn  0.941808 0.336151 0.000000
+vn  0.978690 0.205342 0.000000
+vn  0.997804 -0.066240 -0.000000
+vn  0.845438 0.403546 0.349835
+vn  0.869996 0.336859 0.360047
+vn  0.904193 0.205791 0.374280
+vn  0.921879 -0.066370 0.381752
+vn  0.646802 0.404096 0.646802
+vn  0.665655 0.337351 0.665655
+vn  0.691923 0.206120 0.691923
+vn  0.705543 -0.066480 0.705542
+vn  0.349835 0.403546 0.845438
+vn  0.360047 0.336859 0.869996
+vn  0.374280 0.205791 0.904193
+vn  0.381752 -0.066369 0.921879
+vn  0.000000 0.402725 0.915321
+vn  -0.000000 0.336151 0.941808
+vn  0.000000 0.205342 0.978690
+vn  0.000000 -0.066240 0.997804
+vn  -0.349835 0.403546 0.845438
+vn  -0.360047 0.336859 0.869996
+vn  -0.374280 0.205791 0.904193
+vn  -0.381752 -0.066370 0.921879
+vn  -0.646802 0.404096 0.646802
+vn  -0.665655 0.337351 0.665655
+vn  -0.691923 0.206120 0.691923
+vn  -0.705542 -0.066480 0.705543
+vn  -0.845438 0.403546 0.349835
+vn  -0.869996 0.336859 0.360047
+vn  -0.904193 0.205791 0.374280
+vn  -0.921879 -0.066369 0.381752
+vn  -0.915321 0.402725 0.000000
+vn  -0.941808 0.336151 -0.000000
+vn  -0.978690 0.205342 0.000000
+vn  -0.997804 -0.066240 0.000000
+vn  -0.845438 0.403546 -0.349835
+vn  -0.869996 0.336859 -0.360047
+vn  -0.904193 0.205791 -0.374280
+vn  -0.921879 -0.066370 -0.381752
+vn  -0.646802 0.404096 -0.646802
+vn  -0.665655 0.337351 -0.665655
+vn  -0.691923 0.206120 -0.691923
+vn  -0.705543 -0.066480 -0.705542
+vn  -0.349835 0.403546 -0.845438
+vn  -0.360047 0.336859 -0.869996
+vn  -0.374280 0.205791 -0.904193
+vn  -0.381752 -0.066369 -0.921879
+vn  -0.000000 0.402725 -0.915321
+vn  0.000000 0.336151 -0.941808
+vn  -0.000000 0.205342 -0.978690
+vn  -0.000000 -0.066240 -0.997804
+vn  0.349835 0.403546 -0.845438
+vn  0.360047 0.336859 -0.869996
+vn  0.374280 0.205791 -0.904193
+vn  0.381752 -0.066370 -0.921879
+vn  0.646802 0.404096 -0.646802
+vn  0.665655 0.337351 -0.665655
+vn  0.691923 0.206120 -0.691923
+vn  0.705542 -0.066480 -0.705543
+vn  0.845438 0.403546 -0.349835
+vn  0.869996 0.336859 -0.360047
+vn  0.904193 0.205791 -0.374280
+vn  0.921879 -0.066369 -0.381752
+vn  0.900182 -0.435513 0.000000
+vn  0.729611 -0.683863 0.000000
+vn  0.693951 -0.720022 -0.000000
+vn  0.793950 -0.607983 0.000000
+vn  0.831437 -0.436180 0.344179
+vn  0.673512 -0.684666 0.278594
+vn  0.640399 -0.720924 0.264874
+vn  0.732949 -0.608995 0.303167
+vn  0.636092 -0.436778 0.636092
+vn  0.514965 -0.685290 0.514965
+vn  0.489651 -0.721446 0.489651
+vn  0.560555 -0.609554 0.560555
+vn  0.344179 -0.436180 0.831437
+vn  0.278595 -0.684666 0.673512
+vn  0.264874 -0.720924 0.640399
+vn  0.303167 -0.608995 0.732949
+vn  -0.000000 -0.435513 0.900182
+vn  -0.000000 -0.683863 0.729611
+vn  0.000000 -0.720022 0.693951
+vn  -0.000000 -0.607983 0.793950
+vn  -0.344179 -0.436180 0.831437
+vn  -0.278594 -0.684666 0.673512
+vn  -0.264874 -0.720924 0.640399
+vn  -0.303167 -0.608995 0.732949
+vn  -0.636092 -0.436778 0.636092
+vn  -0.514965 -0.685290 0.514965
+vn  -0.489651 -0.721446 0.489651
+vn  -0.560555 -0.609554 0.560555
+vn  -0.831437 -0.436180 0.344179
+vn  -0.673512 -0.684666 0.278595
+vn  -0.640399 -0.720924 0.264874
+vn  -0.732949 -0.608995 0.303167
+vn  -0.900182 -0.435513 -0.000000
+vn  -0.729611 -0.683863 -0.000000
+vn  -0.693951 -0.720022 0.000000
+vn  -0.793950 -0.607983 -0.000000
+vn  -0.831437 -0.436180 -0.344179
+vn  -0.673512 -0.684666 -0.278594
+vn  -0.640399 -0.720924 -0.264874
+vn  -0.732949 -0.608995 -0.303167
+vn  -0.636092 -0.436778 -0.636092
+vn  -0.514965 -0.685290 -0.514965
+vn  -0.489651 -0.721446 -0.489651
+vn  -0.560555 -0.609554 -0.560555
+vn  -0.344179 -0.436180 -0.831437
+vn  -0.278595 -0.684666 -0.673512
+vn  -0.264874 -0.720924 -0.640399
+vn  -0.303167 -0.608995 -0.732949
+vn  0.000000 -0.435513 -0.900182
+vn  0.000000 -0.683863 -0.729611
+vn  -0.000000 -0.720022 -0.693951
+vn  0.000000 -0.607983 -0.793950
+vn  0.344179 -0.436180 -0.831437
+vn  0.278594 -0.684666 -0.673512
+vn  0.264874 -0.720924 -0.640399
+vn  0.303167 -0.608995 -0.732949
+vn  0.636092 -0.436778 -0.636092
+vn  0.514965 -0.685290 -0.514965
+vn  0.489651 -0.721446 -0.489651
+vn  0.560555 -0.609554 -0.560555
+vn  0.831437 -0.436180 -0.344179
+vn  0.673512 -0.684666 -0.278595
+vn  0.640399 -0.720924 -0.264874
+vn  0.732949 -0.608995 -0.303167
+vn  0.623860 -0.781536 0.000000
+vn  0.177291 -0.984159 -0.000000
+vn  0.049207 -0.998789 0.000000
+vn  0.000000 -1.000000 0.000000
+vn  0.576230 -0.781801 0.238217
+vn  0.163628 -0.984208 0.067527
+vn  0.045422 -0.998792 0.018736
+vn  0.440416 -0.782348 0.440416
+vn  0.124903 -0.984276 0.124903
+vn  0.034662 -0.998798 0.034662
+vn  0.238217 -0.781801 0.576230
+vn  0.067527 -0.984208 0.163628
+vn  0.018736 -0.998792 0.045422
+vn  -0.000000 -0.781536 0.623860
+vn  0.000000 -0.984159 0.177291
+vn  -0.000000 -0.998789 0.049207
+vn  -0.238217 -0.781801 0.576230
+vn  -0.067527 -0.984208 0.163628
+vn  -0.018736 -0.998792 0.045422
+vn  -0.440416 -0.782348 0.440416
+vn  -0.124903 -0.984276 0.124903
+vn  -0.034662 -0.998798 0.034662
+vn  -0.576230 -0.781801 0.238217
+vn  -0.163628 -0.984208 0.067527
+vn  -0.045422 -0.998792 0.018736
+vn  -0.623860 -0.781536 -0.000000
+vn  -0.177291 -0.984159 0.000000
+vn  -0.049207 -0.998789 -0.000000
+vn  -0.576230 -0.781801 -0.238217
+vn  -0.163628 -0.984208 -0.067527
+vn  -0.045422 -0.998792 -0.018736
+vn  -0.440416 -0.782348 -0.440416
+vn  -0.124903 -0.984276 -0.124903
+vn  -0.034662 -0.998798 -0.034662
+vn  -0.238217 -0.781801 -0.576230
+vn  -0.067527 -0.984208 -0.163628
+vn  -0.018736 -0.998792 -0.045422
+vn  0.000000 -0.781536 -0.623860
+vn  -0.000000 -0.984159 -0.177291
+vn  0.000000 -0.998789 -0.049207
+vn  0.238217 -0.781801 -0.576230
+vn  0.067527 -0.984208 -0.163628
+vn  0.018736 -0.998792 -0.045422
+vn  0.440416 -0.782348 -0.440416
+vn  0.124903 -0.984276 -0.124903
+vn  0.034662 -0.998798 -0.034662
+vn  0.576230 -0.781801 -0.238217
+vn  0.163628 -0.984208 -0.067527
+vn  0.045422 -0.998792 -0.018736
+vn  0.007786 -0.999970 -0.000216
+vn  0.039138 -0.999233 -0.000989
+vn  0.179512 -0.983746 -0.004369
+vn  0.612299 -0.790557 -0.010460
+vn  0.986152 -0.165708 -0.006670
+vn  0.007039 -0.812495 0.582926
+vn  0.036127 -0.837257 0.545614
+vn  0.161846 -0.810421 0.563048
+vn  0.482365 -0.595148 0.642746
+vn  0.738720 -0.114594 0.664199
+vn  -0.001909 0.162121 0.986769
+vn  0.002762 0.017107 0.999850
+vn  0.010533 0.073398 0.997247
+vn  -0.066041 0.130070 0.989303
+vn  -0.094427 0.016594 0.995393
+vn  -0.009203 0.871509 0.490293
+vn  -0.048606 0.840609 0.539457
+vn  -0.223298 0.802880 0.552739
+vn  -0.596365 0.559971 0.575135
+vn  -0.803337 0.068236 0.591603
+vn  -0.010561 0.999944 0.000103
+vn  -0.058798 0.998270 0.000710
+vn  -0.280710 0.959787 0.003269
+vn  -0.749723 0.661738 0.004268
+vn  -0.997351 0.072714 0.002059
+vn  -0.008792 0.871493 -0.490330
+vn  -0.046494 0.841178 -0.538756
+vn  -0.217909 0.806807 -0.549161
+vn  -0.597291 0.560026 -0.574121
+vn  -0.804000 0.062913 -0.591292
+vn  -0.001806 0.161691 -0.986840
+vn  0.002031 0.014555 -0.999892
+vn  0.009215 0.060069 -0.998152
+vn  -0.059334 0.113865 -0.991723
+vn  -0.086899 0.012290 -0.996141
+vn  0.006418 -0.812379 -0.583095
+vn  0.033783 -0.837512 -0.545373
+vn  0.157113 -0.811947 -0.562190
+vn  0.484406 -0.589366 -0.646528
+vn  0.738870 -0.101320 -0.666187
+vn  0.946512 0.322650 -0.003357
+vn  0.825830 0.563870 -0.007452
+vn  0.650011 0.759893 -0.006937
+vn  0.532429 0.846459 -0.005245
+vn  0.725608 0.259351 0.637361
+vn  0.645945 0.461988 0.607719
+vn  0.531615 0.636660 0.558614
+vn  0.424964 0.681717 0.595540
+vn  -0.049562 -0.019755 0.998576
+vn  -0.037816 -0.035624 0.998650
+vn  -0.037914 -0.036512 0.998614
+vn  -0.168854 -0.297945 0.939530
+vn  -0.742342 -0.299166 0.599523
+vn  -0.619602 -0.529406 0.579502
+vn  -0.483708 -0.685760 0.543837
+vn  -0.445293 -0.794355 0.413177
+vn  -0.926513 -0.376258 0.001996
+vn  -0.753920 -0.656952 0.004317
+vn  -0.566224 -0.824244 0.003461
+vn  -0.481804 -0.876277 0.001850
+vn  -0.744675 -0.294425 -0.598977
+vn  -0.621949 -0.528114 -0.578165
+vn  -0.481171 -0.688340 -0.542828
+vn  -0.438055 -0.797035 -0.415744
+vn  -0.044337 -0.017056 -0.998871
+vn  -0.026176 -0.028166 -0.999260
+vn  -0.025294 -0.028332 -0.999278
+vn  -0.157482 -0.289392 -0.944167
+vn  0.728244 0.252410 -0.637142
+vn  0.647055 0.459725 -0.608254
+vn  0.522994 0.640657 -0.562170
+vn  0.409978 0.682857 -0.604669
+vn  -0.230787 0.972982 -0.006523
+vn  -0.548936 0.835863 -0.001511
+vn  -0.875671 0.482806 0.009893
+vn  -0.877554 0.479097 0.019092
+vn  -0.696190 0.717439 0.024497
+vn  -0.152877 0.687211 0.710190
+vn  -0.316721 0.637750 0.702113
+vn  -0.601067 0.471452 0.645330
+vn  -0.635889 0.446090 0.629801
+vn  -0.435746 0.601008 0.670011
+vn  0.111113 -0.085070 0.990160
+vn  0.223310 0.006540 0.974726
+vn  0.190097 0.154964 0.969458
+vn  0.005271 0.189482 0.981870
+vn  -0.011752 0.246688 0.969024
+vn  0.343906 -0.722796 0.599412
+vn  0.572489 -0.567656 0.591627
+vn  0.787436 -0.256459 0.560512
+vn  0.647097 -0.306374 0.698141
+vn  0.427528 -0.499343 0.753576
+vn  0.410926 -0.911668 0.001284
+vn  0.671520 -0.740986 -0.000899
+vn  0.922026 -0.387060 -0.007253
+vn  0.846910 -0.531556 -0.013854
+vn  0.535924 -0.844201 -0.010505
+vn  0.341188 -0.722823 -0.600931
+vn  0.578664 -0.561139 -0.591838
+vn  0.784869 -0.251020 -0.566542
+vn  0.642681 -0.302257 -0.703990
+vn  0.418589 -0.500042 -0.758117
+vn  0.115806 -0.079139 -0.990114
+vn  0.232811 0.012565 -0.972441
+vn  0.206662 0.153601 -0.966280
+vn  0.024500 0.161443 -0.986578
+vn  0.003382 0.211115 -0.977455
+vn  -0.134912 0.687491 -0.713551
+vn  -0.319540 0.633073 -0.705063
+vn  -0.603902 0.461442 -0.649903
+vn  -0.631815 0.437169 -0.640072
+vn  -0.424306 0.612706 -0.666750
+vn  -0.425801 0.904753 0.010805
+vn  0.022046 0.999756 0.001623
+vn  0.999598 0.025875 0.011556
+vn  0.709587 -0.704552 0.009672
+vn  -0.259858 0.791937 0.552548
+vn  0.009539 0.999720 -0.021674
+vn  0.410157 0.332912 -0.849082
+vn  0.541523 -0.548619 -0.637001
+vn  0.046311 0.455223 0.889172
+vn  -0.010688 0.988794 0.148900
+vn  -0.044376 0.682946 -0.729120
+vn  0.122824 0.009233 -0.992385
+vn  0.481839 -0.180440 0.857480
+vn  0.455272 0.736752 0.499925
+vn  -0.220542 0.907193 -0.358277
+vn  -0.235919 0.657250 -0.715797
+vn  0.728094 -0.685300 -0.015585
+vn  0.888738 0.458112 -0.016679
+vn  -0.260098 0.965582 0.000800
+vn  -0.371611 0.928378 -0.004418
+vn  0.480165 -0.178362 -0.858853
+vn  0.488102 0.716802 -0.497947
+vn  -0.222004 0.905399 0.361892
+vn  -0.235405 0.663180 0.710477
+vn  0.058720 0.437702 -0.897200
+vn  0.001326 0.986459 -0.164002
+vn  -0.044190 0.681675 0.730319
+vn  0.138801 -0.034188 0.989730
+vn  -0.258890 0.797206 -0.545380
+vn  0.012270 0.999739 0.019287
+vn  0.398632 0.354890 0.845663
+vn  0.537564 -0.581398 0.610738
+vn  0.000000 1.000000 0.000000
+vn  0.824540 0.565804 0.000017
+vn  0.917701 -0.397272 0.000034
+vn  0.935269 -0.353939 0.000113
+vn  0.780712 0.624890 0.000075
+vn  0.762640 0.565035 0.314825
+vn  0.847982 -0.397998 0.350034
+vn  0.864141 -0.355261 0.356441
+vn  0.720992 0.625625 0.297933
+vn  0.583357 0.565165 0.583338
+vn  0.648485 -0.398726 0.648448
+vn  0.660872 -0.355894 0.660748
+vn  0.551862 0.625290 0.551780
+vn  0.314824 0.565051 0.762629
+vn  0.350045 -0.397976 0.847988
+vn  0.356474 -0.355199 0.864153
+vn  0.297983 0.625515 0.721067
+vn  -0.000017 0.565804 0.824540
+vn  -0.000034 -0.397272 0.917701
+vn  -0.000113 -0.353939 0.935269
+vn  -0.000075 0.624890 0.780712
+vn  -0.314825 0.565035 0.762640
+vn  -0.350034 -0.397998 0.847982
+vn  -0.356441 -0.355261 0.864141
+vn  -0.297933 0.625625 0.720992
+vn  -0.583338 0.565165 0.583357
+vn  -0.648448 -0.398726 0.648485
+vn  -0.660748 -0.355894 0.660872
+vn  -0.551780 0.625290 0.551862
+vn  -0.762629 0.565051 0.314824
+vn  -0.847988 -0.397976 0.350045
+vn  -0.864153 -0.355199 0.356474
+vn  -0.721067 0.625515 0.297983
+vn  -0.824540 0.565804 -0.000017
+vn  -0.917701 -0.397272 -0.000034
+vn  -0.935269 -0.353939 -0.000113
+vn  -0.780712 0.624890 -0.000075
+vn  -0.762640 0.565035 -0.314825
+vn  -0.847982 -0.397998 -0.350034
+vn  -0.864141 -0.355261 -0.356441
+vn  -0.720992 0.625625 -0.297933
+vn  -0.583357 0.565165 -0.583338
+vn  -0.648485 -0.398726 -0.648448
+vn  -0.660872 -0.355894 -0.660748
+vn  -0.551862 0.625290 -0.551780
+vn  -0.314824 0.565051 -0.762629
+vn  -0.350045 -0.397976 -0.847988
+vn  -0.356474 -0.355199 -0.864153
+vn  -0.297983 0.625515 -0.721067
+vn  0.000017 0.565804 -0.824540
+vn  0.000034 -0.397272 -0.917701
+vn  0.000113 -0.353939 -0.935269
+vn  0.000075 0.624890 -0.780712
+vn  0.314825 0.565035 -0.762640
+vn  0.350034 -0.397998 -0.847982
+vn  0.356441 -0.355261 -0.864141
+vn  0.297933 0.625625 -0.720992
+vn  0.583338 0.565165 -0.583357
+vn  0.648448 -0.398726 -0.648485
+vn  0.660748 -0.355894 -0.660872
+vn  0.551780 0.625290 -0.551862
+vn  0.762629 0.565051 -0.314824
+vn  0.847988 -0.397976 -0.350045
+vn  0.864153 -0.355199 -0.356474
+vn  0.721067 0.625515 -0.297983
+vn  0.236583 0.971611 -0.000000
+vn  0.173084 0.984907 -0.000000
+vn  0.379703 0.925108 -0.000000
+vn  0.526673 0.850068 0.000000
+vn  0.217978 0.971775 0.090216
+vn  0.159589 0.984977 0.065961
+vn  0.350498 0.925311 0.144740
+vn  0.485590 0.850653 0.201474
+vn  0.166631 0.971838 0.166631
+vn  0.121908 0.985026 0.121908
+vn  0.267668 0.925585 0.267668
+vn  0.371315 0.851029 0.371315
+vn  0.090216 0.971775 0.217978
+vn  0.065961 0.984977 0.159589
+vn  0.144740 0.925311 0.350498
+vn  0.201475 0.850653 0.485590
+vn  0.000000 0.971611 0.236583
+vn  0.000000 0.984907 0.173084
+vn  0.000000 0.925108 0.379703
+vn  -0.000000 0.850068 0.526673
+vn  -0.090216 0.971775 0.217978
+vn  -0.065961 0.984977 0.159589
+vn  -0.144740 0.925311 0.350498
+vn  -0.201474 0.850653 0.485590
+vn  -0.166631 0.971838 0.166631
+vn  -0.121908 0.985026 0.121908
+vn  -0.267668 0.925585 0.267668
+vn  -0.371315 0.851029 0.371315
+vn  -0.217978 0.971775 0.090216
+vn  -0.159589 0.984977 0.065961
+vn  -0.350498 0.925311 0.144740
+vn  -0.485590 0.850653 0.201475
+vn  -0.236583 0.971611 0.000000
+vn  -0.173084 0.984907 0.000000
+vn  -0.379703 0.925108 0.000000
+vn  -0.526673 0.850068 -0.000000
+vn  -0.217978 0.971775 -0.090216
+vn  -0.159589 0.984977 -0.065961
+vn  -0.350498 0.925311 -0.144740
+vn  -0.485590 0.850653 -0.201474
+vn  -0.166631 0.971838 -0.166631
+vn  -0.121908 0.985026 -0.121908
+vn  -0.267668 0.925585 -0.267668
+vn  -0.371315 0.851029 -0.371315
+vn  -0.090216 0.971775 -0.217978
+vn  -0.065961 0.984977 -0.159589
+vn  -0.144740 0.925311 -0.350498
+vn  -0.201475 0.850653 -0.485590
+vn  -0.000000 0.971611 -0.236583
+vn  -0.000000 0.984907 -0.173084
+vn  -0.000000 0.925108 -0.379703
+vn  0.000000 0.850068 -0.526673
+vn  0.090216 0.971775 -0.217978
+vn  0.065961 0.984977 -0.159589
+vn  0.144740 0.925311 -0.350498
+vn  0.201474 0.850653 -0.485590
+vn  0.166631 0.971838 -0.166631
+vn  0.121908 0.985026 -0.121908
+vn  0.267668 0.925585 -0.267668
+vn  0.371315 0.851029 -0.371315
+vn  0.217978 0.971775 -0.090216
+vn  0.159589 0.984977 -0.065961
+vn  0.350498 0.925311 -0.144740
+vn  0.485590 0.850653 -0.201475
+# 530 vertex normals
+
+g Teapot01
+f 1/1/1 6/6/6 7/7/7
+f 7/7/7 2/2/2 1/1/1
+f 2/2/2 7/7/7 8/8/8
+f 8/8/8 3/3/3 2/2/2
+f 3/3/3 8/8/8 9/9/9
+f 9/9/9 4/4/4 3/3/3
+f 4/4/4 9/9/9 10/10/10
+f 10/10/10 5/5/5 4/4/4
+f 6/6/6 11/11/11 12/12/12
+f 12/12/12 7/7/7 6/6/6
+f 7/7/7 12/12/12 13/13/13
+f 13/13/13 8/8/8 7/7/7
+f 8/8/8 13/13/13 14/14/14
+f 14/14/14 9/9/9 8/8/8
+f 9/9/9 14/14/14 15/15/15
+f 15/15/15 10/10/10 9/9/9
+f 11/11/11 16/16/16 17/17/17
+f 17/17/17 12/12/12 11/11/11
+f 12/12/12 17/17/17 18/18/18
+f 18/18/18 13/13/13 12/12/12
+f 13/13/13 18/18/18 19/19/19
+f 19/19/19 14/14/14 13/13/13
+f 14/14/14 19/19/19 20/20/20
+f 20/20/20 15/15/15 14/14/14
+f 16/16/16 21/21/21 22/22/22
+f 22/22/22 17/17/17 16/16/16
+f 17/17/17 22/22/22 23/23/23
+f 23/23/23 18/18/18 17/17/17
+f 18/18/18 23/23/23 24/24/24
+f 24/24/24 19/19/19 18/18/18
+f 19/19/19 24/24/24 25/25/25
+f 25/25/25 20/20/20 19/19/19
+f 21/26/21 26/31/26 27/32/27
+f 27/32/27 22/27/22 21/26/21
+f 22/27/22 27/32/27 28/33/28
+f 28/33/28 23/28/23 22/27/22
+f 23/28/23 28/33/28 29/34/29
+f 29/34/29 24/29/24 23/28/23
+f 24/29/24 29/34/29 30/35/30
+f 30/35/30 25/30/25 24/29/24
+f 26/31/26 31/36/31 32/37/32
+f 32/37/32 27/32/27 26/31/26
+f 27/32/27 32/37/32 33/38/33
+f 33/38/33 28/33/28 27/32/27
+f 28/33/28 33/38/33 34/39/34
+f 34/39/34 29/34/29 28/33/28
+f 29/34/29 34/39/34 35/40/35
+f 35/40/35 30/35/30 29/34/29
+f 31/36/31 36/41/36 37/42/37
+f 37/42/37 32/37/32 31/36/31
+f 32/37/32 37/42/37 38/43/38
+f 38/43/38 33/38/33 32/37/32
+f 33/38/33 38/43/38 39/44/39
+f 39/44/39 34/39/34 33/38/33
+f 34/39/34 39/44/39 40/45/40
+f 40/45/40 35/40/35 34/39/34
+f 36/41/36 41/46/41 42/47/42
+f 42/47/42 37/42/37 36/41/36
+f 37/42/37 42/47/42 43/48/43
+f 43/48/43 38/43/38 37/42/37
+f 38/43/38 43/48/43 44/49/44
+f 44/49/44 39/44/39 38/43/38
+f 39/44/39 44/49/44 45/50/45
+f 45/50/45 40/45/40 39/44/39
+f 41/51/41 46/56/46 47/57/47
+f 47/57/47 42/52/42 41/51/41
+f 42/52/42 47/57/47 48/58/48
+f 48/58/48 43/53/43 42/52/42
+f 43/53/43 48/58/48 49/59/49
+f 49/59/49 44/54/44 43/53/43
+f 44/54/44 49/59/49 50/60/50
+f 50/60/50 45/55/45 44/54/44
+f 46/56/46 51/61/51 52/62/52
+f 52/62/52 47/57/47 46/56/46
+f 47/57/47 52/62/52 53/63/53
+f 53/63/53 48/58/48 47/57/47
+f 48/58/48 53/63/53 54/64/54
+f 54/64/54 49/59/49 48/58/48
+f 49/59/49 54/64/54 55/65/55
+f 55/65/55 50/60/50 49/59/49
+f 51/61/51 56/66/56 57/67/57
+f 57/67/57 52/62/52 51/61/51
+f 52/62/52 57/67/57 58/68/58
+f 58/68/58 53/63/53 52/62/52
+f 53/63/53 58/68/58 59/69/59
+f 59/69/59 54/64/54 53/63/53
+f 54/64/54 59/69/59 60/70/60
+f 60/70/60 55/65/55 54/64/54
+f 56/66/56 61/71/61 62/72/62
+f 62/72/62 57/67/57 56/66/56
+f 57/67/57 62/72/62 63/73/63
+f 63/73/63 58/68/58 57/67/57
+f 58/68/58 63/73/63 64/74/64
+f 64/74/64 59/69/59 58/68/58
+f 59/69/59 64/74/64 65/75/65
+f 65/75/65 60/70/60 59/69/59
+f 61/76/61 66/81/66 67/82/67
+f 67/82/67 62/77/62 61/76/61
+f 62/77/62 67/82/67 68/83/68
+f 68/83/68 63/78/63 62/77/62
+f 63/78/63 68/83/68 69/84/69
+f 69/84/69 64/79/64 63/78/63
+f 64/79/64 69/84/69 70/85/70
+f 70/85/70 65/80/65 64/79/64
+f 66/81/66 71/86/71 72/87/72
+f 72/87/72 67/82/67 66/81/66
+f 67/82/67 72/87/72 73/88/73
+f 73/88/73 68/83/68 67/82/67
+f 68/83/68 73/88/73 74/89/74
+f 74/89/74 69/84/69 68/83/68
+f 69/84/69 74/89/74 75/90/75
+f 75/90/75 70/85/70 69/84/69
+f 71/86/71 76/91/76 77/92/77
+f 77/92/77 72/87/72 71/86/71
+f 72/87/72 77/92/77 78/93/78
+f 78/93/78 73/88/73 72/87/72
+f 73/88/73 78/93/78 79/94/79
+f 79/94/79 74/89/74 73/88/73
+f 74/89/74 79/94/79 80/95/80
+f 80/95/80 75/90/75 74/89/74
+f 76/91/76 1/96/1 2/97/2
+f 2/97/2 77/92/77 76/91/76
+f 77/92/77 2/97/2 3/98/3
+f 3/98/3 78/93/78 77/92/77
+f 78/93/78 3/98/3 4/99/4
+f 4/99/4 79/94/79 78/93/78
+f 79/94/79 4/99/4 5/100/5
+f 5/100/5 80/95/80 79/94/79
+f 5/101/5 10/106/10 85/107/85
+f 85/107/85 81/102/81 5/101/5
+f 81/102/81 85/107/85 86/108/86
+f 86/108/86 82/103/82 81/102/81
+f 82/103/82 86/108/86 87/109/87
+f 87/109/87 83/104/83 82/103/82
+f 83/104/83 87/109/87 88/110/88
+f 88/110/88 84/105/84 83/104/83
+f 10/106/10 15/111/15 89/112/89
+f 89/112/89 85/107/85 10/106/10
+f 85/107/85 89/112/89 90/113/90
+f 90/113/90 86/108/86 85/107/85
+f 86/108/86 90/113/90 91/114/91
+f 91/114/91 87/109/87 86/108/86
+f 87/109/87 91/114/91 92/115/92
+f 92/115/92 88/110/88 87/109/87
+f 15/111/15 20/116/20 93/117/93
+f 93/117/93 89/112/89 15/111/15
+f 89/112/89 93/117/93 94/118/94
+f 94/118/94 90/113/90 89/112/89
+f 90/113/90 94/118/94 95/119/95
+f 95/119/95 91/114/91 90/113/90
+f 91/114/91 95/119/95 96/120/96
+f 96/120/96 92/115/92 91/114/91
+f 20/116/20 25/121/25 97/122/97
+f 97/122/97 93/117/93 20/116/20
+f 93/117/93 97/122/97 98/123/98
+f 98/123/98 94/118/94 93/117/93
+f 94/118/94 98/123/98 99/124/99
+f 99/124/99 95/119/95 94/118/94
+f 95/119/95 99/124/99 100/125/100
+f 100/125/100 96/120/96 95/119/95
+f 25/126/25 30/131/30 101/132/101
+f 101/132/101 97/127/97 25/126/25
+f 97/127/97 101/132/101 102/133/102
+f 102/133/102 98/128/98 97/127/97
+f 98/128/98 102/133/102 103/134/103
+f 103/134/103 99/129/99 98/128/98
+f 99/129/99 103/134/103 104/135/104
+f 104/135/104 100/130/100 99/129/99
+f 30/131/30 35/136/35 105/137/105
+f 105/137/105 101/132/101 30/131/30
+f 101/132/101 105/137/105 106/138/106
+f 106/138/106 102/133/102 101/132/101
+f 102/133/102 106/138/106 107/139/107
+f 107/139/107 103/134/103 102/133/102
+f 103/134/103 107/139/107 108/140/108
+f 108/140/108 104/135/104 103/134/103
+f 35/136/35 40/141/40 109/142/109
+f 109/142/109 105/137/105 35/136/35
+f 105/137/105 109/142/109 110/143/110
+f 110/143/110 106/138/106 105/137/105
+f 106/138/106 110/143/110 111/144/111
+f 111/144/111 107/139/107 106/138/106
+f 107/139/107 111/144/111 112/145/112
+f 112/145/112 108/140/108 107/139/107
+f 40/141/40 45/146/45 113/147/113
+f 113/147/113 109/142/109 40/141/40
+f 109/142/109 113/147/113 114/148/114
+f 114/148/114 110/143/110 109/142/109
+f 110/143/110 114/148/114 115/149/115
+f 115/149/115 111/144/111 110/143/110
+f 111/144/111 115/149/115 116/150/116
+f 116/150/116 112/145/112 111/144/111
+f 45/151/45 50/156/50 117/157/117
+f 117/157/117 113/152/113 45/151/45
+f 113/152/113 117/157/117 118/158/118
+f 118/158/118 114/153/114 113/152/113
+f 114/153/114 118/158/118 119/159/119
+f 119/159/119 115/154/115 114/153/114
+f 115/154/115 119/159/119 120/160/120
+f 120/160/120 116/155/116 115/154/115
+f 50/156/50 55/161/55 121/162/121
+f 121/162/121 117/157/117 50/156/50
+f 117/157/117 121/162/121 122/163/122
+f 122/163/122 118/158/118 117/157/117
+f 118/158/118 122/163/122 123/164/123
+f 123/164/123 119/159/119 118/158/118
+f 119/159/119 123/164/123 124/165/124
+f 124/165/124 120/160/120 119/159/119
+f 55/161/55 60/166/60 125/167/125
+f 125/167/125 121/162/121 55/161/55
+f 121/162/121 125/167/125 126/168/126
+f 126/168/126 122/163/122 121/162/121
+f 122/163/122 126/168/126 127/169/127
+f 127/169/127 123/164/123 122/163/122
+f 123/164/123 127/169/127 128/170/128
+f 128/170/128 124/165/124 123/164/123
+f 60/166/60 65/171/65 129/172/129
+f 129/172/129 125/167/125 60/166/60
+f 125/167/125 129/172/129 130/173/130
+f 130/173/130 126/168/126 125/167/125
+f 126/168/126 130/173/130 131/174/131
+f 131/174/131 127/169/127 126/168/126
+f 127/169/127 131/174/131 132/175/132
+f 132/175/132 128/170/128 127/169/127
+f 65/176/65 70/181/70 133/182/133
+f 133/182/133 129/177/129 65/176/65
+f 129/177/129 133/182/133 134/183/134
+f 134/183/134 130/178/130 129/177/129
+f 130/178/130 134/183/134 135/184/135
+f 135/184/135 131/179/131 130/178/130
+f 131/179/131 135/184/135 136/185/136
+f 136/185/136 132/180/132 131/179/131
+f 70/181/70 75/186/75 137/187/137
+f 137/187/137 133/182/133 70/181/70
+f 133/182/133 137/187/137 138/188/138
+f 138/188/138 134/183/134 133/182/133
+f 134/183/134 138/188/138 139/189/139
+f 139/189/139 135/184/135 134/183/134
+f 135/184/135 139/189/139 140/190/140
+f 140/190/140 136/185/136 135/184/135
+f 75/186/75 80/191/80 141/192/141
+f 141/192/141 137/187/137 75/186/75
+f 137/187/137 141/192/141 142/193/142
+f 142/193/142 138/188/138 137/187/137
+f 138/188/138 142/193/142 143/194/143
+f 143/194/143 139/189/139 138/188/138
+f 139/189/139 143/194/143 144/195/144
+f 144/195/144 140/190/140 139/189/139
+f 80/191/80 5/196/5 81/197/81
+f 81/197/81 141/192/141 80/191/80
+f 141/192/141 81/197/81 82/198/82
+f 82/198/82 142/193/142 141/192/141
+f 142/193/142 82/198/82 83/199/83
+f 83/199/83 143/194/143 142/193/142
+f 143/194/143 83/199/83 84/200/84
+f 84/200/84 144/195/144 143/194/143
+f 84/201/84 88/206/88 149/207/149
+f 149/207/149 145/202/145 84/201/84
+f 145/202/145 149/207/149 150/208/150
+f 150/208/150 146/203/146 145/202/145
+f 146/203/146 150/208/150 151/209/151
+f 151/209/151 147/204/147 146/203/146
+f 147/204/147 151/209/151 152/210/152
+f 152/210/152 148/205/148 147/204/147
+f 88/206/88 92/211/92 153/212/153
+f 153/212/153 149/207/149 88/206/88
+f 149/207/149 153/212/153 154/213/154
+f 154/213/154 150/208/150 149/207/149
+f 150/208/150 154/213/154 155/214/155
+f 155/214/155 151/209/151 150/208/150
+f 151/209/151 155/214/155 156/215/156
+f 156/215/156 152/210/152 151/209/151
+f 92/211/92 96/216/96 157/217/157
+f 157/217/157 153/212/153 92/211/92
+f 153/212/153 157/217/157 158/218/158
+f 158/218/158 154/213/154 153/212/153
+f 154/213/154 158/218/158 159/219/159
+f 159/219/159 155/214/155 154/213/154
+f 155/214/155 159/219/159 160/220/160
+f 160/220/160 156/215/156 155/214/155
+f 96/216/96 100/221/100 161/222/161
+f 161/222/161 157/217/157 96/216/96
+f 157/217/157 161/222/161 162/223/162
+f 162/223/162 158/218/158 157/217/157
+f 158/218/158 162/223/162 163/224/163
+f 163/224/163 159/219/159 158/218/158
+f 159/219/159 163/224/163 164/225/164
+f 164/225/164 160/220/160 159/219/159
+f 100/226/100 104/231/104 165/232/165
+f 165/232/165 161/227/161 100/226/100
+f 161/227/161 165/232/165 166/233/166
+f 166/233/166 162/228/162 161/227/161
+f 162/228/162 166/233/166 167/234/167
+f 167/234/167 163/229/163 162/228/162
+f 163/229/163 167/234/167 168/235/168
+f 168/235/168 164/230/164 163/229/163
+f 104/231/104 108/236/108 169/237/169
+f 169/237/169 165/232/165 104/231/104
+f 165/232/165 169/237/169 170/238/170
+f 170/238/170 166/233/166 165/232/165
+f 166/233/166 170/238/170 171/239/171
+f 171/239/171 167/234/167 166/233/166
+f 167/234/167 171/239/171 172/240/172
+f 172/240/172 168/235/168 167/234/167
+f 108/236/108 112/241/112 173/242/173
+f 173/242/173 169/237/169 108/236/108
+f 169/237/169 173/242/173 174/243/174
+f 174/243/174 170/238/170 169/237/169
+f 170/238/170 174/243/174 175/244/175
+f 175/244/175 171/239/171 170/238/170
+f 171/239/171 175/244/175 176/245/176
+f 176/245/176 172/240/172 171/239/171
+f 112/241/112 116/246/116 177/247/177
+f 177/247/177 173/242/173 112/241/112
+f 173/242/173 177/247/177 178/248/178
+f 178/248/178 174/243/174 173/242/173
+f 174/243/174 178/248/178 179/249/179
+f 179/249/179 175/244/175 174/243/174
+f 175/244/175 179/249/179 180/250/180
+f 180/250/180 176/245/176 175/244/175
+f 116/251/116 120/256/120 181/257/181
+f 181/257/181 177/252/177 116/251/116
+f 177/252/177 181/257/181 182/258/182
+f 182/258/182 178/253/178 177/252/177
+f 178/253/178 182/258/182 183/259/183
+f 183/259/183 179/254/179 178/253/178
+f 179/254/179 183/259/183 184/260/184
+f 184/260/184 180/255/180 179/254/179
+f 120/256/120 124/261/124 185/262/185
+f 185/262/185 181/257/181 120/256/120
+f 181/257/181 185/262/185 186/263/186
+f 186/263/186 182/258/182 181/257/181
+f 182/258/182 186/263/186 187/264/187
+f 187/264/187 183/259/183 182/258/182
+f 183/259/183 187/264/187 188/265/188
+f 188/265/188 184/260/184 183/259/183
+f 124/261/124 128/266/128 189/267/189
+f 189/267/189 185/262/185 124/261/124
+f 185/262/185 189/267/189 190/268/190
+f 190/268/190 186/263/186 185/262/185
+f 186/263/186 190/268/190 191/269/191
+f 191/269/191 187/264/187 186/263/186
+f 187/264/187 191/269/191 192/270/192
+f 192/270/192 188/265/188 187/264/187
+f 128/266/128 132/271/132 193/272/193
+f 193/272/193 189/267/189 128/266/128
+f 189/267/189 193/272/193 194/273/194
+f 194/273/194 190/268/190 189/267/189
+f 190/268/190 194/273/194 195/274/195
+f 195/274/195 191/269/191 190/268/190
+f 191/269/191 195/274/195 196/275/196
+f 196/275/196 192/270/192 191/269/191
+f 132/276/132 136/281/136 197/282/197
+f 197/282/197 193/277/193 132/276/132
+f 193/277/193 197/282/197 198/283/198
+f 198/283/198 194/278/194 193/277/193
+f 194/278/194 198/283/198 199/284/199
+f 199/284/199 195/279/195 194/278/194
+f 195/279/195 199/284/199 200/285/200
+f 200/285/200 196/280/196 195/279/195
+f 136/281/136 140/286/140 201/287/201
+f 201/287/201 197/282/197 136/281/136
+f 197/282/197 201/287/201 202/288/202
+f 202/288/202 198/283/198 197/282/197
+f 198/283/198 202/288/202 203/289/203
+f 203/289/203 199/284/199 198/283/198
+f 199/284/199 203/289/203 204/290/204
+f 204/290/204 200/285/200 199/284/199
+f 140/286/140 144/291/144 205/292/205
+f 205/292/205 201/287/201 140/286/140
+f 201/287/201 205/292/205 206/293/206
+f 206/293/206 202/288/202 201/287/201
+f 202/288/202 206/293/206 207/294/207
+f 207/294/207 203/289/203 202/288/202
+f 203/289/203 207/294/207 208/295/208
+f 208/295/208 204/290/204 203/289/203
+f 144/291/144 84/296/84 145/297/145
+f 145/297/145 205/292/205 144/291/144
+f 205/292/205 145/297/145 146/298/146
+f 146/298/146 206/293/206 205/292/205
+f 206/293/206 146/298/146 147/299/147
+f 147/299/147 207/294/207 206/293/206
+f 207/294/207 147/299/147 148/300/148
+f 148/300/148 208/295/208 207/294/207
+f 148/301/148 152/306/152 213/307/213
+f 213/307/213 209/302/209 148/301/148
+f 209/302/209 213/307/213 214/308/214
+f 214/308/214 210/303/210 209/302/209
+f 210/303/210 214/308/214 215/309/215
+f 215/309/215 211/304/211 210/303/210
+f 211/304/211 215/309/215 212/310/212
+f 152/306/152 156/311/156 216/312/216
+f 216/312/216 213/307/213 152/306/152
+f 213/307/213 216/312/216 217/313/217
+f 217/313/217 214/308/214 213/307/213
+f 214/308/214 217/313/217 218/314/218
+f 218/314/218 215/309/215 214/308/214
+f 215/309/215 218/314/218 212/315/212
+f 156/311/156 160/316/160 219/317/219
+f 219/317/219 216/312/216 156/311/156
+f 216/312/216 219/317/219 220/318/220
+f 220/318/220 217/313/217 216/312/216
+f 217/313/217 220/318/220 221/319/221
+f 221/319/221 218/314/218 217/313/217
+f 218/314/218 221/319/221 212/320/212
+f 160/316/160 164/321/164 222/322/222
+f 222/322/222 219/317/219 160/316/160
+f 219/317/219 222/322/222 223/323/223
+f 223/323/223 220/318/220 219/317/219
+f 220/318/220 223/323/223 224/324/224
+f 224/324/224 221/319/221 220/318/220
+f 221/319/221 224/324/224 212/325/212
+f 164/326/164 168/331/168 225/332/225
+f 225/332/225 222/327/222 164/326/164
+f 222/327/222 225/332/225 226/333/226
+f 226/333/226 223/328/223 222/327/222
+f 223/328/223 226/333/226 227/334/227
+f 227/334/227 224/329/224 223/328/223
+f 224/329/224 227/334/227 212/335/212
+f 168/331/168 172/336/172 228/337/228
+f 228/337/228 225/332/225 168/331/168
+f 225/332/225 228/337/228 229/338/229
+f 229/338/229 226/333/226 225/332/225
+f 226/333/226 229/338/229 230/339/230
+f 230/339/230 227/334/227 226/333/226
+f 227/334/227 230/339/230 212/340/212
+f 172/336/172 176/341/176 231/342/231
+f 231/342/231 228/337/228 172/336/172
+f 228/337/228 231/342/231 232/343/232
+f 232/343/232 229/338/229 228/337/228
+f 229/338/229 232/343/232 233/344/233
+f 233/344/233 230/339/230 229/338/229
+f 230/339/230 233/344/233 212/345/212
+f 176/341/176 180/346/180 234/347/234
+f 234/347/234 231/342/231 176/341/176
+f 231/342/231 234/347/234 235/348/235
+f 235/348/235 232/343/232 231/342/231
+f 232/343/232 235/348/235 236/349/236
+f 236/349/236 233/344/233 232/343/232
+f 233/344/233 236/349/236 212/350/212
+f 180/351/180 184/356/184 237/357/237
+f 237/357/237 234/352/234 180/351/180
+f 234/352/234 237/357/237 238/358/238
+f 238/358/238 235/353/235 234/352/234
+f 235/353/235 238/358/238 239/359/239
+f 239/359/239 236/354/236 235/353/235
+f 236/354/236 239/359/239 212/360/212
+f 184/356/184 188/361/188 240/362/240
+f 240/362/240 237/357/237 184/356/184
+f 237/357/237 240/362/240 241/363/241
+f 241/363/241 238/358/238 237/357/237
+f 238/358/238 241/363/241 242/364/242
+f 242/364/242 239/359/239 238/358/238
+f 239/359/239 242/364/242 212/365/212
+f 188/361/188 192/366/192 243/367/243
+f 243/367/243 240/362/240 188/361/188
+f 240/362/240 243/367/243 244/368/244
+f 244/368/244 241/363/241 240/362/240
+f 241/363/241 244/368/244 245/369/245
+f 245/369/245 242/364/242 241/363/241
+f 242/364/242 245/369/245 212/370/212
+f 192/366/192 196/371/196 246/372/246
+f 246/372/246 243/367/243 192/366/192
+f 243/367/243 246/372/246 247/373/247
+f 247/373/247 244/368/244 243/367/243
+f 244/368/244 247/373/247 248/374/248
+f 248/374/248 245/369/245 244/368/244
+f 245/369/245 248/374/248 212/375/212
+f 196/376/196 200/381/200 249/382/249
+f 249/382/249 246/377/246 196/376/196
+f 246/377/246 249/382/249 250/383/250
+f 250/383/250 247/378/247 246/377/246
+f 247/378/247 250/383/250 251/384/251
+f 251/384/251 248/379/248 247/378/247
+f 248/379/248 251/384/251 212/385/212
+f 200/381/200 204/386/204 252/387/252
+f 252/387/252 249/382/249 200/381/200
+f 249/382/249 252/387/252 253/388/253
+f 253/388/253 250/383/250 249/382/249
+f 250/383/250 253/388/253 254/389/254
+f 254/389/254 251/384/251 250/383/250
+f 251/384/251 254/389/254 212/390/212
+f 204/386/204 208/391/208 255/392/255
+f 255/392/255 252/387/252 204/386/204
+f 252/387/252 255/392/255 256/393/256
+f 256/393/256 253/388/253 252/387/252
+f 253/388/253 256/393/256 257/394/257
+f 257/394/257 254/389/254 253/388/253
+f 254/389/254 257/394/257 212/395/212
+f 208/391/208 148/396/148 209/397/209
+f 209/397/209 255/392/255 208/391/208
+f 255/392/255 209/397/209 210/398/210
+f 210/398/210 256/393/256 255/392/255
+f 256/393/256 210/398/210 211/399/211
+f 211/399/211 257/394/257 256/393/256
+f 257/394/257 211/399/211 212/400/212
+f 258/401/258 263/406/263 264/407/264
+f 264/407/264 259/402/259 258/401/258
+f 259/402/259 264/407/264 265/408/265
+f 265/408/265 260/403/260 259/402/259
+f 260/403/260 265/408/265 266/409/266
+f 266/409/266 261/404/261 260/403/260
+f 261/404/261 266/409/266 267/410/267
+f 267/410/267 262/405/262 261/404/261
+f 263/406/263 268/411/268 269/412/269
+f 269/412/269 264/407/264 263/406/263
+f 264/407/264 269/412/269 270/413/270
+f 270/413/270 265/408/265 264/407/264
+f 265/408/265 270/413/270 271/414/271
+f 271/414/271 266/409/266 265/408/265
+f 266/409/266 271/414/271 272/415/272
+f 272/415/272 267/410/267 266/409/266
+f 268/411/268 273/416/273 274/417/274
+f 274/417/274 269/412/269 268/411/268
+f 269/412/269 274/417/274 275/418/275
+f 275/418/275 270/413/270 269/412/269
+f 270/413/270 275/418/275 276/419/276
+f 276/419/276 271/414/271 270/413/270
+f 271/414/271 276/419/276 277/420/277
+f 277/420/277 272/415/272 271/414/271
+f 273/416/273 278/421/278 279/422/279
+f 279/422/279 274/417/274 273/416/273
+f 274/417/274 279/422/279 280/423/280
+f 280/423/280 275/418/275 274/417/274
+f 275/418/275 280/423/280 281/424/281
+f 281/424/281 276/419/276 275/418/275
+f 276/419/276 281/424/281 282/425/282
+f 282/425/282 277/420/277 276/419/276
+f 278/426/278 283/431/283 284/432/284
+f 284/432/284 279/427/279 278/426/278
+f 279/427/279 284/432/284 285/433/285
+f 285/433/285 280/428/280 279/427/279
+f 280/428/280 285/433/285 286/434/286
+f 286/434/286 281/429/281 280/428/280
+f 281/429/281 286/434/286 287/435/287
+f 287/435/287 282/430/282 281/429/281
+f 283/431/283 288/436/288 289/437/289
+f 289/437/289 284/432/284 283/431/283
+f 284/432/284 289/437/289 290/438/290
+f 290/438/290 285/433/285 284/432/284
+f 285/433/285 290/438/290 291/439/291
+f 291/439/291 286/434/286 285/433/285
+f 286/434/286 291/439/291 292/440/292
+f 292/440/292 287/435/287 286/434/286
+f 288/436/288 293/441/293 294/442/294
+f 294/442/294 289/437/289 288/436/288
+f 289/437/289 294/442/294 295/443/295
+f 295/443/295 290/438/290 289/437/289
+f 290/438/290 295/443/295 296/444/296
+f 296/444/296 291/439/291 290/438/290
+f 291/439/291 296/444/296 297/445/297
+f 297/445/297 292/440/292 291/439/291
+f 293/441/293 258/446/258 259/447/259
+f 259/447/259 294/442/294 293/441/293
+f 294/442/294 259/447/259 260/448/260
+f 260/448/260 295/443/295 294/442/294
+f 295/443/295 260/448/260 261/449/261
+f 261/449/261 296/444/296 295/443/295
+f 296/444/296 261/449/261 262/450/262
+f 262/450/262 297/445/297 296/444/296
+f 262/451/262 267/456/267 302/457/302
+f 302/457/302 298/452/298 262/451/262
+f 298/452/298 302/457/302 303/458/303
+f 303/458/303 299/453/299 298/452/298
+f 299/453/299 303/458/303 304/459/304
+f 304/459/304 300/454/300 299/453/299
+f 300/454/300 304/459/304 305/460/305
+f 305/460/305 301/455/301 300/454/300
+f 267/456/267 272/461/272 306/462/306
+f 306/462/306 302/457/302 267/456/267
+f 302/457/302 306/462/306 307/463/307
+f 307/463/307 303/458/303 302/457/302
+f 303/458/303 307/463/307 308/464/308
+f 308/464/308 304/459/304 303/458/303
+f 304/459/304 308/464/308 309/465/309
+f 309/465/309 305/460/305 304/459/304
+f 272/461/272 277/466/277 310/467/310
+f 310/467/310 306/462/306 272/461/272
+f 306/462/306 310/467/310 311/468/311
+f 311/468/311 307/463/307 306/462/306
+f 307/463/307 311/468/311 312/469/312
+f 312/469/312 308/464/308 307/463/307
+f 308/464/308 312/469/312 313/470/313
+f 313/470/313 309/465/309 308/464/308
+f 277/466/277 282/471/282 314/472/314
+f 314/472/314 310/467/310 277/466/277
+f 310/467/310 314/472/314 315/473/315
+f 315/473/315 311/468/311 310/467/310
+f 311/468/311 315/473/315 316/474/316
+f 316/474/316 312/469/312 311/468/311
+f 312/469/312 316/474/316 317/475/317
+f 317/475/317 313/470/313 312/469/312
+f 282/476/282 287/481/287 318/482/318
+f 318/482/318 314/477/314 282/476/282
+f 314/477/314 318/482/318 319/483/319
+f 319/483/319 315/478/315 314/477/314
+f 315/478/315 319/483/319 320/484/320
+f 320/484/320 316/479/316 315/478/315
+f 316/479/316 320/484/320 321/485/321
+f 321/485/321 317/480/317 316/479/316
+f 287/481/287 292/486/292 322/487/322
+f 322/487/322 318/482/318 287/481/287
+f 318/482/318 322/487/322 323/488/323
+f 323/488/323 319/483/319 318/482/318
+f 319/483/319 323/488/323 324/489/324
+f 324/489/324 320/484/320 319/483/319
+f 320/484/320 324/489/324 325/490/325
+f 325/490/325 321/485/321 320/484/320
+f 292/486/292 297/491/297 326/492/326
+f 326/492/326 322/487/322 292/486/292
+f 322/487/322 326/492/326 327/493/327
+f 327/493/327 323/488/323 322/487/322
+f 323/488/323 327/493/327 328/494/328
+f 328/494/328 324/489/324 323/488/323
+f 324/489/324 328/494/328 329/495/329
+f 329/495/329 325/490/325 324/489/324
+f 297/491/297 262/496/262 298/497/298
+f 298/497/298 326/492/326 297/491/297
+f 326/492/326 298/497/298 299/498/299
+f 299/498/299 327/493/327 326/492/326
+f 327/493/327 299/498/299 300/499/300
+f 300/499/300 328/494/328 327/493/327
+f 328/494/328 300/499/300 301/500/301
+f 301/500/301 329/495/329 328/494/328
+f 330/501/330 335/506/335 336/507/336
+f 336/507/336 331/502/331 330/501/330
+f 331/502/331 336/507/336 337/508/337
+f 337/508/337 332/503/332 331/502/331
+f 332/503/332 337/508/337 338/509/338
+f 338/509/338 333/504/333 332/503/332
+f 333/504/333 338/509/338 339/510/339
+f 339/510/339 334/505/334 333/504/333
+f 335/506/335 340/511/340 341/512/341
+f 341/512/341 336/507/336 335/506/335
+f 336/507/336 341/512/341 342/513/342
+f 342/513/342 337/508/337 336/507/336
+f 337/508/337 342/513/342 343/514/343
+f 343/514/343 338/509/338 337/508/337
+f 338/509/338 343/514/343 344/515/344
+f 344/515/344 339/510/339 338/509/338
+f 340/511/340 345/516/345 346/517/346
+f 346/517/346 341/512/341 340/511/340
+f 341/512/341 346/517/346 347/518/347
+f 347/518/347 342/513/342 341/512/341
+f 342/513/342 347/518/347 348/519/348
+f 348/519/348 343/514/343 342/513/342
+f 343/514/343 348/519/348 349/520/349
+f 349/520/349 344/515/344 343/514/343
+f 345/516/345 350/521/350 351/522/351
+f 351/522/351 346/517/346 345/516/345
+f 346/517/346 351/522/351 352/523/352
+f 352/523/352 347/518/347 346/517/346
+f 347/518/347 352/523/352 353/524/353
+f 353/524/353 348/519/348 347/518/347
+f 348/519/348 353/524/353 354/525/354
+f 354/525/354 349/520/349 348/519/348
+f 350/526/350 355/531/355 356/532/356
+f 356/532/356 351/527/351 350/526/350
+f 351/527/351 356/532/356 357/533/357
+f 357/533/357 352/528/352 351/527/351
+f 352/528/352 357/533/357 358/534/358
+f 358/534/358 353/529/353 352/528/352
+f 353/529/353 358/534/358 359/535/359
+f 359/535/359 354/530/354 353/529/353
+f 355/531/355 360/536/360 361/537/361
+f 361/537/361 356/532/356 355/531/355
+f 356/532/356 361/537/361 362/538/362
+f 362/538/362 357/533/357 356/532/356
+f 357/533/357 362/538/362 363/539/363
+f 363/539/363 358/534/358 357/533/357
+f 358/534/358 363/539/363 364/540/364
+f 364/540/364 359/535/359 358/534/358
+f 360/536/360 365/541/365 366/542/366
+f 366/542/366 361/537/361 360/536/360
+f 361/537/361 366/542/366 367/543/367
+f 367/543/367 362/538/362 361/537/361
+f 362/538/362 367/543/367 368/544/368
+f 368/544/368 363/539/363 362/538/362
+f 363/539/363 368/544/368 369/545/369
+f 369/545/369 364/540/364 363/539/363
+f 365/541/365 330/546/330 331/547/331
+f 331/547/331 366/542/366 365/541/365
+f 366/542/366 331/547/331 332/548/332
+f 332/548/332 367/543/367 366/542/366
+f 367/543/367 332/548/332 333/549/333
+f 333/549/333 368/544/368 367/543/367
+f 368/544/368 333/549/333 334/550/334
+f 334/550/334 369/545/369 368/544/368
+f 334/551/334 339/556/339 374/557/374
+f 374/557/374 370/552/370 334/551/334
+f 370/552/370 374/557/374 375/558/375
+f 375/558/375 371/553/371 370/552/370
+f 371/553/371 375/558/375 376/559/376
+f 376/559/376 372/554/372 371/553/371
+f 372/554/372 376/559/376 377/560/377
+f 377/560/377 373/555/373 372/554/372
+f 339/556/339 344/561/344 378/562/378
+f 378/562/378 374/557/374 339/556/339
+f 374/557/374 378/562/378 379/563/379
+f 379/563/379 375/558/375 374/557/374
+f 375/558/375 379/563/379 380/564/380
+f 380/564/380 376/559/376 375/558/375
+f 376/559/376 380/564/380 381/565/381
+f 381/565/381 377/560/377 376/559/376
+f 344/561/344 349/566/349 382/567/382
+f 382/567/382 378/562/378 344/561/344
+f 378/562/378 382/567/382 383/568/383
+f 383/568/383 379/563/379 378/562/378
+f 379/563/379 383/568/383 384/569/384
+f 384/569/384 380/564/380 379/563/379
+f 380/564/380 384/569/384 385/570/385
+f 385/570/385 381/565/381 380/564/380
+f 349/566/349 354/571/354 386/572/386
+f 386/572/386 382/567/382 349/566/349
+f 382/567/382 386/572/386 387/573/387
+f 387/573/387 383/568/383 382/567/382
+f 383/568/383 387/573/387 388/574/388
+f 388/574/388 384/569/384 383/568/383
+f 384/569/384 388/574/388 389/575/389
+f 389/575/389 385/570/385 384/569/384
+f 354/576/354 359/581/359 390/582/390
+f 390/582/390 386/577/386 354/576/354
+f 386/577/386 390/582/390 391/583/391
+f 391/583/391 387/578/387 386/577/386
+f 387/578/387 391/583/391 392/584/392
+f 392/584/392 388/579/388 387/578/387
+f 388/579/388 392/584/392 393/585/393
+f 393/585/393 389/580/389 388/579/388
+f 359/581/359 364/586/364 394/587/394
+f 394/587/394 390/582/390 359/581/359
+f 390/582/390 394/587/394 395/588/395
+f 395/588/395 391/583/391 390/582/390
+f 391/583/391 395/588/395 396/589/396
+f 396/589/396 392/584/392 391/583/391
+f 392/584/392 396/589/396 397/590/397
+f 397/590/397 393/585/393 392/584/392
+f 364/586/364 369/591/369 398/592/398
+f 398/592/398 394/587/394 364/586/364
+f 394/587/394 398/592/398 399/593/399
+f 399/593/399 395/588/395 394/587/394
+f 395/588/395 399/593/399 400/594/400
+f 400/594/400 396/589/396 395/588/395
+f 396/589/396 400/594/400 401/595/401
+f 401/595/401 397/590/397 396/589/396
+f 369/591/369 334/596/334 370/597/370
+f 370/597/370 398/592/398 369/591/369
+f 398/592/398 370/597/370 371/598/371
+f 371/598/371 399/593/399 398/592/398
+f 399/593/399 371/598/371 372/599/372
+f 372/599/372 400/594/400 399/593/399
+f 400/594/400 372/599/372 373/600/373
+f 373/600/373 401/595/401 400/594/400
+f 407/607/407 403/602/403 402/601/402
+f 403/602/403 407/607/407 408/608/408
+f 408/608/408 404/603/404 403/602/403
+f 404/603/404 408/608/408 409/609/409
+f 409/609/409 405/604/405 404/603/404
+f 405/604/405 409/609/409 410/610/410
+f 410/610/410 406/605/406 405/604/405
+f 411/612/411 407/607/407 402/606/402
+f 407/607/407 411/612/411 412/613/412
+f 412/613/412 408/608/408 407/607/407
+f 408/608/408 412/613/412 413/614/413
+f 413/614/413 409/609/409 408/608/408
+f 409/609/409 413/614/413 414/615/414
+f 414/615/414 410/610/410 409/609/409
+f 415/617/415 411/612/411 402/611/402
+f 411/612/411 415/617/415 416/618/416
+f 416/618/416 412/613/412 411/612/411
+f 412/613/412 416/618/416 417/619/417
+f 417/619/417 413/614/413 412/613/412
+f 413/614/413 417/619/417 418/620/418
+f 418/620/418 414/615/414 413/614/413
+f 419/622/419 415/617/415 402/616/402
+f 415/617/415 419/622/419 420/623/420
+f 420/623/420 416/618/416 415/617/415
+f 416/618/416 420/623/420 421/624/421
+f 421/624/421 417/619/417 416/618/416
+f 417/619/417 421/624/421 422/625/422
+f 422/625/422 418/620/418 417/619/417
+f 423/632/423 419/627/419 402/626/402
+f 419/627/419 423/632/423 424/633/424
+f 424/633/424 420/628/420 419/627/419
+f 420/628/420 424/633/424 425/634/425
+f 425/634/425 421/629/421 420/628/420
+f 421/629/421 425/634/425 426/635/426
+f 426/635/426 422/630/422 421/629/421
+f 427/637/427 423/632/423 402/631/402
+f 423/632/423 427/637/427 428/638/428
+f 428/638/428 424/633/424 423/632/423
+f 424/633/424 428/638/428 429/639/429
+f 429/639/429 425/634/425 424/633/424
+f 425/634/425 429/639/429 430/640/430
+f 430/640/430 426/635/426 425/634/425
+f 431/642/431 427/637/427 402/636/402
+f 427/637/427 431/642/431 432/643/432
+f 432/643/432 428/638/428 427/637/427
+f 428/638/428 432/643/432 433/644/433
+f 433/644/433 429/639/429 428/638/428
+f 429/639/429 433/644/433 434/645/434
+f 434/645/434 430/640/430 429/639/429
+f 435/647/435 431/642/431 402/641/402
+f 431/642/431 435/647/435 436/648/436
+f 436/648/436 432/643/432 431/642/431
+f 432/643/432 436/648/436 437/649/437
+f 437/649/437 433/644/433 432/643/432
+f 433/644/433 437/649/437 438/650/438
+f 438/650/438 434/645/434 433/644/433
+f 439/657/439 435/652/435 402/651/402
+f 435/652/435 439/657/439 440/658/440
+f 440/658/440 436/653/436 435/652/435
+f 436/653/436 440/658/440 441/659/441
+f 441/659/441 437/654/437 436/653/436
+f 437/654/437 441/659/441 442/660/442
+f 442/660/442 438/655/438 437/654/437
+f 443/662/443 439/657/439 402/656/402
+f 439/657/439 443/662/443 444/663/444
+f 444/663/444 440/658/440 439/657/439
+f 440/658/440 444/663/444 445/664/445
+f 445/664/445 441/659/441 440/658/440
+f 441/659/441 445/664/445 446/665/446
+f 446/665/446 442/660/442 441/659/441
+f 447/667/447 443/662/443 402/661/402
+f 443/662/443 447/667/447 448/668/448
+f 448/668/448 444/663/444 443/662/443
+f 444/663/444 448/668/448 449/669/449
+f 449/669/449 445/664/445 444/663/444
+f 445/664/445 449/669/449 450/670/450
+f 450/670/450 446/665/446 445/664/445
+f 451/672/451 447/667/447 402/666/402
+f 447/667/447 451/672/451 452/673/452
+f 452/673/452 448/668/448 447/667/447
+f 448/668/448 452/673/452 453/674/453
+f 453/674/453 449/669/449 448/668/448
+f 449/669/449 453/674/453 454/675/454
+f 454/675/454 450/670/450 449/669/449
+f 455/682/455 451/677/451 402/676/402
+f 451/677/451 455/682/455 456/683/456
+f 456/683/456 452/678/452 451/677/451
+f 452/678/452 456/683/456 457/684/457
+f 457/684/457 453/679/453 452/678/452
+f 453/679/453 457/684/457 458/685/458
+f 458/685/458 454/680/454 453/679/453
+f 459/687/459 455/682/455 402/681/402
+f 455/682/455 459/687/459 460/688/460
+f 460/688/460 456/683/456 455/682/455
+f 456/683/456 460/688/460 461/689/461
+f 461/689/461 457/684/457 456/683/456
+f 457/684/457 461/689/461 462/690/462
+f 462/690/462 458/685/458 457/684/457
+f 463/692/463 459/687/459 402/686/402
+f 459/687/459 463/692/463 464/693/464
+f 464/693/464 460/688/460 459/687/459
+f 460/688/460 464/693/464 465/694/465
+f 465/694/465 461/689/461 460/688/460
+f 461/689/461 465/694/465 466/695/466
+f 466/695/466 462/690/462 461/689/461
+f 403/697/403 463/692/463 402/691/402
+f 463/692/463 403/697/403 404/698/404
+f 404/698/404 464/693/464 463/692/463
+f 464/693/464 404/698/404 405/699/405
+f 405/699/405 465/694/465 464/693/464
+f 465/694/465 405/699/405 406/700/406
+f 406/700/406 466/695/466 465/694/465
+f 406/701/406 410/706/410 471/707/471
+f 471/707/471 467/702/467 406/701/406
+f 467/702/467 471/707/471 472/708/472
+f 472/708/472 468/703/468 467/702/467
+f 468/703/468 472/708/472 473/709/473
+f 473/709/473 469/704/469 468/703/468
+f 469/704/469 473/709/473 474/710/474
+f 474/710/474 470/705/470 469/704/469
+f 410/706/410 414/711/414 475/712/475
+f 475/712/475 471/707/471 410/706/410
+f 471/707/471 475/712/475 476/713/476
+f 476/713/476 472/708/472 471/707/471
+f 472/708/472 476/713/476 477/714/477
+f 477/714/477 473/709/473 472/708/472
+f 473/709/473 477/714/477 478/715/478
+f 478/715/478 474/710/474 473/709/473
+f 414/711/414 418/716/418 479/717/479
+f 479/717/479 475/712/475 414/711/414
+f 475/712/475 479/717/479 480/718/480
+f 480/718/480 476/713/476 475/712/475
+f 476/713/476 480/718/480 481/719/481
+f 481/719/481 477/714/477 476/713/476
+f 477/714/477 481/719/481 482/720/482
+f 482/720/482 478/715/478 477/714/477
+f 418/716/418 422/721/422 483/722/483
+f 483/722/483 479/717/479 418/716/418
+f 479/717/479 483/722/483 484/723/484
+f 484/723/484 480/718/480 479/717/479
+f 480/718/480 484/723/484 485/724/485
+f 485/724/485 481/719/481 480/718/480
+f 481/719/481 485/724/485 486/725/486
+f 486/725/486 482/720/482 481/719/481
+f 422/726/422 426/731/426 487/732/487
+f 487/732/487 483/727/483 422/726/422
+f 483/727/483 487/732/487 488/733/488
+f 488/733/488 484/728/484 483/727/483
+f 484/728/484 488/733/488 489/734/489
+f 489/734/489 485/729/485 484/728/484
+f 485/729/485 489/734/489 490/735/490
+f 490/735/490 486/730/486 485/729/485
+f 426/731/426 430/736/430 491/737/491
+f 491/737/491 487/732/487 426/731/426
+f 487/732/487 491/737/491 492/738/492
+f 492/738/492 488/733/488 487/732/487
+f 488/733/488 492/738/492 493/739/493
+f 493/739/493 489/734/489 488/733/488
+f 489/734/489 493/739/493 494/740/494
+f 494/740/494 490/735/490 489/734/489
+f 430/736/430 434/741/434 495/742/495
+f 495/742/495 491/737/491 430/736/430
+f 491/737/491 495/742/495 496/743/496
+f 496/743/496 492/738/492 491/737/491
+f 492/738/492 496/743/496 497/744/497
+f 497/744/497 493/739/493 492/738/492
+f 493/739/493 497/744/497 498/745/498
+f 498/745/498 494/740/494 493/739/493
+f 434/741/434 438/746/438 499/747/499
+f 499/747/499 495/742/495 434/741/434
+f 495/742/495 499/747/499 500/748/500
+f 500/748/500 496/743/496 495/742/495
+f 496/743/496 500/748/500 501/749/501
+f 501/749/501 497/744/497 496/743/496
+f 497/744/497 501/749/501 502/750/502
+f 502/750/502 498/745/498 497/744/497
+f 438/751/438 442/756/442 503/757/503
+f 503/757/503 499/752/499 438/751/438
+f 499/752/499 503/757/503 504/758/504
+f 504/758/504 500/753/500 499/752/499
+f 500/753/500 504/758/504 505/759/505
+f 505/759/505 501/754/501 500/753/500
+f 501/754/501 505/759/505 506/760/506
+f 506/760/506 502/755/502 501/754/501
+f 442/756/442 446/761/446 507/762/507
+f 507/762/507 503/757/503 442/756/442
+f 503/757/503 507/762/507 508/763/508
+f 508/763/508 504/758/504 503/757/503
+f 504/758/504 508/763/508 509/764/509
+f 509/764/509 505/759/505 504/758/504
+f 505/759/505 509/764/509 510/765/510
+f 510/765/510 506/760/506 505/759/505
+f 446/761/446 450/766/450 511/767/511
+f 511/767/511 507/762/507 446/761/446
+f 507/762/507 511/767/511 512/768/512
+f 512/768/512 508/763/508 507/762/507
+f 508/763/508 512/768/512 513/769/513
+f 513/769/513 509/764/509 508/763/508
+f 509/764/509 513/769/513 514/770/514
+f 514/770/514 510/765/510 509/764/509
+f 450/766/450 454/771/454 515/772/515
+f 515/772/515 511/767/511 450/766/450
+f 511/767/511 515/772/515 516/773/516
+f 516/773/516 512/768/512 511/767/511
+f 512/768/512 516/773/516 517/774/517
+f 517/774/517 513/769/513 512/768/512
+f 513/769/513 517/774/517 518/775/518
+f 518/775/518 514/770/514 513/769/513
+f 454/776/454 458/781/458 519/782/519
+f 519/782/519 515/777/515 454/776/454
+f 515/777/515 519/782/519 520/783/520
+f 520/783/520 516/778/516 515/777/515
+f 516/778/516 520/783/520 521/784/521
+f 521/784/521 517/779/517 516/778/516
+f 517/779/517 521/784/521 522/785/522
+f 522/785/522 518/780/518 517/779/517
+f 458/781/458 462/786/462 523/787/523
+f 523/787/523 519/782/519 458/781/458
+f 519/782/519 523/787/523 524/788/524
+f 524/788/524 520/783/520 519/782/519
+f 520/783/520 524/788/524 525/789/525
+f 525/789/525 521/784/521 520/783/520
+f 521/784/521 525/789/525 526/790/526
+f 526/790/526 522/785/522 521/784/521
+f 462/786/462 466/791/466 527/792/527
+f 527/792/527 523/787/523 462/786/462
+f 523/787/523 527/792/527 528/793/528
+f 528/793/528 524/788/524 523/787/523
+f 524/788/524 528/793/528 529/794/529
+f 529/794/529 525/789/525 524/788/524
+f 525/789/525 529/794/529 530/795/530
+f 530/795/530 526/790/526 525/789/525
+f 466/791/466 406/796/406 467/797/467
+f 467/797/467 527/792/527 466/791/466
+f 527/792/527 467/797/467 468/798/468
+f 468/798/468 528/793/528 527/792/527
+f 528/793/528 468/798/468 469/799/469
+f 469/799/469 529/794/529 528/793/528
+f 529/794/529 469/799/469 470/800/470
+f 470/800/470 530/795/530 529/794/529
+# 992 faces
+
+g
diff --git a/WebCore/manual-tests/webgl/resources/utils3d.js b/WebCore/manual-tests/webgl/resources/utils3d.js
new file mode 100644
index 0000000..0ffd7c4
--- /dev/null
+++ b/WebCore/manual-tests/webgl/resources/utils3d.js
@@ -0,0 +1,531 @@
+//
+// initWebGL
+//
+// Initialize the Canvas element with the passed name as a WebGL object and return the
+// CanvasRenderingContext3D. 
+//
+// Load shaders with the passed names and create a program with them. Return this program 
+// in the 'program' property of the returned context.
+//
+// For each string in the passed attribs array, bind an attrib with that name at that index.
+// Once the attribs are bound, link the program and then use it.
+//
+// Set the clear color to the passed array (4 values) and set the clear depth to the passed value.
+// Enable depth testing and blending with a blend func of (SRC_ALPHA, ONE_MINUS_SRC_ALPHA)
+//
+function initWebGL(canvasName, vshader, fshader, attribs, clearColor, clearDepth)
+{
+    var canvas = document.getElementById(canvasName);
+    var gl = canvas.getContext("webkit-3d");
+
+    // create our shaders
+    var vertexShader = loadShader(gl, vshader);
+    var fragmentShader = loadShader(gl, fshader);
+
+    if (!vertexShader || !fragmentShader)
+        return null;
+
+    // Create the program object
+    gl.program = gl.createProgram();
+
+    if (!gl.program)
+        return null;
+
+    // Attach our two shaders to the program
+    gl.attachShader (gl.program, vertexShader);
+    gl.attachShader (gl.program, fragmentShader);
+
+    // Bind attributes
+    for (var i in attribs)
+        gl.bindAttribLocation (gl.program, i, attribs[i]);
+
+    // Link the program
+    gl.linkProgram(gl.program);
+
+    // Check the link status
+    var linked = gl.getProgrami(gl.program, gl.LINK_STATUS);
+    if (!linked) {
+        // something went wrong with the link
+        var error = gl.getProgramInfoLog (gl.program);
+        console.log("Error in program linking:"+error);
+
+        gl.deleteProgram(gl.program);
+        gl.deleteProgram(fragmentShader);
+        gl.deleteProgram(vertexShader);
+
+        return null;
+    }
+
+    gl.useProgram(gl.program);
+
+    gl.clearColor (clearColor[0], clearColor[1], clearColor[2], clearColor[3]);
+    gl.clearDepth (clearDepth);
+
+    gl.enable(gl.DEPTH_TEST);
+    gl.enable(gl.BLEND);
+    gl.blendFunc(gl.SRC_ALPHA, gl.ONE_MINUS_SRC_ALPHA);
+
+    return gl;
+}
+
+//
+// loadShader
+//
+// 'shaderId' is the id of a <script> element containing the shader source string.
+// Load this shader and return the CanvasShader object corresponding to it.
+//
+function loadShader(ctx, shaderId)
+{
+    var shaderScript = document.getElementById(shaderId);
+    if (!shaderScript) {
+        console.log("*** Error: shader script '"+shaderId+"' not found");
+        return null;
+    }
+        
+    if (shaderScript.type == "x-shader/x-vertex")
+        var shaderType = ctx.VERTEX_SHADER;
+    else if (shaderScript.type == "x-shader/x-fragment")
+        var shaderType = ctx.FRAGMENT_SHADER;
+    else {
+        console.log("*** Error: shader script '"+shaderId+"' of undefined type '"+shaderScript.type+"'");       
+        return null;
+    }
+
+    // Create the shader object
+    var shader = ctx.createShader(shaderType);
+    if (shader == null) {
+        console.log("*** Error: unable to create shader '"+shaderId+"'");       
+        return null;
+    }
+
+    // Load the shader source
+    ctx.shaderSource(shader, shaderScript.text);
+
+    // Compile the shader
+    ctx.compileShader(shader);
+
+    // Check the compile status
+    var compiled = ctx.getShaderi(shader, ctx.COMPILE_STATUS);
+    if (!compiled) {
+        // Something went wrong during compilation; get the error
+        var error = ctx.getShaderInfoLog(shader);
+        console.log("*** Error compiling shader '"+shaderId+"':"+error);
+        ctx.deleteShader(shader);
+        return null;
+    }
+
+    return shader;
+}
+
+// 
+// makeBox
+//
+// Create a box with vertices, normals and texCoords. Create VBOs for each as well as the index array.
+// Return an object with the following properties:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+// 
+function makeBox(ctx)
+{
+    // box
+    //    v6----- v5
+    //   /|      /|
+    //  v1------v0|
+    //  | |     | |
+    //  | |v7---|-|v4
+    //  |/      |/
+    //  v2------v3
+    //
+    // vertex coords array
+    var vertices = new CanvasFloatArray(
+        [  1, 1, 1,  -1, 1, 1,  -1,-1, 1,   1,-1, 1,    // v0-v1-v2-v3 front
+           1, 1, 1,   1,-1, 1,   1,-1,-1,   1, 1,-1,    // v0-v3-v4-v5 right
+           1, 1, 1,   1, 1,-1,  -1, 1,-1,  -1, 1, 1,    // v0-v5-v6-v1 top
+          -1, 1, 1,  -1, 1,-1,  -1,-1,-1,  -1,-1, 1,    // v1-v6-v7-v2 left
+          -1,-1,-1,   1,-1,-1,   1,-1, 1,  -1,-1, 1,    // v7-v4-v3-v2 bottom
+           1,-1,-1,  -1,-1,-1,  -1, 1,-1,   1, 1,-1 ]   // v4-v7-v6-v5 back
+    );
+
+    // normal array
+    var normals = new CanvasFloatArray(
+        [  0, 0, 1,   0, 0, 1,   0, 0, 1,   0, 0, 1,     // v0-v1-v2-v3 front
+           1, 0, 0,   1, 0, 0,   1, 0, 0,   1, 0, 0,     // v0-v3-v4-v5 right
+           0, 1, 0,   0, 1, 0,   0, 1, 0,   0, 1, 0,     // v0-v5-v6-v1 top
+          -1, 0, 0,  -1, 0, 0,  -1, 0, 0,  -1, 0, 0,     // v1-v6-v7-v2 left
+           0,-1, 0,   0,-1, 0,   0,-1, 0,   0,-1, 0,     // v7-v4-v3-v2 bottom
+           0, 0,-1,   0, 0,-1,   0, 0,-1,   0, 0,-1 ]    // v4-v7-v6-v5 back
+       );
+
+
+    // texCoord array
+    var texCoords = new CanvasFloatArray(
+        [  1, 1,   0, 1,   0, 0,   1, 0,    // v0-v1-v2-v3 front
+           0, 1,   0, 0,   1, 0,   1, 1,    // v0-v3-v4-v5 right
+           1, 0,   1, 1,   0, 1,   0, 0,    // v0-v5-v6-v1 top
+           1, 1,   0, 1,   0, 0,   1, 0,    // v1-v6-v7-v2 left
+           0, 0,   1, 0,   1, 1,   0, 1,    // v7-v4-v3-v2 bottom
+           0, 0,   1, 0,   1, 1,   0, 1 ]   // v4-v7-v6-v5 back
+       );
+
+    // index array
+    var indices = new CanvasUnsignedByteArray(
+        [  0, 1, 2,   0, 2, 3,    // front
+           4, 5, 6,   4, 6, 7,    // right
+           8, 9,10,   8,10,11,    // top
+          12,13,14,  12,14,15,    // left
+          16,17,18,  16,18,19,    // bottom
+          20,21,22,  20,22,23 ]   // back
+      );
+
+    var retval = { };
+    
+    retval.normalObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, normals, ctx.STATIC_DRAW);
+    
+    retval.texCoordObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, texCoords, ctx.STATIC_DRAW);
+
+    retval.vertexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, vertices, ctx.STATIC_DRAW);
+    
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, 0);
+
+    retval.indexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, indices, ctx.STATIC_DRAW);
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, 0);
+    
+    retval.numIndices = indices.length;
+
+    return retval;
+}
+
+// 
+// makeSphere
+//
+// Create a sphere with the passed number of latitude and longitude bands and the passed radius. 
+// Sphere has vertices, normals and texCoords. Create VBOs for each as well as the index array.
+// Return an object with the following properties:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+// 
+function makeSphere(ctx, radius, lats, longs)
+{
+    var geometryData = [ ];
+    var normalData = [ ];
+    var texCoordData = [ ];
+    var indexData = [ ];
+    
+    for (var latNumber = 0; latNumber <= lats; ++latNumber) {
+        for (var longNumber = 0; longNumber <= longs; ++longNumber) {
+            var theta = latNumber * Math.PI / lats;
+            var phi = longNumber * 2 * Math.PI / longs;
+            var sinTheta = Math.sin(theta);
+            var sinPhi = Math.sin(phi);
+            var cosTheta = Math.cos(theta);
+            var cosPhi = Math.cos(phi);
+            
+            var x = cosPhi * sinTheta;
+            var y = cosTheta;
+            var z = sinPhi * sinTheta;
+            var u = 1-(longNumber/longs);
+            var v = latNumber/lats;
+            
+            normalData.push(x);
+            normalData.push(y);
+            normalData.push(z);
+            texCoordData.push(u);
+            texCoordData.push(v);
+            geometryData.push(radius * x);
+            geometryData.push(radius * y);
+            geometryData.push(radius * z);
+        }
+    }
+    
+    longs += 1;
+    for (var latNumber = 0; latNumber < lats; ++latNumber) {
+        for (var longNumber = 0; longNumber < longs; ++longNumber) {
+            var first = (latNumber * longs) + (longNumber % longs);
+            var second = first + longs;
+            indexData.push(first);
+            indexData.push(second);
+            indexData.push(first+1);
+
+            indexData.push(second);
+            indexData.push(second+1);
+            indexData.push(first+1);
+        }
+    }
+    
+    var retval = { };
+    
+    retval.normalObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.normalObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(normalData), ctx.STATIC_DRAW);
+
+    retval.texCoordObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.texCoordObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(texCoordData), ctx.STATIC_DRAW);
+
+    retval.vertexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ARRAY_BUFFER, retval.vertexObject);
+    ctx.bufferData(ctx.ARRAY_BUFFER, new CanvasFloatArray(geometryData), ctx.STATIC_DRAW);
+    
+    retval.numIndices = indexData.length;
+    retval.indexObject = ctx.createBuffer();
+    ctx.bindBuffer(ctx.ELEMENT_ARRAY_BUFFER, retval.indexObject);
+    ctx.bufferData(ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexData), ctx.STREAM_DRAW);
+    
+    return retval;
+}
+
+//
+// loadObj
+//
+// Load a .obj file from the passed URL. Return an object with a 'loaded' property set to false.
+// When the object load is complete, the 'loaded' property becomes true and the following 
+// properties are set:
+//
+//  normalObject        CanvasBuffer object for normals
+//  texCoordObject      CanvasBuffer object for texCoords
+//  vertexObject        CanvasBuffer object for vertices
+//  indexObject         CanvasBuffer object for indices
+//  numIndices          The number of indices in the indexObject
+//  
+function loadObj(ctx, url)
+{
+    var obj = { loaded : false };
+    obj.ctx = ctx;
+    var req = new XMLHttpRequest();
+    req.obj = obj;
+    req.onreadystatechange = function () { processLoadObj(req) };
+    req.open("GET", url, true);
+    req.send(null);
+    return obj;
+}
+
+function processLoadObj(req) 
+{
+    console.log("req="+req)
+    // only if req shows "complete"
+    if (req.readyState == 4) {
+        doLoadObj(req.obj, req.responseText);
+    }
+}
+
+function doLoadObj(obj, text)
+{
+    vertexArray = [ ];
+    normalArray = [ ];
+    textureArray = [ ];
+    indexArray = [ ];
+    
+    var vertex = [ ];
+    var normal = [ ];
+    var texture = [ ];
+    var facemap = { };
+    var index = 0;
+        
+    var lines = text.split("\n");
+    for (var lineIndex in lines) {
+        var line = lines[lineIndex].replace(/[ \t]+/g, " ").replace(/\s\s*$/, "");
+        
+        // ignore comments
+        if (line[0] == "#")
+            continue;
+            
+        var array = line.split(" ");
+        if (array[0] == "v") {
+            // vertex
+            vertex.push(parseFloat(array[1]));
+            vertex.push(parseFloat(array[2]));
+            vertex.push(parseFloat(array[3]));
+        }
+        else if (array[0] == "vt") {
+            // normal
+            texture.push(parseFloat(array[1]));
+            texture.push(parseFloat(array[2]));
+        }
+        else if (array[0] == "vn") {
+            // normal
+            normal.push(parseFloat(array[1]));
+            normal.push(parseFloat(array[2]));
+            normal.push(parseFloat(array[3]));
+        }
+        else if (array[0] == "f") {
+            // face
+            if (array.length != 4) {
+                console.log("*** Error: face '"+line+"' not handled");
+                continue;
+            }
+            
+            for (var i = 1; i < 4; ++i) {
+                if (!(array[i] in facemap)) {
+                    // add a new entry to the map and arrays
+                    var f = array[i].split("/");
+                    var vtx, nor, tex;
+                    
+                    if (f.length == 1) {
+                        vtx = parseInt(f[0]) - 1;
+                        nor = vtx;
+                        tex = vtx;
+                    }
+                    else if (f.length = 3) {
+                        vtx = parseInt(f[0]) - 1;
+                        tex = parseInt(f[1]) - 1;
+                        nor = parseInt(f[2]) - 1;
+                    }
+                    else {
+                        console.log("*** Error: did not understand face '"+array[i]+"'");
+                        return null;
+                    }
+                    
+                    // do the vertices
+                    var x = 0;
+                    var y = 0;
+                    var z = 0;
+                    if (vtx * 3 + 2 < vertex.length) {
+                        x = vertex[vtx*3];
+                        y = vertex[vtx*3+1];
+                        z = vertex[vtx*3+2];
+                    }
+                    vertexArray.push(x);
+                    vertexArray.push(y);
+                    vertexArray.push(z);
+                    
+                    // do the textures
+                    x = 0;
+                    y = 0;
+                    if (tex * 2 + 1 < texture.length) {
+                        x = texture[tex*2];
+                        y = texture[tex*2+1];
+                    }
+                    textureArray.push(x);
+                    textureArray.push(y);
+                    
+                    // do the normals
+                    x = 0;
+                    y = 0;
+                    z = 1;
+                    if (nor * 3 + 2 < normal.length) {
+                        x = normal[nor*3];
+                        y = normal[nor*3+1];
+                        z = normal[nor*3+2];
+                    }
+                    normalArray.push(x);
+                    normalArray.push(y);
+                    normalArray.push(z);
+                    
+                    facemap[array[i]] = index++;
+                }
+                
+                indexArray.push(facemap[array[i]]);
+            }
+        }
+    }
+
+    // set the VBOs
+    obj.normalObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.normalObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(normalArray), obj.ctx.STATIC_DRAW);
+
+    obj.texCoordObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.texCoordObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(textureArray), obj.ctx.STATIC_DRAW);
+
+    obj.vertexObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ARRAY_BUFFER, obj.vertexObject);
+    obj.ctx.bufferData(obj.ctx.ARRAY_BUFFER, new CanvasFloatArray(vertexArray), obj.ctx.STATIC_DRAW);
+    
+    obj.numIndices = indexArray.length;
+    obj.indexObject = obj.ctx.createBuffer();
+    obj.ctx.bindBuffer(obj.ctx.ELEMENT_ARRAY_BUFFER, obj.indexObject);
+    obj.ctx.bufferData(obj.ctx.ELEMENT_ARRAY_BUFFER, new CanvasUnsignedShortArray(indexArray), obj.ctx.STREAM_DRAW);
+    
+    obj.loaded = true;
+}
+
+//
+// loadImageTexture
+//
+// Load the image at the passed url, place it in a new CanvasTexture object and return the CanvasTexture.
+//
+function loadImageTexture(ctx, url)
+{
+    var texture = ctx.createTexture();
+    texture.image = new Image();
+    texture.image.onload = function() { doLoadImageTexture(ctx, texture.image, texture) }
+    texture.image.src = url;
+    return texture;
+}
+
+function doLoadImageTexture(ctx, image, texture)
+{
+    ctx.enable(ctx.TEXTURE_2D);
+    ctx.bindTexture(ctx.TEXTURE_2D, texture);
+    ctx.texImage2D(ctx.TEXTURE_2D, 0, image);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_MAG_FILTER, ctx.LINEAR);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_MIN_FILTER, ctx.LINEAR_MIPMAP_LINEAR);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_WRAP_S, ctx.CLAMP_TO_EDGE);
+    ctx.texParameteri(ctx.TEXTURE_2D, ctx.TEXTURE_WRAP_T, ctx.CLAMP_TO_EDGE);
+    ctx.generateMipmap(ctx.TEXTURE_2D)
+    ctx.bindTexture(ctx.TEXTURE_2D, 0);
+}
+
+//
+// Framerate object
+//
+// This object keeps track of framerate and displays it as the innerHTML text of the 
+// HTML element with the passed id. Once created you call snapshot at the end
+// of every rendering cycle. Every 500ms the framerate is updated in the HTML element.
+//
+Framerate = function(id)
+{
+    this.numFramerates = 10;
+    this.framerateUpdateInterval = 500;
+    this.id = id;
+
+    this.renderTime = -1;
+    this.framerates = [ ];
+    self = this;
+    var fr = function() { self.updateFramerate() }
+    setInterval(fr, this.framerateUpdateInterval);
+}
+
+Framerate.prototype.updateFramerate = function()
+{
+    var tot = 0;
+    for (var i = 0; i < this.framerates.length; ++i)
+        tot += this.framerates[i];
+        
+    var framerate = tot / this.framerates.length;
+    framerate = Math.round(framerate);
+    document.getElementById(this.id).innerHTML = "Framerate:"+framerate+"fps";
+}
+
+Framerate.prototype.snapshot = function()
+{
+    if (this.renderTime < 0)
+        this.renderTime = new Date().getTime();
+    else {
+        var newTime = new Date().getTime();
+        var t = newTime - this.renderTime;
+        var framerate = 1000/t;
+        this.framerates.push(framerate);
+        while (this.framerates.length > this.numFramerates)
+            this.framerates.shift();
+        this.renderTime = newTime;
+    }
+}
+
diff --git a/WebCore/manual-tests/wml/select-onpick-event-crash.wml b/WebCore/manual-tests/wml/select-onpick-event-crash.wml
new file mode 100644
index 0000000..07d0262
--- /dev/null
+++ b/WebCore/manual-tests/wml/select-onpick-event-crash.wml
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1//EN" "http://www.wapforum.org/DTD/wml_1.1.xml">
+<wml>
+    <card>
+        <select name="result" dmultiple="true">
+            <option onpick="#card2" value="foo">Foo</option>
+            <option onpick="#card2" value="bar">Bar</option>
+        </select>
+    </card>
+
+    <card id="card2">Test pass, if it didn't crash.</card>
+</wml>
diff --git a/WebCore/mathml/MathMLElement.cpp b/WebCore/mathml/MathMLElement.cpp
new file mode 100644
index 0000000..14febe5
--- /dev/null
+++ b/WebCore/mathml/MathMLElement.cpp
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+    
+MathMLElement::MathMLElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
+{
+}
+    
+PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLElement(tagName, document);
+}
+
+RenderObject* MathMLElement::createRenderer(RenderArena*, RenderStyle* style)
+{
+    return RenderObject::createObject(this, style);
+}
+    
+    
+}
+
+#endif // ENABLE(MATHML)
diff --git a/WebCore/mathml/MathMLElement.h b/WebCore/mathml/MathMLElement.h
new file mode 100644
index 0000000..b00af47
--- /dev/null
+++ b/WebCore/mathml/MathMLElement.h
@@ -0,0 +1,45 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLElement_h
+#define MathMLElement_h
+
+#if ENABLE(MATHML)
+#include "StyledElement.h"
+
+namespace WebCore {
+    
+class MathMLElement : public StyledElement {
+public:
+    static PassRefPtr<MathMLElement> create(const QualifiedName& tagName, Document*);
+    
+    virtual bool isMathMLElement() const { return true; }
+    
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    
+protected:
+    MathMLElement(const QualifiedName& tagName, Document*);
+    
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLElement_h
diff --git a/WebCore/mathml/MathMLInlineContainerElement.cpp b/WebCore/mathml/MathMLInlineContainerElement.cpp
new file mode 100644
index 0000000..2bb02f6
--- /dev/null
+++ b/WebCore/mathml/MathMLInlineContainerElement.cpp
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLInlineContainerElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+MathMLInlineContainerElement::MathMLInlineContainerElement(const QualifiedName& tagName, Document* document)
+    : MathMLElement(tagName, document)
+{
+}
+
+PassRefPtr<MathMLInlineContainerElement> MathMLInlineContainerElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLInlineContainerElement(tagName, document);
+}
+
+RenderObject* MathMLInlineContainerElement::createRenderer(RenderArena *, RenderStyle* style)
+{
+    // FIXME: This method will contain the specialized renderers based on element name
+    return RenderObject::createObject(this, style);
+}
+    
+    
+}
+
+#endif // ENABLE(MATHML)
+
diff --git a/WebCore/mathml/MathMLInlineContainerElement.h b/WebCore/mathml/MathMLInlineContainerElement.h
new file mode 100644
index 0000000..4529d3b
--- /dev/null
+++ b/WebCore/mathml/MathMLInlineContainerElement.h
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLInlineContainerElement_h
+#define MathMLInlineContainerElement_h
+
+#if ENABLE(MATHML)
+#include "MathMLElement.h"
+
+namespace WebCore {
+    
+class MathMLInlineContainerElement : public MathMLElement {
+public:
+    static PassRefPtr<MathMLInlineContainerElement> create(const QualifiedName& tagName, Document*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+protected:
+    MathMLInlineContainerElement(const QualifiedName& tagName, Document*);
+
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLInlineContainerElement_h
diff --git a/WebCore/mathml/MathMLMathElement.cpp b/WebCore/mathml/MathMLMathElement.cpp
new file mode 100644
index 0000000..8b083f4
--- /dev/null
+++ b/WebCore/mathml/MathMLMathElement.cpp
@@ -0,0 +1,46 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#include "config.h"
+
+#if ENABLE(MATHML)
+
+#include "MathMLMathElement.h"
+
+#include "MathMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+    
+using namespace MathMLNames;
+
+MathMLMathElement::MathMLMathElement(const QualifiedName& tagName, Document* document)
+    : MathMLInlineContainerElement(tagName, document)
+{
+}
+
+PassRefPtr<MathMLMathElement> MathMLMathElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new MathMLMathElement(tagName, document);
+}
+
+}
+
+#endif // ENABLE(MATHML)
diff --git a/WebCore/mathml/MathMLMathElement.h b/WebCore/mathml/MathMLMathElement.h
new file mode 100644
index 0000000..f363cd2
--- /dev/null
+++ b/WebCore/mathml/MathMLMathElement.h
@@ -0,0 +1,41 @@
+/*
+ *  Copyright (C) 2009 Alex Milowski (alex@milowski.com). All rights reserved.
+ * 
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *  
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *  
+ *  You should have received a copy of the GNU Library General Public
+ *  License along with this library; if not, write to the
+ *  Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ *  Boston, MA  02110-1301, USA. 
+ *  
+ */
+
+#ifndef MathMLMathElement_h
+#define MathMLMathElement_h
+
+#if ENABLE(MATHML)
+#include "MathMLInlineContainerElement.h"
+
+namespace WebCore {
+    
+class MathMLMathElement : public MathMLInlineContainerElement {
+public:
+    static PassRefPtr<MathMLMathElement> create(const QualifiedName& tagName, Document*);
+    
+protected:
+    MathMLMathElement(const QualifiedName& tagName, Document*);
+    
+};
+    
+}
+
+#endif // ENABLE(MATHML)
+#endif // MathMLMathElement_h
diff --git a/WebCore/mathml/mathtags.in b/WebCore/mathml/mathtags.in
new file mode 100644
index 0000000..8704dbf
--- /dev/null
+++ b/WebCore/mathml/mathtags.in
@@ -0,0 +1,21 @@
+namespace="MathML"
+namespaceURI="http://www.w3.org/1998/Math/MathML"
+guardFactoryWith="ENABLE(MATHML)"
+exportStrings
+
+math
+mfrac interfaceName=MathMLInlineContainerElement
+mfenced interfaceName=MathMLInlineContainerElement
+msubsup interfaceName=MathMLInlineContainerElement
+mrow interfaceName=MathMLInlineContainerElement
+mover interfaceName=MathMLInlineContainerElement
+munder interfaceName=MathMLInlineContainerElement
+munderover interfaceName=MathMLInlineContainerElement
+msqrt interfaceName=MathMLInlineContainerElement
+mroot interfaceName=MathMLInlineContainerElement
+mi interfaceName=MathMLElement, createWithNew
+mn interfaceName=MathMLElement, createWithNew
+mo interfaceName=MathMLElement, createWithNew
+msub interfaceName=MathMLElement, createWithNew
+msup interfaceName=MathMLElement, createWithNew
+
diff --git a/WebCore/notifications/Notification.cpp b/WebCore/notifications/Notification.cpp
new file mode 100644
index 0000000..8dd168f
--- /dev/null
+++ b/WebCore/notifications/Notification.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+#include "Notification.h"
+#include "NotificationContents.h"
+
+#include "Document.h"
+#include "EventNames.h"
+#include "WorkerContext.h" 
+
+namespace WebCore {
+
+Notification::Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(true)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_notificationURL = context->completeURL(url);
+    if (url.isEmpty() || !m_notificationURL.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::Notification(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider)
+    : ActiveDOMObject(context, this)
+    , m_isHTML(false)
+    , m_contents(contents)
+    , m_isShowing(false)
+    , m_presenter(provider)
+{
+    if (m_presenter->checkPermission(context->securityOrigin()) != NotificationPresenter::PermissionAllowed) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    KURL icon = context->completeURL(contents.icon());
+    if (!icon.isEmpty() && !icon.isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+}
+
+Notification::~Notification() 
+{
+    m_presenter->notificationObjectDestroyed(this);
+}
+
+void Notification::show() 
+{
+    // prevent double-showing
+    if (!m_isShowing)
+        m_isShowing = m_presenter->show(this);
+}
+
+void Notification::cancel() 
+{
+    if (m_isShowing)
+        m_presenter->cancel(this);
+}
+
+EventTargetData* Notification::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* Notification::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/notifications/Notification.h b/WebCore/notifications/Notification.h
new file mode 100644
index 0000000..6545579
--- /dev/null
+++ b/WebCore/notifications/Notification.h
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Notification_h  
+#define Notification_h
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "Event.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "ExceptionCode.h"
+#include "KURL.h"
+#include "NotificationPresenter.h"
+#include "NotificationContents.h"
+#include "RegisteredEventListener.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+namespace WebCore {
+
+    class WorkerContext;
+
+    class Notification : public RefCounted<Notification>, public ActiveDOMObject, public EventTarget { 
+    public:
+        static Notification* create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(url, context, ec, provider); }
+        static Notification* create(const NotificationContents& contents, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider) { return new Notification(contents, context, ec, provider); }
+        
+        virtual ~Notification();
+
+        void show();
+        void cancel();
+    
+        bool isHTML() { return m_isHTML; }
+        KURL url() { return m_notificationURL; }
+        NotificationContents& contents() { return m_contents; }
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(display);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(close);
+    
+        using RefCounted<Notification>::ref;
+        using RefCounted<Notification>::deref;
+    
+        // EventTarget interface
+        virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
+        virtual Notification* toNotification() { return this; }
+
+    private:
+        Notification(const String& url, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+        Notification(const NotificationContents& fields, ScriptExecutionContext* context, ExceptionCode& ec, NotificationPresenter* provider);
+
+        // EventTarget interface
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+
+        bool m_isHTML;
+        KURL m_notificationURL;
+        NotificationContents m_contents;
+
+        bool m_isShowing;
+
+        NotificationPresenter* m_presenter;
+        
+        EventTargetData m_eventTargetData;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // Notifications_h
diff --git a/WebCore/notifications/Notification.idl b/WebCore/notifications/Notification.idl
new file mode 100644
index 0000000..ec6a9c8
--- /dev/null
+++ b/WebCore/notifications/Notification.idl
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS,
+        EventTarget
+    ] Notification {
+        void show();
+        void cancel();
+
+        attribute EventListener ondisplay;
+        attribute EventListener onerror;
+        attribute EventListener onclose;
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type, 
+                                       in EventListener listener, 
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type, 
+                                          in EventListener listener, 
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+    };
+
+}
diff --git a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp b/WebCore/notifications/NotificationCenter.cpp
index ce56563..94976a2 100644
--- a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.cpp
+++ b/WebCore/notifications/NotificationCenter.cpp
@@ -30,30 +30,31 @@
 
 #include "config.h"
 
-#if ENABLE(WORKERS)
+#if ENABLE(NOTIFICATIONS)
 
-#include "V8WorkerContextObjectEventListener.h"
+#include "NotificationCenter.h"
 
-#include "WorkerContextExecutionProxy.h"
+#include "Document.h"
+#include "VoidCallback.h"
+#include "WorkerContext.h"
 
 namespace WebCore {
 
-static void weakObjectEventListenerCallback(v8::Persistent<v8::Value>, void* parameter)
-{
-    V8WorkerContextObjectEventListener* listener = static_cast<V8WorkerContextObjectEventListener*>(parameter);
-
-    // Remove the wrapper
-    listener->proxy()->removeEventListener(listener);
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter) 
+    : ActiveDOMObject(context, this)
+    , m_scriptExecutionContext(context)
+    , m_notificationPresenter(presenter) {}
 
-    listener->disposeListenerObject();
+int NotificationCenter::checkPermission() 
+{
+    return m_notificationPresenter->checkPermission(m_scriptExecutionContext->securityOrigin());
 }
 
-V8WorkerContextObjectEventListener::V8WorkerContextObjectEventListener(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-    : V8WorkerContextEventListener(proxy, listener, isInline)
+void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
-    m_listener.MakeWeak(this, weakObjectEventListenerCallback);
+    m_notificationPresenter->requestPermission(m_scriptExecutionContext->securityOrigin(), callback);
 }
 
 } // namespace WebCore
 
-#endif // WORKERS
+#endif // ENABLE(NOTIFICATIONS)
diff --git a/WebCore/notifications/NotificationCenter.h b/WebCore/notifications/NotificationCenter.h
new file mode 100644
index 0000000..596ab8b
--- /dev/null
+++ b/WebCore/notifications/NotificationCenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationCenter_h
+#define NotificationCenter_h
+
+#include "Notification.h"
+#include "NotificationContents.h"
+#include "WorkerThread.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+
+    class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject { 
+    public:
+        static PassRefPtr<NotificationCenter> create(ScriptExecutionContext* context, NotificationPresenter* presenter) { return adoptRef(new NotificationCenter(context, presenter)); }
+        
+        Notification* createHTMLNotification(const String& URI, ExceptionCode& ec)
+        {
+            return Notification::create(KURL(ParsedURLString, URI), context(), ec, presenter());
+        }
+
+        Notification* createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
+        {
+            NotificationContents contents(iconURI, title, body);
+            return Notification::create(contents, context(), ec, presenter());
+        }
+
+        ScriptExecutionContext* context() const { return m_scriptExecutionContext; }
+        NotificationPresenter* presenter() const { return m_notificationPresenter; }
+
+        int checkPermission();
+        void requestPermission(PassRefPtr<VoidCallback> callback);
+
+    private:
+        NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
+
+        ScriptExecutionContext* m_scriptExecutionContext;
+        NotificationPresenter* m_notificationPresenter;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationCenter_h
diff --git a/WebCore/notifications/NotificationCenter.idl b/WebCore/notifications/NotificationCenter.idl
new file mode 100644
index 0000000..3f6e369
--- /dev/null
+++ b/WebCore/notifications/NotificationCenter.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module threads {
+
+    interface [
+        Conditional=NOTIFICATIONS
+    ] NotificationCenter {
+       [V8Custom] Notification createHTMLNotification(in DOMString url) raises(Exception);
+       [V8Custom] Notification createNotification(in DOMString iconUrl, in DOMString title, in DOMString body) raises(Exception);
+
+       int checkPermission();
+       [Custom] void requestPermission(in VoidCallback callback);
+    };
+
+}
diff --git a/WebCore/notifications/NotificationContents.h b/WebCore/notifications/NotificationContents.h
new file mode 100644
index 0000000..ebdc514
--- /dev/null
+++ b/WebCore/notifications/NotificationContents.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationContents_h
+#define NotificationContents_h
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class NotificationContents { 
+    public:
+        NotificationContents() {}
+        NotificationContents(const String& iconUrl, const String& title, const String& body) 
+            : m_icon(iconUrl)
+            , m_title(title)
+            , m_body(body) {}
+
+        String icon() const { return m_icon; }
+        String title() const { return m_title; }
+        String body() const { return m_body; }
+
+    private:
+        String m_icon;
+        String m_title;
+        String m_body;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationContents_h
diff --git a/WebCore/notifications/NotificationPresenter.h b/WebCore/notifications/NotificationPresenter.h
new file mode 100644
index 0000000..d70a3e9
--- /dev/null
+++ b/WebCore/notifications/NotificationPresenter.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NotificationPresenter_h
+#define NotificationPresenter_h
+
+#include <wtf/PassRefPtr.h>
+#include "VoidCallback.h"
+
+#if ENABLE(NOTIFICATIONS)
+
+namespace WebCore {
+
+    class Notification;
+    class SecurityOrigin;
+    class String;
+    
+    class NotificationPresenter {
+
+    public:
+        enum Permission { 
+            PermissionAllowed,     // User has allowed notifications
+            PermissionNotAllowed,  // User has not yet allowed
+            PermissionDenied       // User has explictly denied permission
+        };
+
+        virtual ~NotificationPresenter() {}
+
+        // Requests that a notification be shown.
+        virtual bool show(Notification* object) = 0;
+
+        // Requests that a notification that has already been shown be canceled.
+        virtual void cancel(Notification* object) = 0;
+
+        // Informs the presenter that a Notification object has been destroyed 
+        // (such as by a page transition).  The presenter may continue showing
+        // the notification, but must not attempt to call the event handlers.
+        virtual void notificationObjectDestroyed(Notification* object) = 0;
+
+        // Requests user permission to show desktop notifications from a particular
+        // origin.  The callback parameter should be run when the user has
+        // made a decision.
+        virtual void requestPermission(SecurityOrigin* origin, PassRefPtr<VoidCallback> callback) = 0;
+
+        // Checks the current level of permission.
+        virtual Permission checkPermission(SecurityOrigin* origin) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(NOTIFICATIONS)
+
+#endif // NotificationPresenter_h
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index 5a5670e..96f0fb7 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -87,9 +87,9 @@ IntRect Chrome::windowToScreen(const IntRect& rect) const
     return m_client->windowToScreen(rect);
 }
 
-PlatformWidget Chrome::platformWindow() const
+PlatformPageClient Chrome::platformPageClient() const
 {
-    return m_client->platformWindow();
+    return m_client->platformPageClient();
 }
 
 void Chrome::contentsSizeChanged(Frame* frame, const IntSize& size) const
@@ -102,6 +102,11 @@ void Chrome::scrollRectIntoView(const IntRect& rect, const ScrollView* scrollVie
     m_client->scrollRectIntoView(rect, scrollView);
 }
 
+void Chrome::scrollbarsModeDidChange() const
+{
+    m_client->scrollbarsModeDidChange();
+}
+
 void Chrome::setWindowRect(const FloatRect& rect) const
 {
     m_client->setWindowRect(rect);
@@ -311,8 +316,10 @@ void Chrome::mouseDidMoveOverElement(const HitTestResult& result, unsigned modif
     }
     m_client->mouseDidMoveOverElement(result, modifierFlags);
 
+#if ENABLE(INSPECTOR)
     if (InspectorController* inspector = m_page->inspectorController())
         inspector->mouseDidMoveOverElement(result, modifierFlags);
+#endif
 }
 
 void Chrome::setToolTip(const HitTestResult& result)
@@ -403,6 +410,13 @@ bool Chrome::setCursor(PlatformCursorHandle cursor)
     return m_client->setCursor(cursor);
 }
 
+#if ENABLE(NOTIFICATIONS)
+NotificationPresenter* Chrome::notificationPresenter() const
+{
+    return m_client->notificationPresenter();
+}
+#endif
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index c26e450..033311d 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -44,6 +44,9 @@ namespace WebCore {
     class IntRect;
     class Page;
     class String;
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     struct FrameLoadRequest;
     struct WindowFeatures;
@@ -60,8 +63,9 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
         virtual IntPoint screenToWindow(const IntPoint&) const;
         virtual IntRect windowToScreen(const IntRect&) const;
-        virtual PlatformWidget platformWindow() const;
+        virtual PlatformPageClient platformPageClient() const;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const;
+        virtual void scrollbarsModeDidChange() const;
 
         void contentsSizeChanged(Frame*, const IntSize&) const;
 
@@ -128,6 +132,10 @@ namespace WebCore {
         void focusNSView(NSView*);
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* notificationPresenter() const; 
+#endif
+
     private:
         Page* m_page;
         ChromeClient* m_client;
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 409a492..5231603 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -62,6 +62,10 @@ namespace WebCore {
     class GraphicsLayer;
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
+
     class ChromeClient {
     public:
         virtual void chromeDestroyed() = 0;
@@ -124,11 +128,12 @@ namespace WebCore {
         virtual void scroll(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect) = 0;
         virtual IntPoint screenToWindow(const IntPoint&) const = 0;
         virtual IntRect windowToScreen(const IntRect&) const = 0;
-        virtual PlatformWidget platformWindow() const = 0;
+        virtual PlatformPageClient platformPageClient() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
+        virtual void scrollbarsModeDidChange() const = 0;
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
 
         virtual void setToolTip(const String&, TextDirection) = 0;
@@ -152,6 +157,10 @@ namespace WebCore {
         virtual void dashboardRegionsChanged();
 #endif
 
+#if ENABLE(NOTIFICATIONS)
+        virtual NotificationPresenter* notificationPresenter() const = 0;
+#endif
+
         virtual void populateVisitedLinks();
 
         virtual FloatRect customHighlightRect(Node*, const AtomicString& type, const FloatRect& lineRect);
@@ -166,7 +175,7 @@ namespace WebCore {
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
-        // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
+        // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
         // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
         virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
             
@@ -194,6 +203,10 @@ namespace WebCore {
         virtual void scheduleCompositingLayerSync() = 0;
 #endif
 
+        virtual bool supportsFullscreenForNode(const Node*) { return false; }
+        virtual void enterFullscreenForNode(Node*) { }
+        virtual void exitFullscreenForNode(Node*) { }
+        
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index b5c9bb2..79613d3 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -129,6 +129,9 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
     case ErrorMessageLevel:
         levelString = "ERROR";
         break;
+    case DebugMessageLevel:
+        levelString = "DEBUG";
+        break;
     default:
         ASSERT_NOT_REACHED();
         levelString = "UNKNOWN";
@@ -147,7 +150,9 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     if (source == JSMessageSource)
         page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -173,7 +178,9 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
+#if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack);
+#endif
 
     if (!Console::shouldPrintExceptions())
         return;
@@ -246,6 +253,7 @@ void Console::assertCondition(bool condition, ScriptCallStack* callStack)
 
 void Console::count(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -257,6 +265,9 @@ void Console::count(ScriptCallStack* callStack)
     getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 #if ENABLE(WML)
@@ -293,19 +304,27 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     // FIXME: log a console message when profiling is disabled.
     if (!controller->profilerEnabled())
         return;
+#endif
 
     JSC::UString resolvedTitle = title;
     if (title.isNull())   // no title so give it the next user initiated profile title.
+#if ENABLE(INSPECTOR)
         resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
+#else
+        resolvedTitle = "";
+#endif
 
     JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -317,9 +336,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!this->page())
         return;
 
+#if ENABLE(INSPECTOR)
     InspectorController* controller = page->inspectorController();
     if (!controller->profilerEnabled())
         return;
+#endif
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
     if (!profile)
@@ -327,14 +348,17 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
+#if ENABLE(INSPECTOR)
     const ScriptCallFrame& lastCaller = callStack->at(0);
     controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
+#endif
 }
 
 #endif
 
 void Console::time(const String& title)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -345,10 +369,14 @@ void Console::time(const String& title)
         return;
 
     page->inspectorController()->startTiming(title);
+#else
+    UNUSED_PARAM(title);
+#endif
 }
 
 void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
@@ -366,24 +394,34 @@ void Console::timeEnd(const String& title, ScriptCallStack* callStack)
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
     page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+#else
+    UNUSED_PARAM(title);
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::group(ScriptCallStack* callStack)
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->startGroup(JSMessageSource, callStack);
+#else
+    UNUSED_PARAM(callStack);
+#endif
 }
 
 void Console::groupEnd()
 {
+#if ENABLE(INSPECTOR)
     Page* page = this->page();
     if (!page)
         return;
 
     page->inspectorController()->endGroup(JSMessageSource, 0, String());
+#endif
 }
 
 void Console::warn(ScriptCallStack* callStack)
diff --git a/WebCore/page/Console.h b/WebCore/page/Console.h
index 6d4dbce..08d43e3 100644
--- a/WebCore/page/Console.h
+++ b/WebCore/page/Console.h
@@ -71,7 +71,8 @@ namespace WebCore {
         TipMessageLevel,
         LogMessageLevel,
         WarningMessageLevel,
-        ErrorMessageLevel
+        ErrorMessageLevel,
+        DebugMessageLevel
     };
 
     class Console : public RefCounted<Console> {
diff --git a/WebCore/page/ContextMenuController.cpp b/WebCore/page/ContextMenuController.cpp
index 0ec9d1c..1cf0014 100644
--- a/WebCore/page/ContextMenuController.cpp
+++ b/WebCore/page/ContextMenuController.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuController.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "Chrome.h"
 #include "ContextMenu.h"
 #include "ContextMenuClient.h"
@@ -95,8 +97,10 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
 
     m_contextMenu.set(new ContextMenu(result));
     m_contextMenu->populate();
+#if ENABLE(INSPECTOR)
     if (m_page->inspectorController()->enabled())
         m_contextMenu->addInspectElementItem();
+#endif
 
     PlatformMenuDescription customMenu = m_client->getCustomMenuFromDefaultItems(m_contextMenu.get());
     m_contextMenu->setPlatformDescription(customMenu);
@@ -162,10 +166,12 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->copy();
         break;
     case ContextMenuItemTagGoBack:
-        frame->loader()->goBackOrForward(-1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(-1);
         break;
     case ContextMenuItemTagGoForward:
-        frame->loader()->goBackOrForward(1);
+        if (Page* page = frame->page())
+            page->goBackOrForward(1);
         break;
     case ContextMenuItemTagStop:
         frame->loader()->stop();
@@ -325,13 +331,17 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         frame->editor()->changeBackToReplacedString(result.replacedString());
         break;
 #endif
+#if ENABLE(INSPECTOR)
     case ContextMenuItemTagInspectElement:
         if (Page* page = frame->page())
             page->inspectorController()->inspect(result.innerNonSharedNode());
         break;
+#endif
     default:
         break;
     }
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/page/Coordinates.h b/WebCore/page/Coordinates.h
index 43870a1..bd29d42 100644
--- a/WebCore/page/Coordinates.h
+++ b/WebCore/page/Coordinates.h
@@ -50,7 +50,11 @@ public:
     bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
     bool canProvideHeading() const { return m_canProvideHeading; }
     bool canProvideSpeed() const { return m_canProvideSpeed; }
+<<<<<<< HEAD:WebCore/page/Coordinates.h
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Coordinates.h
 private:
     Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
         : m_latitude(latitude)
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index c42a0dc..dd1e842 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -47,6 +47,9 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
     , m_action(action)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
+#if !ASSERT_DISABLED
+    , m_suspended(false)
+#endif
 {
     static int lastUsedTimeoutId = 0;
     ++lastUsedTimeoutId;
@@ -148,7 +151,10 @@ void DOMTimer::stop()
 
 void DOMTimer::suspend()
 {
-    ASSERT(!m_nextFireInterval && !m_repeatInterval);
+#if !ASSERT_DISABLED
+    ASSERT(!m_suspended);
+    m_suspended = true;
+#endif
     m_nextFireInterval = nextFireInterval();
     m_repeatInterval = repeatInterval();
     TimerBase::stop();
@@ -156,9 +162,11 @@ void DOMTimer::suspend()
 
 void DOMTimer::resume()
 {
+#if !ASSERT_DISABLED
+    ASSERT(m_suspended);
+    m_suspended = false;
+#endif
     start(m_nextFireInterval, m_repeatInterval);
-    m_nextFireInterval = 0;
-    m_repeatInterval = 0;
 }
 
 
diff --git a/WebCore/page/DOMTimer.h b/WebCore/page/DOMTimer.h
index 6d6271f..3c65258 100644
--- a/WebCore/page/DOMTimer.h
+++ b/WebCore/page/DOMTimer.h
@@ -66,6 +66,9 @@ namespace WebCore {
         OwnPtr<ScheduledAction> m_action;
         double m_nextFireInterval;
         double m_repeatInterval;
+#if !ASSERT_DISABLED
+        bool m_suspended;
+#endif
         static double s_minTimerInterval;
     };
 
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index e50b488..e80ce87 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -34,8 +34,11 @@
 #include "CString.h"
 #include "Chrome.h"
 #include "Console.h"
+#include "Database.h"
+#include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMTimer.h"
+#include "PageTransitionEvent.h"
 #include "Document.h"
 #include "Element.h"
 #include "EventException.h"
@@ -54,32 +57,23 @@
 #include "Media.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
+#include "NotificationCenter.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "Screen.h"
 #include "SecurityOrigin.h"
+#include "SerializedScriptValue.h"
 #include "Settings.h"
+#include "Storage.h"
+#include "StorageArea.h"
+#include "StorageNamespace.h"
 #include "SuddenTermination.h"
 #include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
 
-#if ENABLE(DATABASE)
-#include "Database.h"
-#endif
-
-#if ENABLE(DOM_STORAGE)
-#include "Storage.h"
-#include "StorageArea.h"
-#include "StorageNamespace.h"
-#endif
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "DOMApplicationCache.h"
-#endif
-
 using std::min;
 using std::max;
 
@@ -87,24 +81,20 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannel> channel, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, PassRefPtr<SerializedScriptValue> message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannelArray> channels, SecurityOrigin* targetOrigin)
         : m_window(window)
         , m_message(message)
         , m_origin(sourceOrigin)
         , m_source(source)
-        , m_channel(channel)
+        , m_channels(channels)
         , m_targetOrigin(targetOrigin)
     {
     }
 
     PassRefPtr<MessageEvent> event(ScriptExecutionContext* context)
     {
-        RefPtr<MessagePort> messagePort;
-        if (m_channel) {
-            messagePort = MessagePort::create(*context);
-            messagePort->entangle(m_channel.release());
-        }
-        return MessageEvent::create(m_message, m_origin, "", m_source, messagePort.release());
+        OwnPtr<MessagePortArray> messagePorts = MessagePort::entanglePorts(*context, m_channels.release());
+        return MessageEvent::create(messagePorts.release(), m_message, m_origin, "", m_source);
     }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
 
@@ -115,90 +105,103 @@ private:
     }
 
     RefPtr<DOMWindow> m_window;
-    String m_message;
+    RefPtr<SerializedScriptValue> m_message;
     String m_origin;
     RefPtr<DOMWindow> m_source;
-    OwnPtr<MessagePortChannel> m_channel;
+    OwnPtr<MessagePortChannelArray> m_channels;
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
-typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+typedef HashCountedSet<DOMWindow*> DOMWindowSet;
 
-static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+static DOMWindowSet& windowsWithUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithUnloadEventListeners, ());
+    return windowsWithUnloadEventListeners;
 }
 
-static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+static DOMWindowSet& windowsWithBeforeUnloadEventListeners()
 {
-    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
-    return eventListenerMap;
+    DEFINE_STATIC_LOCAL(DOMWindowSet, windowsWithBeforeUnloadEventListeners, ());
+    return windowsWithBeforeUnloadEventListeners;
 }
 
-static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+static void addUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    Frame* frame = window->frame();
-    Page* page = frame->page();
-    return page && frame == page->mainFrame();
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
 }
 
-static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+static void removeUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    if (map.isEmpty())
-        disableSuddenTermination();
-
-    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
-    if (result.second)
-        result.first->second = new RegisteredEventListenerVector;
-    result.first->second->append(listener);
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
 }
 
-static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+static void removeAllUnloadEventListeners(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
-    ASSERT_ARG(listener, listener);
-
-    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
-    ASSERT(it != map.end());
-
-    RegisteredEventListenerVector* listeners = it->second;
-    size_t index = listeners->find(listener);
-    ASSERT(index != WTF::notFound);
-    listeners->remove(index);
-
-    if (!listeners->isEmpty())
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
         return;
-
-    map.remove(it);
-    delete listeners;
-
-    if (map.isEmpty())
+    set.removeAll(it);
+    if (set.isEmpty())
         enableSuddenTermination();
 }
 
-static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
+static void addBeforeUnloadEventListener(DOMWindow* domWindow)
 {
-    ASSERT_ARG(window, window);
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
+        disableSuddenTermination();
+    set.add(domWindow);
+}
 
-    RegisteredEventListenerVector* listeners = map.take(window);
-    if (!listeners)
+static void removeBeforeUnloadEventListener(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
         return;
+    set.remove(it);
+    if (set.isEmpty())
+        enableSuddenTermination();
+}
 
-    delete listeners;
-
-    if (map.isEmpty())
+static void removeAllBeforeUnloadEventListeners(DOMWindow* domWindow)
+{
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    DOMWindowSet::iterator it = set.find(domWindow);
+    if (it == set.end())
+        return;
+    set.removeAll(it);
+    if (set.isEmpty())
         enableSuddenTermination();
 }
 
+static bool allowsBeforeUnloadListeners(DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+    Frame* frame = window->frame();
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return frame == page->mainFrame();
+}
+
 bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithBeforeUnloadEventListeners();
+    if (set.isEmpty())
         return true;
 
     static bool alreadyDispatched = false;
@@ -207,20 +210,21 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
         return true;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
 
-        RegisteredEventListenerVector listenersCopy = *listeners;
         Frame* frame = window->frame();
-        if (!frame->shouldClose(&listenersCopy))
+        if (!frame)
+            continue;
+
+        if (!frame->shouldClose())
             return false;
     }
 
@@ -233,14 +237,13 @@ bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
 
 unsigned DOMWindow::pendingUnloadEventListeners() const
 {
-    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
-    return listeners ? listeners->size() : 0;
+    return windowsWithUnloadEventListeners().count(const_cast<DOMWindow*>(this));
 }
 
 void DOMWindow::dispatchAllPendingUnloadEvents()
 {
-    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
-    if (map.isEmpty())
+    DOMWindowSet& set = windowsWithUnloadEventListeners();
+    if (set.isEmpty())
         return;
 
     static bool alreadyDispatched = false;
@@ -249,18 +252,18 @@ void DOMWindow::dispatchAllPendingUnloadEvents()
         return;
 
     Vector<RefPtr<DOMWindow> > windows;
-    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
-    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+    DOMWindowSet::iterator end = set.end();
+    for (DOMWindowSet::iterator it = set.begin(); it != end; ++it)
         windows.append(it->first);
 
     size_t size = windows.size();
     for (size_t i = 0; i < size; ++i) {
         DOMWindow* window = windows[i].get();
-        RegisteredEventListenerVector* listeners = map.get(window);
-        if (!listeners)
+        if (!set.contains(window))
             continue;
-        RegisteredEventListenerVector listenersCopy = *listeners;
-        window->dispatchUnloadEvent(&listenersCopy);
+
+        window->dispatchEvent(PageTransitionEvent::create(EventNames().pagehideEvent, false), window->document());
+        window->dispatchEvent(Event::create(eventNames().unloadEvent, false, false), window->document());
     }
 
     enableSuddenTermination();
@@ -374,8 +377,8 @@ DOMWindow::~DOMWindow()
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
 
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
 ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
@@ -454,8 +457,22 @@ void DOMWindow::clear()
         m_applicationCache->disconnectFrame();
     m_applicationCache = 0;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+    m_notifications = 0;
+#endif
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+int DOMWindow::orientation() const
+{
+    if (!m_frame)
+        return 0;
+    
+    return m_frame->orientation();
+}
+#endif
+
 Screen* DOMWindow::screen() const
 {
     if (!m_screen)
@@ -522,7 +539,7 @@ Console* DOMWindow::console() const
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 DOMApplicationCache* DOMWindow::applicationCache() const
 {
-    if (!m_applicationCache && m_frame && m_frame->settings() && m_frame->settings()->offlineWebApplicationCacheEnabled())
+    if (!m_applicationCache)
         m_applicationCache = DOMApplicationCache::create(m_frame);
     return m_applicationCache.get();
 }
@@ -560,7 +577,9 @@ Storage* DOMWindow::sessionStorage() const
         return 0;
 
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
+#if ENABLE(INSPECTOR)
     page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
+#endif
 
     m_sessionStorage = Storage::create(m_frame, storageArea.release());
     return m_sessionStorage.get();
@@ -582,18 +601,50 @@ Storage* DOMWindow::localStorage() const
     if (!page->settings()->localStorageEnabled())
         return 0;
 
-    StorageNamespace* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
-    if (storageArea) {
-        page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
-        m_localStorage = Storage::create(m_frame, storageArea.release());
-    }
+    RefPtr<StorageArea> storageArea = page->group().localStorage()->storageArea(document->securityOrigin());
+#if ENABLE(INSPECTOR)
+    page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
+#endif
 
+    m_localStorage = Storage::create(m_frame, storageArea.release());
     return m_localStorage.get();
 }
 #endif
 
-void DOMWindow::postMessage(const String& message, MessagePort* messagePort, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* DOMWindow::webkitNotifications() const
+{
+    if (m_notifications)
+        return m_notifications.get();
+
+    Document* document = this->document();
+    if (!document)
+        return 0;
+    
+    Page* page = document->page();
+    if (!page)
+        return 0;
+
+    if (!page->settings()->experimentalNotificationsEnabled())
+        return 0;
+
+    NotificationPresenter* provider = page->chrome()->notificationPresenter();
+    if (provider) 
+        m_notifications = NotificationCenter::create(document, provider);    
+      
+    return m_notifications.get();
+}
+#endif
+
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
+{
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, targetOrigin, source, ec);
+}
+
+void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     if (!m_frame)
         return;
@@ -609,9 +660,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
         }
     }
 
-    OwnPtr<MessagePortChannel> channel;
-    if (messagePort)
-        channel = messagePort->disentangle(ec);
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
 
@@ -623,7 +672,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     String sourceOrigin = sourceDocument->securityOrigin()->toString();
 
     // Schedule the message.
-    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channel.release(), target.get());
+    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channels.release(), target.get());
     timer->startOneShot(0);
 }
 
@@ -644,8 +693,7 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
         }
     }
 
-    ExceptionCode ec = 0;
-    dispatchEvent(timer->event(document()), ec);
+    dispatchEvent(timer->event(document()));
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -692,12 +740,9 @@ void DOMWindow::close()
         return;
 
     Settings* settings = m_frame->settings();
-    bool allowScriptsToCloseWindows =
-        settings && settings->allowScriptsToCloseWindows();
+    bool allowScriptsToCloseWindows = settings && settings->allowScriptsToCloseWindows();
 
-    if (m_frame->loader()->openedByDOM()
-        || m_frame->loader()->getHistoryLength() <= 1
-        || allowScriptsToCloseWindows)
+    if (page->openedByDOM() || page->getHistoryLength() <= 1 || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -1214,104 +1259,38 @@ void DOMWindow::clearInterval(int timeoutId)
     DOMTimer::removeById(scriptExecutionContext(), timeoutId);
 }
 
-void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
-    if (listeners.isEmpty())
-        return;
-
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = listeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
+    if (!EventTarget::addEventListener(eventType, listener, useCapture))
+        return false;
 
-void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
     if (Document* document = this->document())
         document->addListenerTypeIfNeeded(eventType);
 
-    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
-    m_eventListeners.append(registeredListener);
-
     if (eventType == eventNames().unloadEvent)
-        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
-    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
-}
+        addUnloadEventListener(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        addBeforeUnloadEventListener(this);
 
-void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    RefPtr<DOMWindow> protect(this);
-
-    event->setTarget(this);
-    event->setCurrentTarget(this);
-
-    handleEvent(event.get(), true);
-    handleEvent(event.get(), false);
-
-    return !event->defaultPrevented();
-}
-
-void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+    return true;
 }
 
-// This function accommodates the Firefox quirk of dispatching the load, unload and
-// beforeunload events on the window, but setting event.target to be the Document. 
-inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    ASSERT(!eventDispatchForbidden());
-
-    RefPtr<Event> event = e;
-    RefPtr<DOMWindow> protect(this);
-    RefPtr<Document> document = this->document();
+    if (!EventTarget::removeEventListener(eventType, listener, useCapture))
+        return false;
 
-    event->setTarget(document);
-    event->setCurrentTarget(this);
+    if (eventType == eventNames().unloadEvent)
+        removeUnloadEventListener(this);
+    else if (eventType == eventNames().beforeunloadEvent && allowsBeforeUnloadListeners(this))
+        removeBeforeUnloadEventListener(this);
 
-    handleEvent(event.get(), true, alternateEventListeners);
-    handleEvent(event.get(), false, alternateEventListeners);
+    return true;
 }
 
 void DOMWindow::dispatchLoadEvent()
 {
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+    dispatchEvent(Event::create(eventNames().loadEvent, false, false), document());
 
     // For load events, send a separate load event to the enclosing frame only.
     // This is a DOM extension and is independent of bubbling/capturing rules of
@@ -1322,704 +1301,54 @@ void DOMWindow::dispatchLoadEvent()
         ownerEvent->setTarget(ownerElement);
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
-}
-
-void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
-{
-    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
-}
 
-PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
-{
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
-    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
-    return beforeUnloadEvent.release();
-}
-
-void DOMWindow::removeAllEventListeners()
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_eventListeners[i]->setRemoved(true);
-    m_eventListeners.clear();
-
-    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
-    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
-}
-
-bool DOMWindow::hasEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_eventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    clearAttributeEventListener(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
-            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
-                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
-            r.setRemoved(true);
-            m_eventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
-{
-    size_t size = m_eventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_eventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isAttribute())
-            return r.listener();
-    }
-    return 0;
-}
-
-EventListener* DOMWindow::onabort() const
-{
-    return getAttributeEventListener(eventNames().abortEvent);
-}
-
-void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* DOMWindow::onblur() const
-{
-    return getAttributeEventListener(eventNames().blurEvent);
-}
-
-void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* DOMWindow::onchange() const
-{
-    return getAttributeEventListener(eventNames().changeEvent);
-}
-
-void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onclick() const
-{
-    return getAttributeEventListener(eventNames().clickEvent);
-}
-
-void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondblclick() const
-{
-    return getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrag() const
-{
-    return getAttributeEventListener(eventNames().dragEvent);
-}
-
-void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragend() const
-{
-    return getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragenter() const
-{
-    return getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragleave() const
-{
-    return getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragover() const
-{
-    return getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondragstart() const
-{
-    return getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondrop() const
-{
-    return getAttributeEventListener(eventNames().dropEvent);
-}
-
-void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* DOMWindow::onerror() const
-{
-    return getAttributeEventListener(eventNames().errorEvent);
-}
-
-void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* DOMWindow::onfocus() const
-{
-    return getAttributeEventListener(eventNames().focusEvent);
-}
-
-void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeydown() const
-{
-    return getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeypress() const
-{
-    return getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onkeyup() const
-{
-    return getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onload() const
-{
-    return getAttributeEventListener(eventNames().loadEvent);
-}
-
-void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousedown() const
-{
-    return getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousemove() const
-{
-    return getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseout() const
-{
-    return getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseover() const
-{
-    return getAttributeEventListener(eventNames().mouseoverEvent);
-}
-
-void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmouseup() const
-{
-    return getAttributeEventListener(eventNames().mouseupEvent);
-}
-
-void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* DOMWindow::onmousewheel() const
-{
-    return getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* DOMWindow::onoffline() const
-{
-    return getAttributeEventListener(eventNames().offlineEvent);
-}
-
-void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().offlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::ononline() const
-{
-    return getAttributeEventListener(eventNames().onlineEvent);
-}
-
-void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().onlineEvent, eventListener);
-}
-
-EventListener* DOMWindow::onreset() const
-{
-    return getAttributeEventListener(eventNames().resetEvent);
-}
-
-void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* DOMWindow::onresize() const
-{
-    return getAttributeEventListener(eventNames().resizeEvent);
-}
-
-void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onscroll() const
-{
-    return getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsearch() const
-{
-    return getAttributeEventListener(eventNames().searchEvent);
-}
-
-void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* DOMWindow::onselect() const
-{
-    return getAttributeEventListener(eventNames().selectEvent);
-}
-
-void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().selectEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstorage() const
-{
-    return getAttributeEventListener(eventNames().storageEvent);
-}
-
-void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().storageEvent, eventListener);
-}
-
-EventListener* DOMWindow::onsubmit() const
-{
-    return getAttributeEventListener(eventNames().submitEvent);
-}
-
-void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().submitEvent, eventListener);
-}
-
-EventListener* DOMWindow::onunload() const
-{
-    return getAttributeEventListener(eventNames().unloadEvent);
-}
-
-void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().unloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onbeforeunload() const
-{
-    return getAttributeEventListener(eventNames().beforeunloadEvent);
-}
-
-void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationstart() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
-}
-
-void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationiteration() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
-}
-
-void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkitanimationend() const
-{
-    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
-}
-
-void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwebkittransitionend() const
-{
-    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
-}
-
-void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplay() const
-{
-    return getAttributeEventListener(eventNames().canplayEvent);
-}
-
-void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplayEvent, eventListener);
-}
-
-EventListener* DOMWindow::oncanplaythrough() const
-{
-    return getAttributeEventListener(eventNames().canplaythroughEvent);
-}
-
-void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
-}
-
-EventListener* DOMWindow::ondurationchange() const
-{
-    return getAttributeEventListener(eventNames().durationchangeEvent);
-}
-
-void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onemptied() const
-{
-    return getAttributeEventListener(eventNames().emptiedEvent);
-}
-
-void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onended() const
-{
-    return getAttributeEventListener(eventNames().endedEvent);
-}
-
-void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().endedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadeddata() const
-{
-    return getAttributeEventListener(eventNames().loadeddataEvent);
-}
-
-void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadedmetadata() const
-{
-    return getAttributeEventListener(eventNames().loadedmetadataEvent);
-}
-
-void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
-}
-
-EventListener* DOMWindow::onpause() const
-{
-    return getAttributeEventListener(eventNames().pauseEvent);
-}
-
-void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().pauseEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplay() const
-{
-    return getAttributeEventListener(eventNames().playEvent);
-}
-
-void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playEvent, eventListener);
-}
-
-EventListener* DOMWindow::onplaying() const
-{
-    return getAttributeEventListener(eventNames().playingEvent);
-}
-
-void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().playingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onratechange() const
-{
-    return getAttributeEventListener(eventNames().ratechangeEvent);
-}
-
-void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeked() const
-{
-    return getAttributeEventListener(eventNames().seekedEvent);
-}
-
-void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekedEvent, eventListener);
-}
-
-EventListener* DOMWindow::onseeking() const
-{
-    return getAttributeEventListener(eventNames().seekingEvent);
-}
-
-void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().seekingEvent, eventListener);
-}
-
-EventListener* DOMWindow::ontimeupdate() const
-{
-    return getAttributeEventListener(eventNames().timeupdateEvent);
-}
-
-void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
-}
-
-EventListener* DOMWindow::onvolumechange() const
-{
-    return getAttributeEventListener(eventNames().volumechangeEvent);
-}
-
-void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
-}
-
-EventListener* DOMWindow::onwaiting() const
-{
-    return getAttributeEventListener(eventNames().waitingEvent);
-}
-
-void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().waitingEvent, eventListener);
-}
-
-EventListener* DOMWindow::onloadstart() const
-{
-    return getAttributeEventListener(eventNames().loadstartEvent);
-}
-
-void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
-}
-
-EventListener* DOMWindow::onprogress() const
-{
-    return getAttributeEventListener(eventNames().progressEvent);
-}
-
-void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().progressEvent, eventListener);
-}
-
-EventListener* DOMWindow::onstalled() const
-{
-    return getAttributeEventListener(eventNames().stalledEvent);
-}
-
-void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().stalledEvent, eventListener);
-}
+#if ENABLE(INSPECTOR)
+    if (!frame() || !frame()->page())
+        return;
 
-EventListener* DOMWindow::onsuspend() const
-{
-    return getAttributeEventListener(eventNames().suspendEvent);
+    if (InspectorController* controller = frame()->page()->inspectorController())
+        controller->mainResourceFiredLoadEvent(frame()->loader()->documentLoader(), url());
+#endif
 }
 
-void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
-    setAttributeEventListener(eventNames().suspendEvent, eventListener);
-}
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-EventListener* DOMWindow::oninput() const
-{
-    return getAttributeEventListener(eventNames().inputEvent);
-}
+    event->setTarget(prpTarget ? prpTarget : this);
+    event->setCurrentTarget(this);
+    event->setEventPhase(Event::AT_TARGET);
 
-void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().inputEvent, eventListener);
+    return fireEventListeners(event.get());
 }
 
-EventListener* DOMWindow::onmessage() const
+void DOMWindow::removeAllEventListeners()
 {
-    return getAttributeEventListener(eventNames().messageEvent);
-}
+    EventTarget::removeAllEventListeners();
 
-void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
-{
-    setAttributeEventListener(eventNames().messageEvent, eventListener);
+    removeAllUnloadEventListeners(this);
+    removeAllBeforeUnloadEventListeners(this);
 }
 
-EventListener* DOMWindow::oncontextmenu() const
+void DOMWindow::captureEvents()
 {
-    return getAttributeEventListener(eventNames().contextmenuEvent);
+    // Not implemented.
 }
 
-void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+void DOMWindow::releaseEvents()
 {
-    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+    // Not implemented.
 }
 
-void DOMWindow::captureEvents()
+EventTargetData* DOMWindow::eventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
-void DOMWindow::releaseEvents()
+EventTargetData* DOMWindow::ensureEventTargetData()
 {
-    // Not implemented.
+    return &m_eventTargetData;
 }
 
 #if ENABLE(TOUCH_EVENTS) // Android
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 12caf7e..3e3cbb4 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -28,6 +28,7 @@
 
 #include "EventTarget.h"
 #include "KURL.h"
+#include "MessagePort.h"
 #include "PlatformString.h"
 #include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
@@ -53,11 +54,12 @@ namespace WebCore {
     class History;
     class Location;
     class Media;
-    class MessagePort;
     class Navigator;
     class Node;
+    class NotificationCenter;
     class PostMessageTimer;
     class ScheduledAction;
+    class SerializedScriptValue;
     class Screen;
     class WebKitPoint;
 
@@ -84,6 +86,13 @@ namespace WebCore {
 
         void clear();
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        int orientation() const;
+#endif
+
         void setSecurityOrigin(SecurityOrigin* securityOrigin) { m_securityOrigin = securityOrigin; }
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
@@ -205,7 +214,13 @@ namespace WebCore {
         DOMApplicationCache* applicationCache() const;
 #endif
 
-        void postMessage(const String& message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
+
+        void postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, const String& targetOrigin, DOMWindow* source, ExceptionCode&);
         void postMessageTimerFired(PostMessageTimer*);
 
         void scrollBy(int x, int y) const;
@@ -226,17 +241,20 @@ namespace WebCore {
 
         // Events
         // EventTarget API
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
 
-        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
-
-        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        using EventTarget::dispatchEvent;
+        bool dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget);
         void dispatchLoadEvent();
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
         PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         // Used for legacy "onEvent" property APIs.
         void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
         void clearAttributeEventListener(const AtomicString& eventType);
@@ -333,7 +351,74 @@ namespace WebCore {
         void setOntouchmove(PassRefPtr<EventListener>);
         EventListener* ontouchcancel() const;
         void setOntouchcancel(PassRefPtr<EventListener>);
+=======
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(blur);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(change);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(click);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dblclick);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drag);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragenter);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragleave);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(dragstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(drop);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(hashchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keydown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keypress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(keyup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousedown);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousemove);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseout);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseover);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mouseup);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(mousewheel);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(offline);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(online);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pagehide);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pageshow);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(reset);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(resize);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(scroll);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(search);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(select);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(storage);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(submit);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(unload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(beforeunload);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplay);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(canplaythrough);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(durationchange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(emptied);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ended);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadeddata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadedmetadata);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(pause);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(play);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(playing);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(ratechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeked);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(seeking);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(timeupdate);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(volumechange);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(waiting);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(stalled);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(suspend);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(input);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(contextmenu);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(invalid);
+#if ENABLE(ORIENTATION_EVENTS)
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(orientationchange);
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 #endif
+<<<<<<< HEAD:WebCore/page/DOMWindow.h
         
         EventListener* oncanplay() const;
         void setOncanplay(PassRefPtr<EventListener>);
@@ -381,6 +466,13 @@ namespace WebCore {
         void setOnmessage(PassRefPtr<EventListener>);
         EventListener* oncontextmenu() const;
         void setOncontextmenu(PassRefPtr<EventListener>);
+=======
+
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationstart, webkitAnimationStart);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationiteration, webkitAnimationIteration);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkitanimationend, webkitAnimationEnd);
+        DEFINE_MAPPED_ATTRIBUTE_EVENT_LISTENER(webkittransitionend, webkitTransitionEnd);
+>>>>>>> webkit.org at 49305:WebCore/page/DOMWindow.h
 
         void captureEvents();
         void releaseEvents();
@@ -415,8 +507,8 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -441,8 +533,11 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+#if ENABLE(NOTIFICATIONS)
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
 
-        RegisteredEventListenerVector m_eventListeners;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index aba92f0..c8eafe6 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -39,6 +39,7 @@ module window {
         CustomNativeConverter,
         CustomPutFunction,
         ExtendsDOMGlobalObject,
+        EventTarget,
         GenerateNativeConverter,
         LegacyParent=JSDOMWindowBase
     ] DOMWindow {
@@ -55,7 +56,7 @@ module window {
         attribute [Replaceable] Navigator clientInformation;
         attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
 
-        attribute [Replaceable, CustomGetter] Event event;
+        attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
         readonly attribute [Custom] Crypto crypto;
 
@@ -74,7 +75,7 @@ module window {
                                 in DOMString name,
                                 in [Optional] DOMString options);
 
-        [Custom] DOMObject showModalDialog(in DOMString url, 
+        [Custom] DOMObject showModalDialog(in DOMString url,
                                            in [Optional] DOMObject dialogArgs,
                                            in [Optional] DOMString featureArgs);
 
@@ -169,12 +170,28 @@ module window {
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
+
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        // This is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        readonly attribute long orientation;
+#endif
 
                  attribute [Replaceable] Console console;
 
         // cross-document messaging
-        [DoNotCheckDomainSecurity, Custom] void postMessage(in DOMString message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] Array messagePorts, in DOMString targetOrigin)
             raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
+        [DoNotCheckDomainSecurity, Custom] void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort, in DOMString targetOrigin)
+            raises(DOMException);
+#endif
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
@@ -221,7 +238,9 @@ module window {
         attribute EventListener onended;
         attribute EventListener onerror;
         attribute EventListener onfocus;
+        attribute EventListener onhashchange;
         attribute EventListener oninput;
+        attribute EventListener oninvalid;
         attribute EventListener onkeydown;
         attribute EventListener onkeypress;
         attribute EventListener onkeyup;
@@ -238,6 +257,8 @@ module window {
         attribute EventListener onmousewheel;
         attribute EventListener onoffline;
         attribute EventListener ononline;
+        attribute EventListener onpagehide;
+        attribute EventListener onpageshow;
         attribute EventListener onpause;
         attribute EventListener onplay;
         attribute EventListener onplaying;
@@ -262,8 +283,6 @@ module window {
         // attribute EventListener onbeforeprint;
         // attribute EventListener onformchange;
         // attribute EventListener onforminput;
-        // attribute EventListener onhashchange;
-        // attribute EventListener oninvalid;
         // attribute EventListener onpopstate;
         // attribute EventListener onreadystatechange;
         // attribute EventListener onredo;
@@ -277,6 +296,9 @@ module window {
         attribute EventListener onwebkitanimationiteration;
         attribute EventListener onwebkitanimationstart;
         attribute EventListener onwebkittransitionend;
+#if defined(ENABLE_ORIENTATION_EVENTS) && ENABLE_ORIENTATION_EVENTS
+        attribute EventListener onorientationchange;
+#endif
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type,
@@ -419,13 +441,25 @@ module window {
         attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
 
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
+        attribute [Conditional=3D_CANVAS] CanvasRenderingContext3DConstructor CanvasRenderingContext3D;
         attribute TextMetricsConstructor TextMetrics;
 
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasArrayBufferConstructor CanvasArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasByteArrayConstructor CanvasByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedByteArrayConstructor CanvasUnsignedByteArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasShortArrayConstructor CanvasShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedShortArrayConstructor CanvasUnsignedShortArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasIntArrayConstructor CanvasIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasUnsignedIntArrayConstructor CanvasUnsignedIntArray; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS] CanvasFloatArrayConstructor CanvasFloatArray; // Usable with new operator
+
         attribute EventConstructor Event;
+        attribute BeforeLoadEventConstructor BeforeLoadEvent;
         attribute KeyboardEventConstructor KeyboardEvent;
         attribute MouseEventConstructor MouseEvent;
         attribute MutationEventConstructor MutationEvent;
         attribute OverflowEventConstructor OverflowEvent;
+        attribute PageTransitionEventConstructor PageTransitionEvent;
         attribute ProgressEventConstructor ProgressEvent;
         attribute TextEventConstructor TextEvent;
         attribute UIEventConstructor UIEvent;
@@ -454,6 +488,10 @@ module window {
         attribute RangeConstructor Range;
         attribute RangeExceptionConstructor RangeException;
 
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource; // Usable with new the operator
+#endif
+
         // Mozilla has a separate XMLDocument object for XML documents. 
         // We just use Document for this.
         attribute DocumentConstructor XMLDocument;
@@ -465,9 +503,7 @@ module window {
         attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
         attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
 
-#if defined(ENABLE_XSLT) && ENABLE_XSLT
-        attribute [JSCCustomGetter] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-#endif
+        attribute [JSCCustomGetter,Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
 
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
@@ -482,6 +518,10 @@ module window {
         attribute [JSCCustomGetter] SharedWorkerConstructor SharedWorker; // Usable with the new operator
 #endif
 
+#if defined(ENABLE_WEB_SOCKETS) && ENABLE_WEB_SOCKETS
+        attribute [JSCCustomGetter] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
diff --git a/WebCore/page/DragController.cpp b/WebCore/page/DragController.cpp
index 08fb872..634595a 100644
--- a/WebCore/page/DragController.cpp
+++ b/WebCore/page/DragController.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragController.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #include "CSSStyleDeclaration.h"
 #include "Clipboard.h"
 #include "ClipboardAccessPolicy.h"
@@ -46,6 +47,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "Image.h"
 #include "MoveSelectionCommand.h"
@@ -53,6 +55,7 @@
 #include "Page.h"
 #include "RenderFileUploadControl.h"
 #include "RenderImage.h"
+#include "RenderView.h"
 #include "ReplaceSelectionCommand.h"
 #include "ResourceRequest.h"
 #include "SelectionController.h"
@@ -107,7 +110,7 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
             String title;
             String url = dragData->asURL(&title);
             if (!url.isEmpty()) {
-                RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(document);
+                RefPtr<HTMLAnchorElement> anchor = HTMLAnchorElement::create(document);
                 anchor->setHref(url);
                 ExceptionCode ec;
                 RefPtr<Node> anchorText = document->createTextNode(title);
@@ -253,6 +256,25 @@ static HTMLInputElement* asFileInput(Node* node)
     return 0;
 }
 
+static Element* elementUnderMouse(Document* documentUnderMouse, const IntPoint& p)
+{
+    float zoomFactor = documentUnderMouse->frame()->pageZoomFactor();
+    IntPoint point = roundedIntPoint(FloatPoint(p.x() * zoomFactor, p.y() * zoomFactor));
+
+    HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+    HitTestResult result(point);
+    documentUnderMouse->renderView()->layer()->hitTest(request, result);
+
+    Node* n = result.innerNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    if (n)
+        n = n->shadowAncestorNode();
+
+    ASSERT(n);
+    return static_cast<Element*>(n);
+}
+
 bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
 {
     ASSERT(dragData);
@@ -287,10 +309,8 @@ bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction a
             return true;
         }
 
-        IntPoint dragPos = dragData->clientPosition();
-        IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-        ASSERT(element);
+        IntPoint point = frameView->windowToContents(dragData->clientPosition());
+        Element* element = elementUnderMouse(m_documentUnderMouse, point);
         if (!asFileInput(element)) {
             VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
@@ -340,8 +360,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return false;
 
     IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
-    ASSERT(element);
+    Element* element = elementUnderMouse(m_documentUnderMouse, point);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);
 
@@ -630,6 +649,12 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
     if (isDHTMLDrag)
         dragImage = clipboard->createDragImage(dragImageOffset);
+    else {
+        // This drag operation is not a DHTML drag and may go outside the WebView.
+        // We provide a default set of allowed drag operations that follows from:
+        // http://trac.webkit.org/browser/trunk/WebKit/mac/WebView/WebHTMLView.mm?rev=48526#L3430
+        m_sourceDragOperation = (DragOperation)(DragOperationGeneric | DragOperationCopy);
+    }
 
     // We allow DHTML/JS to set the drag image, even if its a link, image or text we're dragging.
     // This is in the spirit of the IE API, which allows overriding of pasteboard data and DragOp.
@@ -785,3 +810,5 @@ void DragController::placeDragCaret(const IntPoint& windowPoint)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index 937f08f..6b4031e 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -87,6 +87,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#if ENABLE(DRAG_SUPPORT)
 // The link drag hysteresis is much larger than the others because there
 // needs to be enough space to cancel the link press without starting a link drag,
 // and because dragging links is rare.
@@ -94,6 +95,7 @@ const int LinkDragHysteresis = 40;
 const int ImageDragHysteresis = 5;
 const int TextDragHysteresis = 3;
 const int GeneralDragHysteresis = 3;
+#endif // ENABLE(DRAG_SUPPORT)
 
 // Match key code of composition keydown event on windows.
 // IE sends VK_PROCESSKEY which has value 229;
@@ -106,10 +108,9 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
-static Frame* subframeForTargetNode(Node*);
 static Frame* subframeForHitTestResult(const MouseEventWithHitTestResults&);
 
-static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node)
+static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDirection, ScrollDirection negativeDirection, PlatformWheelEvent& e, Node* node, Node** stopNode)
 {
     if (!delta)
         return;
@@ -118,12 +119,13 @@ static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDir
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
 
     if (e.granularity() == ScrollByPageWheelEvent) {
-        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
+        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1, stopNode))
             e.accept();
         return;
-    } 
+    }
+
     float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
+    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll, stopNode))
         e.accept();
 }
 
@@ -146,7 +148,9 @@ EventHandler::EventHandler(Frame* frame)
     , m_mousePressed(false)
     , m_capturesDragging(false)
     , m_mouseDownMayStartSelect(false)
+#if ENABLE(DRAG_SUPPORT)
     , m_mouseDownMayStartDrag(false)
+#endif
     , m_mouseDownWasSingleClickInSelection(false)
     , m_beganSelectingText(false)
     , m_panScrollInProgress(false)
@@ -179,11 +183,13 @@ EventHandler::~EventHandler()
 {
 }
     
+#if ENABLE(DRAG_SUPPORT)
 EventHandler::EventHandlerDragState& EventHandler::dragState()
 {
     DEFINE_STATIC_LOCAL(EventHandlerDragState, state, ());
     return state;
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 void EventHandler::clear()
 {
@@ -203,13 +209,16 @@ void EventHandler::clear()
     m_touch = 0;
 #endif
     m_frameSetBeingResized = 0;
+#if ENABLE(DRAG_SUPPORT)
     m_dragTarget = 0;
+#endif
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
     m_mousePressed = false;
     m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
     m_latchedWheelEventNode = 0;
+    m_previousWheelScrolledNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
@@ -357,8 +366,10 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
 
 bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& event)
 {
+#if ENABLE(DRAG_SUPPORT)
     // Reset drag state.
     dragState().m_dragSrc = 0;
+#endif
 
     if (ScrollView* scrollView = m_frame->view()) {
         if (scrollView->isPointInScrollbarCorner(event.event().pos()))
@@ -371,8 +382,10 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     // so it's allowed to start a drag or selection.
     m_mouseDownMayStartSelect = canMouseDownStartSelect(event.targetNode());
     
+#if ENABLE(DRAG_SUPPORT)
     // Careful that the drag starting logic stays in sync with eventMayStartDrag()
     m_mouseDownMayStartDrag = singleClick;
+#endif
 
     m_mouseDownWasSingleClickInSelection = false;
 
@@ -400,7 +413,9 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     Node* innerNode = event.targetNode();
 
     m_mousePressNode = innerNode;
+#if ENABLE(DRAG_SUPPORT)
     m_dragStartPos = event.event().pos();
+#endif
 
     bool swallowEvent = false;
     m_frame->selection()->setCaretBlinkingSuspended(true);
@@ -420,6 +435,7 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     return swallowEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& event)
 {
     if (handleDrag(event))
@@ -442,7 +458,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         // If the selection is contained in a layer that can scroll, that layer should handle the autoscroll
         // Otherwise, let the bridge handle it so the view can scroll itself.
         RenderObject* renderer = targetNode->renderer();
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -559,6 +575,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
         m_frame->selection()->setSelection(newSelection);
     }
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::handleMouseUp(const MouseEventWithHitTestResults& event)
 {
@@ -586,7 +603,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     m_frame->selection()->setCaretBlinkingSuspended(false);
     m_mousePressed = false;
     m_capturesDragging = false;
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     m_mouseDownWasInSubframe = false;
@@ -598,7 +617,9 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     // on the selection, the selection goes away.  However, if we are
     // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
+#if ENABLE(DRAG_SUPPORT)
             && m_dragStartPos == event.event().pos()
+#endif
             && m_frame->selection()->isRange()
             && event.event().button() != RightButton) {
         VisibleSelection newSelection;
@@ -732,7 +753,7 @@ void EventHandler::updateAutoscrollRenderer()
     if (Node* nodeAtPoint = hitTest.innerNode())
         m_autoscrollRenderer = nodeAtPoint->renderer();
 
-    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeProgramaticallyScrolled(false)))
+    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeScrolledAndHasScrollableArea()))
         m_autoscrollRenderer = m_autoscrollRenderer->parent();
 }
 
@@ -741,6 +762,7 @@ void EventHandler::setAutoscrollRenderer(RenderObject* renderer)
     m_autoscrollRenderer = renderer;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
     flagDHTML = false;
@@ -761,6 +783,7 @@ void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
@@ -883,8 +906,10 @@ bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity g
     
     if (node) {
         RenderObject* r = node->renderer();
-        if (r && !r->isListBox())
-            return r->enclosingBox()->scroll(direction, granularity);
+        if (r && !r->isListBox() && r->enclosingBox()->scroll(direction, granularity)) {
+            setFrameWasScrolledByUser();
+            return true;
+        }
     }
 
     return false;
@@ -914,10 +939,10 @@ Frame* subframeForHitTestResult(const MouseEventWithHitTestResults& hitTestResul
 {
     if (!hitTestResult.isOverWidget())
         return 0;
-    return subframeForTargetNode(hitTestResult.targetNode());
+    return EventHandler::subframeForTargetNode(hitTestResult.targetNode());
 }
 
-Frame* subframeForTargetNode(Node* node)
+Frame* EventHandler::subframeForTargetNode(Node* node)
 {
     if (!node)
         return 0;
@@ -1117,7 +1142,9 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
     m_mouseDownTimestamp = mouseEvent.timestamp();
+#if ENABLE(DRAG_SUPPORT)
     m_mouseDownMayStartDrag = false;
+#endif
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
     if (FrameView* view = m_frame->view())
@@ -1141,6 +1168,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page()) {
         InspectorController* inspector = page->inspectorController();
         if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
@@ -1149,6 +1177,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
             return true;
         }
     }
+#endif
 
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
@@ -1172,7 +1201,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
-        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeScrolledAndHasScrollableArea())) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -1393,8 +1422,10 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
         return true;
     
     swallowEvent = dispatchMouseEvent(eventNames().mousemoveEvent, mev.targetNode(), false, 0, mouseEvent, true);
+#if ENABLE(DRAG_SUPPORT)
     if (!swallowEvent)
         swallowEvent = handleMouseDraggedEvent(mev);
+#endif // ENABLE(DRAG_SUPPORT)
 
     return swallowEvent;
 }
@@ -1464,6 +1495,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
     return swallowMouseUpEvent || swallowClickEvent || swallowMouseReleaseEvent;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
     FrameView* view = m_frame->view();
@@ -1508,15 +1540,15 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
         }
 
         if (m_dragTarget) {
-            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
-                            ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
+            Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
             if (frame)
                 accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
@@ -1524,8 +1556,9 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         }
     } else {
         if (newTarget) {
-            if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
-                accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
+            Frame* frame = (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag)) ? static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame() : 0;
+            if (frame)
+                accept = frame->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
         }
@@ -1571,6 +1604,7 @@ void EventHandler::clearDragState()
     m_sendingEventToSubview = false;
 #endif
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setCapturingMouseEventsNode(PassRefPtr<Node> n)
 {
@@ -1692,12 +1726,15 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
         swallowEvent = m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventType, clickCount);
     
     if (!swallowEvent && eventType == eventNames().mousedownEvent) {
+        // The layout needs to be up to date to determine if an element is focusable.
+        m_frame->document()->updateLayoutIgnorePendingStylesheets();
+
         // Blur current focus node when a link/button is clicked; this
         // is expected by some sites that rely on onChange handlers running
         // from form fields before the button click is processed.
         Node* node = m_nodeUnderMouse.get();
         RenderObject* renderer = node ? node->renderer() : 0;
-                
+
         // Walk up the render tree to search for a node to focus.
         // Walking up the DOM tree wouldn't work for shadow trees, like those behind the engine-based text fields.
         while (renderer) {
@@ -1736,6 +1773,13 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
     return swallowEvent;
 }
 
+#if !PLATFORM(GTK)
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const
+{
+    return false;
+}
+#endif
+
 bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
 {
     Document* doc = m_frame->document();
@@ -1749,35 +1793,39 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     FrameView* view = m_frame->view();
     if (!view)
         return false;
+    setFrameWasScrolledByUser();
     IntPoint vPoint = view->windowToContents(e.pos());
 
     Node* node;
     bool isOverWidget;
     bool didSetLatchedNode = false;
-    
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    HitTestResult result(vPoint);
+    doc->renderView()->layer()->hitTest(request, result);
+
     if (m_useLatchedWheelEventNode) {
         if (!m_latchedWheelEventNode) {
-            HitTestRequest request(HitTestRequest::ReadOnly);
-            HitTestResult result(vPoint);
-            doc->renderView()->layer()->hitTest(request, result);
             m_latchedWheelEventNode = result.innerNode();
             m_widgetIsLatched = result.isOverWidget();
             didSetLatchedNode = true;
         }
-        
+
         node = m_latchedWheelEventNode.get();
         isOverWidget = m_widgetIsLatched;
     } else {
         if (m_latchedWheelEventNode)
             m_latchedWheelEventNode = 0;
-        
-        HitTestRequest request(HitTestRequest::ReadOnly);
-        HitTestResult result(vPoint);
-        doc->renderView()->layer()->hitTest(request, result);
+        if (m_previousWheelScrolledNode)
+            m_previousWheelScrolledNode = 0;
+
         node = result.innerNode();
         isOverWidget = result.isOverWidget();
     }
-    
+
+    if (shouldTurnVerticalTicksIntoHorizontal(result))
+        e.turnVerticalTicksIntoHorizontal();
+
     if (node) {
         // Figure out which view to send the event to.
         RenderObject* target = node->renderer();
@@ -1794,17 +1842,20 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-        
+
         // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
         // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
         while (node && !node->renderer())
             node = node->parent();
-        
+
         if (node && node->renderer()) {
             // Just break up into two scrolls if we need to.  Diagonal movement on 
             // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node);
-            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node);
+            Node* stopNode = m_previousWheelScrolledNode.get();
+            scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node, &stopNode);
+            scrollAndAcceptEvent(e.deltaY(), ScrollUp, ScrollDown, e, node, &stopNode);
+            if (!m_useLatchedWheelEventNode)
+                m_previousWheelScrolledNode = stopNode;
         }
     }
 
@@ -1819,6 +1870,7 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
     return e.isAccepted();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
     Document* doc = m_frame->document();
@@ -1849,6 +1901,7 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
     
     return swallowEvent;
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 void EventHandler::scheduleHoverStateUpdate()
 {
@@ -1868,12 +1921,13 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::canMouseDragExtendSelect(Node* node)
 {
     if (!node || !node->renderer())
@@ -1881,11 +1935,12 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
             
     for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
         if (Node* node = curr->node())
-            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+            return node->dispatchEvent(Event::create(eventNames().selectstartEvent, true, true));
     }
 
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void EventHandler::setResizingFrameSet(HTMLFrameSetElement* frameSet)
 {
@@ -2109,6 +2164,7 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
     }
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLocation) const
 {
     IntPoint dragViewportLocation((int)floatDragViewportLocation.x(), (int)floatDragViewportLocation.y());
@@ -2142,7 +2198,7 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    if (!node || node->hasChildNodes() || !m_frame->view())
+    if (!node || !m_frame->view())
         return false;
     Page* page = m_frame->page();
     return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
@@ -2308,6 +2364,7 @@ cleanupDrag:
     // No more default handling (like selection), whether we're past the hysteresis bounds or not
     return true;
 }
+#endif // ENABLE(DRAG_SUPPORT)
   
 bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEvent, bool isLineBreak, bool isBackTab)
 {
@@ -2339,7 +2396,7 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
 }
     
     
-#if !PLATFORM(MAC) && !PLATFORM(QT)
+#if !PLATFORM(MAC) && !PLATFORM(QT) && !PLATFORM(HAIKU)
 bool EventHandler::invertSenseOfTabsToLinks(KeyboardEvent*) const
 {
     return false;
@@ -2440,22 +2497,28 @@ void EventHandler::capsLockStateMayHaveChanged()
 
 void EventHandler::sendResizeEvent()
 {
-    m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
+    m_frame->document()->dispatchWindowEvent(Event::create(eventNames().resizeEvent, false, false));
 }
 
 void EventHandler::sendScrollEvent()
 {
+    setFrameWasScrolledByUser();
+    if (m_frame->view())
+        m_frame->document()->dispatchEvent(Event::create(eventNames().scrollEvent, true, false));
+}
+
+void EventHandler::setFrameWasScrolledByUser()
+{
     FrameView* v = m_frame->view();
-    if (!v)
-        return;
-    v->setWasScrolledByUser(true);
-    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
+    if (v)
+        v->setWasScrolledByUser(true);
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
 {
     if (!scrollbar || !scrollbar->enabled())
         return false;
+    setFrameWasScrolledByUser();
     return scrollbar->mouseDown(mev.event());
 }
 
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index 7fe64ad..3348366 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -66,10 +66,12 @@ class PlatformTouchEvent;
 class Touch;
 #endif
     
+#if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
+#endif // ENABLE(DRAG_SUPPORT)
 
 enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
 
@@ -80,7 +82,9 @@ public:
 
     void clear();
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag();
+#endif
 
     Node* mousePressNode() const;
     void setMousePressNode(PassRefPtr<Node>);
@@ -99,9 +103,11 @@ public:
 
     void setCapturingMouseEventsNode(PassRefPtr<Node>);
 
+#if ENABLE(DRAG_SUPPORT)
     bool updateDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     void cancelDragAndDrop(const PlatformMouseEvent&, Clipboard*);
     bool performDragAndDrop(const PlatformMouseEvent&, Clipboard*);
+#endif
 
     void scheduleHoverStateUpdate();
 
@@ -113,11 +119,17 @@ public:
 
     void setIgnoreWheelEvents(bool);
 
+    static Frame* subframeForTargetNode(Node*);
+
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
     bool scrollRecursively(ScrollDirection, ScrollGranularity);
 
+#if ENABLE(DRAG_SUPPORT)
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
+#endif
+
+    bool shouldTurnVerticalTicksIntoHorizontal(const HitTestResult&) const;
 
     bool tabsToLinks(KeyboardEvent*) const;
     bool tabsToAllControls(KeyboardEvent*) const;
@@ -131,11 +143,16 @@ public:
     bool handleMouseReleaseEvent(const PlatformMouseEvent&);
     bool handleWheelEvent(PlatformWheelEvent&);
 
+<<<<<<< HEAD:WebCore/page/EventHandler.h
 #if ENABLE(TOUCH_EVENTS) // Android
     bool handleTouchEvent(const PlatformTouchEvent&);
 #endif
 
+=======
+#if ENABLE(CONTEXT_MENUS)
+>>>>>>> webkit.org at 49305:WebCore/page/EventHandler.h
     bool sendContextMenuEvent(const PlatformMouseEvent&);
+#endif
 
     void setMouseDownMayStartAutoscroll() { m_mouseDownMayStartAutoscroll = true; }
 
@@ -150,10 +167,12 @@ public:
         bool isLineBreak = false, bool isBackTab = false);
     void defaultTextInputEventHandler(TextEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     bool eventMayStartDrag(const PlatformMouseEvent&) const;
     
     void dragSourceMovedTo(const PlatformMouseEvent&);
     void dragSourceEndedAt(const PlatformMouseEvent&, DragOperation);
+#endif
 
     void focusDocumentView();
 
@@ -172,7 +191,9 @@ public:
     bool keyEvent(NSEvent *);
     bool wheelEvent(NSEvent *);
 
+#if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(NSEvent *);
+#endif
     bool eventMayStartDrag(NSEvent *);
 
     void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
@@ -183,6 +204,7 @@ public:
 #endif
 
 private:
+#if ENABLE(DRAG_SUPPORT)
     struct EventHandlerDragState {
         RefPtr<Node> m_dragSrc; // element that may be a drag source, for the current mouse gesture
         bool m_dragSrcIsLink;
@@ -197,6 +219,7 @@ private:
     static const double TextDragDelay;
     
     PassRefPtr<Clipboard> createDraggingClipboard() const;
+#endif // ENABLE(DRAG_SUPPORT)
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
     void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
@@ -208,7 +231,9 @@ private:
     bool handleMousePressEventSingleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventDoubleClick(const MouseEventWithHitTestResults&);
     bool handleMousePressEventTripleClick(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool handleMouseDraggedEvent(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseReleaseEvent(const MouseEventWithHitTestResults&);
 
     void handleKeyboardSelectionMovement(KeyboardEvent*);
@@ -221,7 +246,9 @@ private:
     void hoverTimerFired(Timer<EventHandler>*);
 
     static bool canMouseDownStartSelect(Node*);
+#if ENABLE(DRAG_SUPPORT)
     static bool canMouseDragExtendSelect(Node*);
+#endif
 
     void handleAutoscroll(RenderObject*);
     void startAutoscrollTimer();
@@ -238,18 +265,22 @@ private:
     MouseEventWithHitTestResults prepareMouseEvent(const HitTestRequest&, const PlatformMouseEvent&);
 
     bool dispatchMouseEvent(const AtomicString& eventType, Node* target, bool cancelable, int clickCount, const PlatformMouseEvent&, bool setUnder);
+#if ENABLE(DRAG_SUPPORT)
     bool dispatchDragEvent(const AtomicString& eventType, Node* target, const PlatformMouseEvent&, Clipboard*);
 
     void freeClipboard();
 
     bool handleDrag(const MouseEventWithHitTestResults&);
+#endif
     bool handleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     void clearDragState();
 
     bool dispatchDragSrcEvent(const AtomicString& eventType, const PlatformMouseEvent&);
 
     bool dragHysteresisExceeded(const FloatPoint&) const;
     bool dragHysteresisExceeded(const IntPoint&) const;
+#endif // ENABLE(DRAG_SUPPORT)
 
     bool passMousePressEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe);
     bool passMouseMoveEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe, HitTestResult* hoveredNode = 0);
@@ -268,18 +299,26 @@ private:
     void defaultSpaceEventHandler(KeyboardEvent*);
     void defaultTabEventHandler(KeyboardEvent*);
 
+#if ENABLE(DRAG_SUPPORT)
     void allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const;
+#endif
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
+#if ENABLE(DRAG_SUPPORT)
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
+#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
+#if ENABLE(DRAG_SUPPORT)
     void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
+#endif
 
     void updateLastScrollbarUnderMouse(Scrollbar*, bool);
+    
+    void setFrameWasScrolledByUser();
 
     bool capturesDragging() const { return m_capturesDragging; }
 
@@ -296,11 +335,15 @@ private:
     RefPtr<Node> m_mousePressNode;
 
     bool m_mouseDownMayStartSelect;
+#if ENABLE(DRAG_SUPPORT)
     bool m_mouseDownMayStartDrag;
+#endif
     bool m_mouseDownWasSingleClickInSelection;
     bool m_beganSelectingText;
 
+#if ENABLE(DRAG_SUPPORT)
     IntPoint m_dragStartPos;
+#endif
 
     IntPoint m_panScrollStartPos;
     bool m_panScrollInProgress;
@@ -337,7 +380,9 @@ private:
     RefPtr<Touch> m_touch;
 #endif
 
+#if ENABLE(DRAG_SUPPORT)
     RefPtr<Node> m_dragTarget;
+#endif
     
     RefPtr<HTMLFrameSetElement> m_frameSetBeingResized;
 
@@ -351,7 +396,9 @@ private:
     bool m_useLatchedWheelEventNode;
     RefPtr<Node> m_latchedWheelEventNode;
     bool m_widgetIsLatched;
-    
+
+    RefPtr<Node> m_previousWheelScrolledNode;
+
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
diff --git a/WebCore/page/EventSource.cpp b/WebCore/page/EventSource.cpp
new file mode 100644
index 0000000..2c9a343
--- /dev/null
+++ b/WebCore/page/EventSource.cpp
@@ -0,0 +1,314 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(EVENTSOURCE)
+
+#include "EventSource.h"
+
+#include "Cache.h"
+#include "DOMWindow.h"
+#include "Event.h"
+#include "EventException.h"
+#include "PlatformString.h"
+#include "MessageEvent.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ScriptExecutionContext.h"
+#include "SerializedScriptValue.h"
+#include "TextResourceDecoder.h"
+#include "ThreadableLoader.h"
+
+namespace WebCore {
+
+const unsigned long long EventSource::defaultReconnectDelay = 3000;
+
+EventSource::EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec)
+    : ActiveDOMObject(context, this)
+    , m_state(CONNECTING)
+    , m_reconnectTimer(this, &EventSource::reconnectTimerFired)
+    , m_failSilently(false)
+    , m_requestInFlight(false)
+    , m_reconnectDelay(defaultReconnectDelay)
+{
+    if (url.isEmpty() || !(m_url = context->completeURL(url)).isValid()) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+    // FIXME: should support cross-origin requests
+    if (!scriptExecutionContext()->securityOrigin()->canRequest(m_url)) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    m_origin = scriptExecutionContext()->securityOrigin()->toString();
+    m_decoder = TextResourceDecoder::create("text/plain", "UTF-8");
+
+    setPendingActivity(this);
+    connect();
+}
+
+EventSource::~EventSource()
+{
+}
+
+void EventSource::connect()
+{
+    ResourceRequest request(m_url);
+    request.setHTTPMethod("GET");
+    request.setHTTPHeaderField("Accept", "text/event-stream");
+    request.setHTTPHeaderField("Cache-Control", "no-cache");
+    if (!m_lastEventId.isEmpty())
+        request.setHTTPHeaderField("Last-Event-ID", m_lastEventId);
+
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.allowCredentials = true;
+
+    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+
+    m_requestInFlight = true;
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestInFlight(m_url);
+}
+
+void EventSource::endRequest()
+{
+    m_requestInFlight = false;
+
+    if (!m_failSilently)
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+
+    if (!scriptExecutionContext()->isWorkerContext())
+        cache()->loader()->nonCacheRequestComplete(m_url);
+
+    if (m_state != CLOSED)
+        scheduleReconnect();
+    else
+        unsetPendingActivity(this);
+}
+
+void EventSource::scheduleReconnect()
+{
+    m_state = CONNECTING;
+    m_reconnectTimer.startOneShot(m_reconnectDelay / 1000);
+}
+
+void EventSource::reconnectTimerFired(Timer<EventSource>*)
+{
+    connect();
+}
+
+String EventSource::url() const
+{
+    return m_url.string();
+}
+
+EventSource::State EventSource::readyState() const
+{
+    return m_state;
+}
+
+void EventSource::close()
+{
+    if (m_state == CLOSED)
+        return;
+
+    if (m_reconnectTimer.isActive()) {
+        m_reconnectTimer.stop();
+        unsetPendingActivity(this);
+    }
+
+    m_state = CLOSED;
+    m_failSilently = true;
+
+    if (m_requestInFlight)
+        m_loader->cancel();
+}
+
+ScriptExecutionContext* EventSource::scriptExecutionContext() const
+{
+    return ActiveDOMObject::scriptExecutionContext();
+}
+
+void EventSource::didReceiveResponse(const ResourceResponse& response)
+{
+    int statusCode = response.httpStatusCode();
+    if (statusCode == 200 && response.httpHeaderField("Content-Type") == "text/event-stream") {
+        m_state = OPEN;
+        dispatchEvent(Event::create(eventNames().openEvent, false, false));
+    } else {
+        if (statusCode <= 200 || statusCode > 299)
+            m_state = CLOSED;
+        m_loader->cancel();
+    }
+}
+
+void EventSource::didReceiveData(const char* data, int length)
+{
+    append(m_receiveBuf, m_decoder->decode(data, length));
+    parseEventStream();
+}
+
+void EventSource::didFinishLoading(unsigned long)
+{
+    if (m_receiveBuf.size() > 0 || m_data.size() > 0) {
+        append(m_receiveBuf, "\n\n");
+        parseEventStream();
+    }
+    m_state = CONNECTING;
+    endRequest();
+}
+
+void EventSource::didFail(const ResourceError& error)
+{
+    int canceled = error.isCancellation();
+    if (((m_state == CONNECTING) && !canceled) || ((m_state == OPEN) && canceled))
+        m_state = CLOSED;
+    endRequest();
+}
+
+void EventSource::didFailRedirectCheck()
+{
+    m_state = CLOSED;
+    m_loader->cancel();
+}
+
+void EventSource::parseEventStream()
+{
+    unsigned int bufPos = 0;
+    unsigned int bufSize = m_receiveBuf.size();
+    for (;;) {
+        int lineLength = -1;
+        int fieldLength = -1;
+        int carriageReturn = 0;
+        for (unsigned int i = bufPos; lineLength < 0 && i < bufSize; i++) {
+            switch (m_receiveBuf[i]) {
+            case ':':
+                if (fieldLength < 0)
+                    fieldLength = i - bufPos;
+                break;
+            case '\n':
+                if (i > bufPos && m_receiveBuf[i - 1] == '\r') {
+                    carriageReturn++;
+                    i--;
+                }
+                lineLength = i - bufPos;
+                break;
+            }
+        }
+
+        if (lineLength < 0)
+            break;
+
+        parseEventStreamLine(bufPos, fieldLength, lineLength);
+        bufPos += lineLength + carriageReturn + 1;
+    }
+
+    if (bufPos == bufSize)
+        m_receiveBuf.clear();
+    else if (bufPos)
+        m_receiveBuf.remove(0, bufPos);
+}
+
+void EventSource::parseEventStreamLine(unsigned int bufPos, int fieldLength, int lineLength)
+{
+    if (!lineLength) {
+        if (!m_data.isEmpty())
+            dispatchEvent(createMessageEvent());
+        if (!m_eventName.isEmpty())
+            m_eventName = "";
+    } else if (fieldLength) {
+        bool noValue = fieldLength < 0;
+
+        String field(&m_receiveBuf[bufPos], noValue ? lineLength : fieldLength);
+        int step;
+        if (noValue)
+            step = lineLength;
+        else if (m_receiveBuf[bufPos + fieldLength + 1] != ' ')
+            step = fieldLength + 1;
+        else
+            step = fieldLength + 2;
+        bufPos += step;
+        int valueLength = lineLength - step;
+
+        if (field == "data") {
+            if (m_data.size() > 0)
+                m_data.append('\n');
+            if (valueLength)
+                m_data.append(&m_receiveBuf[bufPos], valueLength);
+        } else if (field == "event")
+            m_eventName = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "id")
+            m_lastEventId = valueLength ? String(&m_receiveBuf[bufPos], valueLength) : "";
+        else if (field == "retry") {
+            if (!valueLength)
+                m_reconnectDelay = defaultReconnectDelay;
+            else {
+                String value(&m_receiveBuf[bufPos], valueLength);
+                bool ok;
+                unsigned long long retry = value.toUInt64(&ok);
+                if (ok)
+                    m_reconnectDelay = retry;
+            }
+        }
+    }
+}
+
+void EventSource::stop()
+{
+    close();
+}
+
+PassRefPtr<MessageEvent> EventSource::createMessageEvent()
+{
+    RefPtr<MessageEvent> event = MessageEvent::create();
+    event->initMessageEvent(m_eventName.isEmpty() ? eventNames().messageEvent : AtomicString(m_eventName), false, false, SerializedScriptValue::create(String::adopt(m_data)), m_origin, m_lastEventId, 0, 0);
+    return event.release();
+}
+
+EventTargetData* EventSource::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* EventSource::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
diff --git a/WebCore/page/EventSource.h b/WebCore/page/EventSource.h
new file mode 100644
index 0000000..5b037a4
--- /dev/null
+++ b/WebCore/page/EventSource.h
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EventSource_h
+#define EventSource_h
+
+#if ENABLE(EVENTSOURCE)
+
+#include "ActiveDOMObject.h"
+#include "AtomicStringHash.h"
+#include "EventListener.h"
+#include "EventNames.h"
+#include "EventTarget.h"
+#include "KURL.h"
+#include "ThreadableLoaderClient.h"
+#include "Timer.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class MessageEvent;
+    class ResourceResponse;
+    class TextResourceDecoder;
+    class ThreadableLoader;
+
+    class EventSource : public RefCounted<EventSource>, public EventTarget, private ThreadableLoaderClient, public ActiveDOMObject {
+    public:
+        static PassRefPtr<EventSource> create(const String& url, ScriptExecutionContext* context, ExceptionCode& ec) { return adoptRef(new EventSource(url, context, ec)); }
+        virtual ~EventSource();
+
+        static const unsigned long long defaultReconnectDelay;
+
+        String url() const;
+
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2,
+        };
+
+        State readyState() const;
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+
+        void close();
+
+        using RefCounted<EventSource>::ref;
+        using RefCounted<EventSource>::deref;
+
+        virtual EventSource* toEventSource() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        virtual void stop();
+
+    private:
+        EventSource(const String& url, ScriptExecutionContext* context, ExceptionCode& ec);
+
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+
+        virtual void didReceiveResponse(const ResourceResponse& response);
+        virtual void didReceiveData(const char* data, int length);
+        virtual void didFinishLoading(unsigned long);
+        virtual void didFail(const ResourceError& error);
+        virtual void didFailRedirectCheck();
+
+        void connect();
+        void endRequest();
+        void scheduleReconnect();
+        void reconnectTimerFired(Timer<EventSource>*);
+        void parseEventStream();
+        void parseEventStreamLine(unsigned int pos, int fieldLength, int lineLength);
+        PassRefPtr<MessageEvent> createMessageEvent();
+
+        KURL m_url;
+        State m_state;
+
+        RefPtr<TextResourceDecoder> m_decoder;
+        RefPtr<ThreadableLoader> m_loader;
+        Timer<EventSource> m_reconnectTimer;
+        Vector<UChar> m_receiveBuf;
+        bool m_failSilently;
+        bool m_requestInFlight;
+
+        String m_eventName;
+        Vector<UChar> m_data;
+        String m_lastEventId;
+        unsigned long long m_reconnectDelay;
+        String m_origin;
+        
+        EventTargetData m_eventTargetData;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(EVENTSOURCE)
+
+#endif // EventSource_h
diff --git a/WebCore/page/EventSource.idl b/WebCore/page/EventSource.idl
new file mode 100644
index 0000000..561bd68
--- /dev/null
+++ b/WebCore/page/EventSource.idl
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Ericsson AB
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer
+ *    in the documentation and/or other materials provided with the
+ *    distribution.
+ * 3. Neither the name of Ericsson nor the names of its contributors
+ *    may be used to endorse or promote products derived from this
+ *    software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=EVENTSOURCE,
+        EventTarget,
+        NoStaticTables
+    ] EventSource {
+
+        readonly attribute DOMString URL;
+
+        // ready state
+        const unsigned short CONNECTING = 0;
+        const unsigned short OPEN = 1;
+        const unsigned short CLOSED = 2;
+        readonly attribute unsigned short readyState;
+
+        // networking
+        attribute EventListener onopen;
+        attribute EventListener onmessage;
+        attribute EventListener onerror;
+        void close();
+
+        // EventTarget interface
+        [Custom] void addEventListener(in DOMString type,
+                                      in EventListener listener,
+                                      in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
+
+    };
+}
diff --git a/WebCore/page/FocusController.cpp b/WebCore/page/FocusController.cpp
index 817801c..5e78c7d 100644
--- a/WebCore/page/FocusController.cpp
+++ b/WebCore/page/FocusController.cpp
@@ -36,6 +36,7 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -55,6 +56,18 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static inline void dispatchEventsOnWindowAndFocusedNode(Document* document, bool focused)
+{
+    // If we have a focused node we should dispatch blur on it before we blur the window.
+    // If we have a focused node we should dispatch focus on it after we focus the window.
+    // https://bugs.webkit.org/show_bug.cgi?id=27105
+    if (!focused && document->focusedNode())
+        document->focusedNode()->dispatchBlurEvent();
+    document->dispatchWindowEvent(Event::create(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false));
+    if (focused && document->focusedNode())
+        document->focusedNode()->dispatchFocusEvent();
+}
+
 FocusController::FocusController(Page* page)
     : m_page(page)
     , m_isActive(false)
@@ -75,12 +88,12 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     // Now that the frame is updated, fire events and update the selection focused states of both frames.
     if (oldFrame && oldFrame->view()) {
         oldFrame->selection()->setFocused(false);
-        oldFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+        oldFrame->document()->dispatchWindowEvent(Event::create(eventNames().blurEvent, false, false));
     }
 
     if (newFrame && newFrame->view() && isFocused()) {
         newFrame->selection()->setFocused(true);
-        newFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+        newFrame->document()->dispatchWindowEvent(Event::create(eventNames().focusEvent, false, false));
     }
 }
 
@@ -100,7 +113,7 @@ void FocusController::setFocused(bool focused)
     
     if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(focused);
-        m_focusedFrame->document()->dispatchWindowEvent(focused ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), focused);
     }
 }
 
@@ -146,6 +159,8 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     if (caretBrowsing && !currentNode)
         currentNode = frame->selection()->start().node();
 
+    document->updateLayoutIgnorePendingStylesheets();
+
     Node* node = (direction == FocusDirectionForward)
         ? document->nextFocusableNode(currentNode, event)
         : document->previousFocusableNode(currentNode, event);
@@ -341,7 +356,7 @@ void FocusController::setActive(bool active)
     focusedOrMainFrame()->selection()->pageActivationChanged();
     
     if (m_focusedFrame && isFocused())
-        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
+        dispatchEventsOnWindowAndFocusedNode(m_focusedFrame->document(), active);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index 78cc25c..c03efb0 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -59,6 +59,7 @@
 #include "Navigator.h"
 #include "NodeList.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "RegularExpression.h"
 #include "RenderPart.h"
 #include "RenderTableCell.h"
@@ -66,9 +67,12 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "ScriptController.h"
+#include "ScriptSourceCode.h"
+#include "ScriptValue.h"
 #include "Settings.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
+#include "UserContentURLPattern.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
 #include "markup.h"
@@ -82,10 +86,6 @@
 #include "runtime_root.h"
 #endif
 
-#if FRAME_LOADS_USER_STYLESHEET
-#include "UserStyleSheetLoader.h"
-#endif
-
 #if ENABLE(SVG)
 #include "SVGDocument.h"
 #include "SVGDocumentExtensions.h"
@@ -101,6 +101,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(MATHML)
+#include "MathMLNames.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -122,6 +126,7 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     : m_page(page)
     , m_treeNode(this, parentFromOwnerElement(ownerElement))
     , m_loader(this, frameLoaderClient)
+    , m_redirectScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
     , m_selectionGranularity(CharacterGranularity)
@@ -131,6 +136,9 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_eventHandler(this)
     , m_animationController(this)
     , m_lifeSupportTimer(this, &Frame::lifeSupportTimerFired)
+#if ENABLE(ORIENTATION_EVENTS)
+    , m_orientation(0)
+#endif
     , m_caretVisible(false)
     , m_caretPaint(true)
     , m_highlightTextMatches(false)
@@ -138,9 +146,6 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     , m_needsReapplyStyles(false)
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
-#if FRAME_LOADS_USER_STYLESHEET
-    , m_userStyleSheetLoader(0)
-#endif
 {
     Frame* parent = parentFromOwnerElement(ownerElement);
     m_zoomFactor = parent ? parent->m_zoomFactor : 1.0f;
@@ -159,6 +164,10 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
     WMLNames::init();
 #endif
 
+#if ENABLE(MATHML)
+    MathMLNames::init();
+#endif
+
     XMLNames::init();
 
     if (!ownerElement)
@@ -203,10 +212,6 @@ Frame::~Frame()
     }
 
     ASSERT(!m_lifeSupportTimer.isActive());
-
-#if FRAME_LOADS_USER_STYLESHEET
-    delete m_userStyleSheetLoader;
-#endif
 }
 
 void Frame::init()
@@ -219,6 +224,11 @@ FrameLoader* Frame::loader() const
     return &m_loader;
 }
 
+RedirectScheduler* Frame::redirectScheduler() const
+{
+    return &m_redirectScheduler;
+}
+
 FrameView* Frame::view() const
 {
     return m_view.get();
@@ -226,6 +236,12 @@ FrameView* Frame::view() const
 
 void Frame::setView(PassRefPtr<FrameView> view)
 {
+    // We the custom scroll bars as early as possible to prevent m_doc->detach()
+    // from messing with the view such that its scroll bars won't be torn down.
+    // FIXME: We should revisit this.
+    if (m_view)
+        m_view->detachCustomScrollbars();
+
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
     // hooked up enough for some JavaScript calls to work.
@@ -273,6 +289,15 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
     m_script.updateDocument();
 }
 
+#if ENABLE(ORIENTATION_EVENTS)
+void Frame::sendOrientationChangeEvent(int orientation)
+{
+    m_orientation = orientation;
+    if (Document* doc = document())
+        doc->dispatchWindowEvent(eventNames().orientationchangeEvent, false, false);
+}
+#endif // ENABLE(ORIENTATION_EVENTS)
+    
 Settings* Frame::settings() const
 {
     return m_page ? m_page->settings() : 0;
@@ -829,14 +854,6 @@ void Frame::reapplyStyles()
     // We should probably eventually move it into its own function.
     m_doc->docLoader()->setAutoLoadImages(m_page && m_page->settings()->loadsImagesAutomatically());
 
-#if FRAME_LOADS_USER_STYLESHEET
-    const KURL userStyleSheetLocation = m_page ? m_page->settings()->userStyleSheetLocation() : KURL();
-    if (!userStyleSheetLocation.isEmpty())
-        setUserStyleSheetLocation(userStyleSheetLocation);
-    else
-        setUserStyleSheet(String());
-#endif
-
     // FIXME: It's not entirely clear why the following is needed.
     // The document automatically does this as required when you set the style sheet.
     // But we had problems when this code was removed. Details are in
@@ -844,6 +861,39 @@ void Frame::reapplyStyles()
     m_doc->updateStyleSelector();
 }
 
+void Frame::injectUserScripts(UserScriptInjectionTime injectionTime)
+{
+    if (!m_page)
+        return;
+    
+    // Walk the hashtable. Inject by world.
+    const UserScriptMap* userScripts = m_page->group().userScripts();
+    if (!userScripts)
+        return;
+    UserScriptMap::const_iterator end = userScripts->end();
+    for (UserScriptMap::const_iterator it = userScripts->begin(); it != end; ++it)
+        injectUserScriptsForWorld(it->first, *it->second, injectionTime);
+}
+
+void Frame::injectUserScriptsForWorld(unsigned worldID, const UserScriptVector& userScripts, UserScriptInjectionTime injectionTime)
+{
+    if (userScripts.isEmpty())
+        return;
+
+    Document* doc = document();
+    if (!doc)
+        return;
+
+    Vector<ScriptSourceCode> sourceCode;
+    unsigned count = userScripts.size();
+    for (unsigned i = 0; i < count; ++i) {
+        UserScript* script = userScripts[i].get();
+        if (script->injectionTime() == injectionTime && UserContentURLPattern::matchesPatterns(doc->url(), script->whitelist(), script->blacklist()))
+            sourceCode.append(ScriptSourceCode(script->source(), script->url()));
+    }
+    script()->evaluateInIsolatedWorld(worldID, sourceCode);
+}
+
 bool Frame::shouldChangeSelection(const VisibleSelection& newSelection) const
 {
     return shouldChangeSelection(selection()->selection(), newSelection, newSelection.affinity(), false);
@@ -1559,6 +1609,11 @@ Page* Frame::page() const
     return m_page;
 }
 
+void Frame::detachFromPage()
+{
+    m_page = 0;
+}
+
 EventHandler* Frame::eventHandler() const
 {
     return &m_eventHandler;
@@ -1579,7 +1634,7 @@ void Frame::pageDestroyed()
     script()->clearScriptObjects();
     script()->updatePlatformScriptObjects();
 
-    m_page = 0;
+    detachFromPage();
 }
 
 void Frame::disconnectOwnerElement()
@@ -1624,7 +1679,7 @@ void Frame::unfocusWindow()
         page()->chrome()->unfocus();
 }
 
-bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
+bool Frame::shouldClose()
 {
     Chrome* chrome = page() ? page()->chrome() : 0;
     if (!chrome || !chrome->canRunBeforeUnloadConfirmPanel())
@@ -1638,7 +1693,8 @@ bool Frame::shouldClose(RegisteredEventListenerVector* alternateEventListeners)
     if (!body)
         return true;
 
-    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = m_domWindow->dispatchBeforeUnloadEvent(alternateEventListeners);
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    m_domWindow->dispatchEvent(beforeUnloadEvent.get(), m_domWindow->document());
 
     if (!beforeUnloadEvent->defaultPrevented())
         doc->defaultEventHandler(beforeUnloadEvent.get());
@@ -1759,7 +1815,6 @@ void Frame::createView(const IntSize& viewportSize,
         frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
-    frameView->updateDefaultScrollbarState();
 
     setView(frameView);
 
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index 652269a..6208bbd 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -41,6 +41,7 @@
 #include "ScrollBehavior.h"
 #include "SelectionController.h"
 #include "TextGranularity.h"
+#include "UserScriptTypes.h"
 
 #if PLATFORM(WIN)
 #include "FrameWin.h"
@@ -66,6 +67,7 @@ namespace WebCore {
     class Editor;
     class EventHandler;
     class FrameLoader;
+    class RedirectScheduler;
     class FrameLoaderClient;
     class FrameTree;
     class FrameView;
@@ -79,10 +81,6 @@ namespace WebCore {
     class VisibleSelection;
     class Widget;
 
-#if FRAME_LOADS_USER_STYLESHEET
-    class UserStyleSheetLoader;
-#endif
-
     template <typename T> class Timer;
 
     class Frame : public RefCounted<Frame> {
@@ -97,6 +95,7 @@ namespace WebCore {
         void init();
 
         Page* page() const;
+        void detachFromPage();
         HTMLFrameOwnerElement* ownerElement() const;
 
         void pageDestroyed();
@@ -112,6 +111,7 @@ namespace WebCore {
         Editor* editor() const;
         EventHandler* eventHandler() const;
         FrameLoader* loader() const;
+        RedirectScheduler* redirectScheduler() const;
         SelectionController* selection() const;
         FrameTree* tree() const;
         AnimationController* animation() const;
@@ -128,6 +128,10 @@ namespace WebCore {
         void createView(const IntSize&, const Color&, bool, const IntSize &, bool,
                         ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
 
+        void injectUserScripts(UserScriptInjectionTime);
+
+    private:
+        void injectUserScriptsForWorld(unsigned worldID, const UserScriptVector&, UserScriptInjectionTime);
 
     private:
         Frame(Page*, HTMLFrameOwnerElement*, FrameLoaderClient*);
@@ -139,11 +143,6 @@ namespace WebCore {
 
         Settings* settings() const; // can be NULL
 
-    #if FRAME_LOADS_USER_STYLESHEET
-        void setUserStyleSheetLocation(const KURL&);
-        void setUserStyleSheet(const String& styleSheetData);
-    #endif
-
         void setPrinting(bool printing, float minPageWidth, float maxPageWidth, bool adjustViewSize);
 
         bool inViewSourceMode() const;
@@ -156,6 +155,14 @@ namespace WebCore {
 
         void setDocument(PassRefPtr<Document>);
 
+#if ENABLE(ORIENTATION_EVENTS)
+        // Orientation is the interface orientation in degrees. Some examples are:
+        //  0 is straight up; -90 is when the device is rotated 90 clockwise;
+        //  90 is when rotated counter clockwise.
+        void sendOrientationChangeEvent(int orientation);
+        int orientation() const { return m_orientation; }
+#endif
+
         void clearTimers();
         static void clearTimers(FrameView*, Document*);
 
@@ -193,7 +200,7 @@ namespace WebCore {
     public:
         void focusWindow();
         void unfocusWindow();
-        bool shouldClose(RegisteredEventListenerVector* alternateEventListeners = 0);
+        bool shouldClose();
         void scheduleClose();
 
         void setJSStatusBarText(const String&);
@@ -329,6 +336,7 @@ namespace WebCore {
         Page* m_page;
         mutable FrameTree m_treeNode;
         mutable FrameLoader m_loader;
+        mutable RedirectScheduler m_redirectScheduler;
 
         mutable RefPtr<DOMWindow> m_domWindow;
         HashSet<DOMWindow*> m_liveFormerWindows;
@@ -357,6 +365,10 @@ namespace WebCore {
 
         Timer<Frame> m_lifeSupportTimer;
 
+#if ENABLE(ORIENTATION_EVENTS)
+        int m_orientation;
+#endif
+        
         bool m_caretVisible;
         bool m_caretPaint;
 
@@ -365,11 +377,6 @@ namespace WebCore {
         bool m_needsReapplyStyles;
         bool m_isDisconnected;
         bool m_excludeFromTextSearch;
-
-    #if FRAME_LOADS_USER_STYLESHEET
-        UserStyleSheetLoader* m_userStyleSheetLoader;
-    #endif
-
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/FrameTree.cpp b/WebCore/page/FrameTree.cpp
index 24f125d..41caa9c 100644
--- a/WebCore/page/FrameTree.cpp
+++ b/WebCore/page/FrameTree.cpp
@@ -91,7 +91,7 @@ void FrameTree::removeChild(Frame* child)
     RefPtr<Frame>& newLocationForNext = m_firstChild == child ? m_firstChild : child->tree()->m_previousSibling->tree()->m_nextSibling;
     Frame*& newLocationForPrevious = m_lastChild == child ? m_lastChild : child->tree()->m_nextSibling->tree()->m_previousSibling;
     swap(newLocationForNext, child->tree()->m_nextSibling);
-    // For some inexplicable reason, the following line does not compile without the explicit std:: namepsace
+    // For some inexplicable reason, the following line does not compile without the explicit std:: namespace
     std::swap(newLocationForPrevious, child->tree()->m_previousSibling);
 
     child->tree()->m_previousSibling = 0;
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index ed91587..e7006ed 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -42,11 +42,12 @@
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "InspectorTimelineAgent.h"
 #include "OverflowEvent.h"
-#include "Page.h"
 #include "RenderPart.h"
 #include "RenderPartObject.h"
 #include "RenderScrollbar.h"
+#include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
@@ -96,13 +97,10 @@ struct ScheduledEvent {
 
 FrameView::FrameView(Frame* frame)
     : m_frame(frame)
-    , m_vmode(ScrollbarAuto)
-    , m_hmode(ScrollbarAuto)
     , m_slowRepaintObjectCount(0)
     , m_layoutTimer(this, &FrameView::layoutTimerFired)
     , m_layoutRoot(0)
     , m_postLayoutTasksTimer(this, &FrameView::postLayoutTimerFired)
-    , m_needToInitScrollbars(true)
     , m_isTransparent(false)
     , m_baseBackgroundColor(Color::white)
     , m_mediaType("screen")
@@ -115,6 +113,7 @@ FrameView::FrameView(Frame* frame)
     , m_shouldUpdateWhileOffscreen(true)
     , m_deferSetNeedsLayouts(0)
     , m_setNeedsLayoutWasDeferred(false)
+    , m_scrollCorner(0)
 {
     init();
 }
@@ -143,9 +142,15 @@ FrameView::~FrameView()
     }
 
     resetScrollbars();
+
+    // Custom scrollbars should already be destroyed at this point
+    ASSERT(!horizontalScrollbar() || !horizontalScrollbar()->isCustomScrollbar());
+    ASSERT(!verticalScrollbar() || !verticalScrollbar()->isCustomScrollbar());
+
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
     
+    ASSERT(!m_scrollCorner);
     ASSERT(m_scheduledEvents.isEmpty());
     ASSERT(!m_enqueueEvents);
 
@@ -206,7 +211,7 @@ void FrameView::resetScrollbars()
     // Reset the document's scrollbars back to our defaults before we yield the floor.
     m_firstLayout = true;
     setScrollbarsSuppressed(true);
-    setScrollbarModes(m_hmode, m_vmode);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
     setScrollbarsSuppressed(false);
 }
 
@@ -237,23 +242,18 @@ void FrameView::detachCustomScrollbars()
     if (!m_frame)
         return;
 
-    Document* document = m_frame->document();
-    if (!document)
-        return;
-
-    Element* body = document->body();
-    if (!body)
-        return;
-
-    RenderBox* renderBox = body->renderBox();
-
     Scrollbar* horizontalBar = horizontalScrollbar();
-    if (horizontalBar && horizontalBar->isCustomScrollbar() && toRenderScrollbar(horizontalBar)->owningRenderer() == renderBox)
+    if (horizontalBar && horizontalBar->isCustomScrollbar() && !toRenderScrollbar(horizontalBar)->owningRenderer()->isRenderPart())
         setHasHorizontalScrollbar(false);
 
     Scrollbar* verticalBar = verticalScrollbar();
-    if (verticalBar && verticalBar->isCustomScrollbar() && toRenderScrollbar(verticalBar)->owningRenderer() == renderBox)
+    if (verticalBar && verticalBar->isCustomScrollbar() && !toRenderScrollbar(verticalBar)->owningRenderer()->isRenderPart())
         setHasVerticalScrollbar(false);
+
+    if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
 }
 
 void FrameView::clear()
@@ -275,21 +275,6 @@ bool FrameView::didFirstLayout() const
     return !m_firstLayout;
 }
 
-void FrameView::initScrollbars()
-{
-    if (!m_needToInitScrollbars)
-        return;
-    m_needToInitScrollbars = false;
-    updateDefaultScrollbarState();
-}
-
-void FrameView::updateDefaultScrollbarState()
-{
-    m_hmode = horizontalScrollbarMode();
-    m_vmode = verticalScrollbarMode();
-    setScrollbarModes(m_hmode, m_vmode);
-}
-
 void FrameView::invalidateRect(const IntRect& rect)
 {
     if (!parent()) {
@@ -323,12 +308,6 @@ void FrameView::setMarginHeight(int h)
     m_margins.setHeight(h);
 }
 
-void FrameView::setCanHaveScrollbars(bool canScroll)
-{
-    ScrollView::setCanHaveScrollbars(canScroll);
-    scrollbarModes(m_hmode, m_vmode);
-}
-
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     // FIXME: We need to update the scrollbar dynamically as documents change (or as doc elements and bodies get discovered that have custom styles).
@@ -377,7 +356,7 @@ void FrameView::adjustViewSize()
     RenderView* root = m_frame->contentRenderer();
     if (!root)
         return;
-    setContentsSize(IntSize(root->overflowWidth(), root->overflowHeight()));
+    setContentsSize(IntSize(root->rightLayoutOverflow(), root->bottomLayoutOverflow()));
 }
 
 void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, ScrollbarMode& vMode)
@@ -517,6 +496,12 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willLayout();
+#endif
+
     if (!allowSubtree && m_layoutRoot) {
         m_layoutRoot->markContainingBlocksForLayout(false);
         m_layoutRoot = 0;
@@ -573,8 +558,9 @@ void FrameView::layout(bool allowSubtree)
 
     m_nestedLayoutCount++;
 
-    ScrollbarMode hMode = m_hmode;
-    ScrollbarMode vMode = m_vmode;
+    ScrollbarMode hMode;
+    ScrollbarMode vMode;
+    scrollbarModes(hMode, vMode);
 
     if (!subtree) {
         RenderObject* rootRenderer = document->documentElement() ? document->documentElement()->renderer() : 0;
@@ -674,7 +660,7 @@ void FrameView::layout(bool allowSubtree)
 
 #if PLATFORM(MAC)
     if (AXObjectCache::accessibilityEnabled())
-        root->document()->axObjectCache()->postNotification(root, "AXLayoutComplete", true);
+        root->document()->axObjectCache()->postNotification(root, AXObjectCache::AXLayoutComplete, true);
 #endif
 #if ENABLE(DASHBOARD_SUPPORT)
     updateDashboardRegions();
@@ -709,6 +695,11 @@ void FrameView::layout(bool allowSubtree)
         ASSERT(m_enqueueEvents);
     }
 
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didLayout();
+#endif
+
     m_nestedLayoutCount--;
 }
 
@@ -825,6 +816,22 @@ void FrameView::setScrollPosition(const IntPoint& scrollPoint)
     m_inProgrammaticScroll = wasInProgrammaticScroll;
 }
 
+void FrameView::scrollPositionChanged()
+{
+    frame()->eventHandler()->sendScrollEvent();
+
+#if USE(ACCELERATED_COMPOSITING)
+    // We need to update layer positions after scrolling to account for position:fixed layers.
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    RenderLayer* layer = document->renderer() ? document->renderer()->enclosingLayer() : 0;
+    if (layer)
+        layer->updateLayerPositions(RenderLayer::UpdateCompositingLayers);
+#endif
+}
+
 HostWindow* FrameView::hostWindow() const
 {
     Page* page = frame() ? frame()->page() : 0;
@@ -857,9 +864,9 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
             m_repaintRects.append(unionedRect);
         }
         if (m_repaintCount < cRepaintRectUnionThreshold)
-            m_repaintRects.append(r);
+            m_repaintRects.append(visibleContent);
         else
-            m_repaintRects[0].unite(r);
+            m_repaintRects[0].unite(visibleContent);
         m_repaintCount++;
     
         if (!m_deferringRepaints && !m_deferredRepaintTimer.isActive())
@@ -997,7 +1004,8 @@ void FrameView::layoutTimerFired(Timer<FrameView>*)
 
 void FrameView::scheduleRelayout()
 {
-    ASSERT(!m_frame->document()->inPageCache());
+    // FIXME: We should assert the page is not in the page cache, but that is causing
+    // too many false assertions.  See <rdar://problem/7218118>.
     ASSERT(m_frame->view() == this);
 
     if (m_layoutRoot) {
@@ -1221,6 +1229,9 @@ void FrameView::scrollToAnchor()
     // Align to the top and to the closest side (this matches other browsers).
     anchorNode->renderer()->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
 
+    if (AXObjectCache::accessibilityEnabled())
+        m_frame->document()->axObjectCache()->handleScrolledToAnchor(anchorNode.get());
+
     // scrollRectToVisible can call into scrollRectIntoViewRecursively(), which resets m_maintainScrollPositionAnchor.
     m_maintainScrollPositionAnchor = anchorNode;
 }
@@ -1427,6 +1438,86 @@ void FrameView::updateDashboardRegions()
 }
 #endif
 
+void FrameView::invalidateScrollCorner()
+{
+    invalidateRect(scrollCornerRect());
+}
+
+void FrameView::updateScrollCorner()
+{
+    RenderObject* renderer = 0;
+    RefPtr<RenderStyle> cornerStyle;
+    
+    if (!scrollCornerRect().isEmpty()) {
+        // Try the <body> element first as a scroll corner source.
+        Document* doc = m_frame->document();
+        Element* body = doc ? doc->body() : 0;
+        if (body && body->renderer()) {
+            renderer = body->renderer();
+            cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+        
+        if (!cornerStyle) {
+            // If the <body> didn't have a custom style, then the root element might.
+            Element* docElement = doc ? doc->documentElement() : 0;
+            if (docElement && docElement->renderer()) {
+                renderer = docElement->renderer();
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+            }
+        }
+        
+        if (!cornerStyle) {
+            // If we have an owning iframe/frame element, then it can set the custom scrollbar also.
+            if (RenderPart* renderer = m_frame->ownerRenderer())
+                cornerStyle = renderer->getUncachedPseudoStyle(SCROLLBAR_CORNER, renderer->style());
+        }
+    }
+
+    if (cornerStyle) {
+        if (!m_scrollCorner)
+            m_scrollCorner = new (renderer->renderArena()) RenderScrollbarPart(renderer->document());
+        m_scrollCorner->setStyle(cornerStyle.release());
+        invalidateRect(scrollCornerRect());
+    } else if (m_scrollCorner) {
+        m_scrollCorner->destroy();
+        m_scrollCorner = 0;
+    }
+}
+
+void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    if (context->updatingControlTints()) {
+        updateScrollCorner();
+        return;
+    }
+
+    if (m_scrollCorner) {
+        m_scrollCorner->paintIntoRect(context, cornerRect.x(), cornerRect.y(), cornerRect);
+        return;
+    }
+
+    ScrollView::paintScrollCorner(context, cornerRect);
+}
+
+bool FrameView::hasCustomScrollbars() const
+{
+    const HashSet<RefPtr<Widget> >* viewChildren = children();
+    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
+    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+        Widget* widget = current->get();
+        if (widget->isFrameView()) {
+            if (static_cast<FrameView*>(widget)->hasCustomScrollbars())
+                return true;
+        } else if (widget->isScrollbar()) {
+            Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
+            if (scrollbar->isCustomScrollbar())
+                return true;
+        }
+    }
+
+    return false;
+}
+
 void FrameView::updateControlTints()
 {
     // This is called when control tints are changed from aqua/graphite to clear and vice versa.
@@ -1438,7 +1529,7 @@ void FrameView::updateControlTints()
     if (!m_frame || m_frame->loader()->url().isEmpty())
         return;
 
-    if (m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) {
+    if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
         if (needsLayout())
             layout();
         PlatformGraphicsContext* const noContext = 0;
@@ -1468,7 +1559,13 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 {
     if (!frame())
         return;
-    
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent();
+    if (timelineAgent)
+        timelineAgent->willPaint();
+#endif
+
     Document* document = frame()->document();
 
 #ifndef NDEBUG
@@ -1532,6 +1629,11 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
 
     if (isTopLevelPainter)
         sCurrentPaintTimeStamp = 0;
+
+#if ENABLE(INSPECTOR)
+    if (timelineAgent)
+        timelineAgent->didPaint();
+#endif
 }
 
 void FrameView::setPaintRestriction(PaintRestriction pr)
@@ -1573,10 +1675,15 @@ void FrameView::layoutIfNeededRecursive()
 
     // layoutIfNeededRecursive is called when we need to make sure layout is up-to-date before
     // painting, so we need to flush out any deferred repaints too.
-    if (m_deferredRepaintTimer.isActive()) {
-        m_deferredRepaintTimer.stop();
-        doDeferredRepaints();
-    }
+    flushDeferredRepaints();
+}
+    
+void FrameView::flushDeferredRepaints()
+{
+    if (!m_deferredRepaintTimer.isActive())
+        return;
+    m_deferredRepaintTimer.stop();
+    doDeferredRepaints();
 }
 
 void FrameView::forceLayout(bool allowSubtree)
@@ -1626,7 +1733,7 @@ void FrameView::adjustPageHeight(float *newBottom, float oldTop, float oldBottom
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->overflowWidth(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->rightLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
         if (*newBottom == 0)
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 1bdcfb3..4c900ae 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -25,7 +25,9 @@
 #ifndef FrameView_h
 #define FrameView_h
 
+#include "Frame.h"
 #include "IntSize.h"
+#include "Page.h"
 #include "RenderLayer.h"
 #include "ScrollView.h"
 #include <wtf/Forward.h>
@@ -37,6 +39,7 @@ class Color;
 class Event;
 class Frame;
 class FrameViewPrivate;
+class InspectorTimelineAgent;
 class IntRect;
 class Node;
 class PlatformMouseEvent;
@@ -69,8 +72,6 @@ public:
     void setMarginWidth(int);
     void setMarginHeight(int);
 
-    virtual void setCanHaveScrollbars(bool);
-
     virtual PassRefPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
 
     virtual void setContentsSize(const IntSize&);
@@ -122,8 +123,6 @@ public:
     void setShouldUpdateWhileOffscreen(bool);
 
     void adjustViewSize();
-    void initScrollbars();
-    void updateDefaultScrollbarState();
     
     virtual IntRect windowClipRect(bool clipToContents = true) const;
     IntRect windowClipRectForLayer(const RenderLayer*, bool clipToLayerContents) const;
@@ -132,6 +131,7 @@ public:
 
     virtual void scrollRectIntoViewRecursively(const IntRect&);
     virtual void setScrollPosition(const IntPoint&);
+    void scrollPositionChanged();
 
     String mediaType() const;
     void setMediaType(const String&);
@@ -174,6 +174,7 @@ public:
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
     void layoutIfNeededRecursive();
+    void flushDeferredRepaints();
 
     void setIsVisuallyNonEmpty() { m_isVisuallyNonEmpty = true; }
 
@@ -190,6 +191,9 @@ public:
     virtual IntPoint convertFromRenderer(const RenderObject*, const IntPoint&) const;
     virtual IntPoint convertToRenderer(const RenderObject*, const IntPoint&) const;
 
+    bool isFrameViewScrollCorner(RenderScrollbarPart* scrollCorner) const { return m_scrollCorner == scrollCorner; }
+    void invalidateScrollCorner();
+
 private:
     FrameView(Frame*);
 
@@ -232,7 +236,16 @@ private:
 
     bool updateWidgets();
     void scrollToAnchor();
+
+#if ENABLE(INSPECTOR)
+    InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     
+    bool hasCustomScrollbars() const;
+
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+
     static double sCurrentPaintTimeStamp; // used for detecting decoded resource thrash in the cache
 
     IntSize m_size;
@@ -242,8 +255,6 @@ private:
 
     bool m_doFullRepaint;
     
-    ScrollbarMode m_vmode;
-    ScrollbarMode m_hmode;
     bool m_useSlowRepaints;
     bool m_isOverlapped;
     bool m_contentIsOpaque;
@@ -263,7 +274,6 @@ private:
     bool m_firstLayoutCallbackPending;
 
     bool m_firstLayout;
-    bool m_needToInitScrollbars;
     bool m_isTransparent;
     Color m_baseBackgroundColor;
     IntSize m_lastLayoutSize;
@@ -302,8 +312,18 @@ private:
     bool m_firstVisuallyNonEmptyLayoutCallbackPending;
 
     RefPtr<Node> m_maintainScrollPositionAnchor;
+
+    // Renderer to hold our custom scroll corner.
+    RenderScrollbarPart* m_scrollCorner;
 };
 
+#if ENABLE(INSPECTOR)
+inline InspectorTimelineAgent* FrameView::inspectorTimelineAgent() const
+{
+    return m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
+}
+#endif
+
 } // namespace WebCore
 
 #endif // FrameView_h
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index bf877e6..1ded2af 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -41,8 +41,11 @@
 
 namespace WebCore {
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 static const char* permissionDeniedErrorMessage = "User denied Geolocation";
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
     : m_geolocation(geolocation)
     , m_successCallback(successCallback)
@@ -60,15 +63,30 @@ Geolocation::GeoNotifier::GeoNotifier(Geolocation* geolocation, PassRefPtr<Posit
 
 void Geolocation::GeoNotifier::setFatalError(PassRefPtr<PositionError> error)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     m_fatalError = error;
     m_timer.startOneShot(0);
+=======
+    ASSERT(m_successCallback);
+    // If no options were supplied from JS, we should have created a default set
+    // of options in JSGeolocationCustom.cpp.
+    ASSERT(m_options);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 void Geolocation::GeoNotifier::setCachedPosition(Geoposition* cachedPosition)
+=======
+bool Geolocation::GeoNotifier::hasZeroTimeout() const
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // We do not take owenership from the caller, but add our own ref count.
     m_cachedPosition = cachedPosition;
     m_timer.startOneShot(0);
+=======
+    return m_options->hasTimeout() && m_options->timeout() == 0;
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 }
 
 void Geolocation::GeoNotifier::startTimerIfNeeded()
@@ -81,6 +99,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
 {
     m_timer.stop();
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     if (m_fatalError) {
         if (m_errorCallback)
             m_errorCallback->handleEvent(m_fatalError.get());
@@ -95,8 +114,14 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
         return;
     }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     if (m_errorCallback) {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timed out");
+=======
+        RefPtr<PositionError> error = PositionError::create(PositionError::TIMEOUT, "Timeout expired");
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         m_errorCallback->handleEvent(error.get());
     }
     m_geolocation->requestTimedOut(this);
@@ -274,23 +299,55 @@ void Geolocation::disconnectFrame()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     RefPtr<GeoNotifier> notifier = makeRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
+=======
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
+
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
+        if (notifier->m_errorCallback) {
+            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+            notifier->m_errorCallback->handleEvent(error.get());
+        }
+        return;
+    }
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
     m_oneShots.add(notifier);
 }
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     RefPtr<GeoNotifier> notifier = makeRequest(successCallback, errorCallback, options);
     ASSERT(notifier);
+=======
+    RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    if (notifier->hasZeroTimeout() || m_service->startUpdating(notifier->m_options.get()))
+        notifier->startTimerIfNeeded();
+    else {
+        if (notifier->m_errorCallback) {
+            RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "Unable to Start");
+            notifier->m_errorCallback->handleEvent(error.get());
+        }
+        return 0;
+    }
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     static int sIdentifier = 0;
     m_watchers.set(++sIdentifier, notifier);
 
     return sIdentifier;
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 PassRefPtr<Geolocation::GeoNotifier> Geolocation::makeRequest(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
     RefPtr<GeoNotifier> notifier = GeoNotifier::create(this, successCallback, errorCallback, options);
@@ -334,6 +391,8 @@ void Geolocation::fatalErrorOccurred(Geolocation::GeoNotifier* notifier)
         m_service->stopUpdating();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 void Geolocation::requestTimedOut(GeoNotifier* notifier)
 {
     // If this is a one-shot request, stop it.
@@ -343,6 +402,7 @@ void Geolocation::requestTimedOut(GeoNotifier* notifier)
         m_service->stopUpdating();
 }
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 void Geolocation::requestReturnedCachedPosition(GeoNotifier* notifier)
 {
     // If this is a one-shot request, stop it.
@@ -372,6 +432,8 @@ bool Geolocation::haveSuitableCachedPosition(PositionOptions* options)
     return m_cachedPositionManager->cachedPosition()->timestamp() > currentTimeMillis - options->maximumAge();
 }
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 void Geolocation::clearWatch(int watchId)
 {
     m_watchers.remove(watchId);
@@ -397,9 +459,17 @@ void Geolocation::setIsAllowed(bool allowed)
     // This may be due to either a new position from the service, or a cached
     // position.
     m_allowGeolocation = allowed ? Yes : No;
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
     if (!isAllowed()) {
         RefPtr<WebCore::PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, permissionDeniedErrorMessage);
+=======
+    
+    if (isAllowed())
+        makeSuccessCallbacks();
+    else {
+        RefPtr<PositionError> error = PositionError::create(PositionError::PERMISSION_DENIED, "User disallowed Geolocation");
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         error->setIsFatal(true);
         handleError(error.get());
         return;
@@ -436,7 +506,10 @@ void Geolocation::sendPosition(Vector<RefPtr<GeoNotifier> >& notifiers, Geoposit
         RefPtr<GeoNotifier> notifier = *it;
         ASSERT(notifier->m_successCallback);
         
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         notifier->m_timer.stop();
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         notifier->m_successCallback->handleEvent(position);
     }
 }
@@ -475,15 +548,29 @@ void Geolocation::stopTimers()
 void Geolocation::handleError(PositionError* error)
 {
     ASSERT(error);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    
+    Vector<RefPtr<GeoNotifier> > oneShotsCopy;
+    copyToVector(m_oneShots, oneShotsCopy);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > oneShotsCopy;
     copyToVector(m_oneShots, oneShotsCopy);
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > watchersCopy;
     copyValuesToVector(m_watchers, watchersCopy);
 
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // added by calls to Geolocation methods from the callbacks.
+=======
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     m_oneShots.clear();
     if (error->isFatal())
         m_watchers.clear();
@@ -515,17 +602,32 @@ void Geolocation::requestPermission()
 
 void Geolocation::geolocationServicePositionChanged(GeolocationService*)
 {
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
+=======
+    ASSERT_UNUSED(service, service == m_service);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     ASSERT(m_service->lastPosition());
 
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     m_cachedPositionManager->setCachedPosition(m_service->lastPosition());
 
+=======
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     // Stop all currently running timers.
     stopTimers();
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     if (!isAllowed()) {
         // requestPermission() will ask the chrome for permission. This may be
         // implemented synchronously or asynchronously. In both cases,
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
         // makeSucessCallbacks() will be called if permission is granted, so
+=======
+        // makeSuccessCallbacks() will be called if permission is granted, so
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
         // there's nothing more to do here.
         requestPermission();
         return;
@@ -538,15 +640,32 @@ void Geolocation::makeSuccessCallbacks()
 {
     ASSERT(m_service->lastPosition());
     ASSERT(isAllowed());
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > oneShotsCopy;
     copyToVector(m_oneShots, oneShotsCopy);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     Vector<RefPtr<GeoNotifier> > watchersCopy;
     copyValuesToVector(m_watchers, watchersCopy);
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     // Clear the lists before we make the callbacks, to avoid clearing notifiers
+<<<<<<< HEAD:WebCore/page/Geolocation.cpp
     // added by calls to Geolocation methods from the callbacks.
+=======
+    // added by calls to Geolocation methods from the callbacks, and to prevent
+    // further callbacks to these notifiers.
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.cpp
     m_oneShots.clear();
 
     sendPosition(oneShotsCopy, m_service->lastPosition());
diff --git a/WebCore/page/Geolocation.h b/WebCore/page/Geolocation.h
index 9b3b43f..5b3d156 100644
--- a/WebCore/page/Geolocation.h
+++ b/WebCore/page/Geolocation.h
@@ -82,8 +82,12 @@ private:
     public:
         static PassRefPtr<GeoNotifier> create(Geolocation* geolocation, PassRefPtr<PositionCallback> positionCallback, PassRefPtr<PositionErrorCallback> positionErrorCallback, PassRefPtr<PositionOptions> options) { return adoptRef(new GeoNotifier(geolocation, positionCallback, positionErrorCallback, options)); }
         
+<<<<<<< HEAD:WebCore/page/Geolocation.h
         void setFatalError(PassRefPtr<PositionError> error);
         void setCachedPosition(Geoposition* cachedPosition);
+=======
+        bool hasZeroTimeout() const;
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
         void startTimerIfNeeded();
         void timerFired(Timer<GeoNotifier>*);
         
@@ -96,14 +100,22 @@ private:
         RefPtr<Geoposition> m_cachedPosition;
 
     private:
+<<<<<<< HEAD:WebCore/page/Geolocation.h
         GeoNotifier(Geolocation* geolocation, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+=======
+        GeoNotifier(Geolocation*, PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
     };
 
     bool hasListeners() const { return !m_oneShots.isEmpty() || !m_watchers.isEmpty(); }
 
     void sendError(Vector<RefPtr<GeoNotifier> >&, PositionError*);
     void sendPosition(Vector<RefPtr<GeoNotifier> >&, Geoposition*);
+<<<<<<< HEAD:WebCore/page/Geolocation.h
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
     static void stopTimer(Vector<RefPtr<GeoNotifier> >&);
     void stopTimersForOneShots();
     void stopTimersForWatchers();
@@ -119,13 +131,20 @@ private:
     virtual void geolocationServicePositionChanged(GeolocationService*);
     virtual void geolocationServiceErrorOccurred(GeolocationService*);
 
+<<<<<<< HEAD:WebCore/page/Geolocation.h
     // EventListener
     virtual void handleEvent(Event*, bool isWindowEvent);
 
+=======
+<<<<<<< HEAD:WebCore/page/Geolocation.h
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/page/Geolocation.h
     void fatalErrorOccurred(GeoNotifier* notifier);
     void requestTimedOut(GeoNotifier* notifier);
     void requestReturnedCachedPosition(GeoNotifier* notifier);
     bool haveSuitableCachedPosition(PositionOptions*);
+=======
+    void requestTimedOut(GeoNotifier*);
+>>>>>>> webkit.org at 49305:WebCore/page/Geolocation.h
 
     typedef HashSet<RefPtr<GeoNotifier> > GeoNotifierSet;
     typedef HashMap<int, RefPtr<GeoNotifier> > GeoNotifierMap;
diff --git a/WebCore/page/HaltablePlugin.h b/WebCore/page/HaltablePlugin.h
new file mode 100644
index 0000000..a5fe0f4
--- /dev/null
+++ b/WebCore/page/HaltablePlugin.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HaltablePlugin_h
+#define HaltablePlugin_h
+
+namespace WebCore {
+
+class Node;
+
+class HaltablePlugin {
+public:
+    virtual ~HaltablePlugin() { }
+
+    virtual void halt() = 0;
+    virtual void restart() = 0;
+    virtual Node* node() const = 0;
+};
+
+} // namespace WebCore
+
+#endif // HaltablePlugin_h
diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 2527132..9a27f1c 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -50,28 +50,30 @@ unsigned History::length() const
 {
     if (!m_frame)
         return 0;
-    return m_frame->loader()->getHistoryLength();
+    if (!m_frame->page())
+        return 0;
+    return m_frame->page()->getHistoryLength();
 }
 
 void History::back()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(-1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(-1);
 }
 
 void History::forward()
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(1);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(1);
 }
 
 void History::go(int distance)
 {
     if (!m_frame)
         return;
-    m_frame->loader()->scheduleHistoryNavigation(distance);
+    m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
 }
 
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.cpp b/WebCore/page/Navigator.cpp
index 3603b86..4922860 100644
--- a/WebCore/page/Navigator.cpp
+++ b/WebCore/page/Navigator.cpp
@@ -31,11 +31,13 @@
 #include "Language.h"
 #include "MimeTypeArray.h"
 #include "Page.h"
+#include "PageGroup.h"
 #include "PlatformString.h"
 #include "PluginArray.h"
 #include "PluginData.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "StorageNamespace.h"
 
 namespace WebCore {
 
@@ -150,5 +152,21 @@ Geolocation* Navigator::geolocation() const
         m_geolocation = Geolocation::create(m_frame);
     return m_geolocation.get();
 }
-    
+
+#if ENABLE(DOM_STORAGE)
+void Navigator::getStorageUpdates()
+{
+    if (!m_frame)
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    StorageNamespace* localStorage = page->group().localStorage();
+    if (localStorage)
+        localStorage->unlock();
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/Navigator.h b/WebCore/page/Navigator.h
index d50721e..4adebe1 100644
--- a/WebCore/page/Navigator.h
+++ b/WebCore/page/Navigator.h
@@ -55,6 +55,11 @@ namespace WebCore {
         // This is used for GC marking.
         Geolocation* optionalGeolocation() const { return m_geolocation.get(); }
 
+#if ENABLE(DOM_STORAGE)
+        // Relinquishes the storage lock, if one exists.
+        void getStorageUpdates();
+#endif
+
     private:
         Navigator(Frame*);
         Frame* m_frame;
diff --git a/WebCore/page/Navigator.idl b/WebCore/page/Navigator.idl
index 8048ff3..80ef4fb 100644
--- a/WebCore/page/Navigator.idl
+++ b/WebCore/page/Navigator.idl
@@ -42,6 +42,10 @@ module window {
 #if defined(ENABLE_GEOLOCATION) && ENABLE_GEOLOCATION
         readonly attribute Geolocation geolocation;
 #endif
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
+        void getStorageUpdates();
+#endif
     };
 
 }
diff --git a/WebCore/page/OriginAccessEntry.cpp b/WebCore/page/OriginAccessEntry.cpp
new file mode 100644
index 0000000..98c280c
--- /dev/null
+++ b/WebCore/page/OriginAccessEntry.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "OriginAccessEntry.h"
+
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+    
+OriginAccessEntry::OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting subdomainSetting)
+    : m_protocol(protocol.lower())
+    , m_host(host.lower())
+    , m_subdomainSettings(subdomainSetting)
+{
+    ASSERT(m_protocol == "http" || m_protocol == "https");
+    ASSERT(subdomainSetting == AllowSubdomains || subdomainSetting == DisallowSubdomains);
+
+    // Assume that any host that ends with a digit is trying to be an IP address.
+    m_hostIsIPAddress = !m_host.isEmpty() && isASCIIDigit(m_host[m_host.length() - 1]);
+}
+
+bool OriginAccessEntry::matchesOrigin(const SecurityOrigin& origin) const
+{
+    ASSERT(origin.host() == origin.host().lower());
+    ASSERT(origin.protocol() == origin.protocol().lower());
+
+    if (m_protocol != origin.protocol())
+        return false;
+    
+    // Special case: Include subdomains and empty host means "all hosts, including ip addresses".
+    if (m_subdomainSettings == AllowSubdomains && m_host.isEmpty())
+        return true;
+    
+    // Exact match.
+    if (m_host == origin.host())
+        return true;
+    
+    // Otherwise we can only match if we're matching subdomains.
+    if (m_subdomainSettings == DisallowSubdomains)
+        return false;
+    
+    // Don't try to do subdomain matching on IP addresses.
+    if (m_hostIsIPAddress)
+        return false;
+    
+    // Match subdomains.
+    if (origin.host().length() > m_host.length() && origin.host()[origin.host().length() - m_host.length() - 1] == '.' && origin.host().endsWith(m_host))
+        return true;
+    
+    return false;
+}
+    
+} // namespace WebCore
diff --git a/WebCore/page/OriginAccessEntry.h b/WebCore/page/OriginAccessEntry.h
new file mode 100644
index 0000000..767d75f
--- /dev/null
+++ b/WebCore/page/OriginAccessEntry.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossOriginAccess_h
+#define CrossOriginAccess_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class SecurityOrigin;
+
+class OriginAccessEntry {
+public:
+    enum SubdomainSetting {
+        AllowSubdomains,
+        DisallowSubdomains
+    };
+
+    // If host is empty string and SubdomainSetting is AllowSubdomains, the entry will match all domains in the specified protocol.
+    OriginAccessEntry(const String& protocol, const String& host, SubdomainSetting);
+    bool matchesOrigin(const SecurityOrigin&) const;
+    
+private:
+    String m_protocol;
+    String m_host;
+    SubdomainSetting m_subdomainSettings;
+    bool m_hostIsIPAddress;
+    
+};
+
+} // namespace WebCore
+
+#endif // CrossOriginAccess_h
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index a13496b..397cb72 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "Page.h"
 
+#include "Base64.h"
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
@@ -28,8 +29,10 @@
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
 #include "DragController.h"
+#include "ExceptionCode.h"
 #include "EditorClient.h"
 #include "EventNames.h"
+#include "Event.h"
 #include "FileSystem.h"
 #include "FocusController.h"
 #include "Frame.h"
@@ -40,11 +43,13 @@
 #include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
+#include "InspectorTimelineAgent.h"
 #include "Logging.h"
 #include "Navigator.h"
 #include "NetworkStateNotifier.h"
 #include "PageGroup.h"
 #include "PluginData.h"
+#include "PluginHalter.h"
 #include "ProgressTracker.h"
 #include "RenderWidget.h"
 #include "RenderTheme.h"
@@ -92,22 +97,29 @@ static void networkStateChanged()
 
     AtomicString eventName = networkStateNotifier().onLine() ? eventNames().onlineEvent : eventNames().offlineEvent;
     for (unsigned i = 0; i < frames.size(); i++)
-        frames[i]->document()->dispatchWindowEvent(eventName, false, false);
+        frames[i]->document()->dispatchWindowEvent(Event::create(eventName, false, false));
 }
 
-Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient)
+Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, EditorClient* editorClient, DragClient* dragClient, InspectorClient* inspectorClient, PluginHalterClient* pluginHalterClient)
     : m_chrome(new Chrome(this, chromeClient))
     , m_dragCaretController(new SelectionController(0, true))
+#if ENABLE(DRAG_SUPPORT)
     , m_dragController(new DragController(this, dragClient))
+#endif
     , m_focusController(new FocusController(this))
+#if ENABLE(CONTEXT_MENUS)
     , m_contextMenuController(new ContextMenuController(this, contextMenuClient))
+#endif
+#if ENABLE(INSPECTOR)
     , m_inspectorController(new InspectorController(this, inspectorClient))
+#endif
     , m_settings(new Settings(this))
     , m_progress(new ProgressTracker)
     , m_backForwardList(BackForwardList::create(this))
     , m_theme(RenderTheme::themeForPage(this))
     , m_editorClient(editorClient)
     , m_frameCount(0)
+    , m_openedByDOM(false)
     , m_tabKeyCyclesThroughElements(true)
     , m_defersLoading(false)
     , m_inLowQualityInterpolationMode(false)
@@ -115,7 +127,9 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_areMemoryCacheClientCallsEnabled(true)
     , m_mediaVolume(1)
     , m_javaScriptURLsAreAllowed(true)
+#if ENABLE(INSPECTOR)
     , m_parentInspectorController(0)
+#endif
     , m_didLoadUserStyleSheet(false)
     , m_userStyleSheetModificationTime(0)
     , m_group(0)
@@ -123,7 +137,17 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     , m_customHTMLTokenizerTimeDelay(-1)
     , m_customHTMLTokenizerChunkSize(-1)
     , m_canStartPlugins(true)
+    , m_pluginHalterClient(pluginHalterClient)
 {
+#if !ENABLE(CONTEXT_MENUS)
+    UNUSED_PARAM(contextMenuClient);
+#endif
+#if !ENABLE(DRAG_SUPPORT)
+    UNUSED_PARAM(dragClient);
+#endif
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(inspectorClient);
+#endif
     if (!allPages) {
         allPages = new HashSet<Page*>;
         
@@ -133,6 +157,8 @@ Page::Page(ChromeClient* chromeClient, ContextMenuClient* contextMenuClient, Edi
     ASSERT(!allPages->contains(this));
     allPages->add(this);
 
+    pluginHalterEnabledStateChanged();
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     JavaScriptDebugServer::shared().pageCreated(this);
 #endif
@@ -152,9 +178,11 @@ Page::~Page()
         frame->pageDestroyed();
 
     m_editorClient->pageDestroyed();
+#if ENABLE(INSPECTOR)
     if (m_parentInspectorController)
         m_parentInspectorController->pageDestroyed();
     m_inspectorController->inspectedPageDestroyed();
+#endif
 
     m_backForwardList->close();
 
@@ -174,6 +202,16 @@ void Page::setMainFrame(PassRefPtr<Frame> mainFrame)
     m_mainFrame = mainFrame;
 }
 
+bool Page::openedByDOM() const
+{
+    return m_openedByDOM;
+}
+
+void Page::setOpenedByDOM()
+{
+    m_openedByDOM = true;
+}
+
 BackForwardList* Page::backForwardList()
 {
     return m_backForwardList.get();
@@ -201,6 +239,40 @@ bool Page::goForward()
     return false;
 }
 
+bool Page::canGoBackOrForward(int distance) const
+{
+    if (distance == 0)
+        return true;
+    if (distance > 0 && distance <= m_backForwardList->forwardListCount())
+        return true;
+    if (distance < 0 && -distance <= m_backForwardList->backListCount())
+        return true;
+    return false;
+}
+
+void Page::goBackOrForward(int distance)
+{
+    if (distance == 0)
+        return;
+
+    HistoryItem* item = m_backForwardList->itemAtIndex(distance);
+    if (!item) {
+        if (distance > 0) {
+            int forwardListCount = m_backForwardList->forwardListCount();
+            if (forwardListCount > 0) 
+                item = m_backForwardList->itemAtIndex(forwardListCount);
+        } else {
+            int backListCount = m_backForwardList->backListCount();
+            if (backListCount > 0)
+                item = m_backForwardList->itemAtIndex(-backListCount);
+        }
+    }
+
+    ASSERT(item); // we should not reach this line with an empty back/forward list
+    if (item)
+        goToItem(item, FrameLoadTypeIndexedBackForward);
+}
+
 void Page::goToItem(HistoryItem* item, FrameLoadType type)
 {
     // Abort any current load if we're going to a history item
@@ -220,6 +292,11 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
     m_mainFrame->loader()->goToItem(item, type);
 }
 
+int Page::getHistoryLength()
+{
+    return m_backForwardList->backListCount() + 1;
+}
+
 void Page::setGlobalHistoryItem(HistoryItem* item)
 {
     m_globalHistoryItem = item;
@@ -439,26 +516,43 @@ void Page::willMoveOffscreen()
 
 void Page::userStyleSheetLocationChanged()
 {
-#if !FRAME_LOADS_USER_STYLESHEET
-    // FIXME: We should provide a way to load other types of URLs than just
-    // file: (e.g., http:, data:).
-    if (m_settings->userStyleSheetLocation().isLocalFile())
-        m_userStyleSheetPath = m_settings->userStyleSheetLocation().fileSystemPath();
+    // FIXME: Eventually we will move to a model of just being handed the sheet
+    // text instead of loading the URL ourselves.
+    KURL url = m_settings->userStyleSheetLocation();
+    if (url.isLocalFile())
+        m_userStyleSheetPath = url.fileSystemPath();
     else
         m_userStyleSheetPath = String();
 
     m_didLoadUserStyleSheet = false;
     m_userStyleSheet = String();
     m_userStyleSheetModificationTime = 0;
-#endif
+    
+    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
+    // synchronously and avoid using a loader. 
+    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
+        m_didLoadUserStyleSheet = true;
+        
+        const unsigned prefixLength = 35;
+        Vector<char> encodedData(url.string().length() - prefixLength);
+        for (unsigned i = prefixLength; i < url.string().length(); ++i)
+            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
+
+        Vector<char> styleSheetAsUTF8;
+        if (base64Decode(encodedData, styleSheetAsUTF8))
+            m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data());
+    }
+    
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+        if (frame->document())
+            frame->document()->clearPageUserSheet();
+    }
 }
 
 const String& Page::userStyleSheet() const
 {
-    if (m_userStyleSheetPath.isEmpty()) {
-        ASSERT(m_userStyleSheet.isEmpty());
+    if (m_userStyleSheetPath.isEmpty())
         return m_userStyleSheet;
-    }
 
     time_t modTime;
     if (!getFileModificationTime(m_userStyleSheetPath, modTime)) {
@@ -632,4 +726,39 @@ bool Page::javaScriptURLsAreAllowed() const
     return m_javaScriptURLsAreAllowed;
 }
 
+#if ENABLE(INSPECTOR)
+InspectorTimelineAgent* Page::inspectorTimelineAgent() const
+{
+    return m_inspectorController->timelineAgent();
+}
+#endif
+
+void Page::pluginHalterEnabledStateChanged()
+{
+    if (m_settings->pluginHalterEnabled()) {
+        ASSERT(!m_pluginHalter);
+        m_pluginHalter.set(new PluginHalter(m_pluginHalterClient));
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+    } else
+        m_pluginHalter = 0;
+}
+
+void Page::pluginAllowedRunTimeChanged()
+{
+    if (m_pluginHalter)
+        m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
+}
+
+void Page::didStartPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStartPlugin(obj);
+}
+
+void Page::didStopPlugin(HaltablePlugin* obj)
+{
+    if (m_pluginHalter)
+        m_pluginHalter->didStopPlugin(obj);
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/Page.h b/WebCore/page/Page.h
index 9d9af86..cab075e 100644
--- a/WebCore/page/Page.h
+++ b/WebCore/page/Page.h
@@ -54,11 +54,15 @@ namespace WebCore {
     class EditorClient;
     class FocusController;
     class Frame;
+    class HaltablePlugin;
     class InspectorClient;
     class InspectorController;
+    class InspectorTimelineAgent;
     class Node;
     class PageGroup;
     class PluginData;
+    class PluginHalter;
+    class PluginHalterClient;
     class PluginView;
     class ProgressTracker;
     class RenderTheme;
@@ -71,6 +75,9 @@ namespace WebCore {
 #if ENABLE(WML)
     class WMLPageState;
 #endif
+#if ENABLE(NOTIFICATIONS)
+    class NotificationPresenter;
+#endif
 
     enum FindDirection { FindDirectionForward, FindDirectionBackward };
 
@@ -78,7 +85,7 @@ namespace WebCore {
     public:
         static void setNeedsReapplyStyles();
 
-        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*);
+        Page(ChromeClient*, ContextMenuClient*, EditorClient*, DragClient*, InspectorClient*, PluginHalterClient*);
         ~Page();
 
         RenderTheme* theme() const { return m_theme.get(); };
@@ -96,6 +103,9 @@ namespace WebCore {
         void setMainFrame(PassRefPtr<Frame>);
         Frame* mainFrame() const { return m_mainFrame.get(); }
 
+        bool openedByDOM() const;
+        void setOpenedByDOM();
+
         BackForwardList* backForwardList();
 
         // FIXME: The following three methods don't fall under the responsibilities of the Page object
@@ -104,7 +114,10 @@ namespace WebCore {
         // makes more sense when that class exists.
         bool goBack();
         bool goForward();
+        bool canGoBackOrForward(int distance) const;
+        void goBackOrForward(int distance);
         void goToItem(HistoryItem*, FrameLoadType);
+        int getHistoryLength();
 
         HistoryItem* globalHistoryItem() const { return m_globalHistoryItem.get(); }
         void setGlobalHistoryItem(HistoryItem*);
@@ -121,15 +134,23 @@ namespace WebCore {
 
         Chrome* chrome() const { return m_chrome.get(); }
         SelectionController* dragCaretController() const { return m_dragCaretController.get(); }
+#if ENABLE(DRAG_SUPPORT)
         DragController* dragController() const { return m_dragController.get(); }
+#endif
         FocusController* focusController() const { return m_focusController.get(); }
+#if ENABLE(CONTEXT_MENUS)
         ContextMenuController* contextMenuController() const { return m_contextMenuController.get(); }
+#endif
+#if ENABLE(INSPECTOR)
         InspectorController* inspectorController() const { return m_inspectorController.get(); }
+#endif
         Settings* settings() const { return m_settings.get(); }
         ProgressTracker* progress() const { return m_progress.get(); }
 
+#if ENABLE(INSPECTOR)
         void setParentInspectorController(InspectorController* controller) { m_parentInspectorController = controller; }
         InspectorController* parentInspectorController() const { return m_parentInspectorController; }
+#endif
         
         void setTabKeyCyclesThroughElements(bool b) { m_tabKeyCyclesThroughElements = b; }
         bool tabKeyCyclesThroughElements() const { return m_tabKeyCyclesThroughElements; }
@@ -169,6 +190,11 @@ namespace WebCore {
         void userStyleSheetLocationChanged();
         const String& userStyleSheet() const;
 
+        void didStartPlugin(HaltablePlugin*);
+        void didStopPlugin(HaltablePlugin*);
+        void pluginAllowedRunTimeChanged();
+        void pluginHalterEnabledStateChanged();
+
         static void setDebuggerForAllPages(JSC::Debugger*);
         void setDebugger(JSC::Debugger*);
         JSC::Debugger* debugger() const { return m_debugger; }
@@ -207,15 +233,24 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
+#if ENABLE(INSPECTOR)
+        InspectorTimelineAgent* inspectorTimelineAgent() const;
+#endif
     private:
         void initGroup();
 
         OwnPtr<Chrome> m_chrome;
         OwnPtr<SelectionController> m_dragCaretController;
+#if ENABLE(DRAG_SUPPORT)
         OwnPtr<DragController> m_dragController;
+#endif
         OwnPtr<FocusController> m_focusController;
+#if ENABLE(CONTEXT_MENUS)
         OwnPtr<ContextMenuController> m_contextMenuController;
+#endif
+#if ENABLE(INSPECTOR)
         OwnPtr<InspectorController> m_inspectorController;
+#endif
         OwnPtr<Settings> m_settings;
         OwnPtr<ProgressTracker> m_progress;
         
@@ -232,6 +267,7 @@ namespace WebCore {
 
         int m_frameCount;
         String m_groupName;
+        bool m_openedByDOM;
 
         bool m_tabKeyCyclesThroughElements;
         bool m_defersLoading;
@@ -243,7 +279,9 @@ namespace WebCore {
 
         bool m_javaScriptURLsAreAllowed;
 
+#if ENABLE(INSPECTOR)
         InspectorController* m_parentInspectorController;
+#endif
 
         String m_userStyleSheetPath;
         mutable String m_userStyleSheet;
@@ -261,6 +299,9 @@ namespace WebCore {
         bool m_canStartPlugins;
         HashSet<PluginView*> m_unstartedPlugins;
 
+        OwnPtr<PluginHalter> m_pluginHalter;
+        PluginHalterClient* m_pluginHalterClient;
+
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_sessionStorage;
 #endif
@@ -272,6 +313,10 @@ namespace WebCore {
 #if ENABLE(WML)
         OwnPtr<WMLPageState> m_wmlPageState;
 #endif
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/PageGroup.cpp b/WebCore/page/PageGroup.cpp
index 5155be1..cf6ba37 100644
--- a/WebCore/page/PageGroup.cpp
+++ b/WebCore/page/PageGroup.cpp
@@ -28,6 +28,7 @@
 
 #include "ChromeClient.h"
 #include "Document.h"
+#include "Frame.h"
 #include "Page.h"
 #include "Settings.h"
 
@@ -66,6 +67,11 @@ PageGroup::PageGroup(Page* page)
     addPage(page);
 }
 
+PageGroup::~PageGroup()
+{
+    removeAllUserContent();
+}
+
 typedef HashMap<String, PageGroup*> PageGroupMap;
 static PageGroupMap* pageGroups = 0;
 
@@ -185,12 +191,139 @@ StorageNamespace* PageGroup::localStorage()
     if (!m_localStorage) {
         // Need a page in this page group to query the settings for the local storage database path.
         Page* page = *m_pages.begin();
-        ASSERT(page);
-        m_localStorage = StorageNamespace::localStorageNamespace(page->settings()->localStorageDatabasePath());
+        const String& path = page->settings()->localStorageDatabasePath();
+        unsigned quota = page->settings()->localStorageQuota();
+        m_localStorage = StorageNamespace::localStorageNamespace(path, quota);
     }
 
     return m_localStorage.get();
 }
 #endif
 
+void PageGroup::addUserScript(const String& source, const KURL& url,  PassOwnPtr<Vector<String> > whitelist,
+                              PassOwnPtr<Vector<String> > blacklist, unsigned worldID, UserScriptInjectionTime injectionTime)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserScript> userScript(new UserScript(source, url, whitelist, blacklist, worldID, injectionTime));
+    if (!m_userScripts)
+        m_userScripts.set(new UserScriptMap);
+    UserScriptVector*& scriptsInWorld = m_userScripts->add(worldID, 0).first->second;
+    if (!scriptsInWorld)
+        scriptsInWorld = new UserScriptVector;
+    scriptsInWorld->append(userScript.release());
+}
+
+void PageGroup::addUserStyleSheet(const String& source, const KURL& url, PassOwnPtr<Vector<String> > whitelist,
+                                  PassOwnPtr<Vector<String> > blacklist, unsigned worldID)
+{
+    if (worldID == UINT_MAX)
+        return;
+    OwnPtr<UserStyleSheet> userStyleSheet(new UserStyleSheet(source, url, whitelist, blacklist, worldID));
+    if (!m_userStyleSheets)
+        m_userStyleSheets.set(new UserStyleSheetMap);
+    UserStyleSheetVector*& styleSheetsInWorld = m_userStyleSheets->add(worldID, 0).first->second;
+    if (!styleSheetsInWorld)
+        styleSheetsInWorld = new UserStyleSheetVector;
+    styleSheetsInWorld->append(userStyleSheet.release());
+    
+    // Clear our cached sheets and have them just reparse.
+    HashSet<Page*>::const_iterator end = m_pages.end();
+    for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+        for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+            frame->document()->clearPageGroupUserSheets();
+    }
+}
+
+void PageGroup::removeUserContentWithURLForWorld(const KURL& url, unsigned worldID)
+{
+    if (m_userScripts) {
+        UserScriptMap::iterator it = m_userScripts->find(worldID);
+        if (it != m_userScripts->end()) {
+            UserScriptVector* scripts = it->second;
+            for (int i = scripts->size() - 1; i >= 0; --i) {
+                if (scripts->at(i)->url() == url)
+                    scripts->remove(i);
+            }
+            
+            if (scripts->isEmpty()) {
+                delete it->second;
+                m_userScripts->remove(it);
+            }
+        }
+    }
+    
+    if (m_userStyleSheets) {
+        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+        bool sheetsChanged = false;
+        if (it != m_userStyleSheets->end()) {
+            UserStyleSheetVector* stylesheets = it->second;
+            for (int i = stylesheets->size() - 1; i >= 0; --i) {
+                if (stylesheets->at(i)->url() == url) {
+                    stylesheets->remove(i);
+                    sheetsChanged = true;
+                }
+            }
+            
+            if (stylesheets->isEmpty()) {
+                delete it->second;
+                m_userStyleSheets->remove(it);
+            }
+        }
+        
+        // Clear our cached sheets and have them just reparse.
+        if (sheetsChanged) {
+            HashSet<Page*>::const_iterator end = m_pages.end();
+            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                    frame->document()->clearPageGroupUserSheets();
+            }
+        }
+    }
+}
+
+void PageGroup::removeUserContentForWorld(unsigned worldID)
+{
+    if (m_userScripts) {
+        UserScriptMap::iterator it = m_userScripts->find(worldID);
+        if (it != m_userScripts->end()) {
+            delete it->second;
+            m_userScripts->remove(it);
+        }
+    }
+    
+    if (m_userStyleSheets) {
+        bool sheetsChanged = false;
+        UserStyleSheetMap::iterator it = m_userStyleSheets->find(worldID);
+        if (it != m_userStyleSheets->end()) {
+            delete it->second;
+            m_userStyleSheets->remove(it);
+            sheetsChanged = true;
+        }
+    
+        if (sheetsChanged) {
+            // Clear our cached sheets and have them just reparse.
+            HashSet<Page*>::const_iterator end = m_pages.end();
+            for (HashSet<Page*>::const_iterator it = m_pages.begin(); it != end; ++it) {
+                for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext())
+                    frame->document()->clearPageGroupUserSheets();
+            }
+        }
+    }
+}
+
+void PageGroup::removeAllUserContent()
+{
+    if (m_userScripts) {
+        deleteAllValues(*m_userScripts);
+        m_userScripts.clear();
+    }
+    
+    
+    if (m_userStyleSheets) {
+        deleteAllValues(*m_userStyleSheets);
+        m_userStyleSheets.clear();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/PageGroup.h b/WebCore/page/PageGroup.h
index f92c2e6..7ea2967 100644
--- a/WebCore/page/PageGroup.h
+++ b/WebCore/page/PageGroup.h
@@ -30,6 +30,8 @@
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
 #include "StringHash.h"
+#include "UserScript.h"
+#include "UserStyleSheet.h"
 
 namespace WebCore {
 
@@ -41,6 +43,7 @@ namespace WebCore {
     public:
         PageGroup(const String& name);
         PageGroup(Page*);
+        ~PageGroup();
 
         static PageGroup* pageGroup(const String& groupName);
         static void closeLocalStorage();
@@ -64,13 +67,26 @@ namespace WebCore {
 
 #if ENABLE(DOM_STORAGE)
         StorageNamespace* localStorage();
+        bool hasLocalStorage() { return m_localStorage; }
 #endif
 
+        void addUserScript(const String& source, const KURL&, 
+                           PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                           unsigned worldID, UserScriptInjectionTime);
+        const UserScriptMap* userScripts() const { return m_userScripts.get(); }
+        
+        void addUserStyleSheet(const String& source, const KURL&,
+                               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                               unsigned worldID);
+        const UserStyleSheetMap* userStyleSheets() const { return m_userStyleSheets.get(); }
+        
+        void removeUserContentForWorld(unsigned);
+        void removeUserContentWithURLForWorld(const KURL&, unsigned);
+        void removeAllUserContent();
+        
     private:
         void addVisitedLink(LinkHash stringHash);
-#if ENABLE(DOM_STORAGE)
-        bool hasLocalStorage() { return m_localStorage; }
-#endif
+
         String m_name;
 
         HashSet<Page*> m_pages;
@@ -82,6 +98,9 @@ namespace WebCore {
 #if ENABLE(DOM_STORAGE)
         RefPtr<StorageNamespace> m_localStorage;
 #endif
+
+        OwnPtr<UserScriptMap> m_userScripts;
+        OwnPtr<UserStyleSheetMap> m_userStyleSheets;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/PageGroupLoadDeferrer.cpp b/WebCore/page/PageGroupLoadDeferrer.cpp
index f274de3..122658b 100644
--- a/WebCore/page/PageGroupLoadDeferrer.cpp
+++ b/WebCore/page/PageGroupLoadDeferrer.cpp
@@ -41,10 +41,10 @@ PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
             if (!otherPage->defersLoading())
                 m_deferredFrames.append(otherPage->mainFrame());
 
-#if !PLATFORM(MAC)
+            // This code is not logically part of load deferring, but we do not want JS code executed beneath modal
+            // windows or sheets, which is exactly when PageGroupLoadDeferrer is used.
             for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->suspendActiveDOMObjects();
-#endif
         }
     }
 
@@ -60,10 +60,8 @@ PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
         if (Page* page = m_deferredFrames[i]->page()) {
             page->setDefersLoading(false);
 
-#if !PLATFORM(MAC)
             for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext())
                 frame->document()->resumeActiveDOMObjects();
-#endif
         }
     }
 }
diff --git a/WebCore/page/PluginHalter.cpp b/WebCore/page/PluginHalter.cpp
new file mode 100644
index 0000000..8025337
--- /dev/null
+++ b/WebCore/page/PluginHalter.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "PluginHalter.h"
+
+#include "HaltablePlugin.h"
+#include "PluginHalterClient.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+namespace WebCore {
+
+PluginHalter::PluginHalter(PluginHalterClient* client)
+    : m_client(client)
+    , m_timer(this, &PluginHalter::timerFired)
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
+{
+    ASSERT_ARG(client, client);
+}
+
+void PluginHalter::didStartPlugin(HaltablePlugin* obj)
+{
+    ASSERT_ARG(obj, obj);
+    ASSERT_ARG(obj, !m_plugins.contains(obj));
+
+    double currentTime = WTF::currentTime();
+
+    m_plugins.add(obj, currentTime);
+
+    if (m_plugins.size() == 1)
+        m_oldestStartTime = currentTime;
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::didStopPlugin(HaltablePlugin* obj)
+{
+    m_plugins.remove(obj);
+}
+
+void PluginHalter::timerFired(Timer<PluginHalter>*)
+{
+    if (m_plugins.isEmpty())
+        return;
+
+    Vector<HaltablePlugin*> plugins;
+    copyKeysToVector(m_plugins, plugins);
+
+    // Plug-ins older than this are candidates to be halted.
+    double pluginCutOffTime = WTF::currentTime() - m_pluginAllowedRunTime;
+
+    m_oldestStartTime = numeric_limits<double>::max();
+
+    for (size_t i = 0; i < plugins.size(); ++i) {
+        double thisStartTime = m_plugins.get(plugins[i]);
+        if (thisStartTime > pluginCutOffTime) {
+            // This plug-in is too young to be halted. We find the oldest
+            // plug-in that is not old enough to be halted and use it to set
+            // the timer's next fire time.
+            if (thisStartTime < m_oldestStartTime)
+                m_oldestStartTime = thisStartTime;
+            continue;
+        }
+
+        if (m_client->shouldHaltPlugin(plugins[i]->node()))
+            plugins[i]->halt();
+
+        m_plugins.remove(plugins[i]);
+    }
+
+    startTimerIfNecessary();
+}
+
+void PluginHalter::startTimerIfNecessary()
+{
+    if (m_timer.isActive())
+        return;
+
+    if (m_plugins.isEmpty())
+        return;
+
+    double nextFireInterval = static_cast<double>(m_pluginAllowedRunTime) - (currentTime() - m_oldestStartTime);
+    m_timer.startOneShot(nextFireInterval < 0 ? 0 : nextFireInterval);
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/PluginHalter.h b/WebCore/page/PluginHalter.h
new file mode 100644
index 0000000..26f5101
--- /dev/null
+++ b/WebCore/page/PluginHalter.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalter_h
+#define PluginHalter_h
+
+#include "Timer.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class HaltablePlugin;
+class PluginHalterClient;
+
+class PluginHalter {
+public:
+    PluginHalter(PluginHalterClient*);
+
+    void didStartPlugin(HaltablePlugin*);
+    void didStopPlugin(HaltablePlugin*);
+
+    void setPluginAllowedRunTime(unsigned runTime) { m_pluginAllowedRunTime = runTime; }
+
+private:
+    void timerFired(Timer<PluginHalter>*);
+    void startTimerIfNecessary();
+
+    PluginHalterClient* m_client;
+    Timer<PluginHalter> m_timer;
+    unsigned m_pluginAllowedRunTime;
+    double m_oldestStartTime;
+    HashMap<HaltablePlugin*, double> m_plugins;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalter_h
diff --git a/WebCore/page/PluginHalterClient.h b/WebCore/page/PluginHalterClient.h
new file mode 100644
index 0000000..7ea460a
--- /dev/null
+++ b/WebCore/page/PluginHalterClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef PluginHalterClient_h
+#define PluginHalterClient_h
+
+namespace WebCore {
+
+class Node;
+
+class PluginHalterClient {
+public:
+    virtual ~PluginHalterClient() { }
+
+    virtual bool shouldHaltPlugin(Node*) const = 0;
+};
+
+} // namespace WebCore
+
+#endif // PluginHalterClient_h
diff --git a/WebCore/page/PositionCallback.h b/WebCore/page/PositionCallback.h
index f6bf139..30da2c1 100644
--- a/WebCore/page/PositionCallback.h
+++ b/WebCore/page/PositionCallback.h
@@ -36,7 +36,11 @@ namespace WebCore {
     class PositionCallback : public RefCounted<PositionCallback> {
     public:
         virtual ~PositionCallback() { }
+<<<<<<< HEAD:WebCore/page/PositionCallback.h
         virtual void handleEvent(Geoposition* position) = 0;
+=======
+        virtual void handleEvent(Geoposition*) = 0;
+>>>>>>> webkit.org at 49305:WebCore/page/PositionCallback.h
     };
     
 } // namespace WebCore
diff --git a/WebCore/page/PositionError.h b/WebCore/page/PositionError.h
index c309061..5c26fcc 100644
--- a/WebCore/page/PositionError.h
+++ b/WebCore/page/PositionError.h
@@ -46,7 +46,11 @@ public:
     ErrorCode code() const { return m_code; }
     const String& message() const { return m_message; }
     void setIsFatal(bool isFatal) { m_isFatal = isFatal; }
+<<<<<<< HEAD:WebCore/page/PositionError.h
     bool isFatal() { return m_isFatal; }
+=======
+    bool isFatal() const { return m_isFatal; }
+>>>>>>> webkit.org at 49305:WebCore/page/PositionError.h
     
 private:
     PositionError(ErrorCode code, const String& message) 
diff --git a/WebCore/page/PositionOptions.h b/WebCore/page/PositionOptions.h
index 5900998..b1746a8 100644
--- a/WebCore/page/PositionOptions.h
+++ b/WebCore/page/PositionOptions.h
@@ -33,7 +33,11 @@ namespace WebCore {
     
 class PositionOptions : public RefCounted<PositionOptions> {
 public:
+<<<<<<< HEAD:WebCore/page/PositionOptions.h
     static PassRefPtr<PositionOptions> create() { return adoptRef(new PositionOptions); }
+=======
+    static PassRefPtr<PositionOptions> create() { return adoptRef(new PositionOptions()); }
+>>>>>>> webkit.org at 49305:WebCore/page/PositionOptions.h
 
     bool enableHighAccuracy() const { return m_highAccuracy; }
     void setEnableHighAccuracy(bool enable) { m_highAccuracy = enable; }
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index b855ca5..4d3a839 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -67,7 +67,7 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     float ratio = printRect.height() / printRect.width();
 
-    float pageWidth  = (float)root->overflowWidth();
+    float pageWidth  = (float)root->rightLayoutOverflow();
     float pageHeight = pageWidth * ratio;
     outPageHeight = pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 14a1b59..338bf9f 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -30,16 +30,23 @@
 #include "SecurityOrigin.h"
 
 #include "CString.h"
-#include "FrameLoader.h"
+#include "Document.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "StringHash.h"
-#include <wtf/HashSet.h>
+#include "OriginAccessEntry.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+static SecurityOrigin::LocalLoadPolicy localLoadPolicy = SecurityOrigin::AllowLocalLoadsForLocalOnly;
+
+typedef Vector<OriginAccessEntry> OriginAccessWhiteList;
+typedef HashMap<String, OriginAccessWhiteList*> OriginAccessMap;
+
+static OriginAccessMap& originAccessMap()
+{
+    DEFINE_STATIC_LOCAL(OriginAccessMap, originAccessMap, ());
+    return originAccessMap;
+}
 
 static URLSchemesMap& localSchemes()
 {
@@ -68,7 +75,7 @@ static URLSchemesMap& noAccessSchemes()
     return noAccessSchemes;
 }
 
-static bool isDefaultPortForProtocol(unsigned short port, const String& protocol)
+bool SecurityOrigin::isDefaultPortForProtocol(unsigned short port, const String& protocol)
 {
     if (protocol.isEmpty())
         return false;
@@ -111,9 +118,9 @@ SecurityOrigin::SecurityOrigin(const KURL& url)
 }
 
 SecurityOrigin::SecurityOrigin(const SecurityOrigin* other)
-    : m_protocol(other->m_protocol.copy())
-    , m_host(other->m_host.copy())
-    , m_domain(other->m_domain.copy())
+    : m_protocol(other->m_protocol.threadsafeCopy())
+    , m_host(other->m_host.threadsafeCopy())
+    , m_domain(other->m_domain.threadsafeCopy())
     , m_port(other->m_port)
     , m_noAccess(other->m_noAccess)
     , m_universalAccess(other->m_universalAccess)
@@ -139,7 +146,7 @@ PassRefPtr<SecurityOrigin> SecurityOrigin::createEmpty()
     return create(KURL());
 }
 
-PassRefPtr<SecurityOrigin> SecurityOrigin::copy()
+PassRefPtr<SecurityOrigin> SecurityOrigin::threadsafeCopy()
 {
     return adoptRef(new SecurityOrigin(this));
 }
@@ -203,7 +210,47 @@ bool SecurityOrigin::canRequest(const KURL& url) const
 
     // We call isSameSchemeHostPort here instead of canAccess because we want
     // to ignore document.domain effects.
-    return isSameSchemeHostPort(targetOrigin.get());
+    if (isSameSchemeHostPort(targetOrigin.get()))
+        return true;
+
+    if (OriginAccessWhiteList* list = originAccessMap().get(toString())) {
+        for (size_t i = 0; i < list->size(); ++i) {
+            if (list->at(i).matchesOrigin(*targetOrigin))
+                return true;
+        }
+    }
+
+    return false;
+}
+
+bool SecurityOrigin::taintsCanvas(const KURL& url) const
+{
+    if (canRequest(url))
+        return false;
+
+    // This method exists because we treat data URLs as noAccess, contrary
+    // to the current (9/19/2009) draft of the HTML5 specification.  We still
+    // want to let folks paint data URLs onto untainted canvases, so we special
+    // case data URLs below.  If we change to match HTML5 w.r.t. data URL
+    // security, then we can remove this method in favor of !canRequest.
+    if (url.protocolIs("data"))
+        return false;
+
+    return true;
+}
+
+bool SecurityOrigin::canLoad(const KURL& url, const String& referrer, Document* document)
+{
+    if (!shouldTreatURLAsLocal(url.string()))
+        return true;
+
+    // If we were provided a document, we let its local file policy dictate the result,
+    // otherwise we allow local loads only if the supplied referrer is also local.
+    if (document)
+        return document->securityOrigin()->canLoadLocalResources();
+    if (!referrer.isEmpty())
+        return shouldTreatURLAsLocal(referrer);
+    return false;
 }
 
 void SecurityOrigin::grantLoadLocalResources()
@@ -213,7 +260,7 @@ void SecurityOrigin::grantLoadLocalResources()
     // in a SecurityOrigin is a security hazard because the documents without
     // the privilege can obtain the privilege by injecting script into the
     // documents that have been granted the privilege.
-    ASSERT(FrameLoader::allowSubstituteDataAccessToLocal());
+    ASSERT(allowSubstituteDataAccessToLocal());
     m_canLoadLocalResources = true;
 }
 
@@ -339,13 +386,31 @@ bool SecurityOrigin::isSameSchemeHostPort(const SecurityOrigin* other) const
     return true;
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsLocal(const String& scheme)
 {
     localSchemes().add(scheme);
 }
 
-// static
+void SecurityOrigin::removeURLSchemeRegisteredAsLocal(const String& scheme)
+{
+    if (scheme == "file")
+        return;
+#if PLATFORM(MAC)
+    if (scheme == "applewebdata")
+        return;
+#endif
+#if PLATFORM(QT)
+    if (scheme == "qrc")
+        return;
+#endif
+    localSchemes().remove(scheme);
+}
+
+const URLSchemesMap&  SecurityOrigin::localURLSchemes()
+{
+    return localSchemes();
+}
+
 bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -366,7 +431,6 @@ bool SecurityOrigin::shouldTreatURLAsLocal(const String& url)
     return localSchemes().contains(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
 {
     // This avoids an allocation of another String and the HashSet contains()
@@ -385,16 +449,69 @@ bool SecurityOrigin::shouldTreatURLSchemeAsLocal(const String& scheme)
     return localSchemes().contains(scheme);
 }
 
-// static
 void SecurityOrigin::registerURLSchemeAsNoAccess(const String& scheme)
 {
     noAccessSchemes().add(scheme);
 }
 
-// static
 bool SecurityOrigin::shouldTreatURLSchemeAsNoAccess(const String& scheme)
 {
     return noAccessSchemes().contains(scheme);
 }
 
+bool SecurityOrigin::shouldHideReferrer(const KURL& url, const String& referrer)
+{
+    bool referrerIsSecureURL = protocolIs(referrer, "https");
+    bool referrerIsWebURL = referrerIsSecureURL || protocolIs(referrer, "http");
+
+    if (!referrerIsWebURL)
+        return true;
+
+    if (!referrerIsSecureURL)
+        return false;
+
+    bool URLIsSecureURL = url.protocolIs("https");
+
+    return !URLIsSecureURL;
+}
+
+void SecurityOrigin::setLocalLoadPolicy(LocalLoadPolicy policy)
+{
+    localLoadPolicy = policy;
+}
+
+bool SecurityOrigin::restrictAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForAll;
+}
+
+bool SecurityOrigin::allowSubstituteDataAccessToLocal()
+{
+    return localLoadPolicy != SecurityOrigin::AllowLocalLoadsForLocalOnly;
+}
+
+void SecurityOrigin::whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains)
+{
+    ASSERT(isMainThread());
+    ASSERT(!sourceOrigin.isEmpty());
+    if (sourceOrigin.isEmpty())
+        return;
+
+    String sourceString = sourceOrigin.toString();
+    OriginAccessWhiteList* list = originAccessMap().get(sourceString);
+    if (!list) {
+        list = new OriginAccessWhiteList;
+        originAccessMap().set(sourceString, list);
+    }
+    list->append(OriginAccessEntry(destinationProtocol, destinationDomains, allowDestinationSubdomains ? OriginAccessEntry::AllowSubdomains : OriginAccessEntry::DisallowSubdomains));
+}
+
+void SecurityOrigin::resetOriginAccessWhiteLists()
+{
+    ASSERT(isMainThread());
+    OriginAccessMap& map = originAccessMap();
+    deleteAllValues(map);
+    map.clear();
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/SecurityOrigin.h b/WebCore/page/SecurityOrigin.h
index ab92683..46e6fad 100644
--- a/WebCore/page/SecurityOrigin.h
+++ b/WebCore/page/SecurityOrigin.h
@@ -29,14 +29,19 @@
 #ifndef SecurityOrigin_h
 #define SecurityOrigin_h
 
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
 
 #include "PlatformString.h"
+#include "StringHash.h"
 
 namespace WebCore {
 
+    typedef HashSet<String, CaseFoldingHash> URLSchemesMap;
+
+    class Document;
     class KURL;
     
     class SecurityOrigin : public ThreadSafeShared<SecurityOrigin> {
@@ -48,7 +53,7 @@ namespace WebCore {
 
         // Create a deep copy of this SecurityOrigin.  This method is useful
         // when marshalling a SecurityOrigin to another thread.
-        PassRefPtr<SecurityOrigin> copy();
+        PassRefPtr<SecurityOrigin> threadsafeCopy();
 
         // Set the domain property of this security origin to newDomain.  This
         // function does not check whether newDomain is a suffix of the current
@@ -72,6 +77,16 @@ namespace WebCore {
         // XMLHttpRequests.
         bool canRequest(const KURL&) const;
 
+        // Returns true if drawing an image from this URL taints a canvas from
+        // this security origin.  For example, call this function before
+        // drawing an image onto an HTML canvas element with the drawImage API.
+        bool taintsCanvas(const KURL&) const;
+
+        // Returns true for any non-local URL. If document parameter is supplied,
+        // its local load policy dictates, otherwise if referrer is non-empty and
+        // represents a local file, then the local load is allowed.
+        static bool canLoad(const KURL&, const String& referrer, Document* document);
+
         // Returns true if this SecurityOrigin can load local resources, such
         // as images, iframes, and style sheets, and can link to local URLs.
         // For example, call this function before creating an iframe to a
@@ -129,12 +144,30 @@ namespace WebCore {
         bool isSameSchemeHostPort(const SecurityOrigin*) const;
 
         static void registerURLSchemeAsLocal(const String&);
+        static void removeURLSchemeRegisteredAsLocal(const String&);
+        static const URLSchemesMap& localURLSchemes();
         static bool shouldTreatURLAsLocal(const String&);
         static bool shouldTreatURLSchemeAsLocal(const String&);
 
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
+
+        enum LocalLoadPolicy {
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
+        };
+        static void setLocalLoadPolicy(LocalLoadPolicy);
+        static bool restrictAccessToLocal();
+        static bool allowSubstituteDataAccessToLocal();
+
         static void registerURLSchemeAsNoAccess(const String&);
         static bool shouldTreatURLSchemeAsNoAccess(const String&);
 
+        static void whiteListAccessFromOrigin(const SecurityOrigin& sourceOrigin, const String& destinationProtocol, const String& destinationDomains, bool allowDestinationSubdomains);
+        static void resetOriginAccessWhiteLists();
+
+        static bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
+
     private:
         explicit SecurityOrigin(const KURL&);
         explicit SecurityOrigin(const SecurityOrigin*);
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 9692707..98d08d2 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -48,6 +48,10 @@ static void setNeedsReapplyStylesInAllFrames(Page* page)
 bool Settings::gShouldPaintNativeControls = true;
 #endif
 
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+bool Settings::gShouldUseHighResolutionTimers = true;
+#endif
+
 Settings::Settings(Page* page)
     : m_page(page)
 #ifdef ANDROID_LAYOUT
@@ -69,6 +73,8 @@ Settings::Settings(Page* page)
     , m_blockNetworkImage(false)
 #endif
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
+    , m_localStorageQuota(5 * 1024 * 1024)  // Suggested by the HTML5 spec.
+    , m_pluginAllowedRunTime(numeric_limits<unsigned>::max())
     , m_isJavaEnabled(false)
     , m_loadsImagesAutomatically(false)
     , m_privateBrowsingEnabled(false)
@@ -110,7 +116,8 @@ Settings::Settings(Page* page)
     , m_usesEncodingDetector(false)
     , m_allowScriptsToCloseWindows(false)
     , m_editingBehavior(
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
+        // (PLATFORM(MAC) is always false in Chromium, hence the extra condition.)
         EditingMacBehavior
 #else
         EditingWindowsBehavior
@@ -121,6 +128,12 @@ Settings::Settings(Page* page)
     , m_downloadableBinaryFontsEnabled(true)
     , m_xssAuditorEnabled(false)
     , m_acceleratedCompositingEnabled(true)
+    , m_experimentalNotificationsEnabled(false)
+    , m_pluginHalterEnabled(false)
+    , m_webGLEnabled(false)
+#if ENABLE(WEB_SOCKETS)
+    , m_experimentalWebSocketsEnabled(false)
+#endif
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -272,6 +285,11 @@ void Settings::setSessionStorageEnabled(bool sessionStorageEnabled)
     m_sessionStorageEnabled = sessionStorageEnabled;
 }
 
+void Settings::setLocalStorageQuota(unsigned localStorageQuota)
+{
+    m_localStorageQuota = localStorageQuota;
+}
+
 void Settings::setPrivateBrowsingEnabled(bool privateBrowsingEnabled)
 {
     m_privateBrowsingEnabled = privateBrowsingEnabled;
@@ -295,7 +313,6 @@ void Settings::setUserStyleSheetLocation(const KURL& userStyleSheetLocation)
     m_userStyleSheetLocation = userStyleSheetLocation;
 
     m_page->userStyleSheetLocationChanged();
-    setNeedsReapplyStylesInAllFrames(m_page);
 }
 
 void Settings::setShouldPrintBackgrounds(bool shouldPrintBackgrounds)
@@ -620,4 +637,44 @@ void Settings::setAcceleratedCompositingEnabled(bool enabled)
     setNeedsReapplyStylesInAllFrames(m_page);
 }
 
+void Settings::setExperimentalNotificationsEnabled(bool enabled)
+{
+    m_experimentalNotificationsEnabled = enabled;
+}
+
+void Settings::setPluginHalterEnabled(bool enabled)
+{
+    if (m_pluginHalterEnabled == enabled)
+        return;
+
+    m_pluginHalterEnabled = enabled;
+
+    m_page->pluginHalterEnabledStateChanged();
+}
+
+void Settings::setPluginAllowedRunTime(unsigned runTime)
+{
+    m_pluginAllowedRunTime = runTime;
+    m_page->pluginAllowedRunTimeChanged();
+}
+
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+void Settings::setShouldUseHighResolutionTimers(bool shouldUseHighResolutionTimers)
+{
+    gShouldUseHighResolutionTimers = shouldUseHighResolutionTimers;
+}
+#endif
+
+void Settings::setWebGLEnabled(bool enabled)
+{
+    m_webGLEnabled = enabled;
+}
+
+#if ENABLE(WEB_SOCKETS)
+void Settings::setExperimentalWebSocketsEnabled(bool enabled)
+{
+    m_experimentalWebSocketsEnabled = enabled;
+}
+#endif
+
 } // namespace WebCore
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index 162b21d..344746f 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -151,6 +151,9 @@ namespace WebCore {
         void setSessionStorageEnabled(bool);
         bool sessionStorageEnabled() const { return m_sessionStorageEnabled; }
 
+        void setLocalStorageQuota(unsigned);
+        unsigned localStorageQuota() const { return m_localStorageQuota; }
+
         void setPrivateBrowsingEnabled(bool);
         bool privateBrowsingEnabled() const { return m_privateBrowsingEnabled; }
 
@@ -295,6 +298,28 @@ namespace WebCore {
         void setAcceleratedCompositingEnabled(bool);
         bool acceleratedCompositingEnabled() const { return m_acceleratedCompositingEnabled; }
 
+        void setExperimentalNotificationsEnabled(bool);
+        bool experimentalNotificationsEnabled() const { return m_experimentalNotificationsEnabled; }
+
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static void setShouldUseHighResolutionTimers(bool);
+        static bool shouldUseHighResolutionTimers() { return gShouldUseHighResolutionTimers; }
+#endif
+
+        void setPluginHalterEnabled(bool);
+        bool pluginHalterEnabled() const { return m_pluginHalterEnabled; }
+
+        void setPluginAllowedRunTime(unsigned);
+        unsigned pluginAllowedRunTime() const { return m_pluginAllowedRunTime; }
+
+        void setWebGLEnabled(bool);
+        bool webGLEnabled() const { return m_webGLEnabled; }
+
+#if ENABLE(WEB_SOCKETS)
+        void setExperimentalWebSocketsEnabled(bool);
+        bool experimentalWebSocketsEnabled() const { return m_experimentalWebSocketsEnabled; }
+#endif
+
     private:
         Page* m_page;
         
@@ -352,6 +377,8 @@ namespace WebCore {
         bool m_blockNetworkImage : 1;
 #endif
         size_t m_maximumDecodedImageSize;
+        unsigned m_localStorageQuota;
+        unsigned m_pluginAllowedRunTime;
         bool m_isJavaEnabled : 1;
         bool m_loadsImagesAutomatically : 1;
         bool m_privateBrowsingEnabled : 1;
@@ -396,10 +423,20 @@ namespace WebCore {
         bool m_downloadableBinaryFontsEnabled : 1;
         bool m_xssAuditorEnabled : 1;
         bool m_acceleratedCompositingEnabled : 1;
+        bool m_experimentalNotificationsEnabled : 1;
+        bool m_pluginHalterEnabled : 1;
+        bool m_webGLEnabled : 1;
+
+#if ENABLE(WEB_SOCKETS)
+        bool m_experimentalWebSocketsEnabled : 1;
+#endif
 
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
+#if PLATFORM(WIN) || (PLATFORM(WIN_OS) && PLATFORM(WX))
+        static bool gShouldUseHighResolutionTimers;
+#endif
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/UserContentURLPattern.cpp b/WebCore/page/UserContentURLPattern.cpp
new file mode 100644
index 0000000..5f0a311
--- /dev/null
+++ b/WebCore/page/UserContentURLPattern.cpp
@@ -0,0 +1,226 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "UserContentURLPattern.h"
+#include "KURL.h"
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+bool UserContentURLPattern::matchesPatterns(const KURL& url, const Vector<String>* whitelist, const Vector<String>* blacklist)
+{
+    // In order for a URL to be a match it has to be present in the whitelist and not present in the blacklist.
+    // If there is no whitelist at all, then all URLs are assumed to be in the whitelist.
+    bool matchesWhitelist = !whitelist || whitelist->isEmpty();
+    if (!matchesWhitelist) {
+        for (unsigned i = 0; i < whitelist->size(); ++i) {
+            UserContentURLPattern contentPattern(whitelist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesWhitelist = true;
+                break;
+            }
+        }
+    }
+
+    bool matchesBlacklist = false;
+    if (blacklist) {
+        for (unsigned i = 0; i < blacklist->size(); ++i) {
+            UserContentURLPattern contentPattern(blacklist->at(i));
+            if (contentPattern.matches(url)) {
+                matchesBlacklist = true;
+                break;
+            }
+        }
+    }
+
+    return matchesWhitelist && !matchesBlacklist;
+}
+
+bool UserContentURLPattern::parse(const String& pattern)
+{
+    DEFINE_STATIC_LOCAL(const String, schemeSeparator, ("://"));
+
+    int schemeEndPos = pattern.find(schemeSeparator);
+    if (schemeEndPos == -1)
+        return false;
+
+    m_scheme = pattern.left(schemeEndPos);
+
+    int hostStartPos = schemeEndPos + schemeSeparator.length();
+    if (hostStartPos >= static_cast<int>(pattern.length()))
+        return false;
+
+    int pathStartPos = 0;
+
+    if (m_scheme == "file")
+        pathStartPos = hostStartPos;
+    else {
+        int hostEndPos = pattern.find("/", hostStartPos);
+        if (hostEndPos == -1)
+            return false;
+    
+        m_host = pattern.substring(hostStartPos, hostEndPos - hostStartPos);
+
+        // The first component can be '*', which means to match all subdomains.
+        Vector<String> hostComponents;
+        m_host.split(".", hostComponents); 
+        if (hostComponents[0] == "*") {
+            m_matchSubdomains = true;
+            m_host = "";
+            for (unsigned i = 1; i < hostComponents.size(); ++i) {
+                m_host = m_host + hostComponents[i];
+                if (i < hostComponents.size() - 1)
+                    m_host = m_host + ".";
+            }
+        }
+        
+        // No other '*' can occur in the host.
+        if (m_host.find("*") != -1)
+            return false;
+
+        pathStartPos = hostEndPos;
+    }
+
+    m_path = pattern.right(pattern.length() - pathStartPos);
+
+    return true;
+}
+
+bool UserContentURLPattern::matches(const KURL& test) const
+{
+    if (m_invalid)
+        return false;
+
+    if (test.protocol() != m_scheme)
+        return false;
+
+    if (!matchesHost(test))
+        return false;
+
+    return matchesPath(test);
+}
+
+bool UserContentURLPattern::matchesHost(const KURL& test) const
+{
+    if (test.host() == m_host)
+        return true;
+
+    if (!m_matchSubdomains)
+        return false;
+
+    // If we're matching subdomains, and we have no host, that means the pattern
+    // was <scheme>://*/<whatever>, so we match anything.
+    if (!m_host.length())
+        return true;
+
+    // Check if the test host is a subdomain of our host.
+    return test.host().endsWith(m_host, false);
+}
+
+struct MatchTester
+{
+    const String m_pattern;
+    unsigned m_patternIndex;
+    
+    const String m_test;
+    unsigned m_testIndex;
+    
+    MatchTester(const String& pattern, const String& test)
+    : m_pattern(pattern)
+    , m_patternIndex(0)
+    , m_test(test)
+    , m_testIndex(0)
+    {
+    }
+    
+    bool testStringFinished() const { return m_testIndex >= m_test.length(); }
+    bool patternStringFinished() const { return m_patternIndex >= m_pattern.length(); }
+
+    void eatWildcard()
+    {
+        while (!patternStringFinished()) {
+            if (m_pattern[m_patternIndex] != '*')
+                return;
+            m_patternIndex++;
+        }
+    }
+    
+    void eatSameChars()
+    {
+        while (!patternStringFinished() && !testStringFinished()) {
+            if (m_pattern[m_patternIndex] == '*')
+                return;
+            if (m_pattern[m_patternIndex] != m_test[m_testIndex])
+                return;
+            m_patternIndex++;
+            m_testIndex++;
+        }
+    }
+
+    bool test()
+    {
+        // Eat all the matching chars.
+        eatSameChars();
+
+        // If the string is finished, then the pattern must be empty too, or contains
+        // only wildcards.
+        if (testStringFinished()) {
+            eatWildcard();
+            if (patternStringFinished())
+                return true;
+            return false;
+        }
+  
+        // Pattern is empty but not string, this is not a match.
+        if (patternStringFinished())
+            return false;
+        
+        // If we don't encounter a *, then we're hosed.
+        if (m_pattern[m_patternIndex] != '*')
+            return false;
+        
+        while (!testStringFinished()) {
+            MatchTester nextMatch(*this);
+            nextMatch.m_patternIndex++;
+            if (nextMatch.test())
+                return true;
+            m_testIndex++;
+        }
+
+        // We reached the end of the string.  Let's see if the pattern contains only
+        // wildcards.
+        eatWildcard();
+        return patternStringFinished();
+    }
+};
+
+bool UserContentURLPattern::matchesPath(const KURL& test) const
+{
+    MatchTester match(m_path, test.path());
+    return match.test();
+}
+
+} // namespace WebCore
diff --git a/WebCore/page/UserContentURLPattern.h b/WebCore/page/UserContentURLPattern.h
new file mode 100644
index 0000000..0b1a248
--- /dev/null
+++ b/WebCore/page/UserContentURLPattern.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserContentURLPattern_h
+#define UserContentURLPattern_h
+
+#include "PlatformString.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class KURL;
+
+class UserContentURLPattern {
+public:
+    UserContentURLPattern(const String& pattern)
+    : m_matchSubdomains(false)
+    {
+        m_invalid = !parse(pattern);
+    }
+
+    bool matches(const KURL&) const;
+
+    const String& scheme() const { return m_scheme; }
+    const String& host() const { return m_host; }
+    const String& path() const { return m_path; }
+
+    bool matchSubdomains() const { return m_matchSubdomains; }
+    
+    static bool matchesPatterns(const KURL&, const Vector<String>* whitelist, const Vector<String>* blacklist);
+
+private:
+    bool parse(const String& pattern);
+
+    bool matchesHost(const KURL&) const;
+    bool matchesPath(const KURL&) const;
+
+    bool m_invalid;
+
+    String m_scheme;
+    String m_host;
+    String m_path;
+
+    bool m_matchSubdomains;
+};
+
+
+} // namespace WebCore
+
+#endif // UserContentURLPattern_h
diff --git a/WebCore/page/UserScript.h b/WebCore/page/UserScript.h
new file mode 100644
index 0000000..dbbb879
--- /dev/null
+++ b/WebCore/page/UserScript.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScript_h
+#define UserScript_h
+
+#include "KURL.h"
+#include "UserScriptTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserScript {
+public:
+    UserScript(const String& source, const KURL& url,
+               PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+               unsigned worldID, UserScriptInjectionTime injectionTime)
+        : m_source(source)
+        , m_url(url)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
+        , m_worldID(worldID)
+        , m_injectionTime(injectionTime)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
+    unsigned worldID() const { return m_worldID; }
+    UserScriptInjectionTime injectionTime() const { return m_injectionTime; }
+    
+private:
+    String m_source;
+    KURL m_url;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
+    unsigned m_worldID;
+    UserScriptInjectionTime m_injectionTime;
+};
+
+} // namespace WebCore
+ 
+#endif // UserScript_h
diff --git a/WebCore/page/UserScriptTypes.h b/WebCore/page/UserScriptTypes.h
new file mode 100644
index 0000000..ac37662
--- /dev/null
+++ b/WebCore/page/UserScriptTypes.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserScriptTypes_h
+#define UserScriptTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+enum UserScriptInjectionTime { InjectAtDocumentStart, InjectAtDocumentEnd };
+
+class UserScript;
+
+typedef Vector<OwnPtr<UserScript> > UserScriptVector;
+typedef HashMap<unsigned, UserScriptVector*> UserScriptMap;
+
+} // namespace WebCore
+ 
+#endif // UserScriptTypes_h
diff --git a/WebCore/page/UserStyleSheet.h b/WebCore/page/UserStyleSheet.h
new file mode 100644
index 0000000..56bec40
--- /dev/null
+++ b/WebCore/page/UserStyleSheet.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheet_h
+#define UserStyleSheet_h
+
+#include "KURL.h"
+#include "UserStyleSheetTypes.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet {
+public:
+    UserStyleSheet(const String& source, const KURL& url,
+                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
+                   unsigned worldID)
+        : m_source(source)
+        , m_url(url)
+        , m_whitelist(whitelist)
+        , m_blacklist(blacklist)
+        , m_worldID(worldID)
+    {
+    }
+
+    const String& source() const { return m_source; }
+    const KURL& url() const { return m_url; }
+    const Vector<String>* whitelist() const { return m_whitelist.get(); }
+    const Vector<String>* blacklist() const { return m_blacklist.get(); }
+    unsigned worldID() const { return m_worldID; }
+
+private:
+    String m_source;
+    KURL m_url;
+    OwnPtr<Vector<String> > m_whitelist;
+    OwnPtr<Vector<String> > m_blacklist;
+    unsigned m_worldID;
+};
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheet_h
diff --git a/WebCore/page/UserStyleSheetTypes.h b/WebCore/page/UserStyleSheetTypes.h
new file mode 100644
index 0000000..094b2cf
--- /dev/null
+++ b/WebCore/page/UserStyleSheetTypes.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef UserStyleSheetTypes_h
+#define UserStyleSheetTypes_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class UserStyleSheet;
+
+typedef Vector<OwnPtr<UserStyleSheet> > UserStyleSheetVector;
+typedef HashMap<unsigned, UserStyleSheetVector*> UserStyleSheetMap;
+
+} // namespace WebCore
+ 
+#endif // UserStyleSheetTypes_h
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 70b691b..92ed896 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -48,12 +48,38 @@ namespace WebCore {
 
 static bool isNonCanonicalCharacter(UChar c)
 {
+    // We remove all non-ASCII characters, including non-printable ASCII characters.
+    //
     // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
     // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
     // adverse effect that we remove any legitimate zeros from a string.
     //
     // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
-    return (c == '\\' || c == '0' || c < ' ' || c == 127);
+    return (c == '\\' || c == '0' || c < ' ' || c >= 127);
+}
+
+static bool isIllegalURICharacter(UChar c)
+{
+    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
+    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
+    // in a valid URI: ', ", <, >
+    //
+    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
+    // into response page, because it is impossible to write an inline script of the form <script>...</script>
+    // without "<", ">".
+    return (c == '\'' || c == '"' || c == '<' || c == '>');
+}
+
+String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities)
+{
+    if (decodeEntities == m_decodeEntities && encoding == m_encoding && url == m_inputURL)
+        return m_cachedCanonicalizedURL;
+
+    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities));
+    m_inputURL = url;
+    m_encoding = encoding;
+    m_decodeEntities = decodeEntities;
+    return m_cachedCanonicalizedURL;
 }
 
 XSSAuditor::XSSAuditor(Frame* frame)
@@ -76,7 +102,7 @@ bool XSSAuditor::canEvaluate(const String& code) const
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code, false)) {
+    if (findInRequest(code, false, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -102,7 +128,7 @@ bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code)
     if (!isEnabled())
         return true;
 
-    if (findInRequest(code)) {
+    if (findInRequest(code, true, true)) {
         DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
@@ -156,22 +182,23 @@ String XSSAuditor::canonicalize(const String& string)
     return result.removeCharacters(&isNonCanonicalCharacter);
 }
 
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeHTMLentities)
+String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities)
 {
     String result;
     String url = string;
 
     url.replace('+', ' ');
     result = decodeURLEscapeSequences(url);
-    String decodedResult = encoding.decode(result.utf8().data(), result.length());
+    CString utf8Url = result.utf8();
+    String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
     if (!decodedResult.isEmpty())
         result = decodedResult;
-    if (decodeHTMLentities)
+    if (decodeEntities)
         result = decodeHTMLEntities(result);
     return result;
 }
 
-String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableHTMLEntitiesUntouched)
+String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableEntitiesUntouched)
 {
     SegmentedString source(string);
     SegmentedString sourceShadow;
@@ -186,7 +213,7 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
             continue;
         }
         
-        if (leaveUndecodableHTMLEntitiesUntouched)
+        if (leaveUndecodableEntitiesUntouched)
             sourceShadow = source;
         bool notEnoughCharacters = false;
         unsigned entity = PreloadScanner::consumeEntity(source, notEnoughCharacters);
@@ -196,11 +223,11 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
         if (entity > 0xFFFF) {
             result.append(U16_LEAD(entity));
             result.append(U16_TRAIL(entity));
-        } else if (entity && (!leaveUndecodableHTMLEntitiesUntouched || entity != 0xFFFD)){
+        } else if (entity && (!leaveUndecodableEntitiesUntouched || entity != 0xFFFD)){
             result.append(entity);
         } else {
             result.append('&');
-            if (leaveUndecodableHTMLEntitiesUntouched)
+            if (leaveUndecodableEntitiesUntouched)
                 source = sourceShadow;
         }
     }
@@ -208,31 +235,48 @@ String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodabl
     return String::adopt(result);
 }
 
-bool XSSAuditor::findInRequest(const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
 {
     bool result = false;
     Frame* parentFrame = m_frame->tree()->parent();
     if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, string, decodeHTMLentities);
+        result = findInRequest(parentFrame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
     if (!result)
-        result = findInRequest(m_frame, string, decodeHTMLentities);
+        result = findInRequest(m_frame, string, decodeEntities, allowRequestIfNoIllegalURICharacters);
     return result;
 }
 
-bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHTMLentities) const
+bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeEntities, bool allowRequestIfNoIllegalURICharacters) const
 {
     ASSERT(frame->document());
-    String pageURL = frame->document()->url().string();
 
     if (!frame->document()->decoder()) {
         // Note, JavaScript URLs do not have a charset.
         return false;
     }
 
-    if (protocolIs(pageURL, "data"))
+    if (string.isEmpty())
         return false;
 
-    if (string.isEmpty())
+    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
+    String pageURL = frame->document()->url().string();
+
+    if (!formDataObj && string.length() >= 2 * pageURL.length()) {
+        // Q: Why do we bother to do this check at all?
+        // A: Canonicalizing large inline scripts can be expensive.  We want to
+        //    bail out before the call to canonicalize below, which could
+        //    result in an unneeded allocation and memcpy.
+        //
+        // Q: Why do we multiply by two here?
+        // A: We attempt to detect reflected XSS even when the server
+        //    transforms the attacker's input with addSlashes.  The best the
+        //    attacker can do get the server to inflate his/her input by a
+        //    factor of two by sending " characters, which the server
+        //    transforms to \".
+        return false;
+    }
+
+    if (frame->document()->url().protocolIs("data"))
         return false;
 
     String canonicalizedString = canonicalize(string);
@@ -241,12 +285,16 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
 
     if (string.length() < pageURL.length()) {
         // The string can actually fit inside the pageURL.
-        String decodedPageURL = canonicalize(decodeURL(pageURL, frame->document()->decoder()->encoding(), decodeHTMLentities));
+        String decodedPageURL = m_cache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), decodeEntities);
+
+        if (allowRequestIfNoIllegalURICharacters && (!formDataObj || formDataObj->isEmpty()) 
+            && decodedPageURL.find(&isIllegalURICharacter, 0) == -1)
+            return false; // Injection is impossible because the request does not contain any illegal URI characters. 
+
         if (decodedPageURL.find(canonicalizedString, 0, false) != -1)
-           return true;  // We've found the smoking gun.
+            return true;  // We've found the smoking gun.
     }
 
-    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
     if (formDataObj && !formDataObj->isEmpty()) {
         String formData = formDataObj->flattenToString();
         if (string.length() < formData.length()) {
@@ -254,7 +302,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const String& string, bool decodeHT
             // the url-encoded POST data because the length of the url-decoded
             // code is less than or equal to the length of the url-encoded
             // string.
-            String decodedFormData = canonicalize(decodeURL(formData, frame->document()->decoder()->encoding(), decodeHTMLentities));
+            String decodedFormData = m_cache.canonicalizeURL(formData, frame->document()->decoder()->encoding(), decodeEntities);
             if (decodedFormData.find(canonicalizedString, 0, false) != -1)
                 return true;  // We found the string in the POST data.
         }
diff --git a/WebCore/page/XSSAuditor.h b/WebCore/page/XSSAuditor.h
index 26f10ab..d3d1ec9 100644
--- a/WebCore/page/XSSAuditor.h
+++ b/WebCore/page/XSSAuditor.h
@@ -99,18 +99,34 @@ namespace WebCore {
         bool canSetBaseElementURL(const String& url) const;
 
     private:
-        static String canonicalize(const String&);
-        
-        static String decodeURL(const String& url, const TextEncoding& encoding = UTF8Encoding(), bool decodeHTMLentities = true);
-        
-        static String decodeHTMLEntities(const String&, bool leaveUndecodableHTMLEntitiesUntouched = true);
+        class CachingURLCanonicalizer
+        {
+        public:
+            CachingURLCanonicalizer() : m_decodeEntities(false) { }
+            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+
+        private:
+            // The parameters we were called with last.
+            String m_inputURL;
+            TextEncoding m_encoding;
+            bool m_decodeEntities;
+
+            // The cached result.
+            String m_cachedCanonicalizedURL;
+        };
 
-        bool findInRequest(const String&, bool decodeHTMLentities = true) const;
+        static String canonicalize(const String&);
+        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities);
+        static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
 
-        bool findInRequest(Frame*, const String&, bool decodeHTMLentities = true) const;
+        bool findInRequest(const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
+        bool findInRequest(Frame*, const String&, bool decodeEntities = true, bool allowRequestIfNoIllegalURICharacters = false) const;
 
         // The frame to audit.
         Frame* m_frame;
+
+        // A state store to help us avoid canonicalizing the same URL repeated.
+        mutable CachingURLCanonicalizer m_cache;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/animation/AnimationBase.cpp b/WebCore/page/animation/AnimationBase.cpp
index 7503f0a..ec0e284 100644
--- a/WebCore/page/animation/AnimationBase.cpp
+++ b/WebCore/page/animation/AnimationBase.cpp
@@ -302,11 +302,21 @@ public:
     {
         ShadowData* shadowA = (a->*m_getter)();
         ShadowData* shadowB = (b->*m_getter)();
+        
+        while (true) {
+            if (!shadowA && !shadowB)   // end of both lists
+                return true;
+
+            if (!shadowA || !shadowB)   // end of just one of the lists
+                return false;
+
+            if (*shadowA != *shadowB)
+                return false;
+        
+            shadowA = shadowA->next;
+            shadowB = shadowB->next;
+        }
 
-        if ((!shadowA && shadowB) || (shadowA && !shadowB))
-            return false;
-        if (shadowA && shadowB && (*shadowA != *shadowB))
-            return false;
         return true;
     }
 
@@ -316,12 +326,22 @@ public:
         ShadowData* shadowB = (b->*m_getter)();
         ShadowData defaultShadowData(0, 0, 0, 0, Normal, Color::transparent);
 
-        if (!shadowA)
-            shadowA = &defaultShadowData;
-        if (!shadowB)
-            shadowB = &defaultShadowData;
+        ShadowData* newShadowData = 0;
+        
+        while (shadowA || shadowB) {
+            ShadowData* srcShadow = shadowA ? shadowA : &defaultShadowData;
+            ShadowData* dstShadow = shadowB ? shadowB : &defaultShadowData;
+            
+            if (!newShadowData)
+                newShadowData = blendFunc(anim, srcShadow, dstShadow, progress);
+            else
+                newShadowData->next = blendFunc(anim, srcShadow, dstShadow, progress);
 
-        (dst->*m_setter)(blendFunc(anim, shadowA, shadowB, progress), false);
+            shadowA = shadowA ? shadowA->next : 0;
+            shadowB = shadowB ? shadowB->next : 0;
+        }
+        
+        (dst->*m_setter)(newShadowData, false);
     }
 
 private:
@@ -341,6 +361,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return true;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -353,6 +377,10 @@ public:
     {
         Color fromColor = (a->*m_getter)();
         Color toColor = (b->*m_getter)();
+
+        if (!fromColor.isValid() && !toColor.isValid())
+            return;
+
         if (!fromColor.isValid())
             fromColor = a->color();
         if (!toColor.isValid())
@@ -365,6 +393,124 @@ private:
     void (RenderStyle::*m_setter)(const Color&);
 };
 
+// Wrapper base class for an animatable property in a FillLayer
+class FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperBase()
+    {
+    }
+
+    virtual ~FillLayerPropertyWrapperBase() { }
+    
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const = 0;
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const = 0;
+};
+
+template <typename T>
+class FillLayerPropertyWrapperGetter : public FillLayerPropertyWrapperBase {
+public:
+    FillLayerPropertyWrapperGetter(T (FillLayer::*getter)() const)
+        : m_getter(getter)
+    {
+    }
+
+    virtual bool equals(const FillLayer* a, const FillLayer* b) const
+    {
+       // If the style pointers are the same, don't bother doing the test.
+       // If either is null, return false. If both are null, return true.
+       if ((!a && !b) || a == b)
+           return true;
+       if (!a || !b)
+            return false;
+        return (a->*m_getter)() == (b->*m_getter)();
+    }
+
+protected:
+    T (FillLayer::*m_getter)() const;
+};
+
+template <typename T>
+class FillLayerPropertyWrapper : public FillLayerPropertyWrapperGetter<T> {
+public:
+    FillLayerPropertyWrapper(T (FillLayer::*getter)() const, void (FillLayer::*setter)(T))
+        : FillLayerPropertyWrapperGetter<T>(getter)
+        , m_setter(setter)
+    {
+    }
+    
+    virtual void blend(const AnimationBase* anim, FillLayer* dst, const FillLayer* a, const FillLayer* b, double progress) const
+    {
+        (dst->*m_setter)(blendFunc(anim, (a->*FillLayerPropertyWrapperGetter<T>::m_getter)(), (b->*FillLayerPropertyWrapperGetter<T>::m_getter)(), progress));
+    }
+
+protected:
+    void (FillLayer::*m_setter)(T);
+};
+
+
+class FillLayersPropertyWrapper : public PropertyWrapperBase {
+public:
+    typedef const FillLayer* (RenderStyle::*LayersGetter)() const;
+    typedef FillLayer* (RenderStyle::*LayersAccessor)();
+    
+    FillLayersPropertyWrapper(int prop, LayersGetter getter, LayersAccessor accessor)
+        : PropertyWrapperBase(prop)
+        , m_layersGetter(getter)
+        , m_layersAccessor(accessor)
+    {
+        switch (prop) {
+            case CSSPropertyBackgroundPositionX:
+            case CSSPropertyWebkitMaskPositionX:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::xPosition, &FillLayer::setXPosition);
+                break;
+            case CSSPropertyBackgroundPositionY:
+            case CSSPropertyWebkitMaskPositionY:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<Length>(&FillLayer::yPosition, &FillLayer::setYPosition);
+                break;
+            case CSSPropertyBackgroundSize:
+            case CSSPropertyWebkitMaskSize:
+                m_fillLayerPropertyWrapper = new FillLayerPropertyWrapper<LengthSize>(&FillLayer::sizeLength, &FillLayer::setSizeLength);
+                break;
+        }
+    }
+
+    virtual bool equals(const RenderStyle* a, const RenderStyle* b) const
+    {
+        const FillLayer* fromLayer = (a->*m_layersGetter)();
+        const FillLayer* toLayer = (b->*m_layersGetter)();
+
+        while (fromLayer && toLayer) {
+            if (!m_fillLayerPropertyWrapper->equals(fromLayer, toLayer))
+                return false;
+            
+            fromLayer = fromLayer->next();
+            toLayer = toLayer->next();
+        }
+
+        return true;
+    }
+
+    virtual void blend(const AnimationBase* anim, RenderStyle* dst, const RenderStyle* a, const RenderStyle* b, double progress) const
+    {
+        const FillLayer* aLayer = (a->*m_layersGetter)();
+        const FillLayer* bLayer = (b->*m_layersGetter)();
+        FillLayer* dstLayer = (dst->*m_layersAccessor)();
+
+        while (aLayer && bLayer && dstLayer) {
+            m_fillLayerPropertyWrapper->blend(anim, dstLayer, aLayer, bLayer, progress);
+            aLayer = aLayer->next();
+            bLayer = bLayer->next();
+            dstLayer = dstLayer->next();
+        }
+    }
+
+private:
+    FillLayerPropertyWrapperBase* m_fillLayerPropertyWrapper;
+    
+    LayersGetter m_layersGetter;
+    LayersAccessor m_layersAccessor;
+};
+
 class ShorthandPropertyWrapper : public PropertyWrapperBase {
 public:
     ShorthandPropertyWrapper(int property, const CSSPropertyLonghand& longhand)
@@ -442,13 +588,14 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyColor, &RenderStyle::color, &RenderStyle::setColor));
 
         gPropertyWrappers->append(new PropertyWrapper<const Color&>(CSSPropertyBackgroundColor, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundXPosition, &RenderStyle::setBackgroundXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundYPosition, &RenderStyle::setBackgroundYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitBackgroundSize, &RenderStyle::backgroundSize, &RenderStyle::setBackgroundSize));
 
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskXPosition, &RenderStyle::setMaskXPosition));
-        gPropertyWrappers->append(new PropertyWrapper<Length>(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskYPosition, &RenderStyle::setMaskYPosition));
-        gPropertyWrappers->append(new PropertyWrapper<LengthSize>(CSSPropertyWebkitMaskSize, &RenderStyle::maskSize, &RenderStyle::setMaskSize));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionX, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundPositionY, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyBackgroundSize, &RenderStyle::backgroundLayers, &RenderStyle::accessBackgroundLayers));
+
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionX, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskPositionY, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
+        gPropertyWrappers->append(new FillLayersPropertyWrapper(CSSPropertyWebkitMaskSize, &RenderStyle::maskLayers, &RenderStyle::accessMaskLayers));
 
         gPropertyWrappers->append(new PropertyWrapper<int>(CSSPropertyFontSize, &RenderStyle::fontSize, &RenderStyle::setBlendedFontSize));
         gPropertyWrappers->append(new PropertyWrapper<unsigned short>(CSSPropertyWebkitColumnRuleWidth, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth));
@@ -496,7 +643,7 @@ static void ensurePropertyMap()
         gPropertyWrappers->append(new PropertyWrapperMaybeInvalidColor(CSSPropertyOutlineColor, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor));
 
         // These are for shadows
-        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
+        gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyWebkitBoxShadow, &RenderStyle::boxShadow, &RenderStyle::setBoxShadow));
         gPropertyWrappers->append(new PropertyWrapperShadow(CSSPropertyTextShadow, &RenderStyle::textShadow, &RenderStyle::setTextShadow));
 
 #if ENABLE(SVG)
@@ -685,7 +832,7 @@ void AnimationBase::setNeedsStyleRecalc(Node* node)
 {
     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
     if (node)
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
 }
 
 double AnimationBase::duration() const
diff --git a/WebCore/page/animation/AnimationController.cpp b/WebCore/page/animation/AnimationController.cpp
index ed241e1..691932e 100644
--- a/WebCore/page/animation/AnimationController.cpp
+++ b/WebCore/page/animation/AnimationController.cpp
@@ -36,6 +36,8 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "RenderView.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 
@@ -98,7 +100,7 @@ void AnimationControllerPrivate::updateAnimationTimer(bool callSetChanged/* = fa
                 if (callSetChanged) {
                     Node* node = it->first->node();
                     ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-                    node->setNeedsStyleRecalc(AnimationStyleChange);
+                    node->setNeedsStyleRecalc(SyntheticStyleChange);
                     calledSetChanged = true;
                 }
                 else
@@ -136,9 +138,9 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
     for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
-            it->element->dispatchWebKitTransitionEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
         else
-            it->element->dispatchWebKitAnimationEvent(it->eventType, it->name, it->elapsedTime);
+            it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
     
     m_eventsToDispatch.clear();
@@ -146,7 +148,7 @@ void AnimationControllerPrivate::updateStyleIfNeededDispatcherFired(Timer<Animat
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
-        (*it)->setNeedsStyleRecalc(AnimationStyleChange);
+        (*it)->setNeedsStyleRecalc(SyntheticStyleChange);
     
     m_nodeChangesToDispatch.clear();
     
@@ -244,7 +246,7 @@ bool AnimationControllerPrivate::pauseAnimationAtTime(RenderObject* renderer, co
         return false;
 
     if (compAnim->pauseAnimationAtTime(name, t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -262,7 +264,7 @@ bool AnimationControllerPrivate::pauseTransitionAtTime(RenderObject* renderer, c
         return false;
 
     if (compAnim->pauseTransitionAtTime(cssPropertyID(property), t)) {
-        renderer->node()->setNeedsStyleRecalc(AnimationStyleChange);
+        renderer->node()->setNeedsStyleRecalc(SyntheticStyleChange);
         startUpdateStyleIfNeededDispatcher();
         return true;
     }
@@ -438,7 +440,7 @@ void AnimationController::cancelAnimations(RenderObject* renderer)
     if (m_data->clear(renderer)) {
         Node* node = renderer->node();
         ASSERT(!node || (node->document() && !node->document()->inPageCache()));
-        node->setNeedsStyleRecalc(AnimationStyleChange);
+        node->setNeedsStyleRecalc(SyntheticStyleChange);
     }
 }
 
diff --git a/WebCore/page/chromium/FrameChromium.cpp b/WebCore/page/chromium/FrameChromium.cpp
index 1372cd9..d79ae68 100644
--- a/WebCore/page/chromium/FrameChromium.cpp
+++ b/WebCore/page/chromium/FrameChromium.cpp
@@ -60,7 +60,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->overflowWidth());
+    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/page/gtk/EventHandlerGtk.cpp b/WebCore/page/gtk/EventHandlerGtk.cpp
index d12cdcc..7051391 100644
--- a/WebCore/page/gtk/EventHandlerGtk.cpp
+++ b/WebCore/page/gtk/EventHandlerGtk.cpp
@@ -122,4 +122,13 @@ unsigned EventHandler::accessKeyModifiers()
     return PlatformKeyboardEvent::AltKey;
 }
 
+// GTK+ must scroll horizontally if the mouse pointer is on top of the
+// horizontal scrollbar while scrolling with the wheel; we need to
+// add the deltas and ticks here so that this behavior is consistent
+// for styled scrollbars.
+bool EventHandler::shouldTurnVerticalTicksIntoHorizontal(const HitTestResult& result) const
+{
+    return result.scrollbar() && result.scrollbar()->orientation() == HorizontalScrollbar;
+}
+
 }
diff --git a/WebCore/page/haiku/DragControllerHaiku.cpp b/WebCore/page/haiku/DragControllerHaiku.cpp
index 0b95558..ef08ac2 100644
--- a/WebCore/page/haiku/DragControllerHaiku.cpp
+++ b/WebCore/page/haiku/DragControllerHaiku.cpp
@@ -32,10 +32,9 @@
 #include <InterfaceDefs.h>
 
 
-namespace WebCore
-{
+namespace WebCore {
 
-// FIXME: These values are straight out of DragControllerMac, so probably have 
+// FIXME: These values are straight out of DragControllerMac, so probably have
 // little correlation with Haiku standards...
 const int DragController::LinkDragBorderInset = 2;
 const int DragController::MaxOriginalImageArea = 1500 * 1500;
diff --git a/WebCore/page/haiku/EventHandlerHaiku.cpp b/WebCore/page/haiku/EventHandlerHaiku.cpp
index 64b8519..203344e 100644
--- a/WebCore/page/haiku/EventHandlerHaiku.cpp
+++ b/WebCore/page/haiku/EventHandlerHaiku.cpp
@@ -36,14 +36,13 @@
 #include "HitTestResult.h"
 #include "KeyboardEvent.h"
 #include "MouseEventWithHitTestResults.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "PlatformScrollBar.h"
 #include "PlatformWheelEvent.h"
 #include "RenderWidget.h"
 
-#include "NotImplemented.h"
-
 #include <interface/View.h>
 
 
@@ -117,13 +116,15 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& eve
 
 bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& event, Widget* widget)
 {
-    notImplemented();
-    return false;
+    if (!widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(event);
 }
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-    return new ClipboardHaiku(ClipboardWritable, true);
+    return ClipboardHaiku::create(ClipboardWritable, true);
 }
 
 bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
diff --git a/WebCore/page/mac/DragControllerMac.mm b/WebCore/page/mac/DragControllerMac.mm
index c476df7..8a04809 100644
--- a/WebCore/page/mac/DragControllerMac.mm
+++ b/WebCore/page/mac/DragControllerMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragController.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "DragData.h"
 #import "Frame.h"
 #import "FrameView.h"
@@ -75,4 +76,6 @@ void DragController::cleanupAfterSystemDrag()
     dragEnded();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/page/mac/EventHandlerMac.mm b/WebCore/page/mac/EventHandlerMac.mm
index 54bdff9..7da1d36 100644
--- a/WebCore/page/mac/EventHandlerMac.mm
+++ b/WebCore/page/mac/EventHandlerMac.mm
@@ -60,7 +60,9 @@ static inline IMP method_setImplementation(Method m, IMP i)
 
 namespace WebCore {
 
+#if ENABLE(DRAG_SUPPORT)
 const double EventHandler::TextDragDelay = 0.15;
+#endif
 
 static RetainPtr<NSEvent>& currentNSEventSlot()
 {
@@ -110,7 +112,7 @@ bool EventHandler::wheelEvent(NSEvent *event)
 
     m_useLatchedWheelEventNode = wkIsLatchingWheelEvent(event);
     
-    PlatformWheelEvent wheelEvent(event, page->chrome()->platformWindow());
+    PlatformWheelEvent wheelEvent(event, page->chrome()->platformPageClient());
     handleWheelEvent(wheelEvent);
 
     return wheelEvent.isAccepted();
@@ -372,6 +374,7 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
     return m_activationEventNumber == event.eventNumber();
 }
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
 {
     NSView *view = mouseDownViewIfStillGood();
@@ -399,6 +402,7 @@ PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
     [pasteboard declareTypes:[NSArray array] owner:nil];
     return ClipboardMac::create(true, pasteboard, ClipboardWritable, m_frame);
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
 {
@@ -430,8 +434,10 @@ bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults& eve
             // layout tests.
             if (!m_mouseDownWasInSubframe)
                 return false;
+#if ENABLE(DRAG_SUPPORT)
             if (subframe->page()->dragController()->didInitiateDrag())
                 return false;
+#endif
         case NSMouseMoved:
             // Since we're passing in currentNSEvent() here, we can call
             // handleMouseMoveEvent() directly, since the save/restore of
@@ -706,24 +712,28 @@ PlatformMouseEvent EventHandler::currentPlatformMouseEvent() const
 {
     NSView *windowView = nil;
     if (Page* page = m_frame->page())
-        windowView = page->chrome()->platformWindow();
+        windowView = page->chrome()->platformPageClient();
     return PlatformMouseEvent(currentNSEvent(), windowView);
 }
 
+#if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(NSEvent *event)
 {
     Page* page = m_frame->page();
     if (!page)
         return false;
-    return sendContextMenuEvent(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+    return sendContextMenuEvent(PlatformMouseEvent(event, page->chrome()->platformPageClient()));
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
+#if ENABLE(DRAG_SUPPORT)
 bool EventHandler::eventMayStartDrag(NSEvent *event)
 {
     Page* page = m_frame->page();
     if (!page)
         return false;
-    return eventMayStartDrag(PlatformMouseEvent(event, page->chrome()->platformWindow()));
+    return eventMayStartDrag(PlatformMouseEvent(event, page->chrome()->platformPageClient()));
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 }
diff --git a/WebCore/page/mac/FrameMac.mm b/WebCore/page/mac/FrameMac.mm
index c656624..d9faa8b 100644
--- a/WebCore/page/mac/FrameMac.mm
+++ b/WebCore/page/mac/FrameMac.mm
@@ -28,7 +28,6 @@
 #import "config.h"
 #import "Frame.h"
 
-#import "Base64.h"
 #import "BlockExceptions.h"
 #import "ColorMac.h"
 #import "Cursor.h"
@@ -53,7 +52,6 @@
 #import "RenderTableCell.h"
 #import "Scrollbar.h"
 #import "SimpleFontData.h"
-#import "UserStyleSheetLoader.h"
 #import "WebCoreViewFactory.h"
 #import "visible_units.h"
 
@@ -533,35 +531,4 @@ DragImageRef Frame::dragImageForSelection()
     return selectionImage();
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-
-    // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
-    // synchronously and avoid using a loader. 
-    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
-        const unsigned prefixLength = 35;
-        Vector<char> encodedData(url.string().length() - prefixLength);
-        for (unsigned i = prefixLength; i < url.string().length(); ++i)
-            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
-
-        Vector<char> styleSheetAsUTF8;
-        if (base64Decode(encodedData, styleSheetAsUTF8)) {
-            m_doc->setUserStyleSheet(String::fromUTF8(styleSheetAsUTF8.data()));
-            return;
-        }
-    }
-
-    if (m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    m_doc->setUserStyleSheet(styleSheet);
-}
-
 } // namespace WebCore
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index d4dc821..249d696 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2005 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2005, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -39,6 +39,7 @@
 - (NSString *)fileButtonNoFileSelectedLabel;
 - (NSString *)copyImageUnknownFileLabel;
 
+#if ENABLE(CONTEXT_MENUS)
 // Context menu item titles
 - (NSString *)contextMenuItemTagOpenLinkInNewWindow;
 - (NSString *)contextMenuItemTagDownloadLinkToDisk;
@@ -97,6 +98,7 @@
 - (NSString *)contextMenuItemTagCapitalize;
 - (NSString *)contextMenuItemTagChangeBack:(NSString *)replacedString;
 - (NSString *)contextMenuItemTagInspectElement;
+#endif // ENABLE(CONTEXT_MENUS)
 
 - (NSString *)searchMenuNoRecentSearchesText;
 - (NSString *)searchMenuRecentSearchesText;
@@ -129,6 +131,7 @@
 - (NSString *)AXHeadingText;
 - (NSString *)AXDefinitionListTermText;
 - (NSString *)AXDefinitionListDefinitionText;
+- (NSString *)AXARIAContentGroupText:(NSString *)ariaType;
 
 - (NSString *)AXButtonActionVerb;
 - (NSString *)AXRadioButtonActionVerb;
@@ -143,6 +146,10 @@
 
 - (NSString *)mediaElementLoadingStateText;
 - (NSString *)mediaElementLiveBroadcastStateText;
+- (NSString*)localizedMediaControlElementString:(NSString*)name;
+- (NSString*)localizedMediaControlElementHelpText:(NSString*)name;
+- (NSString*)localizedMediaTimeDescription:(float)time;
+
 
 @end
 
diff --git a/WebCore/page/qt/FrameQt.cpp b/WebCore/page/qt/FrameQt.cpp
index 388bf66..493e60d 100644
--- a/WebCore/page/qt/FrameQt.cpp
+++ b/WebCore/page/qt/FrameQt.cpp
@@ -24,8 +24,6 @@
 #include "config.h"
 #include "Frame.h"
 
-#include "UserStyleSheetLoader.h"
-
 namespace WebCore {
 
 DragImageRef Frame::dragImageForSelection() 
@@ -33,21 +31,5 @@ DragImageRef Frame::dragImageForSelection()
     return 0;
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc && m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc)
-        m_doc->setUserStyleSheet(styleSheet);
-}
-
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/page/win/FrameWin.cpp b/WebCore/page/win/FrameWin.cpp
index 1e480fb..b15d195 100644
--- a/WebCore/page/win/FrameWin.cpp
+++ b/WebCore/page/win/FrameWin.cpp
@@ -61,7 +61,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
     
     float ratio = static_cast<float>(printRect.height()) / static_cast<float>(printRect.width());
  
-    float pageWidth  = static_cast<float>(root->overflowWidth());
+    float pageWidth  = static_cast<float>(root->rightLayoutOverflow());
     float pageHeight = pageWidth * ratio;
     outPageHeight = static_cast<int>(pageHeight);   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/WebCore/page/wince/FrameWince.cpp b/WebCore/page/wince/FrameWince.cpp
index 480a103..5ecb579 100644
--- a/WebCore/page/wince/FrameWince.cpp
+++ b/WebCore/page/wince/FrameWince.cpp
@@ -50,7 +50,6 @@
 #include "runtime_root.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
-#include "UserStyleSheetLoader.h"
 
 #include <windows.h>
 
@@ -166,20 +165,4 @@ DragImageRef Frame::dragImageForSelection()
     return 0;
 }
 
-void Frame::setUserStyleSheetLocation(const KURL& url)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc && m_doc->docLoader())
-        m_userStyleSheetLoader = new UserStyleSheetLoader(m_doc, url.string());
-}
-
-void Frame::setUserStyleSheet(const String& styleSheet)
-{
-    delete m_userStyleSheetLoader;
-    m_userStyleSheetLoader = 0;
-    if (m_doc)
-        m_doc->setUserStyleSheet(styleSheet);
-}
-
 } // namespace WebCore
diff --git a/WebCore/page/wx/EventHandlerWx.cpp b/WebCore/page/wx/EventHandlerWx.cpp
index 65a743c..f4f6914 100644
--- a/WebCore/page/wx/EventHandlerWx.cpp
+++ b/WebCore/page/wx/EventHandlerWx.cpp
@@ -32,6 +32,7 @@
 #include "FrameView.h"
 #include "KeyboardEvent.h"
 #include "MouseEventWithHitTestResults.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformKeyboardEvent.h"
 #include "RenderWidget.h"
@@ -43,17 +44,20 @@ const double EventHandler::TextDragDelay = 0.0;
 
 bool EventHandler::passMousePressEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMousePressEvent(mev.event());
+    return true;
 }
 
 bool EventHandler::passMouseMoveEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe, WebCore::HitTestResult* hittest)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMouseMoveEvent(mev.event(), hittest);
+    return true;
 }
 
 bool EventHandler::passMouseReleaseEventToSubframe(MouseEventWithHitTestResults& mev, Frame* subframe)
 {
-    return passSubframeEventToSubframe(mev, subframe);
+    subframe->eventHandler()->handleMouseReleaseEvent(mev.event());
+    return true;
 }
 
 bool EventHandler::passWidgetMouseDownEventToWidget(const MouseEventWithHitTestResults& event)
@@ -70,6 +74,32 @@ bool EventHandler::passWidgetMouseDownEventToWidget(RenderWidget* renderWidget)
     return passMouseDownEventToWidget(renderWidget->widget());
 }
 
+bool EventHandler::passWheelEventToWidget(PlatformWheelEvent& event, Widget* widget)
+{
+    if (!widget || !widget->isFrameView())
+        return false;
+
+    return static_cast<FrameView*>(widget)->frame()->eventHandler()->handleWheelEvent(event);
+}
+
+bool EventHandler::tabsToAllControls(KeyboardEvent* event) const 
+{ 
+    notImplemented(); 
+    return false; 
+}
+
+bool EventHandler::passSubframeEventToSubframe(MouseEventWithHitTestResults&, Frame* subframe, HitTestResult*)
+{
+    notImplemented(); 
+    return false; 
+}
+
+bool EventHandler::passMouseDownEventToWidget(Widget*)
+{ 
+    notImplemented();
+    return false; 
+}
+
 void EventHandler::focusDocumentView()
 {
     if (Page* page = m_frame->page())
diff --git a/WebCore/page/wx/FrameWx.cpp b/WebCore/page/wx/FrameWx.cpp
new file mode 100644
index 0000000..b220694
--- /dev/null
+++ b/WebCore/page/wx/FrameWx.cpp
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier <kevino@theolliviers.com>.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Frame.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+DragImageRef Frame::dragImageForSelection()
+{
+    notImplemented();
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/ContextMenu.cpp b/WebCore/platform/ContextMenu.cpp
index cca11b5..ee6aa4e 100644
--- a/WebCore/platform/ContextMenu.cpp
+++ b/WebCore/platform/ContextMenu.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 #include "ContextMenuClient.h"
 #include "CSSComputedStyleDeclaration.h"
@@ -359,10 +361,10 @@ void ContextMenu::populate()
                 appendItem(StopItem);
                 appendItem(ReloadItem);
 #else
-                if (loader->canGoBackOrForward(-1))
+                if (frame->page() && frame->page()->canGoBackOrForward(-1))
                     appendItem(BackItem);
 
-                if (loader->canGoBackOrForward(1))
+                if (frame->page() && frame->page()->canGoBackOrForward(1))
                     appendItem(ForwardItem);
 
                 // use isLoadingInAPISense rather than isLoading because Stop/Reload are
@@ -514,6 +516,7 @@ void ContextMenu::populate()
     }
 }
 
+#if ENABLE(INSPECTOR)
 void ContextMenu::addInspectElementItem()
 {
     Node* node = m_hitTestResult.innerNonSharedNode();
@@ -535,6 +538,7 @@ void ContextMenu::addInspectElementItem()
     appendItem(*separatorItem());
     appendItem(InspectElementItem);
 }
+#endif // ENABLE(INSPECTOR)
 
 void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 {
@@ -717,10 +721,10 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
 #endif
 #if PLATFORM(GTK)
         case ContextMenuItemTagGoBack:
-            shouldEnable = frame->loader()->canGoBackOrForward(-1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(-1);
             break;
         case ContextMenuItemTagGoForward:
-            shouldEnable = frame->loader()->canGoBackOrForward(1);
+            shouldEnable = frame->page() && frame->page()->canGoBackOrForward(1);
             break;
         case ContextMenuItemTagStop:
             shouldEnable = frame->loader()->documentLoader()->isLoadingInAPISense();
@@ -772,7 +776,9 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagTextDirectionMenu:
         case ContextMenuItemTagPDFSinglePageScrolling:
         case ContextMenuItemTagPDFFacingPagesScrolling:
+#if ENABLE(INSPECTOR)
         case ContextMenuItemTagInspectElement:
+#endif
         case ContextMenuItemBaseApplicationTag:
             break;
     }
@@ -781,4 +787,6 @@ void ContextMenu::checkOrEnableIfNeeded(ContextMenuItem& item) const
     item.setEnabled(shouldEnable);
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/ContextMenuItem.h b/WebCore/platform/ContextMenuItem.h
index 3a4cdfa..6b9d0a9 100644
--- a/WebCore/platform/ContextMenuItem.h
+++ b/WebCore/platform/ContextMenuItem.h
@@ -46,6 +46,8 @@ typedef struct _GtkMenuItem GtkMenuItem;
 #include <QAction>
 #elif PLATFORM(WX)
 class wxMenuItem;
+#elif PLATFORM(HAIKU)
+class BMenuItem;
 #endif
 
 namespace WebCore {
@@ -119,7 +121,9 @@ namespace WebCore {
         ContextMenuItemTagRightToLeft,
         ContextMenuItemTagPDFSinglePageScrolling,
         ContextMenuItemTagPDFFacingPagesScrolling,
+#if ENABLE(INSPECTOR)
         ContextMenuItemTagInspectElement,
+#endif
         ContextMenuItemTagTextDirectionMenu, // Text Direction sub-menu
         ContextMenuItemTagTextDirectionDefault,
         ContextMenuItemTagTextDirectionLeftToRight,
@@ -204,6 +208,8 @@ namespace WebCore {
         bool checked;
         bool enabled;
     };
+#elif PLATFORM(HAIKU)
+    typedef BMenuItem* PlatformMenuItemDescription;
 #else
     typedef void* PlatformMenuItemDescription;
 #endif
diff --git a/WebCore/platform/Cookie.h b/WebCore/platform/Cookie.h
new file mode 100644
index 0000000..0fe3851
--- /dev/null
+++ b/WebCore/platform/Cookie.h
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Joseph Pecoraro. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Cookie_h
+#define Cookie_h
+
+#include "PlatformString.h"
+#include "StringHash.h"
+
+namespace WebCore {
+
+    // This struct is currently only used to provide more cookies information
+    // to the Web Inspector.
+
+    struct Cookie {
+        Cookie(const String& name, const String& value, const String& domain,
+                const String& path, double expires, bool httpOnly, bool secure,
+                bool session)
+            : name(name)
+            , value(value)
+            , domain(domain)
+            , path(path)
+            , expires(expires)
+            , httpOnly(httpOnly)
+            , secure(secure)
+            , session(session)
+        {
+        }
+
+        String name;
+        String value;
+        String domain;
+        String path;
+        double expires;
+        bool httpOnly;
+        bool secure;
+        bool session;
+    };
+
+    struct CookieHash {
+        static unsigned hash(Cookie key)
+        { 
+            return StringHash::hash(key.name) + StringHash::hash(key.domain) + StringHash::hash(key.path) + key.secure;
+        }
+
+        static bool equal(Cookie a, Cookie b)
+        {
+            return a.name == b.name && a.domain == b.domain && a.path == b.path && a.secure == b.secure;
+        }
+    };
+}
+
+namespace WTF {
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::Cookie> {
+        typedef WebCore::CookieHash Hash;
+    };
+}
+
+#endif
diff --git a/WebCore/platform/CookieJar.h b/WebCore/platform/CookieJar.h
index 6159386..987543e 100644
--- a/WebCore/platform/CookieJar.h
+++ b/WebCore/platform/CookieJar.h
@@ -26,15 +26,21 @@
 #ifndef CookieJar_h
 #define CookieJar_h
 
+#include <wtf/Vector.h>
+
 namespace WebCore {
 
+    class Document;
     class KURL;
     class String;
-    class Document;
+
+    struct Cookie;
 
     String cookies(const Document*, const KURL&);
     void setCookies(Document*, const KURL&, const String&);
     bool cookiesEnabled(const Document*);
+    bool getRawCookies(const Document*, const KURL&, Vector<Cookie>&);
+    void deleteCookie(const Document*, const KURL&, const String&);
 
 }
 
diff --git a/WebCore/platform/CrossThreadCopier.cpp b/WebCore/platform/CrossThreadCopier.cpp
index 9ca626f..d02da6c 100644
--- a/WebCore/platform/CrossThreadCopier.cpp
+++ b/WebCore/platform/CrossThreadCopier.cpp
@@ -41,7 +41,7 @@ namespace WebCore {
 
 CrossThreadCopierBase<false, String>::Type CrossThreadCopierBase<false, String>::copy(const String& str)
 {
-    return str.copy();
+    return str.crossThreadString();
 }
 
 CrossThreadCopierBase<false, ResourceError>::Type CrossThreadCopierBase<false, ResourceError>::copy(const ResourceError& error)
diff --git a/WebCore/platform/CrossThreadCopier.h b/WebCore/platform/CrossThreadCopier.h
index d12d72d..178e056 100644
--- a/WebCore/platform/CrossThreadCopier.h
+++ b/WebCore/platform/CrossThreadCopier.h
@@ -46,6 +46,7 @@ namespace WebCore {
     class String;
     struct CrossThreadResourceResponseData;
     struct CrossThreadResourceRequestData;
+    struct ThreadableLoaderOptions;
 
     template<typename T> struct CrossThreadCopierPassThrough {
         typedef T Type;
@@ -65,6 +66,9 @@ namespace WebCore {
     template<typename T> struct CrossThreadCopierBase<false, T*> : public CrossThreadCopierPassThrough<T*> {
     };
 
+    template<> struct CrossThreadCopierBase<false, ThreadableLoaderOptions> : public CrossThreadCopierPassThrough<ThreadableLoaderOptions> {
+    };
+
     // Custom copy methods.
     template<typename T> struct CrossThreadCopierBase<false, RefPtr<ThreadSafeShared<T> > > {
         typedef PassRefPtr<T> Type;
diff --git a/WebCore/platform/Cursor.h b/WebCore/platform/Cursor.h
index ea75191..2d041d2 100644
--- a/WebCore/platform/Cursor.h
+++ b/WebCore/platform/Cursor.h
@@ -40,6 +40,8 @@ typedef struct _GdkCursor GdkCursor;
 #include <QCursor>
 #elif PLATFORM(CHROMIUM)
 #include "PlatformCursor.h"
+#elif PLATFORM(HAIKU)
+#include <app/Cursor.h>
 #endif
 
 #if PLATFORM(MAC)
@@ -86,6 +88,9 @@ namespace WebCore {
 #elif PLATFORM(CHROMIUM)
     // See PlatformCursor.h
     typedef void* PlatformCursorHandle;
+#elif PLATFORM(HAIKU)
+    typedef BCursor* PlatformCursor;
+    typedef BCursor* PlatformCursorHandle;
 #else
     typedef void* PlatformCursor;
     typedef void* PlatformCursorHandle;
diff --git a/WebCore/platform/DragData.cpp b/WebCore/platform/DragData.cpp
index bf2275a..4518909 100644
--- a/WebCore/platform/DragData.cpp
+++ b/WebCore/platform/DragData.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 namespace WebCore {
 
 #if !PLATFORM(MAC)
@@ -39,4 +40,6 @@ DragData::DragData(DragDataRef data, const IntPoint& clientPosition, const IntPo
 }
 #endif
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/DragData.h b/WebCore/platform/DragData.h
index a1555e3..116ffdd 100644
--- a/WebCore/platform/DragData.h
+++ b/WebCore/platform/DragData.h
@@ -58,6 +58,9 @@ typedef void* DragDataRef;
 typedef void* DragDataRef;
 #elif PLATFORM(CHROMIUM)
 #include "DragDataRef.h"
+#elif PLATFORM(HAIKU)
+class BMessage;
+typedef class BMessage* DragDataRef;
 #endif
 
 
diff --git a/WebCore/platform/DragImage.cpp b/WebCore/platform/DragImage.cpp
index adf9a57..aff4aba 100644
--- a/WebCore/platform/DragImage.cpp
+++ b/WebCore/platform/DragImage.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 #include "DragImage.h"
+
+#if ENABLE(DRAG_SUPPORT)
 #include "DragController.h"
 
 #include "Frame.h"
@@ -71,4 +73,6 @@ DragImageRef createDragImageForSelection(Frame* frame)
     return image;
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/DragImage.h b/WebCore/platform/DragImage.h
index 4887066..00bd7ed 100644
--- a/WebCore/platform/DragImage.h
+++ b/WebCore/platform/DragImage.h
@@ -48,6 +48,8 @@ class wxDragImage;
 #include "DragImageRef.h"
 #elif PLATFORM(GTK)
 typedef struct _GdkPixbuf GdkPixbuf;
+#elif PLATFORM(HAIKU)
+class BBitmap;
 #endif
 
 //We need to #define YOffset as it needs to be shared with WebKit
@@ -72,8 +74,13 @@ namespace WebCore {
     typedef wxDragImage* DragImageRef;
 #elif PLATFORM(GTK)
     typedef GdkPixbuf* DragImageRef;
+<<<<<<< HEAD:WebCore/platform/DragImage.h
 #elif PLATFORM(ANDROID)
     typedef void* DragImageRef;
+=======
+#elif PLATFORM(HAIKU)
+    typedef BBitmap* DragImageRef;
+>>>>>>> webkit.org at 49305:WebCore/platform/DragImage.h
 #endif
     
     IntSize dragImageSize(DragImageRef);
diff --git a/WebCore/platform/FileSystem.h b/WebCore/platform/FileSystem.h
index e23b6da..958eb73 100644
--- a/WebCore/platform/FileSystem.h
+++ b/WebCore/platform/FileSystem.h
@@ -170,6 +170,10 @@ char* filenameFromString(const String&);
 String filenameForDisplay(const String&);
 #endif
 
+#if PLATFORM(CHROMIUM)
+String pathGetDisplayFileName(const String&);
+#endif
+
 } // namespace WebCore
 
 #endif // FileSystem_h
diff --git a/WebCore/platform/HostWindow.h b/WebCore/platform/HostWindow.h
index 3a024de..80f6bdc 100644
--- a/WebCore/platform/HostWindow.h
+++ b/WebCore/platform/HostWindow.h
@@ -48,12 +48,15 @@ public:
     virtual IntPoint screenToWindow(const IntPoint&) const = 0;
     virtual IntRect windowToScreen(const IntRect&) const = 0;
 
-    // Method for retrieving the native window.
-    virtual PlatformWidget platformWindow() const = 0;
+    // Method for retrieving the native client of the page.
+    virtual PlatformPageClient platformPageClient() const = 0;
     
     // For scrolling a rect into view recursively.  Useful in the cases where a WebView is embedded inside some containing
     // platform-specific ScrollView.
     virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0;
+
+    // To notify WebKit of scrollbar mode changes.
+    virtual void scrollbarsModeDidChange() const = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index ec8c55c..ffacc19 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -302,13 +302,13 @@ void KURL::invalidate()
     m_fragmentEnd = 0;
 }
 
-KURL::KURL(const char* url)
+KURL::KURL(ParsedURLStringTag, const char* url)
 {
     parse(url, 0);
     ASSERT(url == m_string);
 }
 
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     parse(url);
     ASSERT(url == m_string);
@@ -529,7 +529,7 @@ void KURL::init(const KURL& base, const String& relative, const TextEncoding& en
 KURL KURL::copy() const
 {
     KURL result = *this;
-    result.m_string = result.m_string.copy();
+    result.m_string = result.m_string.crossThreadString();
     return result;
 }
 
@@ -1641,7 +1641,7 @@ String mimeTypeFromDataURL(const String& url)
 
 const KURL& blankURL()
 {
-    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, ("about:blank"));
+    DEFINE_STATIC_LOCAL(KURL, staticBlankURL, (ParsedURLString, "about:blank"));
     return staticBlankURL;
 }
 
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index 0809f7e..73fadd1 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -55,15 +55,18 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
+enum ParsedURLStringTag { ParsedURLString };
+
 class KURL {
 public:
     // Generates a URL which contains a null string.
     KURL() { invalidate(); }
 
-    // The argument is an absolute URL string. The string is assumed to be
-    // an already encoded (ASCII-only) valid absolute URL.
-    explicit KURL(const char*);
-    explicit KURL(const String&);
+    // The argument is an absolute URL string. The string is assumed to be output of KURL::string() called on a valid
+    // KURL object, or indiscernible from such.
+    // It is usually best to avoid repeatedly parsing a string, unless memory saving outweigh the possible slow-downs.
+    KURL(ParsedURLStringTag, const char*);
+    KURL(ParsedURLStringTag, const String&);
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index 1cb08c1..b323332 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -331,7 +331,7 @@ const String& KURLGooglePrivate::string() const
 // Creates with NULL-terminated string input representing an absolute URL.
 // WebCore generally calls this only with hardcoded strings, so the input is
 // ASCII. We treat is as UTF-8 just in case.
-KURL::KURL(const char *url)
+KURL::KURL(ParsedURLStringTag, const char *url)
 {
     // FIXME The Mac code checks for beginning with a slash and converting to a
     // file: URL. We will want to add this as well once we can compile on a
@@ -349,7 +349,7 @@ KURL::KURL(const char *url)
 // to a string and then converted back. In this case, the URL is already
 // canonical and in proper escaped form so needs no encoding. We treat it was
 // UTF-8 just in case.
-KURL::KURL(const String& url)
+KURL::KURL(ParsedURLStringTag, const String& url)
 {
     if (!url.isNull())
         m_url.init(KURL(), url, 0);
@@ -728,13 +728,8 @@ String decodeURLEscapeSequences(const String& str)
 // cause security holes. We never call this function for components, and
 // just return the ASCII versions instead.
 //
-// However, this static function is called directly in some cases. It appears
-// that this only happens for javascript: URLs, so this is essentially the
-// JavaScript URL decoder. It assumes UTF-8 encoding.
-//
-// IE doesn't unescape %00, forcing you to use \x00 in JS strings, so we do
-// the same. This also eliminates NULL-related problems should a consumer
-// incorrectly call this function for non-JavaScript.
+// This function is also used to decode javascript: URLs and as a general
+// purpose unescaping function.
 //
 // FIXME These should be merged to the KURL.cpp implementation.
 String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
@@ -757,15 +752,9 @@ String decodeURLEscapeSequences(const String& str, const TextEncoding& encoding)
     for (int i = 0; i < inputLength; i++) {
         if (input[i] == '%') {
             unsigned char ch;
-            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch)) {
-                if (!ch) {
-                    // Never unescape NULLs.
-                    unescaped.push_back('%');
-                    unescaped.push_back('0');
-                    unescaped.push_back('0');
-                } else
-                    unescaped.push_back(ch);
-            } else {
+            if (url_canon::DecodeEscaped(input, &i, inputLength, &ch))
+                unescaped.push_back(ch);
+            else {
                 // Invalid escape sequence, copy the percent literal.
                 unescaped.push_back('%');
             }
@@ -936,7 +925,7 @@ unsigned KURL::pathAfterLastSlash() const
 
 const KURL& blankURL()
 {
-    static KURL staticBlankURL("about:blank");
+    static KURL staticBlankURL(ParsedURLString, "about:blank");
     return staticBlankURL;
 }
 
diff --git a/WebCore/platform/KURLHash.h b/WebCore/platform/KURLHash.h
index 4deb078..7448a49 100644
--- a/WebCore/platform/KURLHash.h
+++ b/WebCore/platform/KURLHash.h
@@ -52,7 +52,7 @@ namespace WTF {
 
     template<> struct HashTraits<WebCore::KURL> : GenericHashTraits<WebCore::KURL> {
         static const bool emptyValueIsZero = true;
-        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::String(HashTableDeletedValue)); }
+        static void constructDeletedValue(WebCore::KURL& slot) { new (&slot) WebCore::KURL(WebCore::ParsedURLString, WebCore::String(HashTableDeletedValue)); }
         static bool isDeletedValue(const WebCore::KURL& slot) { return slot.string().isHashTableDeletedValue(); }
     };
 
diff --git a/WebCore/platform/LocalizedStrings.h b/WebCore/platform/LocalizedStrings.h
index 7c586d3..0fa9f71 100644
--- a/WebCore/platform/LocalizedStrings.h
+++ b/WebCore/platform/LocalizedStrings.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,7 @@ namespace WebCore {
     String fileButtonChooseFileLabel();
     String fileButtonNoFileSelectedLabel();
     String copyImageUnknownFileLabel();
+#if ENABLE(CONTEXT_MENUS)
     String contextMenuItemTagOpenLinkInNewWindow();
     String contextMenuItemTagDownloadLinkToDisk();
     String contextMenuItemTagCopyLinkToClipboard();
@@ -103,6 +104,7 @@ namespace WebCore {
     String contextMenuItemTagChangeBack(const String& replacedString);
 #endif
     String contextMenuItemTagInspectElement();
+#endif // ENABLE(CONTEXT_MENUS)
 
     String searchMenuNoRecentSearchesText();
     String searchMenuRecentSearchesText();
@@ -115,6 +117,7 @@ namespace WebCore {
     String AXHeadingText();
     String AXDefinitionListTermText();
     String AXDefinitionListDefinitionText();
+    String AXARIAContentGroupText(const String& ariaType);
     
     String AXButtonActionVerb();
     String AXRadioButtonActionVerb();
@@ -135,6 +138,9 @@ namespace WebCore {
 
     String mediaElementLoadingStateText();
     String mediaElementLiveBroadcastStateText();
+    String localizedMediaControlElementString(const String&);
+    String localizedMediaControlElementHelpText(const String&);
+    String localizedMediaTimeDescription(float);
 }
 
 #endif
diff --git a/WebCore/platform/MIMETypeRegistry.cpp b/WebCore/platform/MIMETypeRegistry.cpp
index 1819e1d..32dd3f6 100644
--- a/WebCore/platform/MIMETypeRegistry.cpp
+++ b/WebCore/platform/MIMETypeRegistry.cpp
@@ -94,7 +94,7 @@ static void initializeSupportedImageMIMETypes()
 
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (size_t i = 0; i < static_cast<size_t>(formats.size()); ++i) {
 #if ENABLE(SVG)
         /*
          * Qt has support for SVG, but we want to use KSVG2
@@ -173,7 +173,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
 #endif
 #elif PLATFORM(QT)
     QList<QByteArray> formats = QImageWriter::supportedImageFormats();
-    for (size_t i = 0; i < formats.size(); ++i) {
+    for (int i = 0; i < formats.size(); ++i) {
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
         supportedImageMIMETypesForEncoding->add(mimeType);
     }
diff --git a/WebCore/platform/Pasteboard.h b/WebCore/platform/Pasteboard.h
index 883364a..188b962 100644
--- a/WebCore/platform/Pasteboard.h
+++ b/WebCore/platform/Pasteboard.h
@@ -86,6 +86,7 @@ public:
     
     static Pasteboard* generalPasteboard();
     void writeSelection(Range*, bool canSmartCopyOrDelete, Frame*);
+    void writePlainText(const String&);
     void writeURL(const KURL&, const String&, Frame* = 0);
     void writeImage(Node*, const KURL&, const String& title);
 #if PLATFORM(MAC)
@@ -95,13 +96,14 @@ public:
     bool canSmartReplace();
     PassRefPtr<DocumentFragment> documentFragment(Frame*, PassRefPtr<Range>, bool allowPlainText, bool& chosePlainText);
     String plainText(Frame* = 0);
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool isSelectionMode() const;
     void setSelectionMode(bool selectionMode);
 #endif
 
 #if PLATFORM(GTK)
     void setHelper(PasteboardHelper*);
+    PasteboardHelper* m_helper;
 #endif
 
 private:
@@ -117,11 +119,7 @@ private:
     HWND m_owner;
 #endif
 
-#if PLATFORM(GTK)
-    PasteboardHelper* m_helper;
-#endif
-
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(CHROMIUM)
     bool m_selectionMode;
 #endif
 
diff --git a/WebCore/platform/PlatformKeyboardEvent.h b/WebCore/platform/PlatformKeyboardEvent.h
index 1499ac5..b5c2e95 100644
--- a/WebCore/platform/PlatformKeyboardEvent.h
+++ b/WebCore/platform/PlatformKeyboardEvent.h
@@ -59,6 +59,10 @@ QT_END_NAMESPACE
 class wxKeyEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class PlatformKeyboardEvent {
@@ -155,6 +159,10 @@ namespace WebCore {
         PlatformKeyboardEvent(wxKeyEvent&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformKeyboardEvent(BMessage*);
+#endif
+
 #if PLATFORM(WIN) || PLATFORM(CHROMIUM)
         bool isSystemKey() const { return m_isSystemKey; }
 #endif
diff --git a/WebCore/platform/PlatformMenuDescription.h b/WebCore/platform/PlatformMenuDescription.h
index ab71710..c986207 100644
--- a/WebCore/platform/PlatformMenuDescription.h
+++ b/WebCore/platform/PlatformMenuDescription.h
@@ -40,6 +40,8 @@ typedef struct HMENU__* HMENU;
 typedef struct _GtkMenu GtkMenu;
 #elif PLATFORM(WX)
 class wxMenu;
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -58,6 +60,8 @@ namespace WebCore {
     typedef void* PlatformMenuDescription;
 #elif PLATFORM(WX)
     typedef wxMenu* PlatformMenuDescription;
+#elif PLATFORM(HAIKU)
+    typedef BMenu* PlatformMenuDescription;
 #else
     typedef void* PlatformMenuDescription;
 #endif
diff --git a/WebCore/platform/PlatformMouseEvent.h b/WebCore/platform/PlatformMouseEvent.h
index 2543d40..99acc63 100644
--- a/WebCore/platform/PlatformMouseEvent.h
+++ b/WebCore/platform/PlatformMouseEvent.h
@@ -36,6 +36,7 @@ typedef struct _GdkEventMotion GdkEventMotion;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QInputEvent;
+class QGraphicsSceneMouseEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -50,6 +51,10 @@ typedef long LPARAM;
 class wxMouseEvent;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
     
     // These button numbers match the ones used in the DOM API, 0 through 2, except for NoButton which isn't specified.
@@ -116,6 +121,7 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformMouseEvent(QInputEvent*, int clickCount);
+        PlatformMouseEvent(QGraphicsSceneMouseEvent*, int clickCount);
 #endif
 
 #if PLATFORM(WIN)
@@ -128,6 +134,10 @@ namespace WebCore {
         PlatformMouseEvent(const wxMouseEvent&, const wxPoint& globalPoint, int clickCount);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformMouseEvent(const BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/WebCore/platform/PlatformWheelEvent.h b/WebCore/platform/PlatformWheelEvent.h
index ae8df4e..9a4a0cb 100644
--- a/WebCore/platform/PlatformWheelEvent.h
+++ b/WebCore/platform/PlatformWheelEvent.h
@@ -35,6 +35,7 @@ typedef struct _GdkEventScroll GdkEventScroll;
 #if PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QWheelEvent;
+class QGraphicsSceneWheelEvent;
 QT_END_NAMESPACE
 #endif
 
@@ -49,6 +50,10 @@ class wxMouseEvent;
 class wxPoint;
 #endif
 
+#if PLATFORM(HAIKU)
+class BMessage;
+#endif
+
 namespace WebCore {
 
     class FloatPoint;
@@ -88,6 +93,15 @@ namespace WebCore {
         void accept() { m_isAccepted = true; }
         void ignore() { m_isAccepted = false; }
 
+        void turnVerticalTicksIntoHorizontal()
+        {
+            m_deltaX = m_deltaY;
+            m_deltaY = 0;
+
+            m_wheelTicksX = m_wheelTicksY;
+            m_wheelTicksY = 0;
+        }
+
 #if PLATFORM(GTK)
         PlatformWheelEvent(GdkEventScroll*);
 #endif
@@ -98,6 +112,8 @@ namespace WebCore {
 
 #if PLATFORM(QT)
         PlatformWheelEvent(QWheelEvent*);
+        PlatformWheelEvent(QGraphicsSceneWheelEvent*);
+        void applyDelta(int delta, Qt::Orientation);
 #endif
 
 #if PLATFORM(WIN)
@@ -109,6 +125,10 @@ namespace WebCore {
         PlatformWheelEvent(const wxMouseEvent&, const wxPoint&);
 #endif
 
+#if PLATFORM(HAIKU)
+        PlatformWheelEvent(BMessage*);
+#endif
+
     protected:
         IntPoint m_position;
         IntPoint m_globalPosition;
diff --git a/WebCore/platform/PopupMenu.h b/WebCore/platform/PopupMenu.h
index fc85d60..2315f02 100644
--- a/WebCore/platform/PopupMenu.h
+++ b/WebCore/platform/PopupMenu.h
@@ -59,6 +59,8 @@ class wxMenu;
 #include <wx/event.h>
 #elif PLATFORM(CHROMIUM)
 #include "PopupMenuPrivate.h"
+#elif PLATFORM(HAIKU)
+class BMenu;
 #endif
 
 namespace WebCore {
@@ -92,6 +94,8 @@ public:
 #if PLATFORM(WIN)
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
 
+    static LPCTSTR popupClassName();
+
     bool up(unsigned lines = 1);
     bool down(unsigned lines = 1);
 
@@ -153,6 +157,10 @@ private:
     void calculatePositionAndSize(const IntRect&, FrameView*);
     void invalidateItem(int index);
 
+    static LRESULT CALLBACK PopupMenuWndProc(HWND, UINT, WPARAM, LPARAM);
+    LRESULT wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam);
+    static void registerClass();
+
     RefPtr<Scrollbar> m_scrollbar;
     HWND m_popup;
     HDC m_DC;
@@ -164,6 +172,7 @@ private:
     int m_wheelDelta;
     int m_focusedIndex;
     bool m_scrollbarCapturingMouse;
+    bool m_showPopup;
 #elif PLATFORM(GTK)
     IntPoint m_menuPosition;
     GtkMenu* m_popup;
@@ -177,6 +186,8 @@ private:
     void OnMenuItemSelected(wxCommandEvent&);
 #elif PLATFORM(CHROMIUM)
     PopupMenuPrivate p;
+#elif PLATFORM(HAIKU)
+    BMenu* m_menu;
 #endif
 
 };
diff --git a/WebCore/platform/PopupMenuClient.h b/WebCore/platform/PopupMenuClient.h
index 2a9625b..2614fe2 100644
--- a/WebCore/platform/PopupMenuClient.h
+++ b/WebCore/platform/PopupMenuClient.h
@@ -49,7 +49,7 @@ public:
     virtual int clientPaddingRight() const = 0;
     virtual int listSize() const = 0;
     virtual int selectedIndex() const = 0;
-    virtual void hidePopup() = 0;
+    virtual void popupDidHide() = 0;
     virtual bool itemIsSeparator(unsigned listIndex) const = 0;
     virtual bool itemIsLabel(unsigned listIndex) const = 0;
     virtual bool itemIsSelected(unsigned listIndex) const = 0;
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 54fa998..8c4b115 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -83,6 +83,7 @@ void ScrollView::setHasHorizontalScrollbar(bool hasBar)
     if (hasBar && !m_horizontalScrollbar) {
         m_horizontalScrollbar = createScrollbar(HorizontalScrollbar);
         addChild(m_horizontalScrollbar.get());
+        m_horizontalScrollbar->styleChanged();
     } else if (!hasBar && m_horizontalScrollbar) {
         removeChild(m_horizontalScrollbar.get());
         m_horizontalScrollbar = 0;
@@ -94,6 +95,7 @@ void ScrollView::setHasVerticalScrollbar(bool hasBar)
     if (hasBar && !m_verticalScrollbar) {
         m_verticalScrollbar = createScrollbar(VerticalScrollbar);
         addChild(m_verticalScrollbar.get());
+        m_verticalScrollbar->styleChanged();
     } else if (!hasBar && m_verticalScrollbar) {
         removeChild(m_verticalScrollbar.get());
         m_verticalScrollbar = 0;
@@ -105,7 +107,6 @@ PassRefPtr<Scrollbar> ScrollView::createScrollbar(ScrollbarOrientation orientati
 {
     return Scrollbar::createNativeScrollbar(this, orientation, RegularScrollbar);
 }
-#endif
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
 {
@@ -118,6 +119,7 @@ void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode v
     else
         updateScrollbars(scrollOffset());
 }
+#endif
 
 void ScrollView::scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const
 {
@@ -332,6 +334,15 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     if (m_inUpdateScrollbars || prohibitsScrolling() || platformWidget())
         return;
 
+    // If we came in here with the view already needing a layout, then go ahead and do that
+    // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
+    // This layout will not re-enter updateScrollbars and does not count towards our max layout pass total.
+    if (!m_scrollbarsSuppressed) {
+        m_inUpdateScrollbars = true;
+        visibleContentsResized();
+        m_inUpdateScrollbars = false;
+    }
+
     bool hasHorizontalScrollbar = m_horizontalScrollbar;
     bool hasVerticalScrollbar = m_verticalScrollbar;
     
@@ -352,13 +363,6 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
         if (hasVerticalScrollbar != newHasVerticalScrollbar)
             setHasVerticalScrollbar(newHasVerticalScrollbar);
     } else {
-        // If we came in here with the view already needing a layout, then go ahead and do that
-        // first.  (This will be the common case, e.g., when the page changes due to window resizing for example).
-        // This layout will not re-enter updateScrollers and does not count towards our max layout pass total.
-        m_inUpdateScrollbars = true;
-        visibleContentsResized();
-        m_inUpdateScrollbars = false;
-
         bool sendContentResizedNotification = false;
         
         IntSize docSize = contentsSize();
@@ -465,8 +469,10 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
             m_verticalScrollbar->setSuppressInvalidation(false);
     }
 
-    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0))
+    if (hasHorizontalScrollbar != (m_horizontalScrollbar != 0) || hasVerticalScrollbar != (m_verticalScrollbar != 0)) {
         frameRectsChanged();
+        updateScrollCorner();
+    }
 
     // See if our offset has changed in a situation where we might not have scrollbars.
     // This can happen when editing a body with overflow:hidden and scrolling to reveal selection.
@@ -481,7 +487,7 @@ void ScrollView::updateScrollbars(const IntSize& desiredOffset)
     m_inUpdateScrollbars = false;
 }
 
-const int panIconSizeLength = 20;
+const int panIconSizeLength = 16;
 
 void ScrollView::scrollContents(const IntSize& scrollDelta)
 {
@@ -626,23 +632,7 @@ void ScrollView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppre
             m_verticalScrollbar->invalidate();
 
         // Invalidate the scroll corner too on unsuppress.
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            invalidateRect(hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner)
-                invalidateRect(vCorner);
-        }
+        invalidateRect(scrollCornerRect());
     }
 }
 
@@ -722,16 +712,48 @@ void ScrollView::frameRectsChanged()
 
 void ScrollView::repaintContentRectangle(const IntRect& rect, bool now)
 {
-    if (rect.isEmpty())
+    IntRect visibleContent = visibleContentRect();
+    visibleContent.intersect(rect);
+    if (visibleContent.isEmpty())
         return;
 
     if (platformWidget()) {
-        platformRepaintContentRectangle(rect, now);
+        platformRepaintContentRectangle(visibleContent, now);
         return;
     }
 
     if (hostWindow())
-        hostWindow()->repaint(contentsToWindow(rect), true, now);
+        hostWindow()->repaint(contentsToWindow(visibleContent), true, now);
+}
+
+IntRect ScrollView::scrollCornerRect() const
+{
+    IntRect cornerRect;
+    
+    if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
+        cornerRect.unite(IntRect(m_horizontalScrollbar->width(),
+                                 height() - m_horizontalScrollbar->height(),
+                                 width() - m_horizontalScrollbar->width(),
+                                 m_horizontalScrollbar->height()));
+    }
+
+    if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
+        cornerRect.unite(IntRect(width() - m_verticalScrollbar->width(),
+                                 m_verticalScrollbar->height(),
+                                 m_verticalScrollbar->width(),
+                                 height() - m_verticalScrollbar->height()));
+    }
+    
+    return cornerRect;
+}
+
+void ScrollView::updateScrollCorner()
+{
+}
+
+void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& cornerRect)
+{
+    ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, cornerRect);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
@@ -773,25 +795,7 @@ void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
         if (m_verticalScrollbar)
             m_verticalScrollbar->paint(context, scrollViewDirtyRect);
 
-        IntRect hCorner;
-        if (m_horizontalScrollbar && width() - m_horizontalScrollbar->width() > 0) {
-            hCorner = IntRect(m_horizontalScrollbar->width(),
-                              height() - m_horizontalScrollbar->height(),
-                              width() - m_horizontalScrollbar->width(),
-                              m_horizontalScrollbar->height());
-            if (hCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, hCorner);
-        }
-
-        if (m_verticalScrollbar && height() - m_verticalScrollbar->height() > 0) {
-            IntRect vCorner(width() - m_verticalScrollbar->width(),
-                            m_verticalScrollbar->height(),
-                            m_verticalScrollbar->width(),
-                            height() - m_verticalScrollbar->height());
-            if (vCorner != hCorner && vCorner.intersects(scrollViewDirtyRect))
-                ScrollbarTheme::nativeTheme()->paintScrollCorner(this, context, vCorner);
-        }
-
+        paintScrollCorner(context, scrollCornerRect());
         context->restore();
     }
 
diff --git a/WebCore/platform/ScrollView.h b/WebCore/platform/ScrollView.h
index 88e2564..ef3d03d 100644
--- a/WebCore/platform/ScrollView.h
+++ b/WebCore/platform/ScrollView.h
@@ -89,7 +89,7 @@ public:
     void scrollbarModes(ScrollbarMode& horizontalMode, ScrollbarMode& verticalMode) const;
     ScrollbarMode horizontalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return horizontal; }
     ScrollbarMode verticalScrollbarMode() const { ScrollbarMode horizontal, vertical; scrollbarModes(horizontal, vertical); return vertical; }
-    virtual void setCanHaveScrollbars(bool flag);
+    void setCanHaveScrollbars(bool flag);
     bool canHaveScrollbars() const { return horizontalScrollbarMode() != ScrollbarAlwaysOff || verticalScrollbarMode() != ScrollbarAlwaysOff; }
 
     // Overridden by FrameView to create custom CSS scrollbars if applicable.
@@ -239,6 +239,10 @@ protected:
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
 
+    IntRect scrollCornerRect() const;
+    virtual void updateScrollCorner();
+    virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    
 private:
     RefPtr<Scrollbar> m_horizontalScrollbar;
     RefPtr<Scrollbar> m_verticalScrollbar;
diff --git a/WebCore/platform/Scrollbar.cpp b/WebCore/platform/Scrollbar.cpp
index 4574f63..4eb2c4a 100644
--- a/WebCore/platform/Scrollbar.cpp
+++ b/WebCore/platform/Scrollbar.cpp
@@ -392,9 +392,9 @@ void Scrollbar::setFrameRect(const IntRect& rect)
     // Get our window resizer rect and see if we overlap.  Adjust to avoid the overlap
     // if necessary.
     IntRect adjustedRect(rect);
-    if (parent()) {
-        bool overlapsResizer = false;
-        ScrollView* view = parent();
+    bool overlapsResizer = false;
+    ScrollView* view = parent();
+    if (view && !rect.isEmpty() && !view->windowResizerRect().isEmpty()) {
         IntRect resizerRect = view->convertFromContainingWindow(view->windowResizerRect());
         if (rect.intersects(resizerRect)) {
             if (orientation() == HorizontalScrollbar) {
@@ -411,11 +411,11 @@ void Scrollbar::setFrameRect(const IntRect& rect)
                 }
             }
         }
-
-        if (overlapsResizer != m_overlapsResizer) {
-            m_overlapsResizer = overlapsResizer;
+    }
+    if (overlapsResizer != m_overlapsResizer) {
+        m_overlapsResizer = overlapsResizer;
+        if (view)
             view->adjustScrollbarsAvoidingResizerCount(m_overlapsResizer ? 1 : -1);
-        }
     }
 
     Widget::setFrameRect(adjustedRect);
diff --git a/WebCore/platform/StaticConstructors.h b/WebCore/platform/StaticConstructors.h
index 26b44de..5bc792c 100644
--- a/WebCore/platform/StaticConstructors.h
+++ b/WebCore/platform/StaticConstructors.h
@@ -56,6 +56,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     const type name;
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    const type name;
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     const type name;
@@ -67,6 +70,9 @@
 #if COMPILER(MSVC7)
 #define DEFINE_GLOBAL(type, name) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
+#elif COMPILER(WINSCW)
+#define DEFINE_GLOBAL(type, name, arg...) \
+    void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
 #else
 #define DEFINE_GLOBAL(type, name, ...) \
     void * name[(sizeof(type) + sizeof(void *) - 1) / sizeof(void *)];
diff --git a/WebCore/platform/ThemeTypes.h b/WebCore/platform/ThemeTypes.h
index b763675..e132313 100644
--- a/WebCore/platform/ThemeTypes.h
+++ b/WebCore/platform/ThemeTypes.h
@@ -46,12 +46,11 @@ typedef unsigned ControlStates;
 // Must follow CSSValueKeywords.in order
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
-    ButtonBevelPart, DefaultButtonPart, ListboxPart, ListItemPart, 
+    ButtonBevelPart, DefaultButtonPart, ListButtonPart, ListboxPart, ListItemPart,
     MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart,
-    MediaSliderPart,
-    MediaSliderThumbPart, MediaControlsBackgroundPart,
-    MediaCurrentTimePart, MediaTimeRemainingPart,
+    MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
+    MediaControlsBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
     MenulistPart, MenulistButtonPart, MenulistTextPart, MenulistTextFieldPart,
     SliderHorizontalPart, SliderVerticalPart, SliderThumbHorizontalPart,
     SliderThumbVerticalPart, CaretPart, SearchFieldPart, SearchFieldDecorationPart,
diff --git a/WebCore/platform/ThreadTimers.cpp b/WebCore/platform/ThreadTimers.cpp
index 71a06b0..3ae8207 100644
--- a/WebCore/platform/ThreadTimers.cpp
+++ b/WebCore/platform/ThreadTimers.cpp
@@ -34,6 +34,11 @@
 
 namespace WebCore {
 
+// Fire timers for this length of time, and then quit to let the run loop process user input events.
+// 100ms is about a perceptable delay in UI, so use a half of that as a threshold.
+// This is to prevent UI freeze when there are too many timers or machine performance is low.
+static const double maxDurationOfFiringTimers = 0.050;
+
 // Timers are created, started and fired on the same thread, and each thread has its own ThreadTimers
 // copy to keep the heap and a set of currently firing timers.
 
@@ -79,43 +84,6 @@ void ThreadTimers::updateSharedTimer()
         m_sharedTimer->setFireTime(m_timerHeap.first()->m_nextFireTime);
 }
 
-
-void ThreadTimers::collectFiringTimers(double fireTime, Vector<TimerBase*>& firingTimers)
-{
-    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
-        TimerBase* timer = m_timerHeap.first();
-        firingTimers.append(timer);
-        m_timersReadyToFire.add(timer);
-        timer->m_nextFireTime = 0;
-        timer->heapDeleteMin();
-    }
-}
-
-void ThreadTimers::fireTimers(double fireTime, const Vector<TimerBase*>& firingTimers)
-{
-    size_t size = firingTimers.size();
-    for (size_t i = 0; i != size; ++i) {
-        TimerBase* timer = firingTimers[i];
-
-        // If not in the set, this timer has been deleted or re-scheduled in another timer's fired function.
-        // So either we don't want to fire it at all or we will fire it next time the shared timer goes off.
-        // It might even have been deleted; that's OK because we won't do anything else with the pointer.
-        if (!m_timersReadyToFire.contains(timer))
-            continue;
-
-        // Setting the next fire time has a side effect of removing the timer from the firing timers set.
-        double interval = timer->repeatInterval();
-        timer->setNextFireTime(interval ? fireTime + interval : 0);
-
-        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
-        timer->fired();
-
-        // Catch the case where the timer asked timers to fire in a nested event loop.
-        if (!m_firingTimers)
-            break;
-    }
-}
-
 void ThreadTimers::sharedTimerFired()
 {
     // Redirect to non-static method.
@@ -130,17 +98,24 @@ void ThreadTimers::sharedTimerFiredInternal()
     m_firingTimers = true;
 
     double fireTime = currentTime();
-    Vector<TimerBase*> firingTimers;
+    double timeToQuit = fireTime + maxDurationOfFiringTimers;
 
-    // m_timersReadyToFire will initially contain the same set as firingTimers, but
-    // as timers fire some mat become re-scheduled or deleted. They get removed from
-    // m_timersReadyToFire so we can avoid firing them.
-    ASSERT(m_timersReadyToFire.isEmpty());
+    while (!m_timerHeap.isEmpty() && m_timerHeap.first()->m_nextFireTime <= fireTime) {
+        TimerBase* timer = m_timerHeap.first();
+        timer->m_nextFireTime = 0;
+        timer->heapDeleteMin();
 
-    collectFiringTimers(fireTime, firingTimers);
-    fireTimers(fireTime, firingTimers);
+        double interval = timer->repeatInterval();
+        timer->setNextFireTime(interval ? fireTime + interval : 0);
+
+        // Once the timer has been fired, it may be deleted, so do nothing else with it after this point.
+        timer->fired();
+
+        // Catch the case where the timer asked timers to fire in a nested event loop, or we are over time limit.
+        if (!m_firingTimers || timeToQuit < currentTime())
+            break;
+    }
 
-    m_timersReadyToFire.clear();
     m_firingTimers = false;
 
     updateSharedTimer();
@@ -150,7 +125,6 @@ void ThreadTimers::fireTimersInNestedEventLoop()
 {
     // Reset the reentrancy guard so the timers can fire again.
     m_firingTimers = false;
-    m_timersReadyToFire.clear();
     updateSharedTimer();
 }
 
diff --git a/WebCore/platform/ThreadTimers.h b/WebCore/platform/ThreadTimers.h
index ea0a366..01b4c71 100644
--- a/WebCore/platform/ThreadTimers.h
+++ b/WebCore/platform/ThreadTimers.h
@@ -45,7 +45,6 @@ namespace WebCore {
         void setSharedTimer(SharedTimer*);
 
         Vector<TimerBase*>& timerHeap() { return m_timerHeap; }
-        HashSet<const TimerBase*>& timersReadyToFire() { return m_timersReadyToFire; }
 
         void updateSharedTimer();
         void fireTimersInNestedEventLoop();
@@ -53,13 +52,10 @@ namespace WebCore {
     private:
         static void sharedTimerFired();
 
-        void fireTimers(double fireTime, const Vector<TimerBase*>&);
-        void collectFiringTimers(double fireTime, Vector<TimerBase*>&);
         void sharedTimerFiredInternal();
         void fireTimersInNestedEventLoopInternal();
 
         Vector<TimerBase*> m_timerHeap;
-        HashSet<const TimerBase*> m_timersReadyToFire; // Temporarily holds a pointer to a stack object. No ownership.
         SharedTimer* m_sharedTimer; // External object, can be a run loop on a worker thread. Normally set/reset by worker thread.
         bool m_firingTimers; // Reentrancy guard.
     };
diff --git a/WebCore/platform/Timer.cpp b/WebCore/platform/Timer.cpp
index bd29fd8..539846c 100644
--- a/WebCore/platform/Timer.cpp
+++ b/WebCore/platform/Timer.cpp
@@ -53,11 +53,6 @@ static Vector<TimerBase*>& timerHeap()
     return threadGlobalData().threadTimers().timerHeap();
 }
 
-static HashSet<const TimerBase*>& timersReadyToFire()
-{
-    return threadGlobalData().threadTimers().timersReadyToFire();
-}
-
 // Class to represent elements in the heap when calling the standard library heap algorithms.
 // Maintains the m_heapIndex value in the timers themselves, which allows us to do efficient
 // modification of the heap.
@@ -205,7 +200,7 @@ bool TimerBase::isActive() const
 {
     ASSERT(m_thread == currentThread());
 
-    return m_nextFireTime || timersReadyToFire().contains(this);
+    return m_nextFireTime;
 }
 
 double TimerBase::nextFireInterval() const
@@ -296,9 +291,6 @@ void TimerBase::setNextFireTime(double newTime)
     ASSERT(m_thread == currentThread());
 
     // Keep heap valid while changing the next-fire time.
-
-    timersReadyToFire().remove(this);
-
     double oldTime = m_nextFireTime;
     if (oldTime != newTime) {
         m_nextFireTime = newTime;
diff --git a/WebCore/platform/TreeShared.h b/WebCore/platform/TreeShared.h
index 1ac1b33..02728ff 100644
--- a/WebCore/platform/TreeShared.h
+++ b/WebCore/platform/TreeShared.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,17 +28,8 @@ namespace WebCore {
 
 template<class T> class TreeShared : public Noncopyable {
 public:
-    TreeShared()
-        : m_refCount(0)
-        , m_parent(0)
-    {
-#ifndef NDEBUG
-        m_deletionHasBegun = false;
-        m_inRemovedLastRefFunction = false;
-#endif
-    }
-    TreeShared(T* parent)
-        : m_refCount(0)
+    TreeShared(int initialRefCount = 1)
+        : m_refCount(initialRefCount)
         , m_parent(0)
     {
 #ifndef NDEBUG
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index 4534d58..cbbc427 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -70,10 +70,22 @@ class wxWindow;
 typedef wxWindow* PlatformWidget;
 #endif
 
+#if PLATFORM(HAIKU)
+class BView;
+typedef BView* PlatformWidget;
+#endif
+
 #if PLATFORM(CHROMIUM)
 #include "PlatformWidget.h"
 #endif
 
+#if PLATFORM(QT)
+class QWebPageClient;
+typedef QWebPageClient* PlatformPageClient;
+#else
+typedef PlatformWidget PlatformPageClient;
+#endif
+
 #include "IntPoint.h"
 #include "IntRect.h"
 #include "IntSize.h"
diff --git a/WebCore/platform/android/TemporaryLinkStubs.cpp b/WebCore/platform/android/TemporaryLinkStubs.cpp
index 482565b..215c7f5 100644
--- a/WebCore/platform/android/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/android/TemporaryLinkStubs.cpp
@@ -174,6 +174,11 @@ void Pasteboard::writeSelection(Range*, bool, Frame*)
     notImplemented();
 }
 
+void Pasteboard::writePlainText(const String&)
+{
+    notImplemented();
+}
+
 void Pasteboard::writeURL(const KURL&, const String&, Frame*)
 {
     notImplemented();
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index bca8c52..1afcc23 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -67,12 +67,16 @@ namespace WebCore {
     class ChromiumBridge {
     public:
         // Clipboard ----------------------------------------------------------
-        static bool clipboardIsFormatAvailable(PasteboardPrivate::ClipboardFormat);
+        static bool clipboardIsFormatAvailable(PasteboardPrivate::ClipboardFormat, PasteboardPrivate::ClipboardBuffer);
 
-        static String clipboardReadPlainText();
-        static void clipboardReadHTML(String*, KURL*);
+        static String clipboardReadPlainText(PasteboardPrivate::ClipboardBuffer);
+        static void clipboardReadHTML(PasteboardPrivate::ClipboardBuffer, String*, KURL*);
 
+        // Only the clipboardRead functions take a buffer argument because 
+        // Chromium currently uses a different technique to write to alternate
+        // clipboard buffers.
         static void clipboardWriteSelection(const String&, const KURL&, const String&, bool);
+        static void clipboardWritePlainText(const String&);
         static void clipboardWriteURL(const KURL&, const String&);
         static void clipboardWriteImage(const NativeImageSkia*, const KURL&, const String&);
 
@@ -92,6 +96,9 @@ namespace WebCore {
         static String directoryName(const String& path);
         static String pathByAppendingComponent(const String& path, const String& component);
         static bool makeAllDirectories(const String& path);
+        static String getAbsolutePath(const String&);
+        static bool isDirectory(const String&);
+        static KURL filePathToURL(const String&);
 
         // Font ---------------------------------------------------------------
 #if PLATFORM(WIN_OS)
@@ -103,12 +110,16 @@ namespace WebCore {
 
         // Forms --------------------------------------------------------------
         static void notifyFormStateChanged(const Document*);
-        
+
         // HTML5 DB -----------------------------------------------------------
 #if ENABLE(DATABASE)
-        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags);
-        static bool databaseDeleteFile(const String& fileName);
+        // Returns a handle to the DB file and ooptionally a handle to its containing directory
+        static PlatformFileHandle databaseOpenFile(const String& fileName, int desiredFlags, PlatformFileHandle* dirHandle = 0);
+        // Returns a SQLite code (SQLITE_OK = 0, on success)
+        static int databaseDeleteFile(const String& fileName, bool syncDir = false);
+        // Returns the attributes of the DB file
         static long databaseGetFileAttributes(const String& fileName);
+        // Returns the size of the DB file
         static long long databaseGetFileSize(const String& fileName);
 #endif
 
diff --git a/WebCore/platform/chromium/ChromiumDataObject.h b/WebCore/platform/chromium/ChromiumDataObject.h
index 3e8675e..a227001 100644
--- a/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/WebCore/platform/chromium/ChromiumDataObject.h
@@ -55,7 +55,38 @@ namespace WebCore {
 
         void clear();
         bool hasData() const;
+        
+        KURL mainURL() const { return url; }
+        void setMainURL(const KURL& newURL) { url = newURL; }
 
+        String mainURLTitle() const { return urlTitle; }
+        void setMainURLTitle(const String& newURLTitle) { urlTitle = newURLTitle; }
+
+        String textPlain() const { return plainText; }
+        void setTextPlain(const String& newText) { plainText = newText; }
+
+        String textHTML() const { return textHtml; }
+        void setTextHTML(const String& newText) { textHtml = newText; }
+
+        KURL htmlBaseURL() const { return htmlBaseUrl; }
+        void setHTMLBaseURL(const KURL& newURL) { htmlBaseUrl = newURL; }
+
+        SharedBuffer* content() const { return fileContent.get(); }
+        PassRefPtr<SharedBuffer> releaseContent() { return fileContent.release(); }
+        void setContent(PassRefPtr<SharedBuffer> newContent) { fileContent = newContent; }
+
+        String contentFileExtension() const { return fileExtension; }
+        void setContentFileExtension(const String& newFileExtension) { fileExtension = newFileExtension; }
+
+        String contentFileName() const { return fileContentFilename; }
+        void setContentFileName(const String& newFilename) { fileContentFilename = newFilename; }
+
+        const Vector<String>& fileNames() const { return filenames; }
+        void setFileNames(const Vector<String>& newFilenames) { filenames = newFilenames; }
+        void takeFileNames(Vector<String>& newFilenames) { filenames.swap(newFilenames); }
+
+        // Interim state: All members will become private, do NOT access them directly! 
+        // Rather use the above accessor methods (or devise new ones if necessary).
         KURL url;
         String urlTitle;
 
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index 4050294..d330d3b 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -40,6 +40,7 @@
 #include "MIMETypeRegistry.h"
 #include "markup.h"
 #include "NamedNodeMap.h"
+#include "Pasteboard.h"
 #include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
@@ -92,6 +93,7 @@ void ClipboardChromium::clearData(const String& type)
         m_dataObject->url = KURL();
         m_dataObject->urlTitle = "";
     }
+
     if (dataType == ClipboardDataTypeText)
         m_dataObject->plainText = "";
 }
@@ -116,7 +118,11 @@ String ClipboardChromium::getData(const String& type, bool& success) const
         if (!isForDragging()) {
             // If this isn't for a drag, it's for a cut/paste event handler.
             // In this case, we need to check the clipboard.
-            text = ChromiumBridge::clipboardReadPlainText();
+            PasteboardPrivate::ClipboardBuffer buffer = 
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer : 
+                PasteboardPrivate::StandardBuffer;
+            text = ChromiumBridge::clipboardReadPlainText(buffer);
             success = !text.isEmpty();
         } else if (!m_dataObject->plainText.isEmpty()) {
             success = true;
@@ -142,7 +148,7 @@ bool ClipboardChromium::setData(const String& type, const String& data)
     ClipboardDataType winType = clipboardTypeFromMIMEType(type);
 
     if (winType == ClipboardDataTypeURL) {
-        m_dataObject->url = KURL(data);
+        m_dataObject->url = KURL(ParsedURLString, data);
         return m_dataObject->url.isValid();
     }
 
@@ -150,6 +156,7 @@ bool ClipboardChromium::setData(const String& type, const String& data)
         m_dataObject->plainText = data;
         return true;
     }
+    
     return false;
 }
 
@@ -163,6 +170,9 @@ HashSet<String> ClipboardChromium::types() const
     if (!m_dataObject)
         return results;
 
+    if (!m_dataObject->filenames.isEmpty())
+        results.add("Files");
+
     if (m_dataObject->url.isValid()) {
         results.add("URL");
         results.add("text/uri-list");
@@ -178,8 +188,17 @@ HashSet<String> ClipboardChromium::types() const
 
 PassRefPtr<FileList> ClipboardChromium::files() const
 {
-    notImplemented();
-    return 0;
+    if (policy() != ClipboardReadable)
+        return FileList::create();
+
+    if (!m_dataObject || m_dataObject->filenames.isEmpty())
+        return FileList::create();
+
+    RefPtr<FileList> fileList = FileList::create();
+    for (size_t i = 0; i < m_dataObject->filenames.size(); ++i)
+        fileList->append(File::create(m_dataObject->filenames.at(i)));
+
+    return fileList.release();
 }
 
 void ClipboardChromium::setDragImage(CachedImage* image, Node* node, const IntPoint& loc)
diff --git a/WebCore/platform/chromium/DragDataChromium.cpp b/WebCore/platform/chromium/DragDataChromium.cpp
index eaec025..133ba24 100644
--- a/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/WebCore/platform/chromium/DragDataChromium.cpp
@@ -30,10 +30,12 @@
 #include "config.h"
 #include "DragData.h"
 
+#include "ChromiumBridge.h"
 #include "ChromiumDataObject.h"
 #include "Clipboard.h"
 #include "ClipboardChromium.h"
 #include "DocumentFragment.h"
+#include "FileSystem.h"
 #include "KURL.h"
 #include "markup.h"
 #include "NotImplemented.h"
@@ -56,18 +58,25 @@ PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) co
 
 bool DragData::containsURL() const
 {
-    return m_platformDragData->url.isValid();
+    return !asURL().isEmpty();
 }
 
 String DragData::asURL(String* title) const
 {
-    if (!m_platformDragData->url.isValid())
-        return String();
+    String url;
+    if (m_platformDragData->url.isValid())
+        url = m_platformDragData->url.string();
+    else if (m_platformDragData->filenames.size() == 1) {
+        String fileName = m_platformDragData->filenames[0];
+        fileName = ChromiumBridge::getAbsolutePath(fileName);
+        if (fileExists(fileName) && !ChromiumBridge::isDirectory(fileName))
+            url = ChromiumBridge::filePathToURL(fileName).string();
+    }
  
     // |title| can be NULL
     if (title)
         *title = m_platformDragData->urlTitle;
-    return m_platformDragData->url.string();
+    return url;
 }
 
 bool DragData::containsFiles() const
@@ -112,7 +121,8 @@ bool DragData::containsCompatibleContent() const
     return containsPlainText()
         || containsURL()
         || containsHTML(m_platformDragData)
-        || containsColor();
+        || containsColor()
+        || containsFiles();
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
diff --git a/WebCore/platform/chromium/FileChooserChromium.cpp b/WebCore/platform/chromium/FileChooserChromium.cpp
index 08d33a3..3d75b42 100644
--- a/WebCore/platform/chromium/FileChooserChromium.cpp
+++ b/WebCore/platform/chromium/FileChooserChromium.cpp
@@ -42,7 +42,7 @@ String FileChooser::basenameForWidth(const Font& font, int width) const
     if (m_filenames.isEmpty())
         string = fileButtonNoFileSelectedLabel();
     else if (m_filenames.size() == 1)
-        string = pathGetFileName(m_filenames[0]);
+        string = pathGetDisplayFileName(m_filenames[0]);
     else
         return StringTruncator::rightTruncate(multipleFileUploadText(m_filenames.size()), width, font, false);
 
diff --git a/WebCore/platform/chromium/FileSystemChromiumLinux.cpp b/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
index e388dee..24f8da5 100644
--- a/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
+++ b/WebCore/platform/chromium/FileSystemChromiumLinux.cpp
@@ -38,4 +38,9 @@ String pathGetFileName(const String& path)
     return path.substring(path.reverseFind('/') + 1);
 }
 
+String pathGetDisplayFileName(const String& path)
+{
+    return pathGetFileName(path);
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/FileSystemChromiumMac.mm b/WebCore/platform/chromium/FileSystemChromiumMac.mm
index 7e880e1..29563de 100644
--- a/WebCore/platform/chromium/FileSystemChromiumMac.mm
+++ b/WebCore/platform/chromium/FileSystemChromiumMac.mm
@@ -38,6 +38,11 @@ namespace WebCore {
 
 String pathGetFileName(const String& path)
 {
+    return [path lastPathComponent];
+}
+
+String pathGetDisplayFileName(const String& path)
+{
     return [[NSFileManager defaultManager] displayNameAtPath:path];
 }
 
diff --git a/WebCore/platform/chromium/FileSystemChromiumWin.cpp b/WebCore/platform/chromium/FileSystemChromiumWin.cpp
index 704c39a..0e605dc 100644
--- a/WebCore/platform/chromium/FileSystemChromiumWin.cpp
+++ b/WebCore/platform/chromium/FileSystemChromiumWin.cpp
@@ -41,4 +41,9 @@ String pathGetFileName(const String& path)
     return String(PathFindFileName(String(path).charactersWithNullTermination()));
 }
 
+String pathGetDisplayFileName(const String& path)
+{
+    return pathGetFileName(path);
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
index 4fc7f32..5950de1 100644
--- a/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
+++ b/WebCore/platform/chromium/KeyCodeConversionGtk.cpp
@@ -357,6 +357,31 @@ int windowsKeyCodeForKeyEvent(unsigned keycode)
         // VKEY_NONAME (FC) Reserved for future use
         // VKEY_PA1 (FD) PA1 key
         // VKEY_OEM_CLEAR (FE) Clear key
+    case GDK_F1:
+    case GDK_F2:
+    case GDK_F3:
+    case GDK_F4:
+    case GDK_F5:
+    case GDK_F6:
+    case GDK_F7:
+    case GDK_F8:
+    case GDK_F9:
+    case GDK_F10:
+    case GDK_F11:
+    case GDK_F12:
+    case GDK_F13:
+    case GDK_F14:
+    case GDK_F15:
+    case GDK_F16:
+    case GDK_F17:
+    case GDK_F18:
+    case GDK_F19:
+    case GDK_F20:
+    case GDK_F21:
+    case GDK_F22:
+    case GDK_F23:
+    case GDK_F24:
+        return VKEY_F1 + (keycode - GDK_F1);
     default:
         return 0;
     }
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index c5dee82..7702730 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -59,6 +59,7 @@ Pasteboard* Pasteboard::generalPasteboard()
 }
 
 Pasteboard::Pasteboard()
+    : m_selectionMode(false)
 {
 }
 
@@ -68,6 +69,16 @@ void Pasteboard::clear()
     // previous contents.
 }
 
+bool Pasteboard::isSelectionMode() const
+{
+    return m_selectionMode;
+}
+
+void Pasteboard::setSelectionMode(bool selectionMode)
+{
+    m_selectionMode = selectionMode;
+}
+
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     String html = createMarkup(selectedRange, 0, AnnotateForInterchange);
@@ -85,6 +96,17 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     ChromiumBridge::clipboardWriteSelection(html, url, plainText, canSmartCopyOrDelete);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+#if PLATFORM(WIN_OS)
+    String plainText(text);
+    replaceNewlinesWithWindowsStyleNewlines(plainText);
+    ChromiumBridge::clipboardWritePlainText(plainText);
+#else
+    ChromiumBridge::clipboardWritePlainText(text);
+#endif
+}
+
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
     ASSERT(!url.isEmpty());
@@ -134,23 +156,23 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String& title)
 
 bool Pasteboard::canSmartReplace()
 {
-    return ChromiumBridge::clipboardIsFormatAvailable(
-        PasteboardPrivate::WebSmartPasteFormat);
+    return ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::WebSmartPasteFormat, m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer);
 }
 
 String Pasteboard::plainText(Frame* frame)
 {
-    return ChromiumBridge::clipboardReadPlainText();
+    return ChromiumBridge::clipboardReadPlainText(m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer);
 }
 
 PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
 {
     chosePlainText = false;
+    PasteboardPrivate::ClipboardBuffer buffer = m_selectionMode ? PasteboardPrivate::SelectionBuffer : PasteboardPrivate::StandardBuffer;
 
-    if (ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::HTMLFormat)) {
+    if (ChromiumBridge::clipboardIsFormatAvailable(PasteboardPrivate::HTMLFormat, buffer)) {
         String markup;
         KURL srcURL;
-        ChromiumBridge::clipboardReadHTML(&markup, &srcURL);
+        ChromiumBridge::clipboardReadHTML(buffer, &markup, &srcURL);
 
         RefPtr<DocumentFragment> fragment =
             createFragmentFromMarkup(frame->document(), markup, srcURL);
@@ -159,7 +181,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     }
 
     if (allowPlainText) {
-        String markup = ChromiumBridge::clipboardReadPlainText();
+        String markup = ChromiumBridge::clipboardReadPlainText(buffer);
         if (!markup.isEmpty()) {
             chosePlainText = true;
 
diff --git a/WebCore/platform/chromium/PasteboardPrivate.h b/WebCore/platform/chromium/PasteboardPrivate.h
index 26d45a0..95cc697 100644
--- a/WebCore/platform/chromium/PasteboardPrivate.h
+++ b/WebCore/platform/chromium/PasteboardPrivate.h
@@ -41,6 +41,10 @@ namespace WebCore {
             BookmarkFormat,
             WebSmartPasteFormat,
         };
+        enum ClipboardBuffer {
+            StandardBuffer,
+            SelectionBuffer,
+        };
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index 51ed6ce..d6f895d 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -50,6 +50,7 @@
 #include "PopupMenu.h"
 #include "RenderTheme.h"
 #include "ScrollbarTheme.h"
+#include "StringTruncator.h"
 #include "SystemTime.h"
 
 #include <wtf/CurrentTime.h>
@@ -72,10 +73,13 @@ static const TimeStamp kTypeAheadTimeoutMs = 1000;
 // The settings used for the drop down menu.
 // This is the delegate used if none is provided.
 static const PopupContainerSettings dropDownSettings = {
-    true, // focusOnShow
-    true, // setTextOnIndexChange
-    true, // acceptOnAbandon
-    false // loopSelectionNavigation
+    true,   // focusOnShow
+    true,   // setTextOnIndexChange
+    true,   // acceptOnAbandon
+    false,  // loopSelectionNavigation
+    false,  // restrictWidthOfListBox
+    // display item text in its first strong directional character's directionality.
+    PopupContainerSettings::FirstStrongDirectionalCharacterDirection,
 };
 
 // This class uses WebCore code to paint and handle events for a drop-down list
@@ -100,10 +104,7 @@ public:
 
     // PopupListBox methods
 
-    // Shows the popup
-    void showPopup();
-
-    // Hides the popup.  Do not call this directly: use client->hidePopup().
+    // Hides the popup.
     void hidePopup();
 
     // Updates our internal list to match the client.
@@ -373,8 +374,7 @@ void PopupContainer::showExternal(const IntRect& rect, FrameView* v, int index)
 
 void PopupContainer::hidePopup()
 {
-    if (client())
-        client()->popupClosed(this);
+    listBox()->hidePopup();
 }
 
 void PopupContainer::layout()
@@ -601,6 +601,22 @@ bool PopupListBox::isInterestedInEventForKey(int keyCode)
     }
 }
 
+static bool isCharacterTypeEvent(const PlatformKeyboardEvent& event)
+{
+    // Check whether the event is a character-typed event or not.
+    // In Windows, PlatformKeyboardEvent::Char (not RawKeyDown) type event
+    // is considered as character type event. In Mac OS, KeyDown (not
+    // KeyUp) is considered as character type event.
+#if PLATFORM(WIN_OS)
+    if (event.type() == PlatformKeyboardEvent::Char)
+        return true;
+#else
+    if (event.type() == PlatformKeyboardEvent::KeyDown)
+        return true;
+#endif
+    return false;
+}
+
 bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
 {
     if (event.type() == PlatformKeyboardEvent::KeyUp)
@@ -615,7 +631,7 @@ bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
         return true;
     case VKEY_RETURN:
         if (m_selectedIndex == -1)  {
-            m_popupClient->hidePopup();
+            hidePopup();
             // Don't eat the enter if nothing is selected.
             return false;
         }
@@ -641,7 +657,8 @@ bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
         break;
     default:
         if (!event.ctrlKey() && !event.altKey() && !event.metaKey()
-            && isPrintableChar(event.windowsVirtualKeyCode()))
+            && isPrintableChar(event.windowsVirtualKeyCode())
+            && isCharacterTypeEvent(event))
             typeAheadFind(event);
         break;
     }
@@ -690,21 +707,6 @@ static String stripLeadingWhiteSpace(const String& string)
     return string.substring(i, length - i);
 }
 
-static bool isCharacterTypeEvent(const PlatformKeyboardEvent& event) {
-    // Check whether the event is a character-typed event or not. 
-    // In Windows, PlatformKeyboardEvent::Char (not RawKeyDown) type event
-    // is considered as character type event. In Mac OS, KeyDown (not 
-    // KeyUp) is considered as character type event.
-#if PLATFORM(WIN_OS)
-    if (event.type() == PlatformKeyboardEvent::Char)
-        return true;
-#else
-    if (event.type() == PlatformKeyboardEvent::KeyDown)
-        return true;
-#endif
-    return false;
-}
-
 // From HTMLSelectElement.cpp, with modifications
 void PopupListBox::typeAheadFind(const PlatformKeyboardEvent& event)
 {
@@ -714,8 +716,7 @@ void PopupListBox::typeAheadFind(const PlatformKeyboardEvent& event)
     // Reset the time when user types in a character. The time gap between
     // last character and the current character is used to indicate whether
     // user typed in a string or just a character as the search prefix.
-    if (isCharacterTypeEvent(event))
-        m_lastCharTime = now;
+    m_lastCharTime = now;
 
     UChar c = event.windowsVirtualKeyCode();
 
@@ -817,25 +818,44 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
         return;
     }
     
+    if (!style.isVisible())
+        return;
+
     gc->setFillColor(textColor);
 
-    // Bunch of shit to deal with RTL text...
+    Font itemFont = getRowFont(rowIndex);
+    // FIXME: http://crbug.com/19872 We should get the padding of individual option
+    // elements.  This probably implies changes to PopupMenuClient.
+    bool rightAligned = m_popupClient->menuStyle().textDirection() == RTL;
+    int textX = 0;
+    int maxWidth = 0;
+    if (rightAligned)
+        maxWidth = rowRect.width() - max(0, m_popupClient->clientPaddingRight() - m_popupClient->clientInsetRight());
+    else {
+        textX = max(0, m_popupClient->clientPaddingLeft() - m_popupClient->clientInsetLeft());
+        maxWidth = rowRect.width() - textX;
+    }
+    // Prepare text to be drawn.
     String itemText = m_popupClient->itemText(rowIndex);
+    if (m_settings.restrictWidthOfListBox)  // truncate string to fit in.
+        itemText = StringTruncator::rightTruncate(itemText, maxWidth, itemFont);
     unsigned length = itemText.length();
     const UChar* str = itemText.characters();
-
-    TextRun textRun(str, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
-
-    // FIXME: http://b/1210481 We should get the padding of individual option
-    // elements.  This probably implies changes to PopupMenuClient.
-
-    // Draw the item text
-    if (style.isVisible()) {
-        Font itemFont = getRowFont(rowIndex);
-        int textX = max(0, m_popupClient->clientPaddingLeft() - m_popupClient->clientInsetLeft());
-        int textY = rowRect.y() + itemFont.ascent() + (rowRect.height() - itemFont.height()) / 2;
-        gc->drawBidiText(itemFont, textRun, IntPoint(textX, textY));
-    }
+    // Prepare the directionality to draw text.
+    bool rtl = false;
+    if (m_settings.itemTextDirectionalityHint == PopupContainerSettings::DOMElementDirection)
+        rtl = style.textDirection() == RTL;
+    else if (m_settings.itemTextDirectionalityHint ==
+             PopupContainerSettings::FirstStrongDirectionalCharacterDirection)
+        rtl = itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft;
+    TextRun textRun(str, length, false, 0, 0, rtl);
+    // If the text is right-to-left, make it right-aligned by adjusting its
+    // beginning position.
+    if (rightAligned)
+        textX += maxWidth - itemFont.width(textRun);
+    // Draw the item text.
+    int textY = rowRect.y() + itemFont.ascent() + (rowRect.height() - itemFont.height()) / 2;
+    gc->drawBidiText(itemFont, textRun, IntPoint(textX, textY));
 }
 
 Font PopupListBox::getRowFont(int rowIndex)
@@ -859,7 +879,7 @@ void PopupListBox::abandon()
 
     m_selectedIndex = m_originalIndex;
 
-    m_popupClient->hidePopup();
+    hidePopup();
 
     if (m_acceptedIndexOnAbandon >= 0) {
         m_popupClient->valueChanged(m_acceptedIndexOnAbandon);
@@ -892,7 +912,7 @@ void PopupListBox::acceptIndex(int index)
     if (index < 0) {
         if (m_popupClient) {
             // Enter pressed with no selection, just close the popup.
-            m_popupClient->hidePopup();
+            hidePopup();
         }
         return;
     }
@@ -901,7 +921,7 @@ void PopupListBox::acceptIndex(int index)
         RefPtr<PopupListBox> keepAlive(this);
 
         // Hide ourselves first since valueChanged may have numerous side-effects.
-        m_popupClient->hidePopup();
+        hidePopup();
 
         // Tell the <select> PopupMenuClient what index was selected.
         m_popupClient->valueChanged(index);
@@ -1047,6 +1067,17 @@ void PopupListBox::adjustSelectedIndex(int delta)
     scrollToRevealSelection();
 }
 
+void PopupListBox::hidePopup()
+{
+    if (parent()) {
+        PopupContainer* container = static_cast<PopupContainer*>(parent());
+        if (container->client())
+            container->client()->popupClosed(container);
+    }
+
+    m_popupClient->popupDidHide();
+}
+
 void PopupListBox::updateFromElement()
 {
     clear();
@@ -1090,10 +1121,11 @@ void PopupListBox::layout()
             baseWidth = max(baseWidth, width);
         }
         // FIXME: http://b/1210481 We should get the padding of individual option elements.
-        paddingWidth = max(paddingWidth, 
+        paddingWidth = max(paddingWidth,
             m_popupClient->clientPaddingLeft() + m_popupClient->clientPaddingRight());
     }
 
+    // Calculate scroll bar width.
     int windowHeight = 0;
 
 #if PLATFORM(DARWIN)
@@ -1124,14 +1156,20 @@ void PopupListBox::layout()
     if (m_visibleRows < numItems())
         scrollbarWidth = ScrollbarTheme::nativeTheme()->scrollbarThickness();
 
-    int windowWidth = baseWidth + scrollbarWidth + paddingWidth;
-    int contentWidth = baseWidth;
-
-    if (windowWidth < m_baseWidth) {
+    int windowWidth;
+    int contentWidth;
+    if (m_settings.restrictWidthOfListBox) {
         windowWidth = m_baseWidth;
         contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
     } else {
-        m_baseWidth = baseWidth;
+        windowWidth = baseWidth + scrollbarWidth + paddingWidth;
+        contentWidth = baseWidth;
+
+        if (windowWidth < m_baseWidth) {
+            windowWidth = m_baseWidth;
+            contentWidth = m_baseWidth - scrollbarWidth - paddingWidth;
+        } else
+            m_baseWidth = baseWidth;
     }
 
     resize(windowWidth, windowHeight);
diff --git a/WebCore/platform/chromium/PopupMenuChromium.h b/WebCore/platform/chromium/PopupMenuChromium.h
index f394bc2..ee094b3 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.h
+++ b/WebCore/platform/chromium/PopupMenuChromium.h
@@ -52,7 +52,11 @@ namespace WebCore {
         };
 
         PopupItem(const String& label, Type type)
-            : label(label), type(type), yOffset(0) { }
+            : label(label)
+            , type(type)
+            , yOffset(0)
+        {
+        }
         String label;
         Type type;
         int yOffset;  // y offset of this item, relative to the top of the popup.
@@ -83,10 +87,30 @@ namespace WebCore {
         // regardless of this setting.
         bool acceptOnAbandon;
 
-        // Whether the we should move the selection to the first/last item when
+        // Whether we should move the selection to the first/last item when
         // the user presses down/up arrow keys and the last/first item is
         // selected.
         bool loopSelectionNavigation;
+
+        // Whether we should restrict the width of the PopupListBox or not.
+        // Autocomplete popups are restricted, combo-boxes (select tags) aren't.
+        bool restrictWidthOfListBox;
+
+        // A hint on the display directionality of the item text in popup menu.
+        //
+        // We could either display the items in the drop-down using its DOM element's
+        // directionality, or we could display the items in the drop-down using heuristics:
+        // such as in its first strong directionality character's direction.
+        // Please refer to the discussion (especially comment #7 and #10) in
+        // https://bugs.webkit.org/show_bug.cgi?id=27889 for details.
+        enum DirectionalityHint {
+            // Use the DOM element's directionality to display the item text in popup menu.
+            DOMElementDirection,
+            // Use the item text's first strong-directional character's directionality
+            // to display the item text in popup menu.
+            FirstStrongDirectionalCharacterDirection,
+        };
+        DirectionalityHint itemTextDirectionalityHint;
     };
 
     class PopupContainer : public FramelessScrollView {
@@ -121,7 +145,7 @@ namespace WebCore {
         // popups on other platforms.
         void show(const IntRect&, FrameView*, int index);
 
-        // Hide the popup.  Do not call this directly: use client->hidePopup().
+        // Hide the popup.
         void hidePopup();
 
         // Compute size of widget and children.
diff --git a/WebCore/platform/chromium/ThemeChromiumMac.h b/WebCore/platform/chromium/ThemeChromiumMac.h
new file mode 100644
index 0000000..5580d1d
--- /dev/null
+++ b/WebCore/platform/chromium/ThemeChromiumMac.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ThemeChromiumMac_h
+#define ThemeChromiumMac_h
+
+#include "Theme.h"
+
+// This file (and its associated .mm file) is a clone of ThemeMac.h. See
+// the .mm file for details.
+
+namespace WebCore {
+
+class ThemeChromiumMac : public Theme {
+public:
+    ThemeChromiumMac() { }
+    virtual ~ThemeChromiumMac() { }
+    
+    virtual int baselinePositionAdjustment(ControlPart) const;
+
+    virtual FontDescription controlFont(ControlPart, const Font&, float zoomFactor) const;
+    
+    virtual LengthSize controlSize(ControlPart, const Font&, const LengthSize&, float zoomFactor) const;
+    virtual LengthSize minimumControlSize(ControlPart, const Font&, float zoomFactor) const;
+
+    virtual LengthBox controlPadding(ControlPart, const Font&, const LengthBox& zoomedBox, float zoomFactor) const;
+    virtual LengthBox controlBorder(ControlPart, const Font&, const LengthBox& zoomedBox, float zoomFactor) const;
+
+    virtual bool controlRequiresPreWhiteSpace(ControlPart part) const { return part == PushButtonPart; }
+
+    virtual void paint(ControlPart, ControlStates, GraphicsContext*, const IntRect&, float zoomFactor, ScrollView*) const;
+    virtual void inflateControlPaintRect(ControlPart, ControlStates, IntRect&, float zoomFactor) const;
+};
+
+} // namespace WebCore
+
+#endif // ThemeChromiumMac_h
diff --git a/WebCore/platform/chromium/ThemeChromiumMac.mm b/WebCore/platform/chromium/ThemeChromiumMac.mm
new file mode 100644
index 0000000..3c97428
--- /dev/null
+++ b/WebCore/platform/chromium/ThemeChromiumMac.mm
@@ -0,0 +1,569 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#import "config.h"
+#import "ThemeChromiumMac.h"
+
+#import "BlockExceptions.h"
+#import "GraphicsContext.h"
+#import "LocalCurrentGraphicsContext.h"
+#import "ScrollView.h"
+#import "WebCoreSystemInterface.h"
+#include <wtf/StdLibExtras.h>
+
+using namespace std;
+
+// This file (and its associated .h file) is a clone of ThemeMac.mm.
+// Because the original file is designed to run in-process inside a Cocoa view,
+// we must maintain a fork. Please maintain this file by performing parallel
+// changes to it.
+//
+// The only changes from ThemeMac should be:
+// - The classname change from ThemeMac to ThemeChromiumMac.
+// - The import of FlippedView() and its use as the parent view for cell
+//   rendering.
+// - In updateStates() the code to update the cells' inactive state.
+// - In paintButton() the code to save/restore the window's default button cell.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
+// FIXME: Default buttons really should be more like push buttons and not like buttons.
+
+namespace WebCore {
+
+// Pick up utility function from RenderThemeChromiumMac.
+extern NSView* FlippedView();
+
+enum {
+    topMargin,
+    rightMargin,
+    bottomMargin,
+    leftMargin
+};
+
+Theme* platformTheme()
+{
+    DEFINE_STATIC_LOCAL(ThemeChromiumMac, themeMac, ());
+    return &themeMac;
+}
+
+// Helper functions used by a bunch of different control parts.
+
+static NSControlSize controlSizeForFont(const Font& font)
+{
+    int fontSize = font.pixelSize();
+    if (fontSize >= 16)
+        return NSRegularControlSize;
+    if (fontSize >= 11)
+        return NSSmallControlSize;
+    return NSMiniControlSize;
+}
+
+static LengthSize sizeFromFont(const Font& font, const LengthSize& zoomedSize, float zoomFactor, const IntSize* sizes)
+{
+    IntSize controlSize = sizes[controlSizeForFont(font)];
+    if (zoomFactor != 1.0f)
+        controlSize = IntSize(controlSize.width() * zoomFactor, controlSize.height() * zoomFactor);
+    LengthSize result = zoomedSize;
+    if (zoomedSize.width().isIntrinsicOrAuto() && controlSize.width() > 0)
+        result.setWidth(Length(controlSize.width(), Fixed));
+    if (zoomedSize.height().isIntrinsicOrAuto() && controlSize.height() > 0)
+        result.setHeight(Length(controlSize.height(), Fixed));
+    return result;
+}
+
+static void setControlSize(NSCell* cell, const IntSize* sizes, const IntSize& minZoomedSize, float zoomFactor)
+{
+    NSControlSize size;
+    if (minZoomedSize.width() >= static_cast<int>(sizes[NSRegularControlSize].width() * zoomFactor) &&
+        minZoomedSize.height() >= static_cast<int>(sizes[NSRegularControlSize].height() * zoomFactor))
+        size = NSRegularControlSize;
+    else if (minZoomedSize.width() >= static_cast<int>(sizes[NSSmallControlSize].width() * zoomFactor) &&
+             minZoomedSize.height() >= static_cast<int>(sizes[NSSmallControlSize].height() * zoomFactor))
+        size = NSSmallControlSize;
+    else
+        size = NSMiniControlSize;
+    if (size != [cell controlSize]) // Only update if we have to, since AppKit does work even if the size is the same.
+        [cell setControlSize:size];
+}
+
+static void updateStates(NSCell* cell, ControlStates states)
+{
+    // Hover state is not supported by Aqua.
+    
+    // Pressed state
+    bool oldPressed = [cell isHighlighted];
+    bool pressed = states & PressedState;
+    if (pressed != oldPressed)
+        [cell setHighlighted:pressed];
+    
+    // Enabled state
+    bool oldEnabled = [cell isEnabled];
+    bool enabled = states & EnabledState;
+    if (enabled != oldEnabled)
+        [cell setEnabled:enabled];
+    
+    // Focused state
+    bool oldFocused = [cell showsFirstResponder];
+    bool focused = states & FocusState;
+    if (focused != oldFocused)
+        [cell setShowsFirstResponder:focused];
+
+    // Checked and Indeterminate
+    bool oldIndeterminate = [cell state] == NSMixedState;
+    bool indeterminate = (states & IndeterminateState);
+    bool checked = states & CheckedState;
+    bool oldChecked = [cell state] == NSOnState;
+    if (oldIndeterminate != indeterminate || checked != oldChecked)
+        [cell setState:indeterminate ? NSMixedState : (checked ? NSOnState : NSOffState)];
+        
+    // Window Inactive state
+    NSControlTint oldTint = [cell controlTint];
+    bool windowInactive = (states & WindowInactiveState);
+    NSControlTint tint = windowInactive ? NSClearControlTint : [NSColor currentControlTint];
+    if (tint != oldTint)
+        [cell setControlTint:tint];
+}
+
+static IntRect inflateRect(const IntRect& zoomedRect, const IntSize& zoomedSize, const int* margins, float zoomFactor)
+{
+    // Only do the inflation if the available width/height are too small.  Otherwise try to
+    // fit the glow/check space into the available box's width/height.
+    int widthDelta = zoomedRect.width() - (zoomedSize.width() + margins[leftMargin] * zoomFactor + margins[rightMargin] * zoomFactor);
+    int heightDelta = zoomedRect.height() - (zoomedSize.height() + margins[topMargin] * zoomFactor + margins[bottomMargin] * zoomFactor);
+    IntRect result(zoomedRect);
+    if (widthDelta < 0) {
+        result.setX(result.x() - margins[leftMargin] * zoomFactor);
+        result.setWidth(result.width() - widthDelta);
+    }
+    if (heightDelta < 0) {
+        result.setY(result.y() - margins[topMargin] * zoomFactor);
+        result.setHeight(result.height() - heightDelta);
+    }
+    return result;
+}
+
+// Checkboxes
+
+static const IntSize* checkboxSizes()
+{
+    static const IntSize sizes[3] = { IntSize(14, 14), IntSize(12, 12), IntSize(10, 10) };
+    return sizes;
+}
+
+static const int* checkboxMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 3, 4, 4, 2 },
+        { 4, 3, 3, 3 },
+        { 4, 3, 3, 3 },
+    };
+    return margins[controlSize];
+}
+
+static LengthSize checkboxSize(const Font& font, const LengthSize& zoomedSize, float zoomFactor)
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!zoomedSize.width().isIntrinsicOrAuto() && !zoomedSize.height().isIntrinsicOrAuto())
+        return zoomedSize;
+
+    // Use the font size to determine the intrinsic width of the control.
+    return sizeFromFont(font, zoomedSize, zoomFactor, checkboxSizes());
+}
+
+static NSButtonCell* checkbox(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell* checkboxCell;
+    if (!checkboxCell) {
+        checkboxCell = [[NSButtonCell alloc] init];
+        [checkboxCell setButtonType:NSSwitchButton];
+        [checkboxCell setTitle:nil];
+        [checkboxCell setAllowsMixedState:YES];
+        [checkboxCell setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(checkboxCell, checkboxSizes(), zoomedRect.size(), zoomFactor);
+
+    // Update the various states we respond to.
+    updateStates(checkboxCell, states);
+    
+    return checkboxCell;
+}
+
+// FIXME: Share more code with radio buttons.
+static void paintCheckbox(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell* checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+
+    context->save();
+
+    NSControlSize controlSize = [checkboxCell controlSize];
+    IntSize zoomedSize = checkboxSizes()[controlSize];
+    zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = inflateRect(zoomedRect, zoomedSize, checkboxMargins(controlSize), zoomFactor);
+    
+    if (zoomFactor != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+        inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+        context->translate(inflatedRect.x(), inflatedRect.y());
+        context->scale(FloatSize(zoomFactor, zoomFactor));
+        context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+    
+    [checkboxCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [checkboxCell setControlView:nil];
+
+    context->restore();
+    
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+// Radio Buttons
+
+static const IntSize* radioSizes()
+{
+    static const IntSize sizes[3] = { IntSize(14, 15), IntSize(12, 13), IntSize(10, 10) };
+    return sizes;
+}
+
+static const int* radioMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 2, 2, 4, 2 },
+        { 3, 2, 3, 2 },
+        { 1, 0, 2, 0 },
+    };
+    return margins[controlSize];
+}
+
+static LengthSize radioSize(const Font& font, const LengthSize& zoomedSize, float zoomFactor)
+{
+    // If the width and height are both specified, then we have nothing to do.
+    if (!zoomedSize.width().isIntrinsicOrAuto() && !zoomedSize.height().isIntrinsicOrAuto())
+        return zoomedSize;
+
+    // Use the font size to determine the intrinsic width of the control.
+    return sizeFromFont(font, zoomedSize, zoomFactor, radioSizes());
+}
+
+static NSButtonCell* radio(ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell* radioCell;
+    if (!radioCell) {
+        radioCell = [[NSButtonCell alloc] init];
+        [radioCell setButtonType:NSRadioButton];
+        [radioCell setTitle:nil];
+        [radioCell setFocusRingType:NSFocusRingTypeExterior];
+    }
+    
+    // Set the control size based off the rectangle we're painting into.
+    setControlSize(radioCell, radioSizes(), zoomedRect.size(), zoomFactor);
+
+    // Update the various states we respond to.
+    updateStates(radioCell, states);
+    
+    return radioCell;
+}
+
+static void paintRadio(ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell* radioCell = radio(states, zoomedRect, zoomFactor);
+
+    context->save();
+
+    NSControlSize controlSize = [radioCell controlSize];
+    IntSize zoomedSize = radioSizes()[controlSize];
+    zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = inflateRect(zoomedRect, zoomedSize, radioMargins(controlSize), zoomFactor);
+    
+    if (zoomFactor != 1.0f) {
+        inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+        inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+        context->translate(inflatedRect.x(), inflatedRect.y());
+        context->scale(FloatSize(zoomFactor, zoomFactor));
+        context->translate(-inflatedRect.x(), -inflatedRect.y());
+    }
+    
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    [radioCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [radioCell setControlView:nil];
+    END_BLOCK_OBJC_EXCEPTIONS
+
+    context->restore();
+}
+
+// Buttons
+
+// Buttons really only constrain height. They respect width.
+static const IntSize* buttonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
+    return sizes;
+}
+
+static const int* buttonMargins(NSControlSize controlSize)
+{
+    static const int margins[3][4] =
+    {
+        { 4, 6, 7, 6 },
+        { 4, 5, 6, 5 },
+        { 0, 1, 1, 1 },
+    };
+    return margins[controlSize];
+}
+
+static NSButtonCell* button(ControlPart part, ControlStates states, const IntRect& zoomedRect, float zoomFactor)
+{
+    static NSButtonCell *buttonCell;
+    static bool defaultButton;
+    if (!buttonCell) {
+        buttonCell = [[NSButtonCell alloc] init];
+        [buttonCell setTitle:nil];
+        [buttonCell setButtonType:NSMomentaryPushInButton];
+    }
+
+    // Set the control size based off the rectangle we're painting into.
+    if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
+        // Use the square button
+        if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
+            [buttonCell setBezelStyle:NSShadowlessSquareBezelStyle];
+    } else if ([buttonCell bezelStyle] != NSRoundedBezelStyle)
+        [buttonCell setBezelStyle:NSRoundedBezelStyle];
+
+    setControlSize(buttonCell, buttonSizes(), zoomedRect.size(), zoomFactor);
+
+    if (defaultButton != (states & DefaultState)) {
+        defaultButton = !defaultButton;
+        [buttonCell setKeyEquivalent:(defaultButton ? @"\r" : @"")];
+    }
+
+    // Update the various states we respond to.
+    updateStates(buttonCell, states);
+    
+    return buttonCell;
+}
+
+static void paintButton(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    
+    // Determine the width and height needed for the control and prepare the cell for painting.
+    NSButtonCell *buttonCell = button(part, states, zoomedRect, zoomFactor);
+    LocalCurrentGraphicsContext localContext(context);
+
+    NSControlSize controlSize = [buttonCell controlSize];
+    IntSize zoomedSize = buttonSizes()[controlSize];
+    zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
+    zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+    IntRect inflatedRect = zoomedRect;
+    if ([buttonCell bezelStyle] == NSRoundedBezelStyle) {
+        // Center the button within the available space.
+        if (inflatedRect.height() > zoomedSize.height()) {
+            inflatedRect.setY(inflatedRect.y() + (inflatedRect.height() - zoomedSize.height()) / 2);
+            inflatedRect.setHeight(zoomedSize.height());
+        }
+
+        // Now inflate it to account for the shadow.
+        inflatedRect = inflateRect(inflatedRect, zoomedSize, buttonMargins(controlSize), zoomFactor);
+
+        if (zoomFactor != 1.0f) {
+            inflatedRect.setWidth(inflatedRect.width() / zoomFactor);
+            inflatedRect.setHeight(inflatedRect.height() / zoomFactor);
+            context->translate(inflatedRect.x(), inflatedRect.y());
+            context->scale(FloatSize(zoomFactor, zoomFactor));
+            context->translate(-inflatedRect.x(), -inflatedRect.y());
+        }
+    } 
+
+    [buttonCell drawWithFrame:NSRect(inflatedRect) inView:FlippedView()];
+    [buttonCell setControlView:nil];
+
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+// Theme overrides
+
+int ThemeChromiumMac::baselinePositionAdjustment(ControlPart part) const
+{
+    if (part == CheckboxPart || part == RadioPart)
+        return -2;
+    return Theme::baselinePositionAdjustment(part);
+}
+
+FontDescription ThemeChromiumMac::controlFont(ControlPart part, const Font& font, float zoomFactor) const
+{
+    switch (part) {
+        case PushButtonPart: {
+            FontDescription fontDescription;
+            fontDescription.setIsAbsoluteSize(true);
+            fontDescription.setGenericFamily(FontDescription::SerifFamily);
+
+            NSFont* nsFont = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:controlSizeForFont(font)]];
+            fontDescription.firstFamily().setFamily([nsFont familyName]);
+            fontDescription.setComputedSize([nsFont pointSize] * zoomFactor);
+            fontDescription.setSpecifiedSize([nsFont pointSize] * zoomFactor);
+            return fontDescription;
+        }
+        default:
+            return Theme::controlFont(part, font, zoomFactor);
+    }
+}
+
+LengthSize ThemeChromiumMac::controlSize(ControlPart part, const Font& font, const LengthSize& zoomedSize, float zoomFactor) const
+{
+    switch (part) {
+        case CheckboxPart:
+            return checkboxSize(font, zoomedSize, zoomFactor);
+        case RadioPart:
+            return radioSize(font, zoomedSize, zoomFactor);
+        case PushButtonPart:
+            // Height is reset to auto so that specified heights can be ignored.
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+        default:
+            return zoomedSize;
+    }
+}
+
+LengthSize ThemeChromiumMac::minimumControlSize(ControlPart part, const Font& font, float zoomFactor) const
+{
+    switch (part) {
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
+        default:
+            return Theme::minimumControlSize(part, font, zoomFactor);
+    }
+}
+
+LengthBox ThemeChromiumMac::controlBorder(ControlPart part, const Font& font, const LengthBox& zoomedBox, float zoomFactor) const
+{
+    switch (part) {
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
+        default:
+            return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
+    }
+}
+
+LengthBox ThemeChromiumMac::controlPadding(ControlPart part, const Font& font, const LengthBox& zoomedBox, float zoomFactor) const
+{
+    switch (part) {
+        case PushButtonPart: {
+            // Just use 8px.  AppKit wants to use 11px for mini buttons, but that padding is just too large
+            // for real-world Web sites (creating a huge necessary minimum width for buttons whose space is
+            // by definition constrained, since we select mini only for small cramped environments.
+            // This also guarantees the HTML <button> will match our rendering by default, since we're using a consistent
+            // padding.
+            const int padding = 8 * zoomFactor;
+            return LengthBox(0, padding, 0, padding);
+        }
+        default:
+            return Theme::controlPadding(part, font, zoomedBox, zoomFactor);
+    }
+}
+
+void ThemeChromiumMac::inflateControlPaintRect(ControlPart part, ControlStates states, IntRect& zoomedRect, float zoomFactor) const
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+    switch (part) {
+        case CheckboxPart: {
+            // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
+            // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
+            NSCell *cell = checkbox(states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+            IntSize zoomedSize = checkboxSizes()[controlSize];
+            zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+            zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+            zoomedRect = inflateRect(zoomedRect, zoomedSize, checkboxMargins(controlSize), zoomFactor);
+            break;
+        }
+        case RadioPart: {
+            // We inflate the rect as needed to account for padding included in the cell to accommodate the radio button
+            // shadow".  We don't consider this part of the bounds of the control in WebKit.
+            NSCell *cell = radio(states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+            IntSize zoomedSize = radioSizes()[controlSize];
+            zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+            zoomedSize.setWidth(zoomedSize.width() * zoomFactor);
+            zoomedRect = inflateRect(zoomedRect, zoomedSize, radioMargins(controlSize), zoomFactor);
+            break;
+        }
+        case PushButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart: {
+            NSButtonCell *cell = button(part, states, zoomedRect, zoomFactor);
+            NSControlSize controlSize = [cell controlSize];
+
+            // We inflate the rect as needed to account for the Aqua button's shadow.
+            if ([cell bezelStyle] == NSRoundedBezelStyle) {
+                IntSize zoomedSize = buttonSizes()[controlSize];
+                zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
+                zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
+                zoomedRect = inflateRect(zoomedRect, zoomedSize, buttonMargins(controlSize), zoomFactor);
+            }
+            break;
+        }
+        default:
+            break;
+    }
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+void ThemeChromiumMac::paint(ControlPart part, ControlStates states, GraphicsContext* context, const IntRect& zoomedRect, float zoomFactor, ScrollView* scrollView) const
+{
+    switch (part) {
+        case CheckboxPart:
+            paintCheckbox(states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        case RadioPart:
+            paintRadio(states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        case PushButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+        case SquareButtonPart:
+            paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
+            break;
+        default:
+            break;
+    }
+}
+
+}
diff --git a/WebCore/platform/graphics/BitmapImage.h b/WebCore/platform/graphics/BitmapImage.h
index 807c11b..13641d2 100644
--- a/WebCore/platform/graphics/BitmapImage.h
+++ b/WebCore/platform/graphics/BitmapImage.h
@@ -45,6 +45,10 @@ class NSImage;
 typedef struct HBITMAP__ *HBITMAP;
 #endif
 
+#if PLATFORM(HAIKU)
+class BBitmap;
+#endif
+
 namespace WebCore {
     struct FrameData;
 }
@@ -137,6 +141,7 @@ public:
 #endif
 
 #if PLATFORM(WIN)
+    static PassRefPtr<BitmapImage> create(HBITMAP);
     virtual bool getHBITMAP(HBITMAP);
     virtual bool getHBITMAPOfSize(HBITMAP, LPSIZE);
 #endif
@@ -165,10 +170,16 @@ protected:
     virtual void drawFrameMatchingSourceSize(GraphicsContext*, const FloatRect& dstRect, const IntSize& srcSize, CompositeOperator);
 #endif
     virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
-#if PLATFORM(WX) || PLATFORM(WINCE)
+
+#if PLATFORM(WX) || (PLATFORM(WINCE) && !PLATFORM(QT))
     virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
                              const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
-#endif    
+#endif
+
+#if PLATFORM(HAIKU)
+    virtual BBitmap* getBBitmap() const;
+#endif
+
     size_t currentFrame() const { return m_currentFrame; }
     size_t frameCount();
     NativeImagePtr frameAtIndex(size_t);
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 5baa56e..8e51b95 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -47,6 +47,10 @@ typedef struct _GdkColor GdkColor;
 class wxColour;
 #endif
 
+#if PLATFORM(HAIKU)
+struct rgb_color;
+#endif
+
 namespace WebCore {
 
 class String;
@@ -121,6 +125,11 @@ public:
     Color(CGColorRef);
 #endif
 
+#if PLATFORM(HAIKU)
+    Color(const rgb_color&);
+    operator rgb_color() const;
+#endif
+
     static bool parseHexColor(const String& name, RGBA32& rgb);
 
     static const RGBA32 black = 0xFF000000;
diff --git a/WebCore/platform/graphics/FloatPoint.h b/WebCore/platform/graphics/FloatPoint.h
index 0c97c49..06b280b 100644
--- a/WebCore/platform/graphics/FloatPoint.h
+++ b/WebCore/platform/graphics/FloatPoint.h
@@ -36,7 +36,7 @@
 typedef struct CGPoint CGPoint;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGPoint NSPoint;
 #else
@@ -51,6 +51,10 @@ class QPointF;
 QT_END_NAMESPACE
 #endif
 
+#if PLATFORM(HAIKU)
+class BPoint;
+#endif
+
 #if PLATFORM(SKIA)
 struct SkPoint;
 #endif
@@ -80,7 +84,8 @@ public:
     operator CGPoint() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     FloatPoint(const NSPoint&);
     operator NSPoint() const;
 #endif
@@ -90,7 +95,16 @@ public:
     operator QPointF() const;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatPoint.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+    FloatPoint(const BPoint&);
+    operator BPoint() const;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatPoint.h
     operator SkPoint() const;
     FloatPoint(const SkPoint&);
 #endif
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index e906812..704241a 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -33,7 +33,7 @@
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -51,7 +51,15 @@ QT_END_NAMESPACE
 class wxRect2DDouble;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatRect.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+class BRect;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatRect.h
 struct SkRect;
 #endif
 
@@ -123,7 +131,8 @@ public:
     operator CGRect() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     FloatRect(const NSRect&);
     operator NSRect() const;
 #endif
@@ -138,7 +147,16 @@ public:
     operator wxRect2DDouble() const;
 #endif
 
+<<<<<<< HEAD:WebCore/platform/graphics/FloatRect.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(HAIKU)
+    FloatRect(const BRect&);
+    operator BRect() const;
+#endif
+
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/FloatRect.h
     FloatRect(const SkRect&);
     operator SkRect() const;
 #endif
diff --git a/WebCore/platform/graphics/FloatSize.h b/WebCore/platform/graphics/FloatSize.h
index 6e792b6..5a84fd1 100644
--- a/WebCore/platform/graphics/FloatSize.h
+++ b/WebCore/platform/graphics/FloatSize.h
@@ -34,7 +34,7 @@
 typedef struct CGSize CGSize;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGSize NSSize;
 #else
@@ -79,7 +79,8 @@ public:
     operator CGSize() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     explicit FloatSize(const NSSize &); // don't do this implicitly since it's lossy
     operator NSSize() const;
 #endif
diff --git a/WebCore/platform/graphics/FontCache.h b/WebCore/platform/graphics/FontCache.h
index 3c0f2d9..b88305f 100644
--- a/WebCore/platform/graphics/FontCache.h
+++ b/WebCore/platform/graphics/FontCache.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2008 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -63,7 +64,15 @@ public:
     // Also implemented by the platform.
     void platformInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+#if defined(IMLANG_FONT_LINK) && (IMLANG_FONT_LINK == 2)
+    IMLangFontLink2* getFontLinkInterface();
+#else
+    IMLangFontLink* getFontLinkInterface();
+#endif
+    static void comInitialize();
+    static void comUninitialize();
+#elif PLATFORM(WIN)
     IMLangFontLink2* getFontLinkInterface();
 #endif
 
diff --git a/WebCore/platform/graphics/FontDescription.h b/WebCore/platform/graphics/FontDescription.h
index c893b8a..fc63db9 100644
--- a/WebCore/platform/graphics/FontDescription.h
+++ b/WebCore/platform/graphics/FontDescription.h
@@ -27,7 +27,9 @@
 
 #include "FontFamily.h"
 #include "FontRenderingMode.h"
+#include "FontSmoothingMode.h"
 #include "FontTraitsMask.h"
+#include "TextRenderingMode.h"
 
 namespace WebCore {
 
@@ -61,6 +63,8 @@ public:
         , m_usePrinterFont(false)
         , m_renderingMode(NormalRenderingMode)
         , m_keywordSize(0)
+        , m_fontSmoothing(AutoSmoothing)
+        , m_textRendering(AutoTextRendering)
     {
     }
 
@@ -80,8 +84,12 @@ public:
     FontWeight bolderWeight() const;
     GenericFamilyType genericFamily() const { return static_cast<GenericFamilyType>(m_genericFamily); }
     bool usePrinterFont() const { return m_usePrinterFont; }
+    // only use fixed default size when there is only one font family, and that family is "monospace"
+    bool useFixedDefaultSize() const { return genericFamily() == MonospaceFamily && !family().next() && family().family() == "-webkit-monospace"; }
     FontRenderingMode renderingMode() const { return static_cast<FontRenderingMode>(m_renderingMode); }
     unsigned keywordSize() const { return m_keywordSize; }
+    FontSmoothingMode fontSmoothing() const { return static_cast<FontSmoothingMode>(m_fontSmoothing); }
+    TextRenderingMode textRenderingMode() const { return static_cast<TextRenderingMode>(m_textRendering); }
 
     FontTraitsMask traitsMask() const;
 
@@ -96,6 +104,8 @@ public:
     void setUsePrinterFont(bool p) { m_usePrinterFont = p; }
     void setRenderingMode(FontRenderingMode mode) { m_renderingMode = mode; }
     void setKeywordSize(unsigned s) { m_keywordSize = s; }
+    void setFontSmoothing(FontSmoothingMode smoothing) { m_fontSmoothing = smoothing; }
+    void setTextRenderingMode(TextRenderingMode rendering) { m_textRendering = rendering; }
 
 private:
     FontFamily m_familyList; // The list of font families to be used.
@@ -117,6 +127,9 @@ private:
     unsigned m_keywordSize : 4; // We cache whether or not a font is currently represented by a CSS keyword (e.g., medium).  If so,
                            // then we can accurately translate across different generic families to adjust for different preference settings
                            // (e.g., 13px monospace vs. 16px everything else).  Sizes are 1-8 (like the HTML size values for <font>).
+
+    unsigned m_fontSmoothing : 2; // FontSmoothingMode
+    unsigned m_textRendering : 2; // TextRenderingMode
 };
 
 inline bool FontDescription::operator==(const FontDescription& other) const
@@ -131,7 +144,9 @@ inline bool FontDescription::operator==(const FontDescription& other) const
         && m_genericFamily == other.m_genericFamily
         && m_usePrinterFont == other.m_usePrinterFont
         && m_renderingMode == other.m_renderingMode
-        && m_keywordSize == other.m_keywordSize;
+        && m_keywordSize == other.m_keywordSize
+        && m_fontSmoothing == other.m_fontSmoothing
+        && m_textRendering == other.m_textRendering;
 }
 
 }
diff --git a/WebCore/platform/graphics/FontFastPath.cpp b/WebCore/platform/graphics/FontFastPath.cpp
index b0e39db..5246593 100644
--- a/WebCore/platform/graphics/FontFastPath.cpp
+++ b/WebCore/platform/graphics/FontFastPath.cpp
@@ -251,6 +251,10 @@ bool Font::canUseGlyphCache(const TextRun& run) const
             return false;
     }
 
+    TextRenderingMode textMode = m_fontDescription.textRenderingMode();
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision)
+        return false;
+
     return true;
 
 }
diff --git a/WebCore/platform/graphics/FontSmoothingMode.h b/WebCore/platform/graphics/FontSmoothingMode.h
new file mode 100644
index 0000000..7c23394
--- /dev/null
+++ b/WebCore/platform/graphics/FontSmoothingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef FontSmoothingMode_h
+#define FontSmoothingMode_h
+
+namespace WebCore {
+
+    enum FontSmoothingMode { AutoSmoothing, NoSmoothing, Antialiased, SubpixelAntialiased };
+    
+} // namespace WebCore
+
+#endif // FontSmoothingMode_h
diff --git a/WebCore/platform/graphics/GlyphPageTreeNode.cpp b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
index 6419e0c..9f53f0b 100644
--- a/WebCore/platform/graphics/GlyphPageTreeNode.cpp
+++ b/WebCore/platform/graphics/GlyphPageTreeNode.cpp
@@ -202,8 +202,10 @@ void GlyphPageTreeNode::initializePage(const FontData* fontData, unsigned pageNu
                 GlyphPage* pageToFill = m_page.get();
                 for (unsigned i = 0; i < numRanges; i++) {
                     const FontDataRange& range = segmentedFontData->rangeAt(i);
-                    int from = max(0, range.from() - static_cast<int>(start));
-                    int to = 1 + min(range.to() - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
+                    // all this casting is to ensure all the parameters to min and max have the same type,
+                    // to avoid ambiguous template parameter errors on Windows
+                    int from = max(0, static_cast<int>(range.from()) - static_cast<int>(start));
+                    int to = 1 + min(static_cast<int>(range.to()) - static_cast<int>(start), static_cast<int>(GlyphPage::size) - 1);
                     if (from < static_cast<int>(GlyphPage::size) && to > 0) {
                         if (haveGlyphs && !scratchPage) {
                             scratchPage = GlyphPage::create(this);
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index a4e8408..ccdce08 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -27,9 +27,9 @@
 #include "GraphicsContext.h"
 
 #include "BidiResolver.h"
+#include "Font.h"
 #include "Generator.h"
 #include "GraphicsContextPrivate.h"
-#include "Font.h"
 
 using namespace std;
 
@@ -89,7 +89,7 @@ void GraphicsContext::save()
         return;
 
     m_common->stack.append(m_common->state);
-    
+
     savePlatformState();
 }
 
@@ -104,7 +104,7 @@ void GraphicsContext::restore()
     }
     m_common->state = m_common->stack.last();
     m_common->stack.removeLast();
-    
+
     restorePlatformState();
 }
 
@@ -305,7 +305,7 @@ bool GraphicsContext::paintingDisabled() const
 }
 
 void GraphicsContext::drawImage(Image* image, const IntPoint& p, CompositeOperator op)
-{        
+{
     drawImage(image, p, IntRect(0, 0, -1, -1), op);
 }
 
@@ -329,7 +329,7 @@ void GraphicsContext::drawText(const Font& font, const TextRun& run, const IntPo
 {
     if (paintingDisabled())
         return;
-    
+
     font.drawText(this, run, point, from, to);
 }
 #endif
@@ -383,7 +383,7 @@ void GraphicsContext::initFocusRing(int width, int offset)
     if (paintingDisabled())
         return;
     clearFocusRing();
-    
+
     m_common->m_focusRingWidth = width;
     m_common->m_focusRingOffset = offset;
 }
@@ -396,12 +396,12 @@ void GraphicsContext::clearFocusRing()
 IntRect GraphicsContext::focusRingBoundingRect()
 {
     IntRect result = IntRect(0, 0, 0, 0);
-    
+
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
         result.unite(rects[i]);
-        
+
     return result;
 }
 
@@ -436,7 +436,7 @@ void GraphicsContext::drawImage(Image* image, const FloatRect& dest, const Float
     float tsh = src.height();
     float tw = dest.width();
     float th = dest.height();
-        
+
     if (tsw == -1)
         tsw = image->width();
     if (tsh == -1)
@@ -540,10 +540,39 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
 }
 #endif
 
-#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA)
+#if !PLATFORM(QT) && !PLATFORM(CAIRO) && !PLATFORM(SKIA) && !PLATFORM(HAIKU)
 void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle&)
 {
 }
 #endif
 
+void GraphicsContext::adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle& penStyle)
+{
+    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
+    // works out.  For example, with a border width of 3, WebKit will pass us (y1+y2)/2, e.g.,
+    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
+    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
+    if (penStyle == DottedStroke || penStyle == DashedStroke) {
+        if (p1.x() == p2.x()) {
+            p1.setY(p1.y() + strokeWidth);
+            p2.setY(p2.y() - strokeWidth);
+        } else {
+            p1.setX(p1.x() + strokeWidth);
+            p2.setX(p2.x() - strokeWidth);
+        }
+    }
+
+    if (static_cast<int>(strokeWidth) % 2) { //odd
+        if (p1.x() == p2.x()) {
+            // We're a vertical line.  Adjust our x.
+            p1.setX(p1.x() + 0.5f);
+            p2.setX(p2.x() + 0.5f);
+        } else {
+            // We're a horizontal line. Adjust our y.
+            p1.setY(p1.y() + 0.5f);
+            p2.setY(p2.y() + 0.5f);
+        }
+    }
+}
+
 }
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 233c14c..b1d1ef9 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -55,8 +55,8 @@ struct SkPoint;
 class wxGCDC;
 class wxWindowDC;
 
-// wxGraphicsContext allows us to support Path, etc. 
-// but on some platforms, e.g. Linux, it requires fairly 
+// wxGraphicsContext allows us to support Path, etc.
+// but on some platforms, e.g. Linux, it requires fairly
 // new software.
 #if USE(WXGC)
 // On OS X, wxGCDC is just a typedef for wxDC, so use wxDC explicitly to make
@@ -72,6 +72,10 @@ class wxWindowDC;
 #endif
 #elif PLATFORM(SKIA)
 typedef class PlatformContextSkia PlatformGraphicsContext;
+#elif PLATFORM(HAIKU)
+class BView;
+typedef BView PlatformGraphicsContext;
+struct pattern;
 #elif PLATFORM(WINCE)
 typedef struct HDC__ PlatformGraphicsContext;
 #else
@@ -124,7 +128,7 @@ namespace WebCore {
     const int cTextFill = 1;
     const int cTextStroke = 2;
     const int cTextClip = 4;
-    
+
     enum StrokeStyle {
         NoStroke,
         SolidStroke,
@@ -132,12 +136,12 @@ namespace WebCore {
         DashedStroke
     };
 
-// FIXME: This is a place-holder until we decide to add
-// real color space support to WebCore.  At that time, ColorSpace will be a
-// class and instances will be held  off of Colors.   There will be
-// special singleton Gradient and Pattern color spaces to mark when
-// a fill or stroke is using a gradient or pattern instead of a solid color.
-// https://bugs.webkit.org/show_bug.cgi?id=20558
+    // FIXME: This is a place-holder until we decide to add
+    // real color space support to WebCore.  At that time, ColorSpace will be a
+    // class and instances will be held  off of Colors.   There will be
+    // special singleton Gradient and Pattern color spaces to mark when
+    // a fill or stroke is using a gradient or pattern instead of a solid color.
+    // https://bugs.webkit.org/show_bug.cgi?id=20558
     enum ColorSpace {
         SolidColorSpace,
         PatternColorSpace,
@@ -156,11 +160,11 @@ namespace WebCore {
     public:
         GraphicsContext(PlatformGraphicsContext*);
         ~GraphicsContext();
-       
+
 #if !PLATFORM(WINCE) || PLATFORM(QT)
         PlatformGraphicsContext* platformContext() const;
 #endif
-        
+
         float strokeThickness() const;
         void setStrokeThickness(float);
         StrokeStyle strokeStyle() const;
@@ -267,7 +271,7 @@ namespace WebCore {
                        CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
         void drawTiledImage(Image*, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize,
                        CompositeOperator = CompositeSourceOver);
-        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect, 
+        void drawTiledImage(Image*, const IntRect& destRect, const IntRect& srcRect,
                             Image::TileRule hRule = Image::StretchTile, Image::TileRule vRule = Image::StretchTile,
                             CompositeOperator = CompositeSourceOver);
 
@@ -291,13 +295,13 @@ namespace WebCore {
         void drawHighlightForText(const Font&, const TextRun&, const IntPoint&, int h, const Color& backgroundColor, int from = 0, int to = -1);
 
         FloatRect roundToDevicePixels(const FloatRect&);
-        
+
         void drawLineForText(const IntPoint&, int width, bool printing);
         void drawLineForMisspellingOrBadGrammar(const IntPoint&, int width, bool grammar);
-        
+
         bool paintingDisabled() const;
         void setPaintingDisabled(bool);
-        
+
         bool updatingControlTints() const;
         void setUpdatingControlTints(bool);
 
@@ -336,7 +340,7 @@ namespace WebCore {
         void rotate(float angleInRadians);
         void translate(float x, float y);
         IntPoint origin();
-        
+
         void setURLForRect(const KURL&, const IntRect&);
 
         void concatCTM(const TransformationMatrix&);
@@ -418,6 +422,10 @@ namespace WebCore {
         GdkEventExpose* gdkExposeEvent() const;
 #endif
 
+#if PLATFORM(HAIKU)
+        pattern getHaikuStrokeStyle();
+#endif
+
     private:
         void savePlatformState();
         void restorePlatformState();
@@ -440,6 +448,8 @@ namespace WebCore {
         void setPlatformShadow(const IntSize&, int blur, const Color&);
         void clearPlatformShadow();
 
+        static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, const StrokeStyle&);
+
         int focusRingWidth() const;
         int focusRingOffset() const;
         const Vector<IntRect>& focusRingRects() const;
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
new file mode 100644
index 0000000..5223e05
--- /dev/null
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -0,0 +1,335 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsContext3D_h
+#define GraphicsContext3D_h
+
+#include "PlatformString.h"
+
+#include <wtf/Noncopyable.h>
+
+#if PLATFORM(MAC)
+#include <OpenGL/OpenGL.h>
+
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef GLuint Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#else
+typedef void* PlatformGraphicsContext3D;
+const  PlatformGraphicsContext3D NullPlatformGraphicsContext3D = 0;
+typedef int Platform3DObject;
+const Platform3DObject NullPlatform3DObject = 0;
+#endif
+
+namespace WebCore {
+    class CanvasArray;
+    class CanvasBuffer;
+    class CanvasUnsignedByteArray;
+    class CanvasFloatArray;
+    class CanvasFramebuffer;
+    class CanvasIntArray;
+    class CanvasProgram;
+    class CanvasRenderbuffer;
+    class CanvasRenderingContext3D;
+    class CanvasShader;
+    class CanvasTexture;
+    class HTMLCanvasElement;
+    class HTMLImageElement;
+    class HTMLVideoElement;
+    class ImageData;
+    class WebKitCSSMatrix;
+    
+    // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(CHROMIUM)
+    class GraphicsContext3DInternal;
+#endif
+
+    class GraphicsContext3D : Noncopyable {
+    public:
+        enum ShaderType { FRAGMENT_SHADER, VERTEX_SHADER };
+    
+        GraphicsContext3D();
+        virtual ~GraphicsContext3D();
+
+#if PLATFORM(MAC)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
+        Platform3DObject platformTexture() const { return m_texture; }
+#elif PLATFORM(CHROMIUM)
+        PlatformGraphicsContext3D platformGraphicsContext3D() const;
+        Platform3DObject platformTexture() const;
+#else
+        PlatformGraphicsContext3D platformGraphicsContext3D() const { return NullPlatformGraphicsContext3D; }
+        Platform3DObject platformTexture() const { return NullPlatform3DObject; }
+#endif
+        void checkError() const;
+        
+        void makeContextCurrent();
+        
+        // Helper to return the size in bytes of OpenGL data types
+        // like GL_FLOAT, GL_INT, etc.
+        int sizeInBytes(int type);
+
+        void activeTexture(unsigned long texture);
+        void attachShader(CanvasProgram* program, CanvasShader* shader);
+        void bindAttribLocation(CanvasProgram*, unsigned long index, const String& name);
+        void bindBuffer(unsigned long target, CanvasBuffer*);
+        void bindFramebuffer(unsigned long target, CanvasFramebuffer*);
+        void bindRenderbuffer(unsigned long target, CanvasRenderbuffer*);
+        void bindTexture(unsigned long target, CanvasTexture* texture);
+        void blendColor(double red, double green, double blue, double alpha);
+        void blendEquation(unsigned long mode);
+        void blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha);
+        void blendFunc(unsigned long sfactor, unsigned long dfactor);
+        void blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha);
+
+        void bufferData(unsigned long target, int size, unsigned long usage);
+        void bufferData(unsigned long target, CanvasArray* data, unsigned long usage);
+        void bufferSubData(unsigned long target, long offset, CanvasArray* data);
+
+        unsigned long checkFramebufferStatus(unsigned long target);
+        void clear(unsigned long mask);
+        void clearColor(double red, double green, double blue, double alpha);
+        void clearDepth(double depth);
+        void clearStencil(long s);
+        void colorMask(bool red, bool green, bool blue, bool alpha);
+        void compileShader(CanvasShader*);
+        
+        //void compressedTexImage2D(unsigned long target, long level, unsigned long internalformat, unsigned long width, unsigned long height, long border, unsigned long imageSize, const void* data);
+        //void compressedTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, unsigned long width, unsigned long height, unsigned long format, unsigned long imageSize, const void* data);
+        
+        void copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border);
+        void copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height);
+        void cullFace(unsigned long mode);
+        void depthFunc(unsigned long func);
+        void depthMask(bool flag);
+        void depthRange(double zNear, double zFar);
+        void detachShader(CanvasProgram*, CanvasShader*);
+        void disable(unsigned long cap);
+        void disableVertexAttribArray(unsigned long index);
+        void drawArrays(unsigned long mode, long first, long count);
+        void drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset);
+
+        void enable(unsigned long cap);
+        void enableVertexAttribArray(unsigned long index);
+        void finish();
+        void flush();
+        void framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer*);
+        void framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture*, long level);
+        void frontFace(unsigned long mode);
+        void generateMipmap(unsigned long target);
+
+        int  getAttribLocation(CanvasProgram*, const String& name);
+
+        bool getBoolean(unsigned long pname);
+        PassRefPtr<CanvasUnsignedByteArray> getBooleanv(unsigned long pname);
+        int getBufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getBufferParameteriv(unsigned long target, unsigned long pname);
+
+        unsigned long getError();
+
+        float getFloat(unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getFloatv(unsigned long pname);
+        int getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname);
+        int getInteger(unsigned long pname);
+        PassRefPtr<CanvasIntArray> getIntegerv(unsigned long pname);
+        int getProgrami(CanvasProgram*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getProgramiv(CanvasProgram*, unsigned long pname);
+        String getProgramInfoLog(CanvasProgram*);
+        int getRenderbufferParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getRenderbufferParameteriv(unsigned long target, unsigned long pname);
+        int getShaderi(CanvasShader*, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getShaderiv(CanvasShader*, unsigned long pname);
+
+        String getShaderInfoLog(CanvasShader*);
+
+        // TBD
+        // void glGetShaderPrecisionFormat (GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision);
+
+        String getShaderSource(CanvasShader*);
+        String getString(unsigned long name);
+        
+        float getTexParameterf(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getTexParameterfv(unsigned long target, unsigned long pname);
+        int getTexParameteri(unsigned long target, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getTexParameteriv(unsigned long target, unsigned long pname);
+
+        float getUniformf(CanvasProgram* program, long location);
+        PassRefPtr<CanvasFloatArray> getUniformfv(CanvasProgram* program, long location);
+        int getUniformi(CanvasProgram* program, long location);
+        PassRefPtr<CanvasIntArray> getUniformiv(CanvasProgram* program, long location);
+
+        long getUniformLocation(CanvasProgram*, const String& name);
+
+        float getVertexAttribf(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasFloatArray> getVertexAttribfv(unsigned long index, unsigned long pname);
+        int getVertexAttribi(unsigned long index, unsigned long pname);
+        PassRefPtr<CanvasIntArray> getVertexAttribiv(unsigned long index, unsigned long pname);
+        
+        long getVertexAttribOffset(unsigned long index, unsigned long pname);
+
+        void hint(unsigned long target, unsigned long mode);
+        bool isBuffer(CanvasBuffer*);
+        bool isEnabled(unsigned long cap);
+        bool isFramebuffer(CanvasFramebuffer*);
+        bool isProgram(CanvasProgram*);
+        bool isRenderbuffer(CanvasRenderbuffer*);
+        bool isShader(CanvasShader*);
+        bool isTexture(CanvasTexture*);
+        void lineWidth(double);
+        void linkProgram(CanvasProgram*);
+        void pixelStorei(unsigned long pname, long param);
+        void polygonOffset(double factor, double units);
+        
+        // TBD
+        //void readPixels(long x, long y, unsigned long width, unsigned long height, unsigned long format, unsigned long type, void* pixels);
+        
+        void releaseShaderCompiler();
+        void renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height);
+        void sampleCoverage(double value, bool invert);
+        void scissor(long x, long y, unsigned long width, unsigned long height);
+        void shaderSource(CanvasShader*, const String& string);
+        void stencilFunc(unsigned long func, long ref, unsigned long mask);
+        void stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask);
+        void stencilMask(unsigned long mask);
+        void stencilMaskSeparate(unsigned long face, unsigned long mask);
+        void stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass);
+        void stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass);
+
+        // These next several functions return an error code (0 if no errors) rather than using an ExceptionCode.
+        // Currently they return -1 on any error.
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, CanvasArray* pixels);
+        int texImage2D(unsigned target, unsigned level, unsigned internalformat,
+                       unsigned width, unsigned height, unsigned border,
+                       unsigned format, unsigned type, ImageData* pixels);
+        int texImage2D(unsigned target, unsigned level, HTMLImageElement* image,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas,
+                       bool flipY, bool premultiplyAlpha);
+        int texImage2D(unsigned target, unsigned level, HTMLVideoElement* video,
+                       bool flipY, bool premultiplyAlpha);
+
+        void texParameterf(unsigned target, unsigned pname, float param);
+        void texParameteri(unsigned target, unsigned pname, int param);
+
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, CanvasArray* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height,
+                          unsigned format, unsigned type, ImageData* pixels);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLImageElement* image,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLCanvasElement* canvas,
+                          bool flipY, bool premultiplyAlpha);
+        int texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
+                          unsigned width, unsigned height, HTMLVideoElement* video,
+                          bool flipY, bool premultiplyAlpha);
+
+        void uniform1f(long location, float x);
+        void uniform1fv(long location, float* v, int size);
+        void uniform1i(long location, int x);
+        void uniform1iv(long location, int* v, int size);
+        void uniform2f(long location, float x, float y);
+        void uniform2fv(long location, float* v, int size);
+        void uniform2i(long location, int x, int y);
+        void uniform2iv(long location, int* v, int size);
+        void uniform3f(long location, float x, float y, float z);
+        void uniform3fv(long location, float* v, int size);
+        void uniform3i(long location, int x, int y, int z);
+        void uniform3iv(long location, int* v, int size);
+        void uniform4f(long location, float x, float y, float z, float w);
+        void uniform4fv(long location, float* v, int size);
+        void uniform4i(long location, int x, int y, int z, int w);
+        void uniform4iv(long location, int* v, int size);
+        void uniformMatrix2fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix3fv(long location, bool transpose, float* value, int size);
+        void uniformMatrix4fv(long location, bool transpose, float* value, int size);
+
+        void useProgram(CanvasProgram*);
+        void validateProgram(CanvasProgram*);
+
+        void vertexAttrib1f(unsigned long indx, float x);
+        void vertexAttrib1fv(unsigned long indx, float* values);
+        void vertexAttrib2f(unsigned long indx, float x, float y);
+        void vertexAttrib2fv(unsigned long indx, float* values);
+        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long indx, float* values);
+        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long indx, float* values);
+        void vertexAttribPointer(unsigned long indx, int size, int type, bool normalized,
+                                 unsigned long stride, unsigned long offset);
+
+        void viewport(long x, long y, unsigned long width, unsigned long height);
+
+        void reshape(int width, int height);
+        
+        // Helpers for notification about paint events
+        void beginPaint(CanvasRenderingContext3D* context);
+        void endPaint();
+
+        // Support for buffer creation and deletion
+        unsigned createBuffer();
+        unsigned createFramebuffer();
+        unsigned createProgram();
+        unsigned createRenderbuffer();
+        unsigned createShader(ShaderType);
+        unsigned createTexture();
+        
+        void deleteBuffer(unsigned);
+        void deleteFramebuffer(unsigned);
+        void deleteProgram(unsigned);
+        void deleteRenderbuffer(unsigned);
+        void deleteShader(unsigned);
+        void deleteTexture(unsigned);        
+        
+    private:        
+        int m_currentWidth, m_currentHeight;
+        
+#if PLATFORM(MAC)
+        Vector<Vector<float> > m_vertexArray;
+        
+        CGLContextObj m_contextObj;
+        GLuint m_texture;
+        GLuint m_fbo;
+        GLuint m_depthBuffer;
+#endif        
+
+        // FIXME: ideally this would be used on all platforms.
+#if PLATFORM(CHROMIUM)
+        friend class GraphicsContext3DInternal;
+        OwnPtr<GraphicsContext3DInternal> m_internal;
+#endif
+    };
+
+} // namespace WebCore
+
+#endif // GraphicsContext3D_h
+
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index 7d43832..b375bd3 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -69,10 +69,11 @@ GraphicsLayer::GraphicsLayer(GraphicsLayerClient* client)
     , m_usingTiledLayer(false)
     , m_masksToBounds(false)
     , m_drawsContent(false)
-    , m_paintingPhase(GraphicsLayerPaintAllMask)
+    , m_paintingPhase(GraphicsLayerPaintAll)
     , m_geometryOrientation(CompositingCoordinatesTopDown)
     , m_contentsOrientation(CompositingCoordinatesTopDown)
     , m_parent(0)
+    , m_maskLayer(0)
 #ifndef NDEBUG
     , m_repaintCount(0)
 #endif
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 4d7668a..2924073 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -33,11 +33,15 @@
 #include "FloatPoint.h"
 #include "FloatPoint3D.h"
 #include "FloatSize.h"
+#if ENABLE(3D_CANVAS)
+#include "GraphicsContext3D.h"
+#endif
 #include "GraphicsLayerClient.h"
 #include "IntRect.h"
 #include "TransformationMatrix.h"
 #include "TransformOperations.h"
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #ifdef __OBJC__
@@ -152,7 +156,7 @@ protected:
 class GraphicsLayer {
 public:
 
-    static GraphicsLayer* createGraphicsLayer(GraphicsLayerClient*);
+    static PassOwnPtr<GraphicsLayer> create(GraphicsLayerClient*);
     
     virtual ~GraphicsLayer();
 
@@ -180,6 +184,9 @@ public:
     void removeAllChildren();
     virtual void removeFromParent();
 
+    GraphicsLayer* maskLayer() const { return m_maskLayer; }
+    virtual void setMaskLayer(GraphicsLayer* layer) { m_maskLayer = layer; }
+    
     // Offset is origin of the renderer minus origin of the graphics layer (so either zero or negative).
     IntSize offsetFromRenderer() const { return m_offsetFromRenderer; }
     void setOffsetFromRenderer(const IntSize& offset) { m_offsetFromRenderer = offset; }
@@ -229,8 +236,8 @@ public:
     virtual void setOpacity(float opacity) { m_opacity = opacity; }
 
     // Some GraphicsLayers paint only the foreground or the background content
-    GraphicsLayerPaintingPhase drawingPhase() const { return m_paintingPhase; }
-    void setDrawingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
+    GraphicsLayerPaintingPhase paintingPhase() const { return m_paintingPhase; }
+    void setPaintingPhase(GraphicsLayerPaintingPhase phase) { m_paintingPhase = phase; }
 
     virtual void setNeedsDisplay() = 0;
     // mark the given rect (in layer coords) as needing dispay. Never goes deep.
@@ -255,6 +262,10 @@ public:
     virtual void setContentsToVideo(PlatformLayer*) { }
     virtual void setContentsBackgroundColor(const Color&) { }
     
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*) { }
+    virtual void setGraphicsContext3DNeedsDisplay() { }
+#endif
     // Callback from the underlying graphics system to draw layer contents.
     void paintGraphicsLayerContents(GraphicsContext&, const IntRect& clip);
     
@@ -347,6 +358,8 @@ protected:
     Vector<GraphicsLayer*> m_children;
     GraphicsLayer* m_parent;
 
+    GraphicsLayer* m_maskLayer; // Reference to mask layer. We don't own this.
+
     IntRect m_contentsRect;
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/graphics/GraphicsLayerClient.h b/WebCore/platform/graphics/GraphicsLayerClient.h
index 8c0b7ed..5facc94 100644
--- a/WebCore/platform/graphics/GraphicsLayerClient.h
+++ b/WebCore/platform/graphics/GraphicsLayerClient.h
@@ -37,9 +37,10 @@ class IntRect;
 class FloatPoint;
 
 enum GraphicsLayerPaintingPhase {
-    GraphicsLayerPaintBackgroundMask = (1 << 0),
-    GraphicsLayerPaintForegroundMask = (1 << 1),
-    GraphicsLayerPaintAllMask = (GraphicsLayerPaintBackgroundMask | GraphicsLayerPaintForegroundMask)
+    GraphicsLayerPaintBackground = (1 << 0),
+    GraphicsLayerPaintForeground = (1 << 1),
+    GraphicsLayerPaintMask = (1 << 2),
+    GraphicsLayerPaintAll = (GraphicsLayerPaintBackground | GraphicsLayerPaintForeground | GraphicsLayerPaintMask)
 };
 
 enum AnimatedPropertyID {
diff --git a/WebCore/platform/graphics/ImageBuffer.h b/WebCore/platform/graphics/ImageBuffer.h
index 2a96d3b..9432058 100644
--- a/WebCore/platform/graphics/ImageBuffer.h
+++ b/WebCore/platform/graphics/ImageBuffer.h
@@ -50,6 +50,11 @@ namespace WebCore {
         LinearRGB
     };
 
+    enum Multiply {
+        Premultiplied,
+        Unmultiplied
+    };
+
     class ImageBuffer : public Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
@@ -71,8 +76,11 @@ namespace WebCore {
 
         void clearImage() { m_image.clear(); }
 
-        PassRefPtr<ImageData> getImageData(const IntRect& rect) const;
-        void putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint);
+        PassRefPtr<ImageData> getUnmultipliedImageData(const IntRect&) const;
+        PassRefPtr<ImageData> getPremultipliedImageData(const IntRect&) const;
+
+        void putUnmultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
+        void putPremultipliedImageData(ImageData*, const IntRect& sourceRect, const IntPoint& destPoint);
 
         String toDataURL(const String& mimeType) const;
 #if !PLATFORM(CG)
diff --git a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp b/WebCore/platform/graphics/ImageSource.cpp
index df62618..bf7ae21 100644
--- a/WebCore/platform/graphics/cairo/ImageSourceCairo.cpp
+++ b/WebCore/platform/graphics/ImageSource.cpp
@@ -1,6 +1,8 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp.toker@collabora.co.uk>
+ * Copyright (C) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,64 +29,20 @@
 #include "config.h"
 #include "ImageSource.h"
 
-#if PLATFORM(CAIRO)
+#if PLATFORM(QT)
+#include "ImageDecoderQt.h"
+#else
+#include "ImageDecoder.h"
+#endif
 
-#include "BMPImageDecoder.h"
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "PNGImageDecoder.h"
-#include "XBMImageDecoder.h"
-#include "SharedBuffer.h"
-#include <cairo.h>
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#ifndef IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS
+#define IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS (1024 * 1024)
+#endif
+#endif
 
 namespace WebCore {
 
-ImageDecoder* createDecoder(const Vector<char>& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
 ImageSource::ImageSource()
     : m_decoder(0)
 {
@@ -120,53 +78,41 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
     // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
     // If insufficient bytes are available to determine the image type, no decoder plugin will be
     // made.
-    if (!m_decoder)
-        m_decoder = createDecoder(data->buffer());
-
-    if (!m_decoder)
-        return;
+    if (!m_decoder) {
+        m_decoder = static_cast<NativeImageSourcePtr>(ImageDecoder::create(*data));
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        if (m_decoder)
+            m_decoder->setMaxNumPixels(IMAGE_DECODER_DOWN_SAMPLING_MAX_NUMBER_OF_PIXELS);
+#endif
+    }
 
-    m_decoder->setData(data, allDataReceived);
+    if (m_decoder)
+        m_decoder->setData(data, allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
 {
-    if (!m_decoder)
-        return String();
-
-    return m_decoder->filenameExtension();
+    return m_decoder ? m_decoder->filenameExtension() : String();
 }
 
 bool ImageSource::isSizeAvailable()
 {
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
+    return m_decoder && m_decoder->isSizeAvailable();
 }
 
 IntSize ImageSource::size() const
 {
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
+    return m_decoder ? m_decoder->size() : IntSize();
 }
 
 IntSize ImageSource::frameSizeAtIndex(size_t index) const
 {
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
+    return m_decoder ? m_decoder->frameSizeAtIndex(index) : IntSize();
 }
 
 int ImageSource::repetitionCount()
 {
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
+    return m_decoder ? m_decoder->repetitionCount() : cAnimationNone;
 }
 
 size_t ImageSource::frameCount() const
@@ -176,9 +122,6 @@ size_t ImageSource::frameCount() const
 
 NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
 {
-    if (!initialized())
-        return 0;
-
     if (!m_decoder)
         return 0;
 
@@ -186,23 +129,16 @@ NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
     if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
         return 0;
 
-    // Cairo does not like zero height images.
-    // If we have a zero height image, just pretend we don't have enough data yet.
-    if (!size().height())
+    // Zero-height images can cause problems for some ports.  If we have an
+    // empty image dimension, just bail.
+    if (size().isEmpty())
         return 0;
 
+    // Return the buffer contents as a native image.  For some ports, the data
+    // is already in a native container, and this just increments its refcount.
     return buffer->asNewNativeImage();
 }
 
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
-}
-
 float ImageSource::frameDurationAtIndex(size_t index)
 {
     if (!m_decoder)
@@ -223,17 +159,23 @@ float ImageSource::frameDurationAtIndex(size_t index)
 
 bool ImageSource::frameHasAlphaAtIndex(size_t index)
 {
-    // When a frame has not finished decoding, always mark it as having alpha,
-    // so we don't get a black background for the undecoded sections.
-    // TODO: A better solution is probably to have the underlying buffer's
-    // hasAlpha() return true in these cases, since it is, in fact, technically
-    // true.
-    if (!frameIsCompleteAtIndex(index))
-        return true;
-
-    return m_decoder->frameBufferAtIndex(index)->hasAlpha();
+    // When a frame has not finished decoding, always mark it as having alpha.
+    // Ports that check the result of this function to determine their
+    // compositing op need this in order to not draw the undecoded portion as
+    // black.
+    // TODO: Perhaps we should ensure that each individual decoder returns true
+    // in this case.
+    return !frameIsCompleteAtIndex(index)
+        || m_decoder->frameBufferAtIndex(index)->hasAlpha();
 }
 
+bool ImageSource::frameIsCompleteAtIndex(size_t index)
+{
+    if (!m_decoder)
+        return false;
+
+    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
+    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
 }
 
-#endif // PLATFORM(CAIRO)
+}
diff --git a/WebCore/platform/graphics/ImageSource.h b/WebCore/platform/graphics/ImageSource.h
index 173d50b..eabeeab 100644
--- a/WebCore/platform/graphics/ImageSource.h
+++ b/WebCore/platform/graphics/ImageSource.h
@@ -51,6 +51,8 @@ class SkBitmapRef;
 class PrivateAndroidImageSourceRec;
 #elif PLATFORM(SKIA)
 class NativeImageSkia;
+#elif PLATFORM(HAIKU)
+class BBitmap;
 #elif PLATFORM(WINCE)
 #include "SharedBitmap.h"
 #endif
@@ -61,22 +63,14 @@ class IntSize;
 class SharedBuffer;
 class String;
 
-#if PLATFORM(WX)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
-typedef const Vector<char>* NativeBytePtr;
-#if USE(WXGC)
-typedef wxGraphicsBitmap* NativeImagePtr;
-#else
-typedef wxBitmap* NativeImagePtr;
-#endif
-#elif PLATFORM(CG)
+#if PLATFORM(CG)
 typedef CGImageSourceRef NativeImageSourcePtr;
 typedef CGImageRef NativeImagePtr;
 #elif PLATFORM(QT)
 class ImageDecoderQt;
 typedef ImageDecoderQt* NativeImageSourcePtr;
 typedef QPixmap* NativeImagePtr;
+<<<<<<< HEAD:WebCore/platform/graphics/ImageSource.h
 #elif PLATFORM(ANDROID)
 #if PLATFORM(SGL)
 class String;
@@ -98,18 +92,27 @@ typedef ImageDecoder* NativeImageSourcePtr;
 typedef NativeImageSkia* NativeImagePtr;
 #endif
 #elif PLATFORM(CAIRO)
+=======
+#else
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/ImageSource.h
 class ImageDecoder;
 typedef ImageDecoder* NativeImageSourcePtr;
+#if PLATFORM(WX)
+#if USE(WXGC)
+typedef wxGraphicsBitmap* NativeImagePtr;
+#else
+typedef wxBitmap* NativeImagePtr;
+#endif
+#elif PLATFORM(CAIRO)
 typedef cairo_surface_t* NativeImagePtr;
 #elif PLATFORM(SKIA)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
 typedef NativeImageSkia* NativeImagePtr;
+#elif PLATFORM(HAIKU)
+typedef BBitmap* NativeImagePtr;
 #elif PLATFORM(WINCE)
-class ImageDecoder;
-typedef ImageDecoder* NativeImageSourcePtr;
 typedef RefPtr<SharedBitmap> NativeImagePtr;
 #endif
+#endif
 
 const int cAnimationLoopOnce = -1;
 const int cAnimationNone = -2;
diff --git a/WebCore/platform/graphics/IntPoint.h b/WebCore/platform/graphics/IntPoint.h
index e6d4816..afbfb46 100644
--- a/WebCore/platform/graphics/IntPoint.h
+++ b/WebCore/platform/graphics/IntPoint.h
@@ -55,6 +55,8 @@ class QPoint;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkPoint GdkPoint;
+#elif PLATFORM(HAIKU)
+class BPoint;
 #endif
 
 #if PLATFORM(WX)
@@ -121,6 +123,9 @@ public:
 #elif PLATFORM(GTK)
     IntPoint(const GdkPoint&);
     operator GdkPoint() const;
+#elif PLATFORM(HAIKU)
+    explicit IntPoint(const BPoint&);
+    operator BPoint() const;
 #endif
 
 #if PLATFORM(WX)
diff --git a/WebCore/platform/graphics/IntRect.h b/WebCore/platform/graphics/IntRect.h
index 0b607f5..cd912ff 100644
--- a/WebCore/platform/graphics/IntRect.h
+++ b/WebCore/platform/graphics/IntRect.h
@@ -33,7 +33,7 @@
 typedef struct CGRect CGRect;
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 #ifdef NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES
 typedef struct CGRect NSRect;
 #else
@@ -49,6 +49,8 @@ class QRect;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
 typedef struct _GdkRectangle GdkRectangle;
+#elif PLATFORM(HAIKU)
+class BRect;
 #endif
 
 #if PLATFORM(WX)
@@ -144,6 +146,9 @@ public:
 #elif PLATFORM(GTK)
     IntRect(const GdkRectangle&);
     operator GdkRectangle() const;
+#elif PLATFORM(HAIKU)
+    explicit IntRect(const BRect&);
+    operator BRect() const;
 #endif
 
 #if PLATFORM(CG)
@@ -156,7 +161,8 @@ public:
     operator SkIRect() const;
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
     operator NSRect() const;
 #endif
 
@@ -193,7 +199,8 @@ inline bool operator!=(const IntRect& a, const IntRect& b)
 IntRect enclosingIntRect(const CGRect&);
 #endif
 
-#if PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)
+#if (PLATFORM(MAC) && !defined(NSGEOMETRY_TYPES_SAME_AS_CGGEOMETRY_TYPES)) \
+        || (PLATFORM(CHROMIUM) && PLATFORM(DARWIN))
 IntRect enclosingIntRect(const NSRect&);
 #endif
 
diff --git a/WebCore/platform/graphics/IntSize.h b/WebCore/platform/graphics/IntSize.h
index dc7a85d..b242784 100644
--- a/WebCore/platform/graphics/IntSize.h
+++ b/WebCore/platform/graphics/IntSize.h
@@ -47,6 +47,12 @@ typedef struct tagSIZE SIZE;
 QT_BEGIN_NAMESPACE
 class QSize;
 QT_END_NAMESPACE
+#elif PLATFORM(HAIKU)
+class BSize;
+#endif
+
+#if PLATFORM(WX)
+class wxSize;
 #endif
 
 namespace WebCore {
@@ -113,6 +119,15 @@ public:
     operator QSize() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    explicit IntSize(const BSize&);
+    operator BSize() const;
+#endif
+
+#if PLATFORM(WX)
+    IntSize(const wxSize&);
+    operator wxSize() const;
+#endif
 
 private:
     int m_width, m_height;
diff --git a/WebCore/platform/graphics/MediaPlayer.cpp b/WebCore/platform/graphics/MediaPlayer.cpp
index 8792640..3898386 100644
--- a/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/WebCore/platform/graphics/MediaPlayer.cpp
@@ -35,10 +35,11 @@
 #include "FrameView.h"
 #include "Frame.h"
 #include "Document.h"
+#include "TimeRanges.h"
 
 #if PLATFORM(MAC)
 #include "MediaPlayerPrivateQTKit.h"
-#elif PLATFORM(WINCE)
+#elif PLATFORM(WINCE) && !PLATFORM(QT)
 #include "MediaPlayerPrivateWince.h"
 #elif PLATFORM(WIN)
 #include "MediaPlayerPrivateQuickTimeWin.h"
@@ -67,11 +68,12 @@ public:
     virtual void play() { }
     virtual void pause() { }    
 
-    virtual bool supportsFullscreen() const { return false; }
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
 
     virtual IntSize naturalSize() const { return IntSize(0, 0); }
 
     virtual bool hasVideo() const { return false; }
+    virtual bool hasAudio() const { return false; }
 
     virtual void setVisible(bool) { }
 
@@ -93,7 +95,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const { return MediaPlayer::HaveNothing; }
 
     virtual float maxTimeSeekable() const { return 0; }
-    virtual float maxTimeBuffered() const { return 0; }
+    virtual PassRefPtr<TimeRanges> buffered() const { return TimeRanges::create(); }
 
     virtual int dataRate() const { return 0; }
 
@@ -260,11 +262,19 @@ bool MediaPlayer::canLoadPoster() const
 {
     return m_private->canLoadPoster();
 }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 void MediaPlayer::setPoster(const String& url)
 {
     m_private->setPoster(url);
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 }
+=======
+}    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 
 void MediaPlayer::cancelLoad()
 {
@@ -275,7 +285,11 @@ void MediaPlayer::prepareToPlay()
 {
     m_private->prepareToPlay();
 }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayer.cpp
 
+=======
+    
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayer.cpp
 void MediaPlayer::play()
 {
     m_private->play();
@@ -331,11 +345,16 @@ IntSize MediaPlayer::naturalSize()
     return m_private->naturalSize();
 }
 
-bool MediaPlayer::hasVideo()
+bool MediaPlayer::hasVideo() const
 {
     return m_private->hasVideo();
 }
 
+bool MediaPlayer::hasAudio() const
+{
+    return m_private->hasAudio();
+}
+
 bool MediaPlayer::inMediaDocument()
 {
     Frame* frame = m_frameView ? m_frameView->frame() : 0;
@@ -344,6 +363,11 @@ bool MediaPlayer::inMediaDocument()
     return document && document->isMediaDocument();
 }
 
+PlatformMedia MediaPlayer::platformMedia() const
+{
+    return m_private->platformMedia();
+}
+
 MediaPlayer::NetworkState MediaPlayer::networkState()
 {
     return m_private->networkState();
@@ -397,9 +421,9 @@ void MediaPlayer::setEndTime(float time)
     m_private->setEndTime(time);
 }
 
-float MediaPlayer::maxTimeBuffered()
+PassRefPtr<TimeRanges> MediaPlayer::buffered()
 {
-    return m_private->maxTimeBuffered();
+    return m_private->buffered();
 }
 
 float MediaPlayer::maxTimeSeekable()
diff --git a/WebCore/platform/graphics/MediaPlayer.h b/WebCore/platform/graphics/MediaPlayer.h
index d0220ed..4cc6476 100644
--- a/WebCore/platform/graphics/MediaPlayer.h
+++ b/WebCore/platform/graphics/MediaPlayer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,8 +38,24 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/Noncopyable.h>
 
+#ifdef __OBJC__
+@class QTMovie;
+#else
+class QTMovie;
+#endif
+
 namespace WebCore {
 
+// Structure that will hold every native
+// types supported by the current media player.
+// We have to do that has multiple media players
+// backend can live at runtime.
+typedef struct PlatformMedia {
+    QTMovie* qtMovie;
+} PlatformMedia;
+
+static const PlatformMedia NoPlatformMedia = { 0 };
+
 class ContentType;
 class FrameView;
 class GraphicsContext;
@@ -48,6 +64,7 @@ class IntSize;
 class MediaPlayer;
 class MediaPlayerPrivateInterface;
 class String;
+class TimeRanges;
 
 #if USE(ACCELERATED_COMPOSITING)
 class GraphicsLayer;
@@ -109,8 +126,11 @@ public:
 
     bool supportsFullscreen() const;
     bool supportsSave() const;
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize();
-    bool hasVideo();
+    bool hasVideo() const;
+    bool hasAudio() const;
     
     void setFrameView(FrameView* frameView) { m_frameView = frameView; }
     FrameView* frameView() { return m_frameView; }
@@ -146,7 +166,7 @@ public:
     bool preservesPitch() const;    
     void setPreservesPitch(bool);
     
-    float maxTimeBuffered();
+    PassRefPtr<TimeRanges> buffered();
     float maxTimeSeekable();
 
     unsigned bytesLoaded();
diff --git a/WebCore/platform/graphics/MediaPlayerPrivate.h b/WebCore/platform/graphics/MediaPlayerPrivate.h
index de7f75c..925e563 100644
--- a/WebCore/platform/graphics/MediaPlayerPrivate.h
+++ b/WebCore/platform/graphics/MediaPlayerPrivate.h
@@ -44,6 +44,11 @@ public:
     virtual void cancelLoad() = 0;
     
     virtual void prepareToPlay() { }
+<<<<<<< HEAD:WebCore/platform/graphics/MediaPlayerPrivate.h
+=======
+    virtual PlatformMedia platformMedia() const { return NoPlatformMedia; }
+
+>>>>>>> webkit.org at 49305:WebCore/platform/graphics/MediaPlayerPrivate.h
     virtual void play() = 0;
     virtual void pause() = 0;    
 
@@ -53,6 +58,7 @@ public:
     virtual IntSize naturalSize() const = 0;
 
     virtual bool hasVideo() const = 0;
+    virtual bool hasAudio() const = 0;
 
     virtual void setVisible(bool) = 0;
 
@@ -77,7 +83,7 @@ public:
     virtual MediaPlayer::ReadyState readyState() const = 0;
 
     virtual float maxTimeSeekable() const = 0;
-    virtual float maxTimeBuffered() const = 0;
+    virtual PassRefPtr<TimeRanges> buffered() const = 0;
 
     virtual int dataRate() const = 0;
 
diff --git a/WebCore/platform/graphics/Path.h b/WebCore/platform/graphics/Path.h
index da324bc..6b617a0 100644
--- a/WebCore/platform/graphics/Path.h
+++ b/WebCore/platform/graphics/Path.h
@@ -52,6 +52,9 @@ typedef WebCore::CairoPath PlatformPath;
 #elif PLATFORM(SKIA)
 class SkPath;
 typedef SkPath PlatformPath;
+#elif PLATFORM(HAIKU)
+class BRegion;
+typedef BRegion PlatformPath;
 #elif PLATFORM(WINCE)
 namespace WebCore {
     class PlatformPath;
diff --git a/WebCore/platform/graphics/Pattern.h b/WebCore/platform/graphics/Pattern.h
index 02ad3ec..2f1192c 100644
--- a/WebCore/platform/graphics/Pattern.h
+++ b/WebCore/platform/graphics/Pattern.h
@@ -53,6 +53,9 @@ typedef wxGraphicsBrush* PlatformPatternPtr;
 class wxBrush;
 typedef wxBrush* PlatformPatternPtr;
 #endif // USE(WXGC)
+#elif PLATFORM(HAIKU)
+#include <interface/GraphicsDefs.h>
+typedef pattern* PlatformPatternPtr;
 #elif PLATFORM(WINCE)
 typedef void* PlatformPatternPtr;
 #endif
diff --git a/WebCore/platform/graphics/SimpleFontData.cpp b/WebCore/platform/graphics/SimpleFontData.cpp
index c879228..2ec8abb 100644
--- a/WebCore/platform/graphics/SimpleFontData.cpp
+++ b/WebCore/platform/graphics/SimpleFontData.cpp
@@ -48,7 +48,9 @@ using namespace std;
 namespace WebCore {
 
 SimpleFontData::SimpleFontData(const FontPlatformData& f, bool customFont, bool loading, SVGFontData* svgFontData)
-    : m_unitsPerEm(defaultUnitsPerEm)
+    : m_maxCharWidth(-1)
+    , m_avgCharWidth(-1)
+    , m_unitsPerEm(defaultUnitsPerEm)
     , m_platformData(f)
     , m_treatAsFixedPitch(false)
 #if ENABLE(SVG_FONTS)
diff --git a/WebCore/platform/graphics/SimpleFontData.h b/WebCore/platform/graphics/SimpleFontData.h
index cb472b0..387a5c7 100644
--- a/WebCore/platform/graphics/SimpleFontData.h
+++ b/WebCore/platform/graphics/SimpleFontData.h
@@ -2,6 +2,7 @@
  * This file is part of the internal font implementation.
  *
  * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,13 +28,14 @@
 #include "FontPlatformData.h"
 #include "GlyphPageTreeNode.h"
 #include "GlyphWidthMap.h"
+#include "TextRenderingMode.h"
 #include <wtf/OwnPtr.h>
 
 #if USE(ATSUI)
 typedef struct OpaqueATSUStyle* ATSUStyle;
 #endif
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
 #include <usp10.h>
 #endif
 
@@ -45,6 +47,10 @@ typedef struct OpaqueATSUStyle* ATSUStyle;
 #include <QFont>
 #endif
 
+#if PLATFORM(HAIKU)
+#include <Font.h>
+#endif
+
 namespace WebCore {
 
 class FontDescription;
@@ -115,7 +121,7 @@ public:
 
 #if USE(CORE_TEXT)
     CTFontRef getCTFont() const;
-    CFDictionaryRef getCFStringAttributes() const;
+    CFDictionaryRef getCFStringAttributes(TextRenderingMode) const;
 #endif
 
 #if USE(ATSUI)
@@ -134,17 +140,14 @@ public:
 
 #if PLATFORM(WIN)
     bool isSystemFont() const { return m_isSystemFont; }
+#if !PLATFORM(WINCE)    // disable unused members to save space
     SCRIPT_FONTPROPERTIES* scriptFontProperties() const;
     SCRIPT_CACHE* scriptCache() const { return &m_scriptCache; }
-
+#endif
     static void setShouldApplyMacAscentHack(bool);
     static bool shouldApplyMacAscentHack();
 #endif
 
-#if PLATFORM(CAIRO)
-    void setFont(cairo_t*) const;
-#endif
-
 #if PLATFORM(WX)
     wxFont* getWxFont() const { return m_platformData.font(); }
 #endif
@@ -159,7 +162,7 @@ private:
 
     void commonInit();
 
-#if PLATFORM(WIN)
+#if PLATFORM(WIN) && !PLATFORM(WINCE)
     void initGDIFont();
     void platformCommonDestroy();
     float widthForGDIGlyph(Glyph glyph) const;
@@ -224,9 +227,11 @@ private:
 
 #if PLATFORM(WIN)
     bool m_isSystemFont;
+#if !PLATFORM(WINCE)    // disable unused members to save space
     mutable SCRIPT_CACHE m_scriptCache;
     mutable SCRIPT_FONTPROPERTIES* m_scriptFontProperties;
 #endif
+#endif
 };
     
     
diff --git a/WebCore/platform/graphics/TextRenderingMode.h b/WebCore/platform/graphics/TextRenderingMode.h
new file mode 100644
index 0000000..4f817a4
--- /dev/null
+++ b/WebCore/platform/graphics/TextRenderingMode.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextRenderingMode_h
+#define TextRenderingMode_h
+
+namespace WebCore {
+
+    enum TextRenderingMode { AutoTextRendering, OptimizeSpeed, OptimizeLegibility, GeometricPrecision };
+    
+} // namespace WebCore
+
+#endif // TextRenderingMode_h
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index 0f7ae79..1a951c2 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -46,7 +46,7 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
     cairo_t* cr = context->platformContext();
     cairo_save(cr);
 
-    font->setFont(cr);
+    cairo_set_scaled_font(cr, font->platformData().scaledFont());
 
     GlyphBufferGlyph* glyphs = (GlyphBufferGlyph*)glyphBuffer.glyphs(from);
 
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 5765546..de8afb3 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -31,7 +31,6 @@
 
 #if PLATFORM(CAIRO)
 
-#include "TransformationMatrix.h"
 #include "CairoPath.h"
 #include "FloatRect.h"
 #include "Font.h"
@@ -41,6 +40,7 @@
 #include "Path.h"
 #include "Pattern.h"
 #include "SimpleFontData.h"
+#include "TransformationMatrix.h"
 
 #include <cairo.h>
 #include <math.h>
@@ -53,8 +53,8 @@
 #elif PLATFORM(WIN)
 #include <cairo-win32.h>
 #endif
-#include "GraphicsContextPrivate.h"
 #include "GraphicsContextPlatformPrivateCairo.h"
+#include "GraphicsContextPrivate.h"
 
 #ifndef M_PI
 #define M_PI 3.14159265358979323846
@@ -142,38 +142,6 @@ void GraphicsContext::drawRect(const IntRect& rect)
     cairo_restore(cr);
 }
 
-// FIXME: Now that this is refactored, it should be shared by all contexts.
-static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth, StrokeStyle style)
-{
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
-    // works out.  For example, with a border width of 3, KHTML will pass us (y1+y2)/2, e.g.,
-    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
-    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
-    if (style == DottedStroke || style == DashedStroke) {
-        if (p1.x() == p2.x()) {
-            p1.setY(p1.y() + strokeWidth);
-            p2.setY(p2.y() - strokeWidth);
-        }
-        else {
-            p1.setX(p1.x() + strokeWidth);
-            p2.setX(p2.x() - strokeWidth);
-        }
-    }
-
-    if (static_cast<int>(strokeWidth) % 2) {
-        if (p1.x() == p2.x()) {
-            // We're a vertical line.  Adjust our x.
-            p1.setX(p1.x() + 0.5);
-            p2.setX(p2.x() + 0.5);
-        }
-        else {
-            // We're a horizontal line. Adjust our y.
-            p1.setY(p1.y() + 0.5);
-            p2.setY(p2.y() + 0.5);
-        }
-    }
-}
-
 // This is only used to draw borders.
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 {
@@ -239,20 +207,18 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0;
         else {
-            bool evenNumberOfSegments = numSegments%2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
                 if (remainder) {
                     patternOffset += patWidth - remainder;
-                    patternOffset += remainder/2;
-                }
-                else
-                    patternOffset = patWidth/2;
-            }
-            else if (!evenNumberOfSegments) {
+                    patternOffset += remainder / 2;
+                } else
+                    patternOffset = patWidth / 2;
+            } else if (!evenNumberOfSegments) {
                 if (remainder)
-                    patternOffset = (patWidth - remainder)/2;
+                    patternOffset = (patWidth - remainder) / 2;
             }
         }
 
@@ -318,7 +284,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     if (w != h)
         cairo_scale(cr, 1., scaleFactor);
-    
+
     cairo_arc_negative(cr, x + hRadius, (y + vRadius) * reverseScaleFactor, hRadius, -fa * M_PI/180, -falen * M_PI/180);
 
     if (w != h)
@@ -326,16 +292,16 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     float width = strokeThickness();
     int patWidth = 0;
-    
+
     switch (strokeStyle()) {
-        case DottedStroke:
-            patWidth = static_cast<int>(width / 2);
-            break;
-        case DashedStroke:
-            patWidth = 3 * static_cast<int>(width / 2);
-            break;
-        default:
-            break;
+    case DottedStroke:
+        patWidth = static_cast<int>(width / 2);
+        break;
+    case DashedStroke:
+        patWidth = 3 * static_cast<int>(width / 2);
+        break;
+    default:
+        break;
     }
 
     setColor(cr, strokeColor());
@@ -349,7 +315,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             distance = static_cast<int>((M_PI * hRadius) / 2.0);
         else // We are elliptical and will have to estimate the distance
             distance = static_cast<int>((M_PI * sqrtf((hRadius * hRadius + vRadius * vRadius) / 2.0)) / 2.0);
-        
+
         int remainder = distance % patWidth;
         int coverage = distance - remainder;
         int numSegments = coverage / patWidth;
@@ -359,7 +325,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         if (patWidth == 1)
             patternOffset = 1.0;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -828,15 +794,15 @@ void GraphicsContext::setLineCap(LineCap lineCap)
 
     cairo_line_cap_t cairoCap = CAIRO_LINE_CAP_BUTT;
     switch (lineCap) {
-        case ButtCap:
-            // no-op
-            break;
-        case RoundCap:
-            cairoCap = CAIRO_LINE_CAP_ROUND;
-            break;
-        case SquareCap:
-            cairoCap = CAIRO_LINE_CAP_SQUARE;
-            break;
+    case ButtCap:
+        // no-op
+        break;
+    case RoundCap:
+        cairoCap = CAIRO_LINE_CAP_ROUND;
+        break;
+    case SquareCap:
+        cairoCap = CAIRO_LINE_CAP_SQUARE;
+        break;
     }
     cairo_set_line_cap(m_data->cr, cairoCap);
 }
@@ -853,15 +819,15 @@ void GraphicsContext::setLineJoin(LineJoin lineJoin)
 
     cairo_line_join_t cairoJoin = CAIRO_LINE_JOIN_MITER;
     switch (lineJoin) {
-        case MiterJoin:
-            // no-op
-            break;
-        case RoundJoin:
-            cairoJoin = CAIRO_LINE_JOIN_ROUND;
-            break;
-        case BevelJoin:
-            cairoJoin = CAIRO_LINE_JOIN_BEVEL;
-            break;
+    case MiterJoin:
+        // no-op
+        break;
+    case RoundJoin:
+        cairoJoin = CAIRO_LINE_JOIN_ROUND;
+        break;
+    case BevelJoin:
+        cairoJoin = CAIRO_LINE_JOIN_BEVEL;
+        break;
     }
     cairo_set_line_join(m_data->cr, cairoJoin);
 }
@@ -887,37 +853,37 @@ float GraphicsContext::getAlpha()
 static inline cairo_operator_t toCairoOperator(CompositeOperator op)
 {
     switch (op) {
-        case CompositeClear:
-            return CAIRO_OPERATOR_CLEAR;
-        case CompositeCopy:
-            return CAIRO_OPERATOR_SOURCE;
-        case CompositeSourceOver:
-            return CAIRO_OPERATOR_OVER;
-        case CompositeSourceIn:
-            return CAIRO_OPERATOR_IN;
-        case CompositeSourceOut:
-            return CAIRO_OPERATOR_OUT;
-        case CompositeSourceAtop:
-            return CAIRO_OPERATOR_ATOP;
-        case CompositeDestinationOver:
-            return CAIRO_OPERATOR_DEST_OVER;
-        case CompositeDestinationIn:
-            return CAIRO_OPERATOR_DEST_IN;
-        case CompositeDestinationOut:
-            return CAIRO_OPERATOR_DEST_OUT;
-        case CompositeDestinationAtop:
-            return CAIRO_OPERATOR_DEST_ATOP;
-        case CompositeXOR:
-            return CAIRO_OPERATOR_XOR;
-        case CompositePlusDarker:
-            return CAIRO_OPERATOR_SATURATE;
-        case CompositeHighlight:
-            // There is no Cairo equivalent for CompositeHighlight.
-            return CAIRO_OPERATOR_OVER;
-        case CompositePlusLighter:
-            return CAIRO_OPERATOR_ADD;
-        default:
-            return CAIRO_OPERATOR_SOURCE;
+    case CompositeClear:
+        return CAIRO_OPERATOR_CLEAR;
+    case CompositeCopy:
+        return CAIRO_OPERATOR_SOURCE;
+    case CompositeSourceOver:
+        return CAIRO_OPERATOR_OVER;
+    case CompositeSourceIn:
+        return CAIRO_OPERATOR_IN;
+    case CompositeSourceOut:
+        return CAIRO_OPERATOR_OUT;
+    case CompositeSourceAtop:
+        return CAIRO_OPERATOR_ATOP;
+    case CompositeDestinationOver:
+        return CAIRO_OPERATOR_DEST_OVER;
+    case CompositeDestinationIn:
+        return CAIRO_OPERATOR_DEST_IN;
+    case CompositeDestinationOut:
+        return CAIRO_OPERATOR_DEST_OUT;
+    case CompositeDestinationAtop:
+        return CAIRO_OPERATOR_DEST_ATOP;
+    case CompositeXOR:
+        return CAIRO_OPERATOR_XOR;
+    case CompositePlusDarker:
+        return CAIRO_OPERATOR_SATURATE;
+    case CompositeHighlight:
+        // There is no Cairo equivalent for CompositeHighlight.
+        return CAIRO_OPERATOR_OVER;
+    case CompositePlusLighter:
+        return CAIRO_OPERATOR_ADD;
+    default:
+        return CAIRO_OPERATOR_SOURCE;
     }
 }
 
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index c905ee8..0213944 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -138,16 +138,17 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     }
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& data, const IntSize& size)
 {
-    ASSERT(cairo_surface_get_type(m_data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+    ASSERT(cairo_surface_get_type(data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
 
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
-    unsigned char* dataSrc = cairo_image_surface_get_data(m_data.m_surface);
+    unsigned char* dataSrc = cairo_image_surface_get_data(data.m_surface);
     unsigned char* dataDst = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
-        memset(dataSrc, 0, result->data()->length());
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
+        memset(dataDst, 0, result->data()->length());
 
     int originx = rect.x();
     int destx = 0;
@@ -156,8 +157,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -167,11 +168,11 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    int stride = cairo_image_surface_get_stride(m_data.m_surface);
+    int stride = cairo_image_surface_get_stride(data.m_surface);
     unsigned destBytesPerRow = 4 * rect.width();
 
     unsigned char* destRows = dataDst + desty * destBytesPerRow + destx * 4;
@@ -180,7 +181,11 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned* pixel = row + x + originx;
-            Color pixelColor = colorFromPremultipliedARGB(*pixel);
+            Color pixelColor;
+            if (multiplied == Unmultiplied)
+                pixelColor = colorFromPremultipliedARGB(*pixel);
+            else
+                pixelColor = Color(*pixel);
             destRows[basex]     = pixelColor.red();
             destRows[basex + 1] = pixelColor.green();
             destRows[basex + 2] = pixelColor.blue();
@@ -192,11 +197,22 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
-    ASSERT(cairo_surface_get_type(m_data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
 
-    unsigned char* dataDst = cairo_image_surface_get_data(m_data.m_surface);
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& data, const IntSize& size)
+{
+    ASSERT(cairo_surface_get_type(data.m_surface) == CAIRO_SURFACE_TYPE_IMAGE);
+
+    unsigned char* dataDst = cairo_image_surface_get_data(data.m_surface);
 
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -204,28 +220,28 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
-    int stride = cairo_image_surface_get_stride(m_data.m_surface);
+    int stride = cairo_image_surface_get_stride(data.m_surface);
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
@@ -237,12 +253,25 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
                     srcRows[basex + 1],
                     srcRows[basex + 2],
                     srcRows[basex + 3]);
-            *pixel = premultipliedARGBFromColor(pixelColor);
+            if (multiplied == Unmultiplied)
+                *pixel = premultipliedARGBFromColor(pixelColor);
+            else
+                *pixel = pixelColor.rgb();
         }
         srcRows += srcBytesPerRow;
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
 static cairo_status_t writeFunction(void* closure, const unsigned char* data, unsigned int length)
 {
     Vector<char>* in = reinterpret_cast<Vector<char>*>(closure);
diff --git a/WebCore/platform/graphics/cg/ColorCG.cpp b/WebCore/platform/graphics/cg/ColorCG.cpp
index 0465c0b..40aacc5 100644
--- a/WebCore/platform/graphics/cg/ColorCG.cpp
+++ b/WebCore/platform/graphics/cg/ColorCG.cpp
@@ -29,6 +29,7 @@
 #if PLATFORM(CG)
 
 #include <wtf/Assertions.h>
+#include <wtf/RetainPtr.h>
 #include <ApplicationServices/ApplicationServices.h>
 
 namespace WebCore {
@@ -75,13 +76,12 @@ CGColorRef createCGColor(const Color& c)
     CMProfileRef prof = NULL;
     CMGetSystemProfile(&prof);
 
-    CGColorSpaceRef rgbSpace = CGColorSpaceCreateWithPlatformColorSpace(prof);
+    RetainPtr<CGColorSpaceRef> rgbSpace(AdoptCF, CGColorSpaceCreateWithPlatformColorSpace(prof));
 
-    if (rgbSpace != NULL)
-    {
-        float components[4] = {c.red() / 255.0f, c.green() / 255.0f, c.blue() / 255.0f, c.alpha() / 255.0f};
-        color = CGColorCreate(rgbSpace, components);
-        CGColorSpaceRelease(rgbSpace);
+    if (rgbSpace) {
+        CGFloat components[4] = { static_cast<CGFloat>(c.red()) / 255, static_cast<CGFloat>(c.green()) / 255,
+                                  static_cast<CGFloat>(c.blue()) / 255, static_cast<CGFloat>(c.alpha()) / 255 };
+        color = CGColorCreate(rgbSpace.get(), components);
     }
 
     CMCloseProfile(prof);
diff --git a/WebCore/platform/graphics/cg/GradientCG.cpp b/WebCore/platform/graphics/cg/GradientCG.cpp
index c189fd5..05a0aad 100644
--- a/WebCore/platform/graphics/cg/GradientCG.cpp
+++ b/WebCore/platform/graphics/cg/GradientCG.cpp
@@ -58,17 +58,14 @@ CGShadingRef Gradient::platformGradient()
     const CGFloat intervalRanges[2] = { 0, 1 };
     const CGFloat colorComponentRanges[4 * 2] = { 0, 1, 0, 1, 0, 1, 0, 1 };
     const CGFunctionCallbacks gradientCallbacks = { 0, gradientCallback, 0 };
-    CGFunctionRef colorFunction = CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks);
+    RetainPtr<CGFunctionRef> colorFunction(AdoptCF, CGFunctionCreate(this, 1, intervalRanges, 4, colorComponentRanges, &gradientCallbacks));
 
-    CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
+    static CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceRGB();
 
     if (m_radial)
-        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction, true, true);
+        m_gradient = CGShadingCreateRadial(colorSpace, m_p0, m_r0, m_p1, m_r1, colorFunction.get(), true, true);
     else
-        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction, true, true);
-
-    CGColorSpaceRelease(colorSpace);
-    CGFunctionRelease(colorFunction);
+        m_gradient = CGShadingCreateAxial(colorSpace, m_p0, m_p1, colorFunction.get(), true, true);
 
     return m_gradient;
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index ab8eb3c..1b843e4 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -28,14 +28,15 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#include "TransformationMatrix.h"
 #include "FloatConversion.h"
-#include "GraphicsContextPrivate.h"
 #include "GraphicsContextPlatformPrivateCG.h"
+#include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
 #include "KURL.h"
 #include "Path.h"
 #include "Pattern.h"
+#include "TransformationMatrix.h"
+
 #include <CoreGraphics/CGBitmapContext.h>
 #include <CoreGraphics/CGPDFContext.h>
 #include <wtf/MathExtras.h>
@@ -86,7 +87,7 @@ CGContextRef GraphicsContext::platformContext() const
 {
     ASSERT(!paintingDisabled());
     ASSERT(m_data->m_cgContext);
-    return m_data->m_cgContext;
+    return m_data->m_cgContext.get();
 }
 
 void GraphicsContext::savePlatformState()
@@ -178,19 +179,19 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     
     int patWidth = 0;
     switch (strokeStyle()) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = (int)width;
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)width;
+        break;
     }
 
     CGContextRef context = platformContext();
-    
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, false);
 
@@ -221,7 +222,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -235,7 +236,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
                     patternOffset = (patWidth - remainder)/2;
             }
         }
-        
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
@@ -248,7 +249,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 
     if (patWidth)
         CGContextRestoreGState(context);
-        
+
     if (shouldAntialias())
         CGContextSetShouldAntialias(context, true);
 }
@@ -263,7 +264,7 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
     if (paintingDisabled())
         return;
-        
+
     CGContextRef context = platformContext();
     CGContextBeginPath(context);
     float r = (float)rect.width() / 2;
@@ -275,25 +276,25 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
 
 
 void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
-{ 
+{
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f)
         return;
-    
+
     CGContextRef context = platformContext();
     CGContextSaveGState(context);
     CGContextBeginPath(context);
     CGContextSetShouldAntialias(context, false);
-    
+
     int x = rect.x();
     int y = rect.y();
     float w = (float)rect.width();
     float h = (float)rect.height();
     float scaleFactor = h / w;
     float reverseScaleFactor = w / h;
-    
+
     if (w != h)
         scale(FloatSize(1, scaleFactor));
-    
+
     float hRadius = w / 2;
     float vRadius = h / 2;
     float fa = startAngle;
@@ -304,22 +305,21 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
 
     if (w != h)
         scale(FloatSize(1, reverseScaleFactor));
-    
-    
+
     float width = strokeThickness();
     int patWidth = 0;
-    
+
     switch (strokeStyle()) {
-        case DottedStroke:
-            patWidth = (int)(width / 2);
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)(width / 2);
-            break;
-        default:
-            break;
+    case DottedStroke:
+        patWidth = (int)(width / 2);
+        break;
+    case DashedStroke:
+        patWidth = 3 * (int)(width / 2);
+        break;
+    default:
+        break;
     }
-    
+
     if (patWidth) {
         // Example: 80 pixels with a width of 30 pixels.
         // Remainder is 20.  The maximum pixels of line we could paint
@@ -329,7 +329,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
             distance = static_cast<int>((piFloat * hRadius) / 2.0f);
         else // We are elliptical and will have to estimate the distance
             distance = static_cast<int>((piFloat * sqrtf((hRadius * hRadius + vRadius * vRadius) / 2.0f)) / 2.0f);
-        
+
         int remainder = distance % patWidth;
         int coverage = distance - remainder;
         int numSegments = coverage / patWidth;
@@ -339,7 +339,7 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -353,13 +353,13 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
                     patternOffset = (patWidth - remainder) / 2.0f;
             }
         }
-    
+
         const CGFloat dottedLine[2] = { patWidth, patWidth };
         CGContextSetLineDash(context, patternOffset, dottedLine, 2);
     }
 
     CGContextStrokePath(context);
-    
+
     CGContextRestoreGState(context);
 }
 
@@ -375,7 +375,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, antialiased);
-    
+
     CGContextBeginPath(context);
     CGContextMoveToPoint(context, points[0].x(), points[0].y());
     for (size_t i = 1; i < npoints; i++)
@@ -383,7 +383,7 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     CGContextClosePath(context);
 
     drawPath();
-    
+
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, shouldAntialias());
 }
@@ -391,35 +391,31 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
 void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
-    
-    CGPatternRef platformPattern = m_common->state.strokePattern.get()->createPlatformPattern(getCTM());
+
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.strokePattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetStrokeColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetStrokeColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetStrokePattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetStrokePattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 void GraphicsContext::applyFillPattern()
 {
     CGContextRef cgContext = platformContext();
 
-    CGPatternRef platformPattern = m_common->state.fillPattern.get()->createPlatformPattern(getCTM());
+    RetainPtr<CGPatternRef> platformPattern(AdoptCF, m_common->state.fillPattern.get()->createPlatformPattern(getCTM()));
     if (!platformPattern)
         return;
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(0);
-    CGContextSetFillColorSpace(cgContext, patternSpace);
-    CGColorSpaceRelease(patternSpace);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
+    CGContextSetFillColorSpace(cgContext, patternSpace.get());
 
     const CGFloat patternAlpha = 1;
-    CGContextSetFillPattern(cgContext, platformPattern, &patternAlpha);
-    CGPatternRelease(platformPattern);
+    CGContextSetFillPattern(cgContext, platformPattern.get(), &patternAlpha);
 }
 
 static inline bool calculateDrawingMode(const GraphicsContextState& state, CGPathDrawingMode& mode)
@@ -463,7 +459,7 @@ void GraphicsContext::drawPath()
         strokePath();
         return;
     }
-    
+
     if (state.fillColorSpace == PatternColorSpace)
         applyFillPattern();
     if (state.strokeColorSpace == PatternColorSpace)
@@ -599,7 +595,7 @@ void GraphicsContext::clipOut(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGRect rects[2] = { CGContextGetClipBoundingBox(platformContext()), rect };
     CGContextBeginPath(platformContext());
     CGContextAddRects(platformContext(), rects, 2);
@@ -610,7 +606,7 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddEllipseInRect(platformContext(), rect);
@@ -639,13 +635,13 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
 
     clip(rect);
     CGContextRef context = platformContext();
-    
+
     // Add outer ellipse
     CGContextAddEllipseInRect(context, CGRectMake(rect.x(), rect.y(), rect.width(), rect.height()));
     // Add inner ellipse.
     CGContextAddEllipseInRect(context, CGRectMake(rect.x() + thickness, rect.y() + thickness,
         rect.width() - (thickness * 2), rect.height() - (thickness * 2)));
-    
+
     CGContextEOClip(context);
 }
 
@@ -653,7 +649,7 @@ void GraphicsContext::clipToImageBuffer(const FloatRect& rect, const ImageBuffer
 {
     if (paintingDisabled())
         return;
-    
+
     CGContextTranslateCTM(platformContext(), rect.x(), rect.y() + rect.height());
     CGContextScaleCTM(platformContext(), 1, -1);
     CGContextClipToMask(platformContext(), FloatRect(FloatPoint(), rect.size()), imageBuffer->image()->getCGImageRef());
@@ -731,12 +727,11 @@ void GraphicsContext::setPlatformShadow(const IntSize& size, int blur, const Col
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(width, height), blurRadius);
     else {
-        CGColorRef colorCG = createCGColor(color);
+        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColor(color));
         CGContextSetShadowWithColor(context,
                                     CGSizeMake(width, height),
-                                    blurRadius, 
-                                    colorCG);
-        CGColorRelease(colorCG);
+                                    blurRadius,
+                                    colorCG.get());
     }
 }
 
@@ -799,15 +794,15 @@ void GraphicsContext::setLineCap(LineCap cap)
     if (paintingDisabled())
         return;
     switch (cap) {
-        case ButtCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapButt);
-            break;
-        case RoundCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapRound);
-            break;
-        case SquareCap:
-            CGContextSetLineCap(platformContext(), kCGLineCapSquare);
-            break;
+    case ButtCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapButt);
+        break;
+    case RoundCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapRound);
+        break;
+    case SquareCap:
+        CGContextSetLineCap(platformContext(), kCGLineCapSquare);
+        break;
     }
 }
 
@@ -821,15 +816,15 @@ void GraphicsContext::setLineJoin(LineJoin join)
     if (paintingDisabled())
         return;
     switch (join) {
-        case MiterJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
-            break;
-        case RoundJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
-            break;
-        case BevelJoin:
-            CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
-            break;
+    case MiterJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinMiter);
+        break;
+    case RoundJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinRound);
+        break;
+    case BevelJoin:
+        CGContextSetLineJoin(platformContext(), kCGLineJoinBevel);
+        break;
     }
 }
 
@@ -858,7 +853,7 @@ void GraphicsContext::clipOut(const Path& path)
 {
     if (paintingDisabled())
         return;
-        
+
     CGContextBeginPath(platformContext());
     CGContextAddRect(platformContext(), CGContextGetClipBoundingBox(platformContext()));
     CGContextAddPath(platformContext(), path.platformPath());
@@ -909,9 +904,9 @@ TransformationMatrix GraphicsContext::getCTM() const
 
 FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
 {
-    // It is not enough just to round to pixels in device space. The rotation part of the 
+    // It is not enough just to round to pixels in device space. The rotation part of the
     // affine transform matrix to device space can mess with this conversion if we have a
-    // rotating image like the hands of the world clock widget. We just need the scale, so 
+    // rotating image like the hands of the world clock widget. We just need the scale, so
     // we get the affine transform matrix and extract the scale.
 
     if (m_data->m_userToDeviceTransformKnownToBeIdentity)
@@ -934,11 +929,11 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     deviceOrigin.y = roundf(deviceOrigin.y);
     deviceLowerRight.x = roundf(deviceLowerRight.x);
     deviceLowerRight.y = roundf(deviceLowerRight.y);
-    
+
     // Don't let the height or width round to 0 unless either was originally 0
-    if (deviceOrigin.y == deviceLowerRight.y && rect.height() != 0)
+    if (deviceOrigin.y == deviceLowerRight.y && rect.height())
         deviceLowerRight.y += 1;
-    if (deviceOrigin.x == deviceLowerRight.x && rect.width() != 0)
+    if (deviceOrigin.x == deviceLowerRight.x && rect.width())
         deviceLowerRight.x += 1;
 
     FloatPoint roundedOrigin = FloatPoint(deviceOrigin.x / deviceScaleX, deviceOrigin.y / deviceScaleY);
@@ -984,13 +979,13 @@ void GraphicsContext::drawLineForText(const IntPoint& point, int width, bool pri
             }
         }
     }
-    
+
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), strokeColor());
     CGContextFillRect(platformContext(), CGRectMake(x, y, lineLength, thickness));
     if (fillColor() != strokeColor())
         setCGFillColor(platformContext(), fillColor());
-        
+
     if (restoreAntialiasMode)
         CGContextSetShouldAntialias(platformContext(), true);
 }
@@ -999,51 +994,50 @@ void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
 {
     if (paintingDisabled())
         return;
-        
-    CFURLRef urlRef = link.createCFURL();
-    if (urlRef) {
-        CGContextRef context = platformContext();
-        
-        // Get the bounding box to handle clipping.
-        CGRect box = CGContextGetClipBoundingBox(context);
-
-        IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
-        IntRect rect = destRect;
-        rect.intersect(intBox);
-
-        CGPDFContextSetURLForRect(context, urlRef,
-            CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
-
-        CFRelease(urlRef);
-    }
+
+    RetainPtr<CFURLRef> urlRef(AdoptCF, link.createCFURL());
+    if (!urlRef)
+        return;
+
+    CGContextRef context = platformContext();
+
+    // Get the bounding box to handle clipping.
+    CGRect box = CGContextGetClipBoundingBox(context);
+
+    IntRect intBox((int)box.origin.x, (int)box.origin.y, (int)box.size.width, (int)box.size.height);
+    IntRect rect = destRect;
+    rect.intersect(intBox);
+
+    CGPDFContextSetURLForRect(context, urlRef.get(),
+        CGRectApplyAffineTransform(rect, CGContextGetCTM(context)));
 }
 
 void GraphicsContext::setImageInterpolationQuality(InterpolationQuality mode)
 {
     if (paintingDisabled())
         return;
-    
+
     CGInterpolationQuality quality = kCGInterpolationDefault;
     switch (mode) {
-        case InterpolationDefault:
-            quality = kCGInterpolationDefault;
-            break;
-        case InterpolationNone:
-            quality = kCGInterpolationNone;
-            break;
-        case InterpolationLow:
-            quality = kCGInterpolationLow;
-            break;
-
-        // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
-        case InterpolationMedium:
+    case InterpolationDefault:
+        quality = kCGInterpolationDefault;
+        break;
+    case InterpolationNone:
+        quality = kCGInterpolationNone;
+        break;
+    case InterpolationLow:
+        quality = kCGInterpolationLow;
+        break;
+
+    // Fall through to InterpolationHigh if kCGInterpolationMedium is not available
+    case InterpolationMedium:
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-            quality = kCGInterpolationMedium;
-            break;
+        quality = kCGInterpolationMedium;
+        break;
 #endif
-        case InterpolationHigh:
-            quality = kCGInterpolationHigh;
-            break;
+    case InterpolationHigh:
+        quality = kCGInterpolationHigh;
+        break;
     }
     CGContextSetInterpolationQuality(platformContext(), quality);
 }
@@ -1055,18 +1049,18 @@ InterpolationQuality GraphicsContext::imageInterpolationQuality() const
 
     CGInterpolationQuality quality = CGContextGetInterpolationQuality(platformContext());
     switch (quality) {
-        case kCGInterpolationDefault:
-            return InterpolationDefault;
-        case kCGInterpolationNone:
-            return InterpolationNone;
-        case kCGInterpolationLow:
-            return InterpolationLow;
+    case kCGInterpolationDefault:
+        return InterpolationDefault;
+    case kCGInterpolationNone:
+        return InterpolationNone;
+    case kCGInterpolationLow:
+        return InterpolationLow;
 #if HAVE(CG_INTERPOLATION_MEDIUM)
-        case kCGInterpolationMedium:
-            return InterpolationMedium;
+    case kCGInterpolationMedium:
+        return InterpolationMedium;
 #endif
-        case kCGInterpolationHigh:
-            return InterpolationHigh;
+    case kCGInterpolationHigh:
+        return InterpolationHigh;
     }
     return InterpolationDefault;
 }
@@ -1079,32 +1073,32 @@ void GraphicsContext::setPlatformTextDrawingMode(int mode)
     // Wow, wish CG had used bits here.
     CGContextRef context = platformContext();
     switch (mode) {
-        case cTextInvisible: // Invisible
-            CGContextSetTextDrawingMode(context, kCGTextInvisible);
-            break;
-        case cTextFill: // Fill
-            CGContextSetTextDrawingMode(context, kCGTextFill);
-            break;
-        case cTextStroke: // Stroke
-            CGContextSetTextDrawingMode(context, kCGTextStroke);
-            break;
-        case 3: // Fill | Stroke
-            CGContextSetTextDrawingMode(context, kCGTextFillStroke);
-            break;
-        case cTextClip: // Clip
-            CGContextSetTextDrawingMode(context, kCGTextClip);
-            break;
-        case 5: // Fill | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillClip);
-            break;
-        case 6: // Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
-            break;
-        case 7: // Fill | Stroke | Clip
-            CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
-            break;
-        default:
-            break;
+    case cTextInvisible: // Invisible
+        CGContextSetTextDrawingMode(context, kCGTextInvisible);
+        break;
+    case cTextFill: // Fill
+        CGContextSetTextDrawingMode(context, kCGTextFill);
+        break;
+    case cTextStroke: // Stroke
+        CGContextSetTextDrawingMode(context, kCGTextStroke);
+        break;
+    case 3: // Fill | Stroke
+        CGContextSetTextDrawingMode(context, kCGTextFillStroke);
+        break;
+    case cTextClip: // Clip
+        CGContextSetTextDrawingMode(context, kCGTextClip);
+        break;
+    case 5: // Fill | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillClip);
+        break;
+    case 6: // Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextStrokeClip);
+        break;
+    case 7: // Fill | Stroke | Clip
+        CGContextSetTextDrawingMode(context, kCGTextFillStrokeClip);
+        break;
+    default:
+        break;
     }
 }
 
@@ -1138,54 +1132,54 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 
 #ifndef BUILDING_ON_TIGER // Tiger's setCompositeOperation() is defined in GraphicsContextMac.mm.
 void GraphicsContext::setCompositeOperation(CompositeOperator mode)
-{   
+{
     if (paintingDisabled())
         return;
 
-    CGBlendMode target = kCGBlendModeNormal;   
+    CGBlendMode target = kCGBlendModeNormal;
     switch (mode) {
-        case CompositeClear:
-            target = kCGBlendModeClear;
-            break;
-        case CompositeCopy:
-            target = kCGBlendModeCopy;
-            break;
-        case CompositeSourceOver:
-            //kCGBlendModeNormal
-            break;
-        case CompositeSourceIn:
-            target = kCGBlendModeSourceIn;
-            break;
-        case CompositeSourceOut:
-            target = kCGBlendModeSourceOut;
-            break;
-        case CompositeSourceAtop:
-            target = kCGBlendModeSourceAtop; 
-            break;
-        case CompositeDestinationOver:
-            target = kCGBlendModeDestinationOver;
-            break;
-        case CompositeDestinationIn:
-            target = kCGBlendModeDestinationIn;
-            break;
-        case CompositeDestinationOut:
-            target = kCGBlendModeDestinationOut;
-            break;
-        case CompositeDestinationAtop:
-            target = kCGBlendModeDestinationAtop;
-            break;
-        case CompositeXOR:
-            target = kCGBlendModeXOR;
-            break;
-        case CompositePlusDarker:
-            target = kCGBlendModePlusDarker;
-            break;
-        case CompositeHighlight:
-            // currently unsupported
-            break;
-        case CompositePlusLighter:
-            target = kCGBlendModePlusLighter;
-            break;
+    case CompositeClear:
+        target = kCGBlendModeClear;
+        break;
+    case CompositeCopy:
+        target = kCGBlendModeCopy;
+        break;
+    case CompositeSourceOver:
+        //kCGBlendModeNormal
+        break;
+    case CompositeSourceIn:
+        target = kCGBlendModeSourceIn;
+        break;
+    case CompositeSourceOut:
+        target = kCGBlendModeSourceOut;
+        break;
+    case CompositeSourceAtop:
+        target = kCGBlendModeSourceAtop;
+        break;
+    case CompositeDestinationOver:
+        target = kCGBlendModeDestinationOver;
+        break;
+    case CompositeDestinationIn:
+        target = kCGBlendModeDestinationIn;
+        break;
+    case CompositeDestinationOut:
+        target = kCGBlendModeDestinationOut;
+        break;
+    case CompositeDestinationAtop:
+        target = kCGBlendModeDestinationAtop;
+        break;
+    case CompositeXOR:
+        target = kCGBlendModeXOR;
+        break;
+    case CompositePlusDarker:
+        target = kCGBlendModePlusDarker;
+        break;
+    case CompositeHighlight:
+        // currently unsupported
+        break;
+    case CompositePlusLighter:
+        target = kCGBlendModePlusLighter;
+        break;
     }
     CGContextSetBlendMode(platformContext(), target);
 }
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index f63a8dd..38c5506 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -38,12 +38,10 @@ public:
 #endif
         , m_userToDeviceTransformKnownToBeIdentity(false)
     {
-        CGContextRetain(m_cgContext);
     }
     
     ~GraphicsContextPlatformPrivate()
     {
-        CGContextRelease(m_cgContext);
     }
 
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
@@ -80,7 +78,7 @@ public:
     bool m_shouldIncludeChildWindows;
 #endif
 
-    CGContextRef m_cgContext;
+    RetainPtr<CGContextRef> m_cgContext;
     bool m_userToDeviceTransformKnownToBeIdentity;
 };
 
diff --git a/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index 6db7e88..b1896f8 100644
--- a/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -65,37 +65,37 @@ ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, b
         bytesPerRow *= 4;
     }
 
-    m_data.m_data = tryFastCalloc(size.height(), bytesPerRow);
+    if (!tryFastCalloc(size.height(), bytesPerRow).getValue(m_data.m_data))
+        return;
+
     ASSERT((reinterpret_cast<size_t>(m_data.m_data) & 2) == 0);
 
-    CGColorSpaceRef colorSpace;
+    RetainPtr<CGColorSpaceRef> colorSpace;
     switch(imageColorSpace) {
         case DeviceRGB:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
         case GrayScale:
-            colorSpace = CGColorSpaceCreateDeviceGray();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceGray());
             break;
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER)
         case LinearRGB:
-            colorSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
+            colorSpace.adoptCF(CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear));
             break;
 #endif
         default:
-            colorSpace = CGColorSpaceCreateDeviceRGB();
+            colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
             break;
     }
 
-    CGContextRef cgContext = CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
-        colorSpace, (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast);
-    CGColorSpaceRelease(colorSpace);
+    RetainPtr<CGContextRef> cgContext(AdoptCF, CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
+        colorSpace.get(), (imageColorSpace == GrayScale) ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast));
     if (!cgContext)
         return;
 
-    m_context.set(new GraphicsContext(cgContext));
+    m_context.set(new GraphicsContext(cgContext.get()));
     m_context->scale(FloatSize(1, -1));
     m_context->translate(0, -size.height());
-    CGContextRelease(cgContext);
     success = true;
 }
 
@@ -122,12 +122,13 @@ Image* ImageBuffer::image() const
     return m_image.get();
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -137,8 +138,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -148,20 +149,21 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    unsigned srcBytesPerRow = 4 * m_size.width();
+    unsigned srcBytesPerRow = 4 * size.width();
     unsigned destBytesPerRow = 4 * rect.width();
 
     // ::create ensures that all ImageBuffers have valid data, so we don't need to check it here.
-    unsigned char* srcRows = reinterpret_cast<unsigned char*>(m_data.m_data) + originy * srcBytesPerRow + originx * 4;
+    unsigned char* srcRows = reinterpret_cast<unsigned char*>(imageData.m_data) + originy * srcBytesPerRow + originx * 4;
     unsigned char* destRows = data + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
-            if (unsigned char alpha = srcRows[basex + 3]) {
+            unsigned char alpha = srcRows[basex + 3];
+            if (multiplied == Unmultiplied && alpha) {
                 destRows[basex] = (srcRows[basex] * 255) / alpha;
                 destRows[basex + 1] = (srcRows[basex + 1] * 255) / alpha;
                 destRows[basex + 2] = (srcRows[basex + 2] * 255) / alpha;
@@ -175,7 +177,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& imageData, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -183,36 +196,36 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
-    unsigned destBytesPerRow = 4 * m_size.width();
+    unsigned destBytesPerRow = 4 * size.width();
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
-    unsigned char* destRows = reinterpret_cast<unsigned char*>(m_data.m_data) + desty * destBytesPerRow + destx * 4;
+    unsigned char* destRows = reinterpret_cast<unsigned char*>(imageData.m_data) + desty * destBytesPerRow + destx * 4;
     for (int y = 0; y < numRows; ++y) {
         for (int x = 0; x < numColumns; x++) {
             int basex = x * 4;
             unsigned char alpha = srcRows[basex + 3];
-            if (alpha != 255) {
+            if (multiplied == Unmultiplied && alpha != 255) {
                 destRows[basex] = (srcRows[basex] * alpha + 254) / 255;
                 destRows[basex + 1] = (srcRows[basex + 1] * alpha + 254) / 255;
                 destRows[basex + 2] = (srcRows[basex + 2] * alpha + 254) / 255;
@@ -225,6 +238,16 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
 static RetainPtr<CFStringRef> utiFromMIMEType(const String& mimeType)
 {
 #if PLATFORM(MAC)
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index a5620e8..4da7018 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -101,30 +101,29 @@ BitmapImage::BitmapImage(CGImageRef cgImage, ImageObserver* observer)
 void BitmapImage::checkForSolidColor()
 {
     m_checkedForSolidColor = true;
-    if (frameCount() > 1)
+    if (frameCount() > 1) {
         m_isSolidColor = false;
-    else {
-        CGImageRef image = frameAtIndex(0);
-        
-        // Currently we only check for solid color in the important special case of a 1x1 image.
-        if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
-            unsigned char pixel[4]; // RGBA
-            CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
-            CGContextRef bmap = CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
-                kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big);
-            if (bmap) {
-                GraphicsContext(bmap).setCompositeOperation(CompositeCopy);
-                CGRect dst = { {0, 0}, {1, 1} };
-                CGContextDrawImage(bmap, dst, image);
-                if (pixel[3] == 0)
-                    m_solidColor = Color(0, 0, 0, 0);
-                else
-                    m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
-                m_isSolidColor = true;
-                CFRelease(bmap);
-            } 
-            CFRelease(space);
-        }
+        return;
+    }
+
+    CGImageRef image = frameAtIndex(0);
+    
+    // Currently we only check for solid color in the important special case of a 1x1 image.
+    if (image && CGImageGetWidth(image) == 1 && CGImageGetHeight(image) == 1) {
+        unsigned char pixel[4]; // RGBA
+        static CGColorSpaceRef space = CGColorSpaceCreateDeviceRGB();
+        RetainPtr<CGContextRef> bmap(AdoptCF, CGBitmapContextCreate(pixel, 1, 1, 8, sizeof(pixel), space,
+            kCGImageAlphaPremultipliedLast | kCGBitmapByteOrder32Big));
+        if (!bmap)
+            return;
+        GraphicsContext(bmap.get()).setCompositeOperation(CompositeCopy);
+        CGRect dst = { {0, 0}, {1, 1} };
+        CGContextDrawImage(bmap.get(), dst, image);
+        if (pixel[3] == 0)
+            m_solidColor = Color(0, 0, 0, 0);
+        else
+            m_solidColor = Color(pixel[0] * 255 / pixel[3], pixel[1] * 255 / pixel[3], pixel[2] * 255 / pixel[3], pixel[3]);
+        m_isSolidColor = true;
     }
 }
 
@@ -252,14 +251,14 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     CGImageRef tileImage = nativeImageForCurrentFrame();
     float h = CGImageGetHeight(tileImage);
 
-    CGImageRef subImage;
+    RetainPtr<CGImageRef> subImage;
     if (tileRect.size() == size())
         subImage = tileImage;
     else {
         // Copying a sub-image out of a partially-decoded image stops the decoding of the original image. It should never happen
         // because sub-images are only used for border-image, which only renders when the image is fully decoded.
         ASSERT(h == height());
-        subImage = CGImageCreateWithImageInRect(tileImage, tileRect);
+        subImage.adoptCF(CGImageCreateWithImageInRect(tileImage, tileRect));
     }
     
 #ifndef BUILDING_ON_TIGER
@@ -275,7 +274,7 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
 #else
     if (w == size().width() && h == size().height())
 #endif
-        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage);
+        CGContextDrawTiledImage(context, FloatRect(adjustedX, adjustedY, scaledTileWidth, scaledTileHeight), subImage.get());
     else {
 #endif
 
@@ -288,39 +287,31 @@ void Image::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRect, const
     matrix = CGAffineTransformConcat(matrix, CGContextGetCTM(context));
     // The top of a partially-decoded image is drawn at the bottom of the tile. Map it to the top.
     matrix = CGAffineTransformTranslate(matrix, 0, size().height() - h);
-    CGPatternRef pattern = CGPatternCreate(subImage, CGRectMake(0, 0, tileRect.width(), tileRect.height()),
-                                           matrix, tileRect.width(), tileRect.height(), 
-                                           kCGPatternTilingConstantSpacing, true, &patternCallbacks);
-    if (pattern == NULL) {
-        if (subImage != tileImage)
-            CGImageRelease(subImage);
+    RetainPtr<CGPatternRef> pattern(AdoptCF, CGPatternCreate(subImage.get(), CGRectMake(0, 0, tileRect.width(), tileRect.height()),
+                                             matrix, tileRect.width(), tileRect.height(), 
+                                             kCGPatternTilingConstantSpacing, true, &patternCallbacks));
+    if (!pattern) {
         ctxt->restore();
         return;
     }
 
-    CGColorSpaceRef patternSpace = CGColorSpaceCreatePattern(NULL);
+    RetainPtr<CGColorSpaceRef> patternSpace(AdoptCF, CGColorSpaceCreatePattern(0));
     
     CGFloat alpha = 1;
-    CGColorRef color = CGColorCreateWithPattern(patternSpace, pattern, &alpha);
-    CGContextSetFillColorSpace(context, patternSpace);
-    CGColorSpaceRelease(patternSpace);
-    CGPatternRelease(pattern);
+    RetainPtr<CGColorRef> color(AdoptCF, CGColorCreateWithPattern(patternSpace.get(), pattern.get(), &alpha));
+    CGContextSetFillColorSpace(context, patternSpace.get());
 
     // FIXME: Really want a public API for this.  It is just CGContextSetBaseCTM(context, CGAffineTransformIdentiy).
     wkSetPatternBaseCTM(context, CGAffineTransformIdentity);
     CGContextSetPatternPhase(context, CGSizeZero);
 
-    CGContextSetFillColorWithColor(context, color);
+    CGContextSetFillColorWithColor(context, color.get());
     CGContextFillRect(context, CGContextGetClipBoundingBox(context));
-    
-    CGColorRelease(color);
-    
+
 #ifndef BUILDING_ON_TIGER
     }
 #endif
 
-    if (subImage != tileImage)
-        CGImageRelease(subImage);
     ctxt->restore();
 
     if (imageObserver())
diff --git a/WebCore/platform/graphics/cg/ImageSourceCG.cpp b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
index b716060..66246fe 100644
--- a/WebCore/platform/graphics/cg/ImageSourceCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageSourceCG.cpp
@@ -109,18 +109,16 @@ void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
 #if PLATFORM(MAC)
     // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
     // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-    CFDataRef cfData = data->createCFData();
+    RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
 #else
     // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
     // scenes.  We use CFDataCreateWithBytesNoCopy in that case. Ensure that the SharedBuffer lives as long as the CFDataRef.
     data->ref();
     CFAllocatorContext context = {0, data, 0, 0, 0, 0, 0, &sharedBufferDerefCallback, 0};
-    CFAllocatorRef derefAllocator = CFAllocatorCreate(kCFAllocatorDefault, &context);
-    CFDataRef cfData = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator);
-    CFRelease(derefAllocator);
+    RetainPtr<CFAllocatorRef> derefAllocator(AdoptCF, CFAllocatorCreate(kCFAllocatorDefault, &context));
+    RetainPtr<CFDataRef> cfData(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(data->data()), data->size(), derefAllocator.get()));
 #endif
-    CGImageSourceUpdateData(m_decoder, cfData, allDataReceived);
-    CFRelease(cfData);
+    CGImageSourceUpdateData(m_decoder, cfData.get(), allDataReceived);
 }
 
 String ImageSource::filenameExtension() const
@@ -138,12 +136,11 @@ bool ImageSource::isSizeAvailable()
 
     // Ragnaros yells: TOO SOON! You have awakened me TOO SOON, Executus!
     if (imageSourceStatus >= kCGImageStatusIncomplete) {
-        CFDictionaryRef image0Properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions());
+        RetainPtr<CFDictionaryRef> image0Properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, 0, imageSourceOptions()));
         if (image0Properties) {
-            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelWidth);
-            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties, kCGImagePropertyPixelHeight);
+            CFNumberRef widthNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelWidth);
+            CFNumberRef heightNumber = (CFNumberRef)CFDictionaryGetValue(image0Properties.get(), kCGImagePropertyPixelHeight);
             result = widthNumber && heightNumber;
-            CFRelease(image0Properties);
         }
     }
     
@@ -153,17 +150,16 @@ bool ImageSource::isSizeAvailable()
 IntSize ImageSource::frameSizeAtIndex(size_t index) const
 {
     IntSize result;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
         int w = 0, h = 0;
-        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelWidth);
+        CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelWidth);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &w);
-        num = (CFNumberRef)CFDictionaryGetValue(properties, kCGImagePropertyPixelHeight);
+        num = (CFNumberRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyPixelHeight);
         if (num)
             CFNumberGetValue(num, kCFNumberIntType, &h);
         result = IntSize(w, h);
-        CFRelease(properties);
     }
     return result;
 }
@@ -180,17 +176,15 @@ int ImageSource::repetitionCount()
         return result;
 
     // A property with value 0 means loop forever.
-    CFDictionaryRef properties = CGImageSourceCopyProperties(m_decoder, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyProperties(m_decoder, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef gifProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (gifProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(gifProperties, kCGImagePropertyGIFLoopCount);
             if (num)
                 CFNumberGetValue(num, kCFNumberIntType, &result);
         } else
             result = cAnimationNone; // Turns out we're not a GIF after all, so we don't animate.
-        
-        CFRelease(properties);
     }
     
     return result;
@@ -206,20 +200,19 @@ CGImageRef ImageSource::createFrameAtIndex(size_t index)
     if (!initialized())
         return 0;
 
-    CGImageRef image = CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CGImageRef> image(AdoptCF, CGImageSourceCreateImageAtIndex(m_decoder, index, imageSourceOptions()));
     CFStringRef imageUTI = CGImageSourceGetType(m_decoder);
     static const CFStringRef xbmUTI = CFSTR("public.xbitmap-image");
     if (!imageUTI || !CFEqual(imageUTI, xbmUTI))
-        return image;
+        return image.releaseRef();
     
     // If it is an xbm image, mask out all the white areas to render them transparent.
     const CGFloat maskingColors[6] = {255, 255,  255, 255, 255, 255};
-    CGImageRef maskedImage = CGImageCreateWithMaskingColors(image, maskingColors);
+    RetainPtr<CGImageRef> maskedImage(AdoptCF, CGImageCreateWithMaskingColors(image.get(), maskingColors));
     if (!maskedImage)
-        return image;
-        
-    CGImageRelease(image);
-    return maskedImage; 
+        return image.releaseRef();
+
+    return maskedImage.releaseRef();
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
@@ -233,15 +226,14 @@ float ImageSource::frameDurationAtIndex(size_t index)
         return 0;
 
     float duration = 0;
-    CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions());
+    RetainPtr<CFDictionaryRef> properties(AdoptCF, CGImageSourceCopyPropertiesAtIndex(m_decoder, index, imageSourceOptions()));
     if (properties) {
-        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties, kCGImagePropertyGIFDictionary);
+        CFDictionaryRef typeProperties = (CFDictionaryRef)CFDictionaryGetValue(properties.get(), kCGImagePropertyGIFDictionary);
         if (typeProperties) {
             CFNumberRef num = (CFNumberRef)CFDictionaryGetValue(typeProperties, kCGImagePropertyGIFDelayTime);
             if (num)
                 CFNumberGetValue(num, kCFNumberFloatType, &duration);
         }
-        CFRelease(properties);
     }
 
     // Many annoying ads specify a 0 duration to make an image flash as quickly as possible.
diff --git a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
index 858b18e..2f5c15e 100644
--- a/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
+++ b/WebCore/platform/graphics/cg/PDFDocumentImage.cpp
@@ -68,16 +68,14 @@ bool PDFDocumentImage::dataChanged(bool allDataReceived)
 #if PLATFORM(MAC)
         // On Mac the NSData inside the SharedBuffer can be secretly appended to without the SharedBuffer's knowledge.  We use SharedBuffer's ability
         // to wrap itself inside CFData to get around this, ensuring that ImageIO is really looking at the SharedBuffer.
-        CFDataRef data = this->data()->createCFData();
+        RetainPtr<CFDataRef> data(AdoptCF, this->data()->createCFData());
 #else
         // If no NSData is available, then we know SharedBuffer will always just be a vector.  That means no secret changes can occur to it behind the
         // scenes.  We use CFDataCreateWithBytesNoCopy in that case.
-        CFDataRef data = CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull);
+        RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, reinterpret_cast<const UInt8*>(this->data()->data()), this->data()->size(), kCFAllocatorNull));
 #endif
-        CGDataProviderRef dataProvider = CGDataProviderCreateWithCFData(data);
-        CFRelease(data);
-        m_document = CGPDFDocumentCreateWithProvider(dataProvider);
-        CGDataProviderRelease(dataProvider);
+        RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(data.get()));
+        m_document = CGPDFDocumentCreateWithProvider(dataProvider.get());
         setCurrentPage(0);
     }
     return m_document; // return true if size is available
diff --git a/WebCore/platform/graphics/cg/PathCG.cpp b/WebCore/platform/graphics/cg/PathCG.cpp
index 5812cea..3b05641 100644
--- a/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/WebCore/platform/graphics/cg/PathCG.cpp
@@ -49,9 +49,8 @@ static size_t putBytesNowhere(void*, const void*, size_t count)
 static CGContextRef createScratchContext()
 {
     CGDataConsumerCallbacks callbacks = { putBytesNowhere, 0 };
-    CGDataConsumerRef consumer = CGDataConsumerCreate(0, &callbacks);
-    CGContextRef context = CGPDFContextCreate(consumer, 0, 0);
-    CGDataConsumerRelease(consumer);
+    RetainPtr<CGDataConsumerRef> consumer(AdoptCF, CGDataConsumerCreate(0, &callbacks));
+    CGContextRef context = CGPDFContextCreate(consumer.get(), 0, 0);
 
     CGFloat black[4] = { 0, 0, 0, 1 };
     CGContextSetFillColor(context, black);
@@ -129,9 +128,8 @@ bool Path::contains(const FloatPoint &point, WindRule rule) const
         return false;
 
     // CGPathContainsPoint returns false for non-closed paths, as a work-around, we copy and close the path first.  Radar 4758998 asks for a better CG API to use
-    CGMutablePathRef path = copyCGPathClosingSubpaths(m_path);
-    bool ret = CGPathContainsPoint(path, 0, point, rule == RULE_EVENODD ? true : false);
-    CGPathRelease(path);
+    RetainPtr<CGMutablePathRef> path(AdoptCF, copyCGPathClosingSubpaths(m_path));
+    bool ret = CGPathContainsPoint(path.get(), 0, point, rule == RULE_EVENODD ? true : false);
     return ret;
 }
 
diff --git a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
index 9252ae0..e8fa860 100644
--- a/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontCacheChromiumWin.cpp
@@ -261,7 +261,7 @@ static HFONT createFontIndirectAndGetWinName(const String& family, LOGFONT* winf
 // characters. Because it's family names rather than font faces we use
 // as keys, there might be edge cases where one face of a font family
 // has a different repertoire from another face of the same family. 
-typedef HashMap<const wchar_t*, UnicodeSet*> FontCmapCache;
+typedef HashMap<const wchar_t*, icu::UnicodeSet*> FontCmapCache;
 
 static bool fontContainsCharacter(const FontPlatformData* fontData,
                                   const wchar_t* family, UChar32 character)
@@ -277,7 +277,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     if (!fontCmapCache)
         fontCmapCache = new FontCmapCache;
 
-    HashMap<const wchar_t*, UnicodeSet*>::iterator it = fontCmapCache->find(family);
+    HashMap<const wchar_t*, icu::UnicodeSet*>::iterator it = fontCmapCache->find(family);
     if (it != fontCmapCache->end()) 
         return it->second->contains(character);
     
@@ -308,7 +308,7 @@ static bool fontContainsCharacter(const FontPlatformData* fontData,
     // 1) port back ICU 4.0's faster look-up code for UnicodeSet
     // 2) port Mozilla's CompressedCharMap or gfxSparseBitset
     unsigned i = 0;
-    UnicodeSet* cmap = new UnicodeSet;
+    icu::UnicodeSet* cmap = new icu::UnicodeSet;
     while (i < glyphset->cRanges) {
         WCHAR start = glyphset->ranges[i].wcLow; 
         cmap->add(start, start + glyphset->ranges[i].cGlyphs - 1);
diff --git a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
index 3d67992..229188e 100644
--- a/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontChromiumWin.cpp
@@ -459,14 +459,16 @@ void Font::drawComplexText(GraphicsContext* graphicsContext,
     TransparencyAwareUniscribePainter painter(graphicsContext, this, run, from, to, point);
 
     HDC hdc = painter.hdc();
-    if (!hdc)
+    if (windowsCanHandleTextDrawing(graphicsContext) && !hdc)
         return;
 
     // TODO(maruel): http://b/700464 SetTextColor doesn't support transparency.
     // Enforce non-transparent color.
     color = SkColorSetRGB(SkColorGetR(color), SkColorGetG(color), SkColorGetB(color));
-    SetTextColor(hdc, skia::SkColorToCOLORREF(color));
-    SetBkMode(hdc, TRANSPARENT);
+    if (hdc) {
+        SetTextColor(hdc, skia::SkColorToCOLORREF(color));
+        SetBkMode(hdc, TRANSPARENT);
+    }
 
     // If there is a non-blur shadow and both the fill color and shadow color 
     // are opaque, handle without skia. 
diff --git a/WebCore/platform/graphics/chromium/FontLinux.cpp b/WebCore/platform/graphics/chromium/FontLinux.cpp
index d4e45fb..dca0efb 100644
--- a/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -45,6 +45,11 @@
 #include "SkTypeface.h"
 #include "SkUtils.h"
 
+#include <unicode/normlzr.h>
+#include <unicode/uchar.h>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/OwnPtr.h>
+
 namespace WebCore {
 
 bool Font::canReturnFallbackFontsForComplexText()
@@ -136,27 +141,29 @@ class TextRunWalker {
 public:
     TextRunWalker(const TextRun& run, unsigned startingX, const Font* font)
         : m_font(font)
-        , m_run(run)
         , m_startingX(startingX)
         , m_offsetX(m_startingX)
-        , m_iterateBackwards(run.rtl())
+        , m_run(getTextRun(run))
+        , m_iterateBackwards(m_run.rtl())
     {
+        // Do not use |run| inside this constructor. Use |m_run| instead.
+
         memset(&m_item, 0, sizeof(m_item));
         // We cannot know, ahead of time, how many glyphs a given script run
         // will produce. We take a guess that script runs will not produce more
         // than twice as many glyphs as there are code points and fallback if
         // we find that we are wrong.
-        m_maxGlyphs = run.length() * 2;
+        m_maxGlyphs = m_run.length() * 2;
         createGlyphArrays();
 
-        m_item.log_clusters = new unsigned short[run.length()];
+        m_item.log_clusters = new unsigned short[m_run.length()];
 
         m_item.face = 0;
         m_item.font = allocHarfbuzzFont();
 
-        m_item.string = run.characters();
-        m_item.stringLength = run.length();
-        m_item.item.bidiLevel = run.rtl();
+        m_item.string = m_run.characters();
+        m_item.stringLength = m_run.length();
+        m_item.item.bidiLevel = m_run.rtl();
 
         reset();
     }
@@ -283,6 +290,43 @@ public:
     }
 
 private:
+    const TextRun& getTextRun(const TextRun& originalRun)
+    {
+        // Convert the |originalRun| to NFC normalized form if combining diacritical marks
+        // (U+0300..) are used in the run. This conversion is necessary since most OpenType
+        // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
+        // their GSUB tables.
+        //
+        // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
+        // the API returns FALSE (= not normalized) for complex runs that don't require NFC
+        // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
+        // Harfbuzz will do the same thing for us using the GSUB table.
+        for (unsigned i = 0; i < originalRun.length(); ++i) {
+            UBlockCode block = ::ublock_getCode(originalRun[i]);
+            if (block == UBLOCK_COMBINING_DIACRITICAL_MARKS) {
+                return getNormalizedTextRun(originalRun);
+            }
+        }
+        return originalRun;
+    }
+
+    const TextRun& getNormalizedTextRun(const TextRun& originalRun)
+    {
+        icu::UnicodeString normalizedString;
+        UErrorCode error = U_ZERO_ERROR;
+        icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(), originalRun.length()), UNORM_NFC, 0 /* no options */, normalizedString, error);
+        if (U_FAILURE(error))
+            return originalRun;
+
+        m_normalizedBuffer.set(new UChar[normalizedString.length() + 1]);
+        normalizedString.extract(m_normalizedBuffer.get(), normalizedString.length() + 1, error);
+        ASSERT(U_SUCCESS(error));
+
+        m_normalizedRun.set(new TextRun(originalRun));
+        m_normalizedRun->setText(m_normalizedBuffer.get(), normalizedString.length());
+        return *m_normalizedRun;
+    }
+
     void setupFontForScriptRun()
     {
         const FontData* fontData = m_font->fontDataAt(0);
@@ -379,7 +423,6 @@ private:
     }
 
     const Font* const m_font;
-    const TextRun& m_run;
     HB_ShaperItem m_item;
     uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
     SkScalar* m_xPositions; // A vector of x positions for each glyph.
@@ -389,6 +432,10 @@ private:
     unsigned m_pixelWidth; // Width (in px) of the current script run.
     unsigned m_numCodePoints; // Code points in current script run.
     unsigned m_maxGlyphs; // Current size of all the Harfbuzz arrays.
+
+    OwnPtr<TextRun> m_normalizedRun;
+    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
+    const TextRun& m_run;
     bool m_iterateBackwards;
 };
 
diff --git a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
index 9596a4c..4e2a226 100644
--- a/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
+++ b/WebCore/platform/graphics/chromium/FontUtilsChromiumWin.cpp
@@ -100,11 +100,11 @@ void initializeScriptFontMap(ScriptToFontMap& scriptFontMap)
     // Initialize the locale-dependent mapping.
     // Since Chrome synchronizes the ICU default locale with its UI locale,
     // this ICU locale tells the current UI locale of Chrome.
-    Locale locale = Locale::getDefault();
+    icu::Locale locale = icu::Locale::getDefault();
     const UChar* localeFamily = 0;
-    if (locale == Locale::getJapanese())
+    if (locale == icu::Locale::getJapanese())
         localeFamily = scriptFontMap[USCRIPT_HIRAGANA];
-    else if (locale == Locale::getKorean())
+    else if (locale == icu::Locale::getKorean())
         localeFamily = scriptFontMap[USCRIPT_HANGUL];
     else {
         // Use Simplified Chinese font for all other locales including
diff --git a/WebCore/platform/graphics/chromium/UniscribeHelper.cpp b/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
index 39b0847..10fcdf6 100644
--- a/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
+++ b/WebCore/platform/graphics/chromium/UniscribeHelper.cpp
@@ -375,11 +375,13 @@ void UniscribeHelper::draw(GraphicsContext* graphicsContext,
             // Pass 0 in when there is no justification.
             const int* justify = shaping.m_justify.size() == 0 ? 0 : &shaping.m_justify[fromGlyph];
 
-            if (firstRun) {
-                oldFont = SelectObject(dc, shaping.m_hfont);
-                firstRun = false;
-            } else
-                SelectObject(dc, shaping.m_hfont);
+            if (useWindowsDrawing) {
+                if (firstRun) {
+                    oldFont = SelectObject(dc, shaping.m_hfont);
+                    firstRun = false;
+                } else
+                    SelectObject(dc, shaping.m_hfont);
+            }
 
             // Fonts with different ascents can be used to render different
             // runs.  'Across-runs' y-coordinate correction needs to be
@@ -401,7 +403,7 @@ void UniscribeHelper::draw(GraphicsContext* graphicsContext,
                 } else {
                     SkPoint origin;
                     origin.fX = curX + + innerOffset;
-                    origin.fY = y + m_ascent - shaping.m_ascentOffset;
+                    origin.fY = y + m_ascent;
                     textOutOk = paintSkiaText(graphicsContext,
                                               shaping.m_hfont,
                                               glyphCount,
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 86b702f..2364cc4 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,13 @@
 #if ENABLE(FILTERS)
 #include "FEBlend.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "FloatPoint.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+
+typedef unsigned char (*BlendType)(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB);
 
 namespace WebCore {
 
@@ -61,8 +68,77 @@ void FEBlend::setBlendMode(BlendModeType mode)
     m_mode = mode;
 }
 
-void FEBlend::apply(Filter*)
+static unsigned char unknown(unsigned char, unsigned char, unsigned char, unsigned char)
+{
+    return 0;
+}
+
+static unsigned char normal(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char)
+{
+    return (((255 - alphaA) * colorB + colorA * 255) / 255);
+}
+
+static unsigned char multiply(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return (((255 - alphaA) * colorB + (255 - alphaB + colorB) * colorA) / 255);
+}
+
+static unsigned char screen(unsigned char colorA, unsigned char colorB, unsigned char, unsigned char)
+{
+    return (((colorB + colorA) * 255 - colorA * colorB) / 255);
+}
+
+static unsigned char darken(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
+{
+    return ((std::min((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+static unsigned char lighten(unsigned char colorA, unsigned char colorB, unsigned char alphaA, unsigned char alphaB)
 {
+    return ((std::max((255 - alphaA) * colorB + colorA * 255, (255 - alphaB) * colorA + colorB * 255)) / 255);
+}
+
+void FEBlend::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    if (m_mode == FEBLEND_MODE_UNKNOWN)
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+    IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+    RefPtr<CanvasPixelArray> srcPixelArrayB(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    // Keep synchronized with BlendModeType
+    static const BlendType callEffect[] = {unknown, normal, multiply, screen, darken, lighten};
+
+    ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArrayA->length(); pixelOffset += 4) {
+        unsigned char alphaA = srcPixelArrayA->get(pixelOffset + 3);
+        unsigned char alphaB = srcPixelArrayB->get(pixelOffset + 3);
+        for (unsigned channel = 0; channel < 3; ++channel) {
+            unsigned char colorA = srcPixelArrayA->get(pixelOffset + channel);
+            unsigned char colorB = srcPixelArrayB->get(pixelOffset + channel);
+
+            unsigned char result = (*callEffect[m_mode])(colorA, colorB, alphaA, alphaB);
+            imageData->data()->set(pixelOffset + channel, result);
+        }
+        unsigned char alphaR = 255 - ((255 - alphaA) * (255 - alphaB)) / 255;
+        imageData->data()->set(pixelOffset + 3, alphaR);
+    }
+
+    resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEBlend::dump()
diff --git a/WebCore/platform/graphics/filters/FEBlend.h b/WebCore/platform/graphics/filters/FEBlend.h
index b09cd72..31c625f 100644
--- a/WebCore/platform/graphics/filters/FEBlend.h
+++ b/WebCore/platform/graphics/filters/FEBlend.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class FEBlend : public FilterEffect {
     public:
         static PassRefPtr<FEBlend> create(FilterEffect*, FilterEffect*, BlendModeType);
-        
+
         FilterEffect* in2() const;
         void setIn2(FilterEffect*);
 
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index fb0a194..1e2e552 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -166,7 +166,7 @@ void FEColorMatrix::apply(Filter* filter)
     filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
-    PassRefPtr<ImageData> imageData(resultImage()->getImageData(imageRect));
+    PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
     PassRefPtr<CanvasPixelArray> srcPixelArray(imageData->data());
 
     switch (m_type) {
@@ -186,7 +186,7 @@ void FEColorMatrix::apply(Filter* filter)
             break;
     }
 
-    resultImage()->putImageData(imageData.get(), imageRect, IntPoint());
+    resultImage()->putUnmultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEColorMatrix::dump()
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 54ac123..43e5edd 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,10 +25,16 @@
 #if ENABLE(FILTERS)
 #include "FEComponentTransfer.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include <math.h>
 
 namespace WebCore {
 
+typedef void (*TransferType)(unsigned char*, const ComponentTransferFunction&);
+
 FEComponentTransfer::FEComponentTransfer(FilterEffect* in, const ComponentTransferFunction& redFunc, 
     const ComponentTransferFunction& greenFunc, const ComponentTransferFunction& blueFunc, const ComponentTransferFunction& alphaFunc)
     : FilterEffect()
@@ -85,8 +92,91 @@ void FEComponentTransfer::setAlphaFunction(const ComponentTransferFunction& func
     m_alphaFunc = func;
 }
 
-void FEComponentTransfer::apply(Filter*)
+void identity(unsigned char*, const ComponentTransferFunction&)
+{
+}
+
+void table(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;            
+    for (unsigned i = 0; i < 256; ++i) {
+        double c = i / 255.0;                
+        unsigned k = static_cast<unsigned>(c * (n - 1));
+        double v1 = tableValues[k];
+        double v2 = tableValues[std::min((k + 1), (n - 1))];
+        double val = 255.0 * (v1 + (c * (n - 1) - k) * (v2 - v1));
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void discrete(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    const Vector<float>& tableValues = transferFunction.tableValues;
+    unsigned n = tableValues.size();
+    if (n < 1)
+        return;
+    for (unsigned i = 0; i < 256; ++i) {
+        unsigned k = static_cast<unsigned>((i * n) / 255.0);
+        k = std::min(k, n - 1);
+        double val = 255 * tableValues[k];
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void linear(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = transferFunction.slope * i + 255 * transferFunction.intercept;
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void gamma(unsigned char* values, const ComponentTransferFunction& transferFunction)
+{
+    for (unsigned i = 0; i < 256; ++i) {
+        double val = 255.0 * (transferFunction.amplitude * pow((i / 255.0), transferFunction.exponent) + transferFunction.offset);
+        val = std::max(0.0, std::min(255.0, val));
+        values[i] = static_cast<unsigned char>(val);
+    }
+}
+
+void FEComponentTransfer::apply(Filter* filter)
 {
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    unsigned char rValues[256], gValues[256], bValues[256], aValues[256];
+    for (unsigned i = 0; i < 256; ++i)
+        rValues[i] = gValues[i] = bValues[i] = aValues[i] = i;
+    unsigned char* tables[] = { rValues, gValues, bValues, aValues };
+    ComponentTransferFunction transferFunction[] = {m_redFunc, m_greenFunc, m_blueFunc, m_alphaFunc};
+    TransferType callEffect[] = {identity, identity, table, discrete, linear, gamma};
+
+    for (unsigned channel = 0; channel < 4; channel++)
+        (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
+
+    IntRect drawingRect = calculateDrawingIntRect(m_in->subRegion());
+    RefPtr<ImageData> imageData(m_in->resultImage()->getUnmultipliedImageData(drawingRect));
+    CanvasPixelArray* srcPixelArray(imageData->data());
+
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset += 4) {
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            unsigned char c = srcPixelArray->get(pixelOffset + channel);
+            imageData->data()->set(pixelOffset + channel, tables[channel][c]);
+        }
+    }
+
+    resultImage()->putUnmultipliedImageData(imageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
 }
 
 void FEComponentTransfer::dump()
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 0706358..1b41165 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -24,7 +25,10 @@
 #if ENABLE(FILTERS)
 #include "FEComposite.h"
 
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "GraphicsContext.h"
+#include "ImageData.h"
 
 namespace WebCore {
 
@@ -97,8 +101,74 @@ void FEComposite::setK4(float k4)
     m_k4 = k4;
 }
 
-void FEComposite::apply(Filter*)
+inline void arithmetic(const RefPtr<CanvasPixelArray>& srcPixelArrayA, CanvasPixelArray*& srcPixelArrayB,
+                       float k1, float k2, float k3, float k4)
 {
+    float scaledK1 = k1 / 255.f;
+    float scaledK4 = k4 * 255.f;
+    for (unsigned pixelOffset = 0; pixelOffset < srcPixelArrayA->length(); pixelOffset += 4) {
+        for (unsigned channel = 0; channel < 4; ++channel) {
+            unsigned char i1 = srcPixelArrayA->get(pixelOffset + channel);
+            unsigned char i2 = srcPixelArrayB->get(pixelOffset + channel);
+
+            unsigned char result = scaledK1 * i1 * i2 + k2 * i1 + k3 * i2 + scaledK4;
+            if (channel == 3 && i1 == 0 && i2 == 0)
+                result = 0;
+            srcPixelArrayB->set(pixelOffset + channel, result);
+        }
+    }
+}
+
+void FEComposite::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    m_in2->apply(filter);
+    if (!m_in->resultImage() || !m_in2->resultImage())
+        return;
+
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    FloatRect srcRect = FloatRect(0.f, 0.f, -1.f, -1.f);
+    switch (m_type) {
+    case FECOMPOSITE_OPERATOR_OVER:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        break;
+    case FECOMPOSITE_OPERATOR_IN:
+        filterContext->save();
+        filterContext->clipToImageBuffer(calculateDrawingRect(m_in2->subRegion()), m_in2->resultImage());
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->restore();
+        break;
+    case FECOMPOSITE_OPERATOR_OUT:
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()));
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()), srcRect, CompositeDestinationOut);
+        break;
+    case FECOMPOSITE_OPERATOR_ATOP:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeSourceAtop);
+        break;
+    case FECOMPOSITE_OPERATOR_XOR:
+        filterContext->drawImage(m_in2->resultImage()->image(), calculateDrawingRect(m_in2->subRegion()));
+        filterContext->drawImage(m_in->resultImage()->image(), calculateDrawingRect(m_in->subRegion()), srcRect, CompositeXOR);
+        break;
+    case FECOMPOSITE_OPERATOR_ARITHMETIC: {
+        IntRect effectADrawingRect = calculateDrawingIntRect(m_in->subRegion());
+        RefPtr<CanvasPixelArray> srcPixelArrayA(m_in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
+
+        IntRect effectBDrawingRect = calculateDrawingIntRect(m_in2->subRegion());
+        RefPtr<ImageData> imageData(m_in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
+        CanvasPixelArray* srcPixelArrayB(imageData->data());
+
+        arithmetic(srcPixelArrayA, srcPixelArrayB, m_k1, m_k2, m_k3, m_k4);
+        resultImage()->putPremultipliedImageData(imageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
+        }
+        break;
+    default:
+        break;
+    }
 }
 
 void FEComposite::dump()
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 41e8a39..5818e50 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -59,6 +59,13 @@ FloatRect FilterEffect::calculateEffectRect(Filter* filter)
     return subRegion();
 }
 
+IntRect FilterEffect::calculateDrawingIntRect(const FloatRect& effectRect)
+{
+    IntPoint location = roundedIntPoint(FloatPoint(subRegion().x() - effectRect.x(),
+                                                   subRegion().y() - effectRect.y()));
+    return IntRect(location, resultImage()->size());
+}
+
 FloatRect FilterEffect::calculateDrawingRect(const FloatRect& srcRect)
 {
     FloatPoint startPoint = FloatPoint(srcRect.x() - subRegion().x(), srcRect.y() - subRegion().y());
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index 8dc6233..e2b8a0e 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -77,6 +77,7 @@ namespace WebCore {
 
         GraphicsContext* getEffectContext();
         FloatRect calculateDrawingRect(const FloatRect&);
+        IntRect calculateDrawingIntRect(const FloatRect&);
 
         virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return filter->filterRegion(); }
         virtual FloatRect calculateEffectRect(Filter*);
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index 646a57b..57436be 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -22,6 +22,7 @@
 #if ENABLE(FILTERS)
 #include "SourceAlpha.h"
 
+#include "Color.h"
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "Filter.h"
@@ -41,8 +42,28 @@ const AtomicString& SourceAlpha::effectName()
     return s_effectName;
 }
 
-void SourceAlpha::apply(Filter*)
+FloatRect SourceAlpha::calculateEffectRect(Filter* filter)
 {
+    FloatRect clippedSourceRect = filter->sourceImageRect();
+    if (filter->sourceImageRect().x() < filter->filterRegion().x())
+        clippedSourceRect.setX(filter->filterRegion().x());
+    if (filter->sourceImageRect().y() < filter->filterRegion().y())
+        clippedSourceRect.setY(filter->filterRegion().y());
+    setSubRegion(clippedSourceRect);
+    return filter->filterRegion();
+}
+
+void SourceAlpha::apply(Filter* filter)
+{
+    GraphicsContext* filterContext = getEffectContext();
+    if (!filterContext)
+        return;
+
+    FloatRect imageRect(FloatPoint(), filter->sourceImage()->image()->size());
+    filterContext->save();
+    filterContext->clipToImageBuffer(imageRect, filter->sourceImage());
+    filterContext->fillRect(imageRect, Color::black);
+    filterContext->restore();
 }
 
 void SourceAlpha::dump()
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.h b/WebCore/platform/graphics/filters/SourceAlpha.h
index 5341562..172d05a 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.h
+++ b/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -35,7 +35,7 @@ namespace WebCore {
         static const AtomicString& effectName();
 
         virtual bool isSourceInput() { return true; }
-        virtual FloatRect calculateEffectRect(Filter* filter) { return filter->sourceImageRect(); }
+        virtual FloatRect calculateEffectRect(Filter*);
         void apply(Filter*);
         void dump();
     
diff --git a/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
new file mode 100644
index 0000000..a6c2dfb
--- /dev/null
+++ b/WebCore/platform/graphics/gtk/DataSourceGStreamer.cpp
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "DataSourceGStreamer.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+#include <gst/gst.h>
+#include <gst/pbutils/missing-plugins.h>
+
+static GstStaticPadTemplate src_template = GST_STATIC_PAD_TEMPLATE("src",
+                                                                   GST_PAD_SRC,
+                                                                   GST_PAD_ALWAYS,
+                                                                   GST_STATIC_CAPS_ANY);
+
+GST_DEBUG_CATEGORY_STATIC(webkit_data_src_debug);
+#define GST_CAT_DEFAULT webkit_data_src_debug
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface,
+                                             gpointer iface_data);
+
+static void webkit_data_src_finalize(WebkitDataSrc* src);
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element,
+                                                         GstStateChange transition);
+
+static const GInterfaceInfo urihandler_info = {
+    webkit_data_src_uri_handler_init,
+    0, 0
+};
+
+
+static void _do_init(GType datasrc_type)
+{
+    GST_DEBUG_CATEGORY_INIT(webkit_data_src_debug, "webkit_data_src", 0, "datasrc element");
+    g_type_add_interface_static(datasrc_type, GST_TYPE_URI_HANDLER,
+                                &urihandler_info);
+}
+
+GST_BOILERPLATE_FULL(WebkitDataSrc, webkit_data_src, GstBin, GST_TYPE_BIN, _do_init);
+
+static void webkit_data_src_base_init(gpointer klass)
+{
+    GstElementClass* element_class = GST_ELEMENT_CLASS(klass);
+
+    gst_element_class_add_pad_template(element_class,
+                                       gst_static_pad_template_get(&src_template));
+    gst_element_class_set_details_simple(element_class, (gchar*) "WebKit data source element",
+                                         (gchar*) "Source",
+                                         (gchar*) "Handles data: uris",
+                                         (gchar*) "Philippe Normand <pnormand@igalia.com>");
+
+}
+
+static void webkit_data_src_class_init(WebkitDataSrcClass* klass)
+{
+    GObjectClass* oklass = G_OBJECT_CLASS(klass);
+    GstElementClass* eklass = GST_ELEMENT_CLASS(klass);
+
+    oklass->finalize = (GObjectFinalizeFunc) webkit_data_src_finalize;
+    eklass->change_state = webkit_data_src_change_state;
+}
+
+
+static gboolean webkit_data_src_reset(WebkitDataSrc* src)
+{
+    GstPad* targetpad;
+
+    if (src->kid) {
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+    }
+
+    src->kid = gst_element_factory_make("giostreamsrc", "streamsrc");
+    if (!src->kid) {
+        GST_ERROR_OBJECT(src, "Failed to create giostreamsrc");
+        return FALSE;
+    }
+
+    gst_bin_add(GST_BIN(src), src->kid);
+
+    targetpad = gst_element_get_static_pad(src->kid, "src");
+    gst_ghost_pad_set_target(GST_GHOST_PAD(src->pad), targetpad);
+    gst_object_unref(targetpad);
+
+    return TRUE;
+}
+
+static void webkit_data_src_init(WebkitDataSrc* src,
+                                 WebkitDataSrcClass* g_class)
+{
+    GstPadTemplate* pad_template = gst_static_pad_template_get(&src_template);
+    src->pad = gst_ghost_pad_new_no_target_from_template("src",
+                                                         pad_template);
+
+    gst_element_add_pad(GST_ELEMENT(src), src->pad);
+
+    webkit_data_src_reset(src);
+}
+
+static void webkit_data_src_finalize(WebkitDataSrc* src)
+{
+    g_free(src->uri);
+
+    if (src->kid) {
+        GST_DEBUG_OBJECT(src, "Removing giostreamsrc element");
+        gst_element_set_state(src->kid, GST_STATE_NULL);
+        gst_bin_remove(GST_BIN(src), src->kid);
+        src->kid = 0;
+    }
+
+    GST_CALL_PARENT(G_OBJECT_CLASS, finalize, ((GObject* )(src)));
+}
+
+static GstStateChangeReturn webkit_data_src_change_state(GstElement* element, GstStateChange transition)
+{
+    GstStateChangeReturn ret = GST_STATE_CHANGE_SUCCESS;
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(element);
+
+    switch (transition) {
+    case GST_STATE_CHANGE_NULL_TO_READY:
+        if (!src->kid) {
+            gst_element_post_message(element,
+                                     gst_missing_element_message_new(element, "giostreamsrc"));
+            GST_ELEMENT_ERROR(src, CORE, MISSING_PLUGIN, (0), ("no giostreamsrc"));
+            return GST_STATE_CHANGE_FAILURE;
+        }
+        break;
+    default:
+        break;
+    }
+
+    ret = GST_ELEMENT_CLASS(parent_class)->change_state(element, transition);
+    if (G_UNLIKELY(ret == GST_STATE_CHANGE_FAILURE))
+        return ret;
+
+    // Downwards state change code should be here, after chaining up
+    // to the parent class.
+
+    return ret;
+}
+
+/*** GSTURIHANDLER INTERFACE *************************************************/
+
+static GstURIType webkit_data_src_uri_get_type(void)
+{
+    return GST_URI_SRC;
+}
+
+static gchar** webkit_data_src_uri_get_protocols(void)
+{
+    static gchar* protocols[] = {(gchar*) "data", 0 };
+
+    return protocols;
+}
+
+static const gchar* webkit_data_src_uri_get_uri(GstURIHandler* handler)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    return src->uri;
+}
+
+static gboolean webkit_data_src_uri_set_uri(GstURIHandler* handler, const gchar* uri)
+{
+    WebkitDataSrc* src = WEBKIT_DATA_SRC(handler);
+
+    // URI as defined in RFC2397:
+    // "data:" [ mediatype ] [ ";base64" ] "," data
+    // we parse URIs like this one:
+    // data:audio/3gpp;base64,AA...
+
+    gchar** scheme_and_remains = g_strsplit(uri, ":", 2);
+    gchar** mime_type_and_options = g_strsplit(scheme_and_remains[1], ";", 0);
+    gint options_size = g_strv_length(mime_type_and_options);
+    gchar* data = 0;
+    gchar* mime_type = 0;
+    gint ret = FALSE;
+
+    // we require uris with a specified mime-type and base64-encoded
+    // data. It doesn't make much sense anyway to play plain/text data
+    // with very few allowed characters (as per the RFC).
+
+    if (GST_STATE(src) >= GST_STATE_PAUSED) {
+        GST_ERROR_OBJECT(src, "Element already configured. Reset it and retry");
+    } else if (!options_size)
+        GST_ERROR_OBJECT(src, "A mime-type is needed in %s", uri);
+    else {
+        mime_type = mime_type_and_options[0];
+        data = mime_type_and_options[options_size-1];
+
+        guchar* decoded_data = 0;
+        gsize decoded_size;
+
+        if (!g_str_has_prefix(data, "base64"))
+            GST_ERROR_OBJECT(src, "Data has to be base64-encoded in %s", uri);
+        else {
+            decoded_data = g_base64_decode(data+7, &decoded_size);
+            GInputStream* stream = g_memory_input_stream_new_from_data(decoded_data,
+                                                                       decoded_size,
+                                                                       g_free);
+            g_object_set(src->kid, "stream", stream, 0);
+            g_object_unref(stream);
+
+            if (src->uri) {
+                g_free(src->uri);
+                src->uri = 0;
+            }
+
+            src->uri = g_strdup(uri);
+            ret = TRUE;
+        }
+    }
+
+    g_strfreev(scheme_and_remains);
+    g_strfreev(mime_type_and_options);
+    return ret;
+}
+
+static void webkit_data_src_uri_handler_init(gpointer g_iface, gpointer iface_data)
+{
+    GstURIHandlerInterface* iface = (GstURIHandlerInterface *) g_iface;
+
+    iface->get_type = webkit_data_src_uri_get_type;
+    iface->get_protocols = webkit_data_src_uri_get_protocols;
+    iface->get_uri = webkit_data_src_uri_get_uri;
+    iface->set_uri = webkit_data_src_uri_set_uri;
+}
diff --git a/WebCore/platform/graphics/gtk/DataSourceGStreamer.h b/WebCore/platform/graphics/gtk/DataSourceGStreamer.h
new file mode 100644
index 0000000..3e88f63
--- /dev/null
+++ b/WebCore/platform/graphics/gtk/DataSourceGStreamer.h
@@ -0,0 +1,54 @@
+/*
+ *  Copyright (C) 2009 Igalia S.L
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef DATA_SOURCE_GSTREAMER_H
+#define DATA_SOURCE_GSTREAMER_H
+
+#include <glib-object.h>
+#include <gst/base/gstbasesrc.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_DATA_SRC            (webkit_data_src_get_type ())
+#define WEBKIT_DATA_SRC(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_DATA_SRC, WebkitDataSrc))
+#define WEBKIT_DATA_SRC_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_DATA_SRC, WebkitDataSrcClass))
+#define WEBKIT_IS_DATA_SRC(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_DATA_SRC))
+#define WEBKIT_IS_DATA_SRC_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_DATA_SRC))
+
+typedef struct _WebkitDataSrc        WebkitDataSrc;
+typedef struct _WebkitDataSrcClass   WebkitDataSrcClass;
+
+
+struct _WebkitDataSrc {
+    GstBin parent;
+
+    /* explicit pointers to stuff used */
+    GstElement* kid;
+    GstPad* pad;
+    gchar* uri;
+};
+
+struct _WebkitDataSrcClass {
+    GstBinClass parent_class;
+};
+
+GType webkit_data_src_get_type(void);
+
+G_END_DECLS
+
+#endif
diff --git a/WebCore/platform/graphics/gtk/FontPlatformData.h b/WebCore/platform/graphics/gtk/FontPlatformData.h
index 2a65f1e..d30b480 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformData.h
+++ b/WebCore/platform/graphics/gtk/FontPlatformData.h
@@ -87,7 +87,7 @@ public:
     bool syntheticBold() const { return m_syntheticBold; }
     bool syntheticOblique() const { return m_syntheticOblique; }
 
-    void setFont(cairo_t*) const;
+    cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 
     unsigned hash() const
     {
diff --git a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
index f2c5f0c..0b1280e 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontPlatformDataGtk.cpp
@@ -224,10 +224,8 @@ FontPlatformData::~FontPlatformData()
         m_fallbacks = 0;
     }
 
-    if (m_scaledFont) {
+    if (m_scaledFont)
         cairo_scaled_font_destroy(m_scaledFont);
-        m_scaledFont = 0;
-    }
 }
 
 bool FontPlatformData::isFixedPitch()
@@ -242,13 +240,6 @@ bool FontPlatformData::isFixedPitch()
     return false;
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
-
 bool FontPlatformData::operator==(const FontPlatformData& other) const
 {
     if (m_pattern == other.m_pattern)
diff --git a/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp b/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
index 9ea6811..8a1a5f1 100644
--- a/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
+++ b/WebCore/platform/graphics/gtk/FontPlatformDataPango.cpp
@@ -214,13 +214,6 @@ bool FontPlatformData::isFixedPitch()
     return pango_font_family_is_monospace(family);
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
-
 FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
 {
     // Check for self-assignment.
diff --git a/WebCore/platform/graphics/gtk/ImageGtk.cpp b/WebCore/platform/graphics/gtk/ImageGtk.cpp
index 0e92d6c..38da70d 100644
--- a/WebCore/platform/graphics/gtk/ImageGtk.cpp
+++ b/WebCore/platform/graphics/gtk/ImageGtk.cpp
@@ -88,26 +88,67 @@ PassRefPtr<Image> Image::loadPlatformResource(const char* name)
     return img.release();
 }
 
+static inline unsigned char* getCairoSurfacePixel(unsigned char* data, uint x, uint y, uint rowStride)
+{
+    return data + (y * rowStride) + x * 4;
+}
+
+static inline guchar* getGdkPixbufPixel(guchar* data, uint x, uint y, uint rowStride)
+{
+    return data + (y * rowStride) + x * 4;
+}
+
 GdkPixbuf* BitmapImage::getGdkPixbuf()
 {
     int width = cairo_image_surface_get_width(frameAtIndex(currentFrame()));
     int height = cairo_image_surface_get_height(frameAtIndex(currentFrame()));
-
-    int bestDepth = gdk_visual_get_best_depth();
-    GdkColormap* cmap = gdk_colormap_new(gdk_visual_get_best_with_depth(bestDepth), true);
-
-    GdkPixmap* pixmap = gdk_pixmap_new(0, width, height, bestDepth);
-    gdk_drawable_set_colormap(GDK_DRAWABLE(pixmap), cmap);
-    cairo_t* cr = gdk_cairo_create(GDK_DRAWABLE(pixmap));
-    cairo_set_source_surface(cr, frameAtIndex(currentFrame()), 0, 0);
-    cairo_paint(cr);
-    cairo_destroy(cr);
-
-    GdkPixbuf* pixbuf = gdk_pixbuf_get_from_drawable(0, GDK_DRAWABLE(pixmap), 0, 0, 0, 0, 0, width, height);
-    g_object_unref(pixmap);
-    g_object_unref(cmap);
-
-    return pixbuf;
+    unsigned char* surfaceData = cairo_image_surface_get_data(frameAtIndex(currentFrame()));
+    int surfaceRowStride = cairo_image_surface_get_stride(frameAtIndex(currentFrame()));
+
+    GdkPixbuf* dest = gdk_pixbuf_new(GDK_COLORSPACE_RGB, TRUE, 8, width, height);
+    if (!dest)
+        return 0;
+
+    guchar* pixbufData = gdk_pixbuf_get_pixels(dest);
+    int pixbufRowStride = gdk_pixbuf_get_rowstride(dest);
+
+    /* From: http://cairographics.org/manual/cairo-image-surface.html#cairo-format-t
+     * "CAIRO_FORMAT_ARGB32: each pixel is a 32-bit quantity, with alpha in
+     * the upper 8 bits, then red, then green, then blue. The 32-bit
+     * quantities are stored native-endian. Pre-multiplied alpha is used.
+     * (That is, 50% transparent red is 0x80800000, not 0x80ff0000.)"
+     *
+     * See http://developer.gimp.org/api/2.0/gdk-pixbuf/gdk-pixbuf-gdk-pixbuf.html#GdkPixbuf
+     * for information on the structure of GdkPixbufs stored with GDK_COLORSPACE_RGB.
+     *
+     * RGB color channels in CAIRO_FORMAT_ARGB32 are stored based on the
+     * endianness of the machine and are also multiplied by the alpha channel.
+     * To properly transfer the data from the Cairo surface we must divide each
+     * of the RGB channels by the alpha channel and then reorder all channels
+     * if this machine is little-endian.
+     */
+    for (int y = 0; y < height; y++) {
+        for (int x = 0; x < width; x++) {
+            unsigned char* source = getCairoSurfacePixel(surfaceData, x, y, surfaceRowStride);
+            guchar* dest = getGdkPixbufPixel(pixbufData, x, y, pixbufRowStride);
+
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+            guchar alpha = source[3];
+            dest[0] = alpha ? ((source[2] * 255) / alpha) : 0;
+            dest[1] = alpha ? ((source[1] * 255) / alpha) : 0;
+            dest[2] = alpha ? ((source[0] * 255) / alpha) : 0;
+            dest[3] = alpha;
+#else
+            guchar alpha = source[0];
+            dest[0] = alpha ? ((source[1] * 255) / alpha) : 0;
+            dest[1] = alpha ? ((source[2] * 255) / alpha) : 0;
+            dest[2] = alpha ? ((source[3] * 255) / alpha) : 0;
+            dest[3] = alpha;
+#endif
+        }
+    }
+
+    return dest;
 }
 
 }
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
index 4e4bda9..65c64b4 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
  * Copyright (C) 2007 Collabora Ltd.  All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2009 Gustavo Noronha Silva <gns@gnome.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +25,7 @@
 #if ENABLE(VIDEO)
 
 #include "MediaPlayerPrivateGStreamer.h"
+#include "DataSourceGStreamer.h"
 
 #include "CString.h"
 #include "GraphicsContext.h"
@@ -35,6 +37,7 @@
 #include "ScrollView.h"
 #include "VideoSinkGStreamer.h"
 #include "Widget.h"
+#include "TimeRanges.h"
 
 #include <gst/base/gstbasesrc.h>
 #include <gst/gst.h>
@@ -56,13 +59,19 @@ gboolean mediaPlayerPrivateErrorCallback(GstBus* bus, GstMessage* message, gpoin
         GOwnPtr<gchar> debug;
 
         gst_message_parse_error(message, &err.outPtr(), &debug.outPtr());
-        if (err->code == 3) {
-            LOG_VERBOSE(Media, "File not found");
-            MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
-            if (mp)
-                mp->loadingFailed();
-        } else
-            LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+        LOG_VERBOSE(Media, "Error: %d, %s", err->code,  err->message);
+
+        MediaPlayer::NetworkState error = MediaPlayer::Empty;
+        if (err->domain == GST_CORE_ERROR || err->domain == GST_LIBRARY_ERROR)
+            error = MediaPlayer::DecodeError;
+        else if (err->domain == GST_RESOURCE_ERROR)
+            error = MediaPlayer::FormatError;
+        else if (err->domain == GST_STREAM_ERROR)
+            error = MediaPlayer::NetworkError;
+
+        MediaPlayerPrivate* mp = reinterpret_cast<MediaPlayerPrivate*>(data);
+        if (mp)
+            mp->loadingFailed(error);
     }
     return true;
 }
@@ -112,6 +121,19 @@ void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
         registrar(create, getSupportedTypes, supportsType);
 }
 
+static bool gstInitialized = false;
+
+static void do_gst_init() {
+    // FIXME: We should pass the arguments from the command line
+    if (!gstInitialized) {
+        gst_init(0, 0);
+        gstInitialized = true;
+        gst_element_register(0, "webkitmediasrc", GST_RANK_PRIMARY,
+                             WEBKIT_TYPE_DATA_SRC);
+
+    }
+}
+
 MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     : m_player(player)
     , m_playBin(0)
@@ -119,7 +141,6 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_source(0)
     , m_rate(1.0f)
     , m_endTime(numeric_limits<float>::infinity())
-    , m_isEndReached(false)
     , m_volume(0.5f)
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
@@ -127,19 +148,22 @@ MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
     , m_isStreaming(false)
     , m_size(IntSize())
     , m_visible(true)
+    , m_paused(true)
+    , m_seeking(false)
+    , m_errorOccured(false)
 {
-
-    static bool gstInitialized = false;
-    // FIXME: We should pass the arguments from the command line
-    if (!gstInitialized) {
-        gst_init(0, 0);
-        gstInitialized = true;
-    }
+    do_gst_init();
 
     // FIXME: The size shouldn't be fixed here, this is just a quick hack.
     m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, 640, 480);
 }
 
+static gboolean idleUnref(gpointer data)
+{
+    g_object_unref(reinterpret_cast<GObject*>(data));
+    return FALSE;
+}
+
 MediaPlayerPrivate::~MediaPlayerPrivate()
 {
     if (m_surface)
@@ -149,6 +173,18 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
         gst_element_set_state(m_playBin, GST_STATE_NULL);
         gst_object_unref(GST_OBJECT(m_playBin));
     }
+
+    // FIXME: We should find a better way to handle the lifetime of this object; this is
+    // needed because the object is sometimes being destroyed inbetween a call to
+    // webkit_video_sink_render, and the idle it schedules. Adding a ref in
+    // webkit_video_sink_render that would be balanced by the idle is not an option,
+    // because in some cases the destruction of the sink may happen in time for the idle
+    // to be removed from the queue, so it may not run. It would also cause lots of ref
+    // counting churn (render/idle are called many times). This is an ugly race.
+    if (m_videoSink) {
+        g_idle_add(idleUnref, m_videoSink);
+        m_videoSink = 0;
+    }
 }
 
 void MediaPlayerPrivate::load(const String& url)
@@ -170,20 +206,13 @@ void MediaPlayerPrivate::load(const String& url)
 void MediaPlayerPrivate::play()
 {
     LOG_VERBOSE(Media, "Play");
-    // When end reached, rewind for Test video-seek-past-end-playing
-    if (m_isEndReached)
-        seek(0);
-    m_isEndReached = false;
-
     gst_element_set_state(m_playBin, GST_STATE_PLAYING);
-    m_startedPlaying = true;
 }
 
 void MediaPlayerPrivate::pause()
 {
     LOG_VERBOSE(Media, "Pause");
     gst_element_set_state(m_playBin, GST_STATE_PAUSED);
-    m_startedPlaying = false;
 }
 
 float MediaPlayerPrivate::duration() const
@@ -191,17 +220,24 @@ float MediaPlayerPrivate::duration() const
     if (!m_playBin)
         return 0.0;
 
+    if (m_errorOccured)
+        return 0.0;
+
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    // FIXME: We try to get the duration, but we do not trust the
+#if !GST_CHECK_VERSION(0, 10, 23)
+    // We try to get the duration, but we do not trust the
     // return value of the query function only; the problem we are
     // trying to work-around here is that pipelines in stream mode may
     // not be able to figure out the duration, but still return true!
-    // See https://bugs.webkit.org/show_bug.cgi?id=24639.
+    // See https://bugs.webkit.org/show_bug.cgi?id=24639 which has been
+    // fixed in gst-plugins-base 0.10.23
     if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeLength <= 0) {
+#else
+    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength)) {
+#endif
         LOG_VERBOSE(Media, "Time duration query failed.");
-        m_isStreaming = true;
         return numeric_limits<float>::infinity();
     }
 
@@ -215,22 +251,24 @@ float MediaPlayerPrivate::currentTime() const
 {
     if (!m_playBin)
         return 0;
-    // Necessary as sometimes, gstreamer return 0:00 at the EOS
-    if (m_isEndReached)
-        return m_endTime;
 
-    float ret;
+    if (m_errorOccured)
+        return 0;
+
+    float ret = 0.0;
 
     GstQuery* query = gst_query_new_position(GST_FORMAT_TIME);
-    if (gst_element_query(m_playBin, query)) {
-        gint64 position;
-        gst_query_parse_position(query, 0, &position);
-        ret = (float) (position / 1000000000.0);
-        LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
-    } else {
+    if (!gst_element_query(m_playBin, query)) {
         LOG_VERBOSE(Media, "Position query failed...");
-        ret = 0.0;
+        gst_query_unref(query);
+        return ret;
     }
+
+    gint64 position;
+    gst_query_parse_position(query, 0, &position);
+    ret = (float) (position / 1000000000.0);
+    LOG_VERBOSE(Media, "Position %" GST_TIME_FORMAT, GST_TIME_ARGS(position));
+
     gst_query_unref(query);
 
     return ret;
@@ -246,35 +284,23 @@ void MediaPlayerPrivate::seek(float time)
     if (m_isStreaming)
         return;
 
+    if (m_errorOccured)
+        return;
+
     LOG_VERBOSE(Media, "Seek: %" GST_TIME_FORMAT, GST_TIME_ARGS(sec));
-    // FIXME: What happens when the seeked position is not available?
     if (!gst_element_seek( m_playBin, m_rate,
             GST_FORMAT_TIME,
             (GstSeekFlags)(GST_SEEK_FLAG_FLUSH),
             GST_SEEK_TYPE_SET, sec,
             GST_SEEK_TYPE_NONE, GST_CLOCK_TIME_NONE))
         LOG_VERBOSE(Media, "Seek to %f failed", time);
+    else
+        m_seeking = true;
 }
 
 void MediaPlayerPrivate::setEndTime(float time)
 {
-    if (!m_playBin)
-        return;
-    if (m_isStreaming)
-        return;
-    if (m_endTime != time) {
-        m_endTime = time;
-        GstClockTime start = (GstClockTime)(currentTime() * GST_SECOND);
-        GstClockTime end   = (GstClockTime)(time * GST_SECOND);
-        LOG_VERBOSE(Media, "setEndTime: %" GST_TIME_FORMAT, GST_TIME_ARGS(end));
-        // FIXME: What happens when the seeked position is not available?
-        if (!gst_element_seek(m_playBin, m_rate,
-                GST_FORMAT_TIME,
-                (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
-                GST_SEEK_TYPE_SET, start,
-                GST_SEEK_TYPE_SET, end))
-            LOG_VERBOSE(Media, "Seek to %f failed", time);
-    }
+    notImplemented();
 }
 
 void MediaPlayerPrivate::startEndPointTimerIfNeeded()
@@ -294,12 +320,12 @@ void MediaPlayerPrivate::endPointTimerFired(Timer<MediaPlayerPrivate>*)
 
 bool MediaPlayerPrivate::paused() const
 {
-    return !m_startedPlaying;
+    return m_paused;
 }
 
 bool MediaPlayerPrivate::seeking() const
 {
-    return false;
+    return m_seeking;
 }
 
 // Returns the size of the video
@@ -308,13 +334,28 @@ IntSize MediaPlayerPrivate::naturalSize() const
     if (!hasVideo())
         return IntSize();
 
-    int x = 0, y = 0;
+    // TODO: handle possible clean aperture data. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596571
+    // TODO: handle possible transformation matrix. See
+    // https://bugzilla.gnome.org/show_bug.cgi?id=596326
+    int width = 0, height = 0;
     if (GstPad* pad = gst_element_get_static_pad(m_videoSink, "sink")) {
-        gst_video_get_size(GST_PAD(pad), &x, &y);
+        gst_video_get_size(GST_PAD(pad), &width, &height);
+        GstCaps* caps = GST_PAD_CAPS(pad);
+        gfloat pixelAspectRatio;
+        gint pixelAspectRatioNumerator, pixelAspectRatioDenominator;
+
+        if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
+                                                     &pixelAspectRatioDenominator))
+            pixelAspectRatioNumerator = pixelAspectRatioDenominator = 1;
+
+        pixelAspectRatio = (gfloat) pixelAspectRatioNumerator / (gfloat) pixelAspectRatioDenominator;
+        width *= pixelAspectRatio;
+        height /= pixelAspectRatio;
         gst_object_unref(GST_OBJECT(pad));
     }
 
-    return IntSize(x, y);
+    return IntSize(width, height);
 }
 
 bool MediaPlayerPrivate::hasVideo() const
@@ -325,24 +366,31 @@ bool MediaPlayerPrivate::hasVideo() const
     return currentVideo > -1;
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    gint currentAudio = -1;
+    if (m_playBin)
+        g_object_get(G_OBJECT(m_playBin), "current-audio", &currentAudio, NULL);
+    return currentAudio > -1;
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
     m_volume = volume;
     LOG_VERBOSE(Media, "Volume to %f", volume);
-    setMuted(false);
+
+    if (!m_playBin)
+        return;
+
+    g_object_set(G_OBJECT(m_playBin), "volume", m_volume, NULL);
 }
 
-void MediaPlayerPrivate::setMuted(bool b)
+void MediaPlayerPrivate::setMuted(bool mute)
 {
     if (!m_playBin)
         return;
 
-    if (b) {
-        g_object_get(G_OBJECT(m_playBin), "volume", &m_volume, NULL);
-        g_object_set(G_OBJECT(m_playBin), "volume", (double)0.0, NULL);
-    } else
-        g_object_set(G_OBJECT(m_playBin), "volume", m_volume, NULL);
-
+    g_object_set(G_OBJECT(m_playBin), "mute", mute, NULL);
 }
 
 void MediaPlayerPrivate::setRate(float rate)
@@ -351,17 +399,13 @@ void MediaPlayerPrivate::setRate(float rate)
         gst_element_set_state(m_playBin, GST_STATE_PAUSED);
         return;
     }
+
     if (m_isStreaming)
         return;
 
     m_rate = rate;
     LOG_VERBOSE(Media, "Set Rate to %f", rate);
-    if (!gst_element_seek(m_playBin, rate,
-            GST_FORMAT_TIME,
-            (GstSeekFlags)(GST_SEEK_FLAG_FLUSH | GST_SEEK_FLAG_ACCURATE),
-            GST_SEEK_TYPE_SET, (GstClockTime) (currentTime() * GST_SECOND),
-            GST_SEEK_TYPE_SET, (GstClockTime) (m_endTime * GST_SECOND)))
-        LOG_VERBOSE(Media, "Set Rate to %f failed", rate);
+    seek(currentTime());
 }
 
 int MediaPlayerPrivate::dataRate() const
@@ -380,16 +424,20 @@ MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
     return m_readyState;
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
-    notImplemented();
-    LOG_VERBOSE(Media, "maxTimeBuffered");
-    // rtsp streams are not buffered
-    return m_isStreaming ? 0 : maxTimeLoaded();
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    if (!m_errorOccured && !m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
 {
+    if (m_errorOccured)
+        return 0.0;
+
     // TODO
     LOG_VERBOSE(Media, "maxTimeSeekable");
     if (m_isStreaming)
@@ -400,6 +448,9 @@ float MediaPlayerPrivate::maxTimeSeekable() const
 
 float MediaPlayerPrivate::maxTimeLoaded() const
 {
+    if (m_errorOccured)
+        return 0.0;
+
     // TODO
     LOG_VERBOSE(Media, "maxTimeLoaded");
     notImplemented();
@@ -416,29 +467,30 @@ unsigned MediaPlayerPrivate::bytesLoaded() const
     float maxTime = maxTimeLoaded();
     if (!dur)
         return 0;*/
+
     return 1;//totalBytes() * maxTime / dur;
 }
 
 bool MediaPlayerPrivate::totalBytesKnown() const
 {
-    notImplemented();
     LOG_VERBOSE(Media, "totalBytesKnown");
     return totalBytes() > 0;
 }
 
 unsigned MediaPlayerPrivate::totalBytes() const
 {
-    notImplemented();
     LOG_VERBOSE(Media, "totalBytes");
-    if (!m_playBin)
+    if (!m_source)
         return 0;
 
-    if (!m_source)
+    if (m_errorOccured)
         return 0;
 
-    // Do something with m_source to get the total bytes of the media
+    GstFormat fmt = GST_FORMAT_BYTES;
+    gint64 length = 0;
+    gst_element_query_duration(m_source, &fmt, &length);
 
-    return 100;
+    return length;
 }
 
 void MediaPlayerPrivate::cancelLoad()
@@ -452,17 +504,21 @@ void MediaPlayerPrivate::updateStates()
     // the state of GStreamer, therefore, when in PAUSED state,
     // we are sure we can display the first frame and go to play
 
+    if (!m_playBin)
+        return;
+
+    if (m_errorOccured)
+        return;
+
     MediaPlayer::NetworkState oldNetworkState = m_networkState;
     MediaPlayer::ReadyState oldReadyState = m_readyState;
     GstState state;
     GstState pending;
 
-    if (!m_playBin)
-        return;
-
     GstStateChangeReturn ret = gst_element_get_state(m_playBin,
         &state, &pending, 250 * GST_NSECOND);
 
+    bool shouldUpdateAfterSeek = false;
     switch (ret) {
     case GST_STATE_CHANGE_SUCCESS:
         LOG_VERBOSE(Media, "State: %s, pending: %s",
@@ -474,6 +530,16 @@ void MediaPlayerPrivate::updateStates()
         } else if (state == GST_STATE_PAUSED)
             m_readyState = MediaPlayer::HaveEnoughData;
 
+        if (state == GST_STATE_PLAYING)
+            m_paused = false;
+        else
+            m_paused = true;
+
+        if (m_seeking) {
+            shouldUpdateAfterSeek = true;
+            m_seeking = false;
+        }
+
         m_networkState = MediaPlayer::Loaded;
 
         g_object_get(m_playBin, "source", &m_source, NULL);
@@ -486,11 +552,17 @@ void MediaPlayerPrivate::updateStates()
             gst_element_state_get_name(pending));
         // Change in progress
         return;
-        break;
+    case GST_STATE_CHANGE_FAILURE:
+        LOG_VERBOSE(Media, "Failure: State: %s, pending: %s",
+            gst_element_state_get_name(state),
+            gst_element_state_get_name(pending));
+        // Change failed
+        return;
     case GST_STATE_CHANGE_NO_PREROLL:
         LOG_VERBOSE(Media, "No preroll: State: %s, pending: %s",
             gst_element_state_get_name(state),
             gst_element_state_get_name(pending));
+
         if (state == GST_STATE_READY) {
             m_readyState = MediaPlayer::HaveFutureData;
         } else if (state == GST_STATE_PAUSED)
@@ -506,6 +578,9 @@ void MediaPlayerPrivate::updateStates()
     if (seeking())
         m_readyState = MediaPlayer::HaveNothing;
 
+    if (shouldUpdateAfterSeek)
+        timeChanged();
+
     if (m_networkState != oldNetworkState) {
         LOG_VERBOSE(Media, "Network State Changed from %u to %u",
             oldNetworkState, m_networkState);
@@ -546,15 +621,14 @@ void MediaPlayerPrivate::volumeChanged()
 
 void MediaPlayerPrivate::didEnd()
 {
-    m_isEndReached = true;
-    pause();
     timeChanged();
 }
 
-void MediaPlayerPrivate::loadingFailed()
+void MediaPlayerPrivate::loadingFailed(MediaPlayer::NetworkState error)
 {
-    if (m_networkState != MediaPlayer::NetworkError) {
-        m_networkState = MediaPlayer::NetworkError;
+    m_errorOccured = true;
+    if (m_networkState != error) {
+        m_networkState = error;
         m_player->networkStateChanged();
     }
     if (m_readyState != MediaPlayer::HaveNothing) {
@@ -565,7 +639,18 @@ void MediaPlayerPrivate::loadingFailed()
 
 void MediaPlayerPrivate::setSize(const IntSize& size)
 {
+    // Destroy and re-create the cairo surface only if the size
+    // changed.
+    if (size != m_size) {
+        if (m_surface)
+            cairo_surface_destroy(m_surface);
+        m_surface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, size.width(),
+                                               size.height());
+        g_object_set(m_videoSink, "surface", m_surface, 0);
+    }
+
     m_size = size;
+
 }
 
 void MediaPlayerPrivate::setVisible(bool visible)
@@ -586,11 +671,12 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     if (!m_visible)
         return;
 
-    //TODO: m_size vs rect?
     cairo_t* cr = context->platformContext();
 
     cairo_save(cr);
     cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
+
+    // paint the rectangle on the context and draw the surface inside.
     cairo_translate(cr, rect.x(), rect.y());
     cairo_rectangle(cr, 0, 0, rect.width(), rect.height());
     cairo_set_source_surface(cr, m_surface, 0, 0);
@@ -598,24 +684,124 @@ void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
     cairo_restore(cr);
 }
 
+static HashSet<String> mimeTypeCache()
+{
+
+    do_gst_init();
+
+    static HashSet<String> cache;
+    static bool typeListInitialized = false;
+
+    if (!typeListInitialized) {
+        // These subtypes are already beeing supported by WebKit itself
+        HashSet<String> ignoredApplicationSubtypes;
+        ignoredApplicationSubtypes.add(String("javascript"));
+        ignoredApplicationSubtypes.add(String("ecmascript"));
+        ignoredApplicationSubtypes.add(String("x-javascript"));
+        ignoredApplicationSubtypes.add(String("xml"));
+        ignoredApplicationSubtypes.add(String("xhtml+xml"));
+        ignoredApplicationSubtypes.add(String("rss+xml"));
+        ignoredApplicationSubtypes.add(String("atom+xml"));
+        ignoredApplicationSubtypes.add(String("x-ftp-directory"));
+        ignoredApplicationSubtypes.add(String("x-java-applet"));
+        ignoredApplicationSubtypes.add(String("x-java-bean"));
+        ignoredApplicationSubtypes.add(String("x-java-vm"));
+        ignoredApplicationSubtypes.add(String("x-shockwave-flash"));
+
+        GList* factories = gst_type_find_factory_get_list();
+        for (GList* iterator = factories; iterator; iterator = iterator->next) {
+            GstTypeFindFactory* factory = GST_TYPE_FIND_FACTORY(iterator->data);
+            GstCaps* caps = gst_type_find_factory_get_caps(factory);
+
+            // Splitting the capability by comma and taking the first part
+            // as capability can be something like "audio/x-wavpack, framed=(boolean)false"
+            GOwnPtr<gchar> capabilityString(gst_caps_to_string(caps));
+            gchar** capability = g_strsplit(capabilityString.get(), ",", 2);
+            gchar** mimetype = g_strsplit(capability[0], "/", 2);
+
+            // GStreamer plugins can be capable of supporting types which WebKit supports
+            // by default. In that case, we should not consider these types supportable by GStreamer.
+            // Examples of what GStreamer can support but should not be added:
+            // text/plain, text/html, image/jpeg, application/xml
+            if (g_str_equal(mimetype[0], "audio") ||
+                    g_str_equal(mimetype[0], "video") ||
+                    (g_str_equal(mimetype[0], "application") &&
+                        !ignoredApplicationSubtypes.contains(String(mimetype[1])))) {
+                cache.add(String(capability[0]));
+
+                // These formats are supported by GStreamer, but not correctly advertised
+                if (g_str_equal(capability[0], "video/x-h264") ||
+                    g_str_equal(capability[0], "audio/x-m4a")) {
+                    cache.add(String("video/mp4"));
+                    cache.add(String("audio/aac"));
+                }
+
+                if (g_str_equal(capability[0], "video/x-theora"))
+                    cache.add(String("video/ogg"));
+
+                if (g_str_equal(capability[0], "audio/x-wav"))
+                    cache.add(String("audio/wav"));
+
+                if (g_str_equal(capability[0], "audio/mpeg")) {
+                    // This is what we are handling: mpegversion=(int)1, layer=(int)[ 1, 3 ]
+                    gchar** versionAndLayer = g_strsplit(capability[1], ",", 2);
+
+                    if (g_str_has_suffix (versionAndLayer[0], "(int)1")) {
+                        for (int i = 0; versionAndLayer[1][i] != '\0'; i++) {
+                            if (versionAndLayer[1][i] == '1')
+                                cache.add(String("audio/mp1"));
+                            else if (versionAndLayer[1][i] == '2')
+                                cache.add(String("audio/mp2"));
+                            else if (versionAndLayer[1][i] == '3')
+                                cache.add(String("audio/mp3"));
+                        }
+                    }
+
+                    g_strfreev(versionAndLayer);
+                }
+            }
+
+            g_strfreev(capability);
+            g_strfreev(mimetype);
+        }
+
+        gst_plugin_feature_list_free(factories);
+        typeListInitialized = true;
+    }
+
+    return cache;
+}
+
 void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
 {
-    // FIXME: query the engine to see what types are supported
-    notImplemented();
-    types.add(String("video/x-theora+ogg"));
+    types = mimeTypeCache();
 }
 
 MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
 {
-    // FIXME: query the engine to see what types are supported
-    notImplemented();
-    return type == "video/x-theora+ogg" ? (codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported) : MediaPlayer::IsNotSupported;
+    if (type.isNull() || type.isEmpty())
+        return MediaPlayer::IsNotSupported;
+
+    // spec says we should not return "probably" if the codecs string is empty
+    if (mimeTypeCache().contains(type))
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    return MediaPlayer::IsNotSupported;
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    return true;
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
 }
 
 void MediaPlayerPrivate::createGSTPlayBin(String url)
 {
     ASSERT(!m_playBin);
-    m_playBin = gst_element_factory_make("playbin", "play");
+    m_playBin = gst_element_factory_make("playbin2", "play");
 
     GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
     gst_bus_add_signal_watch(bus);
@@ -627,10 +813,12 @@ void MediaPlayerPrivate::createGSTPlayBin(String url)
 
     g_object_set(G_OBJECT(m_playBin), "uri", url.utf8().data(), NULL);
 
-    GstElement* audioSink = gst_element_factory_make("gconfaudiosink", 0);
     m_videoSink = webkit_video_sink_new(m_surface);
 
-    g_object_set(m_playBin, "audio-sink", audioSink, NULL);
+    // This ref is to protect the sink from being destroyed before we stop the idle it
+    // creates internally. See the comment in ~MediaPlayerPrivate.
+    g_object_ref(m_videoSink);
+
     g_object_set(m_playBin, "video-sink", m_videoSink, NULL);
 
     g_signal_connect(m_videoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
@@ -641,4 +829,3 @@ void MediaPlayerPrivate::createGSTPlayBin(String url)
 }
 
 #endif
-
diff --git a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
index 8842f84..d305759 100644
--- a/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
+++ b/WebCore/platform/graphics/gtk/MediaPlayerPrivateGStreamer.h
@@ -56,6 +56,7 @@ namespace WebCore {
 
             IntSize naturalSize() const;
             bool hasVideo() const;
+            bool hasAudio() const;
 
             void load(const String &url);
             void cancelLoad();
@@ -80,7 +81,7 @@ namespace WebCore {
             MediaPlayer::NetworkState networkState() const;
             MediaPlayer::ReadyState readyState() const;
 
-            float maxTimeBuffered() const;
+            PassRefPtr<TimeRanges> buffered() const;
             float maxTimeSeekable() const;
             unsigned bytesLoaded() const;
             bool totalBytesKnown() const;
@@ -95,11 +96,15 @@ namespace WebCore {
             void timeChanged();
             void volumeChanged();
             void didEnd();
-            void loadingFailed();
+            void loadingFailed(MediaPlayer::NetworkState);
 
             void repaint();
             void paint(GraphicsContext*, const IntRect&);
 
+            bool hasSingleSecurityOrigin() const;
+
+            bool supportsFullscreen() const;
+
         private:
             MediaPlayerPrivate(MediaPlayer*);
             static MediaPlayerPrivateInterface* create(MediaPlayer* player);
@@ -132,6 +137,10 @@ namespace WebCore {
             IntSize m_size;
             bool m_visible;
             cairo_surface_t* m_surface;
+
+            bool m_paused;
+            bool m_seeking;
+            bool m_errorOccured;
     };
 }
 
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
index a77c1cf..9a616f4 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataGtk.cpp
@@ -50,9 +50,9 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
-    m_ascent = static_cast<int>(font_extents.ascent);
-    m_descent = static_cast<int>(font_extents.descent);
-    m_lineSpacing = static_cast<int>(font_extents.height);
+    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
+    m_descent = static_cast<int>(lroundf(font_extents.descent));
+    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
@@ -63,7 +63,7 @@ void SimpleFontData::platformInit()
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
-    m_spaceWidth =  static_cast<int>(text_extents.x_advance);
+    m_spaceWidth = static_cast<float>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
@@ -130,10 +130,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return w;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
index e57d9e6..975143e 100644
--- a/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
+++ b/WebCore/platform/graphics/gtk/SimpleFontDataPango.cpp
@@ -49,9 +49,9 @@ void SimpleFontData::platformInit()
     cairo_font_extents_t font_extents;
     cairo_text_extents_t text_extents;
     cairo_scaled_font_extents(m_platformData.m_scaledFont, &font_extents);
-    m_ascent = static_cast<int>(font_extents.ascent);
-    m_descent = static_cast<int>(font_extents.descent);
-    m_lineSpacing = static_cast<int>(font_extents.height);
+    m_ascent = static_cast<int>(lroundf(font_extents.ascent));
+    m_descent = static_cast<int>(lroundf(font_extents.descent));
+    m_lineSpacing = static_cast<int>(lroundf(font_extents.height));
     // There seems to be some rounding error in cairo (or in how we
     // use cairo) with some fonts, like DejaVu Sans Mono, which makes
     // cairo report a height smaller than ascent + descent, which is
@@ -62,7 +62,7 @@ void SimpleFontData::platformInit()
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, "x", &text_extents);
     m_xHeight = text_extents.height;
     cairo_scaled_font_text_extents(m_platformData.m_scaledFont, " ", &text_extents);
-    m_spaceWidth =  static_cast<int>(text_extents.x_advance);
+    m_spaceWidth =  static_cast<float>(text_extents.x_advance);
     m_lineGap = m_lineSpacing - m_ascent - m_descent;
     m_syntheticBoldOffset = m_platformData.syntheticBold() ? 1.0f : 0.f;
 }
@@ -133,10 +133,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return w;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
index f049998..fb86fe9 100644
--- a/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
+++ b/WebCore/platform/graphics/gtk/VideoSinkGStreamer.cpp
@@ -33,8 +33,14 @@
 #include <gst/video/video.h>
 
 static GstStaticPadTemplate sinktemplate = GST_STATIC_PAD_TEMPLATE("sink",
-        GST_PAD_SINK, GST_PAD_ALWAYS,
-        GST_STATIC_CAPS(GST_VIDEO_CAPS_RGBx ";" GST_VIDEO_CAPS_BGRx));
+                                                                   GST_PAD_SINK, GST_PAD_ALWAYS,
+// CAIRO_FORMAT_RGB24 used to render the video buffers is little/big endian dependant.
+#if G_BYTE_ORDER == G_LITTLE_ENDIAN
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_BGRx)
+#else
+                                                                   GST_STATIC_CAPS(GST_VIDEO_CAPS_xRGB)
+#endif
+);
 
 GST_DEBUG_CATEGORY_STATIC(webkit_video_sink_debug);
 #define GST_CAT_DEFAULT webkit_video_sink_debug
@@ -102,9 +108,14 @@ webkit_video_sink_init(WebKitVideoSink* sink, WebKitVideoSinkClass* klass)
 static gboolean
 webkit_video_sink_idle_func(gpointer data)
 {
-    WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(data);
+    WebKitVideoSink* sink = reinterpret_cast<WebKitVideoSink*>(data);
     WebKitVideoSinkPrivate* priv = sink->priv;
     GstBuffer* buffer;
+    GstCaps* caps;
+    GstVideoFormat format;
+    gint par_n, par_d;
+    gfloat par;
+    gint bwidth, bheight;
 
     if (!priv->async_queue)
         return FALSE;
@@ -113,19 +124,35 @@ webkit_video_sink_idle_func(gpointer data)
     if (!buffer || G_UNLIKELY(!GST_IS_BUFFER(buffer)))
         return FALSE;
 
+    caps = GST_BUFFER_CAPS(buffer);
+    if (!gst_video_format_parse_caps(caps, &format, &bwidth, &bheight)) {
+        GST_ERROR_OBJECT(sink, "Unknown video format in buffer caps '%s'",
+                         gst_caps_to_string(caps));
+        return FALSE;
+    }
+
+    if (!gst_video_parse_caps_pixel_aspect_ratio(caps, &par_n, &par_d))
+        par_n = par_d = 1;
+
+    par = (gfloat) par_n / (gfloat) par_d;
+
     // TODO: consider priv->rgb_ordering?
-    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer), CAIRO_FORMAT_RGB24, priv->width, priv->height, (4 * priv->width + 3) & ~3);
+    cairo_surface_t* src = cairo_image_surface_create_for_data(GST_BUFFER_DATA(buffer),
+                                                               CAIRO_FORMAT_RGB24,
+                                                               bwidth, bheight,
+                                                               4 * bwidth);
 
     // TODO: We copy the data twice right now. This could be easily improved.
     cairo_t* cr = cairo_create(priv->surface);
+    cairo_scale(cr, par, 1.0 / par);
     cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
     cairo_set_source_surface(cr, src, 0, 0);
     cairo_surface_destroy(src);
     cairo_rectangle(cr, 0, 0, priv->width, priv->height);
     cairo_fill(cr);
     cairo_destroy(cr);
-
     gst_buffer_unref(buffer);
+    g_async_queue_unref(priv->async_queue);
 
     g_signal_emit(sink, webkit_video_sink_signals[REPAINT_REQUESTED], 0);
 
@@ -138,6 +165,7 @@ webkit_video_sink_render(GstBaseSink* bsink, GstBuffer* buffer)
     WebKitVideoSink* sink = WEBKIT_VIDEO_SINK(bsink);
     WebKitVideoSinkPrivate* priv = sink->priv;
 
+    g_async_queue_ref(priv->async_queue);
     g_async_queue_push(priv->async_queue, gst_buffer_ref(buffer));
     g_idle_add_full(G_PRIORITY_HIGH_IDLE, webkit_video_sink_idle_func, sink, 0);
 
@@ -151,9 +179,7 @@ webkit_video_sink_set_caps(GstBaseSink* bsink, GstCaps* caps)
     WebKitVideoSinkPrivate* priv = sink->priv;
     GstStructure* structure;
     gboolean ret;
-    const GValue* fps;
-    const GValue* par;
-    gint width, height;
+    gint width, height, fps_n, fps_d;
     int red_mask;
 
     GstCaps* intersection = gst_caps_intersect(gst_static_pad_template_get_caps(&sinktemplate), caps);
@@ -167,25 +193,19 @@ webkit_video_sink_set_caps(GstBaseSink* bsink, GstCaps* caps)
 
     ret = gst_structure_get_int(structure, "width", &width);
     ret &= gst_structure_get_int(structure, "height", &height);
-    fps = gst_structure_get_value(structure, "framerate");
-    ret &= (fps != 0);
-
-    par = gst_structure_get_value(structure, "pixel-aspect-ratio");
 
-    if (!ret)
-        return FALSE;
+    /* We dont yet use fps but handy to have */
+    ret &= gst_structure_get_fraction(structure, "framerate",
+                                      &fps_n, &fps_d);
+    g_return_val_if_fail(ret, FALSE);
 
     priv->width = width;
     priv->height = height;
+    priv->fps_n = fps_n;
+    priv->fps_d = fps_d;
 
-    /* We dont yet use fps or pixel aspect into but handy to have */
-    priv->fps_n = gst_value_get_fraction_numerator(fps);
-    priv->fps_d = gst_value_get_fraction_denominator(fps);
-
-    if (par) {
-        priv->par_n = gst_value_get_fraction_numerator(par);
-        priv->par_d = gst_value_get_fraction_denominator(par);
-    } else
+    if (!gst_structure_get_fraction(structure, "pixel-aspect-ratio",
+                                    &priv->par_n, &priv->par_d))
         priv->par_n = priv->par_d = 1;
 
     gst_structure_get_int(structure, "red_mask", &red_mask);
@@ -265,6 +285,8 @@ webkit_video_sink_stop(GstBaseSink* base_sink)
 
     g_async_queue_unlock(priv->async_queue);
 
+    g_idle_remove_by_data(base_sink);
+
     return TRUE;
 }
 
diff --git a/WebCore/platform/graphics/haiku/ColorHaiku.cpp b/WebCore/platform/graphics/haiku/ColorHaiku.cpp
new file mode 100644
index 0000000..a9ac186
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ColorHaiku.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Color.h"
+
+#include <InterfaceDefs.h>
+
+
+namespace WebCore {
+
+Color::Color(const rgb_color& color)
+    : m_color(makeRGBA(color.red, color.green, color.blue, color.alpha))
+    , m_valid(true)
+{
+}
+
+Color::operator rgb_color() const
+{
+    return make_color(red(), green(), blue(), alpha());
+}
+
+
+Color focusRingColor()
+{
+    return Color(keyboard_navigation_color());
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp b/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp
new file mode 100644
index 0000000..0f50898
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FloatPointHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FloatPoint.h"
+
+#include <Point.h>
+
+
+namespace WebCore {
+
+FloatPoint::FloatPoint(const BPoint& point)
+    : m_x(point.x)
+    , m_y(point.y)
+{
+}
+
+FloatPoint::operator BPoint() const
+{
+    return BPoint(m_x, m_y);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp b/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp
new file mode 100644
index 0000000..67af3af
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FloatRectHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FloatRect.h"
+
+#include <Rect.h>
+
+
+namespace WebCore {
+
+FloatRect::FloatRect(const BRect& rect)
+    : m_location(rect.LeftTop())
+    , m_size(rect.Width(), rect.Height())
+{
+}
+
+FloatRect::operator BRect() const
+{
+    return BRect(BPoint(x(), y()), BSize(width(), height()));
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp b/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp
new file mode 100644
index 0000000..b99bf42
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCacheHaiku.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FontCache.h"
+
+#include "Font.h"
+#include "FontData.h"
+#include "FontPlatformData.h"
+#include "NotImplemented.h"
+#include <String.h>
+
+
+namespace WebCore {
+
+void FontCache::platformInit()
+{
+}
+
+const SimpleFontData* FontCache::getFontDataForCharacters(const Font& font, const UChar* characters, int length)
+{
+    FontPlatformData data(font.fontDescription(), font.family().family());
+    return getCachedFontData(&data);
+}
+
+FontPlatformData* FontCache::getSimilarFontPlatformData(const Font& font)
+{
+    notImplemented();
+    return 0;
+}
+
+FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fontDescription)
+{
+    // FIXME: Would be even better to somehow get the user's default font here.
+    // For now we'll pick the default that the user would get without changing any prefs.
+    static AtomicString defaultString("DejaVu Serif");
+    return getCachedFontPlatformData(fontDescription, defaultString);
+}
+
+FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& family)
+{
+    return new FontPlatformData(fontDescription, family);
+}
+
+void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp b/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
new file mode 100644
index 0000000..6008bb1
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCustomPlatformData.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "FontCustomPlatformData.h"
+
+#include "SharedBuffer.h"
+#include "FontPlatformData.h"
+
+
+namespace WebCore {
+
+FontCustomPlatformData::~FontCustomPlatformData()
+{
+}
+
+FontPlatformData FontCustomPlatformData::fontPlatformData(int size, bool bold, bool italic, FontRenderingMode)
+{
+    return FontPlatformData(size, bold, italic);
+}
+
+FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
+{
+    // FIXME: We need support in Haiku to read fonts from memory to implement this.
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/graphics/haiku/FontCustomPlatformData.h b/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
new file mode 100644
index 0000000..c5a814e
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontCustomPlatformData.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2008 Alp Toker <alp@atoker.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef FontCustomPlatformData_h
+#define FontCustomPlatformData_h
+
+#include "FontRenderingMode.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class FontPlatformData;
+    class SharedBuffer;
+
+    struct FontCustomPlatformData : Noncopyable {
+    public:
+        FontCustomPlatformData() { }
+        ~FontCustomPlatformData();
+
+        FontPlatformData fontPlatformData(int size, bool bold, bool italic, FontRenderingMode = NormalRenderingMode);
+    };
+
+    FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer*);
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/haiku/FontHaiku.cpp b/WebCore/platform/graphics/haiku/FontHaiku.cpp
new file mode 100644
index 0000000..48744d9
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontHaiku.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Font.h"
+
+#include "FontData.h"
+#include "FontDescription.h"
+#include "FontSelector.h"
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include <Font.h>
+#include <String.h>
+#include <View.h>
+
+
+// FIXME: Temp routine to convert unicode character to UTF8.
+int charUnicodeToUTF8HACK(unsigned short glyph, char* out)
+{
+    int i = 0;
+
+    if (glyph < 0x0080)
+        out[i++] = static_cast<char>(glyph);
+    else if (glyph < 0x0800) {  // 2 bytes
+        out[i++] = 0xc0 | (glyph >> 6);
+        out[i++] = 0x80 | (glyph & 0x3F);
+    } else if (glyph > 0x0800) {  // 3 bytes
+        out[i++] = 0xe0 | (glyph >> 12);
+        out[i++] = 0x80 | ((glyph >> 6) & 0x3F);
+        out[i++] = 0x80 | (glyph & 0x3F);
+    }
+
+    out[i] = '\0';
+    return i;
+}
+
+namespace WebCore {
+
+bool Font::canReturnFallbackFontsForComplexText()
+{
+    return false;
+}
+
+void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* font,
+                      const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
+{
+    Color color = graphicsContext->fillColor();
+    BView* view = graphicsContext->platformContext();
+    BFont* m_font = font->platformData().font();
+
+    graphicsContext->setCompositeOperation(CompositeSourceOver);
+    view->SetHighColor(color);
+    view->SetFont(m_font);
+
+    GlyphBufferGlyph* glyphs = const_cast<GlyphBufferGlyph*>(glyphBuffer.glyphs(from));
+    float offset = point.x();
+    for (int i = 0; i < numGlyphs; i++) {
+        char out[4];
+        charUnicodeToUTF8HACK(glyphs[i], out);
+
+        view->DrawString(out, sizeof(out), BPoint(offset, point.y()));
+        offset += glyphBuffer.advanceAt(from + i);
+    }
+}
+
+void Font::drawComplexText(GraphicsContext* ctx, const TextRun& run, const FloatPoint& point,
+                           int from, int to) const
+{
+    notImplemented();
+}
+
+
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts) const
+{
+    notImplemented();
+    return 0;
+}
+
+FloatRect Font::selectionRectForComplexText(const TextRun&, const IntPoint&, int, int, int) const
+{
+    notImplemented();
+    return FloatRect();
+}
+
+int Font::offsetForPositionForComplexText(const TextRun&, int, bool) const
+{
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/FontPlatformData.h b/WebCore/platform/graphics/haiku/FontPlatformData.h
new file mode 100644
index 0000000..9feab8e
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/FontPlatformData.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#ifndef FontPlatformData_H
+#define FontPlatformData_H
+
+#include "FontDescription.h"
+#include "GlyphBuffer.h"
+#include <interface/Font.h>
+
+namespace WebCore {
+
+    class FontPlatformData {
+    public:
+        FontPlatformData(WTF::HashTableDeletedValueType)
+            : m_font(hashTableDeletedFontValue())
+            { }
+
+        FontPlatformData()
+            : m_font(0)
+            { }
+
+        FontPlatformData(const FontDescription&, const AtomicString& family);
+        FontPlatformData(float size, bool bold, bool oblique);
+        FontPlatformData(const FontPlatformData&);
+
+        ~FontPlatformData();
+
+        BFont* font() const { return m_font; }
+
+        bool isFixedPitch();
+        float size() const { return m_size; }
+        bool bold() const { return m_bold; }
+        bool oblique() const { return m_oblique; }
+
+        unsigned hash() const;
+        bool isHashTableDeletedValue() const;
+
+        bool operator==(const FontPlatformData&) const;
+
+#ifndef NDEBUG
+        String description() const;
+#endif
+
+        BFont* m_font;
+        float m_size;
+        bool m_bold;
+        bool m_oblique;
+
+    private:
+        static BFont* hashTableDeletedFontValue() { return reinterpret_cast<BFont*>(-1); }
+    };
+
+} // namespace WebCore
+
+#endif
+
diff --git a/WebCore/platform/graphics/haiku/GradientHaiku.cpp b/WebCore/platform/graphics/haiku/GradientHaiku.cpp
new file mode 100644
index 0000000..469a17f
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/GradientHaiku.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2008 Kevin Ollivier <kevino@theolliviers.com>  All rights reserved.
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@theolliviers.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Gradient.h"
+
+#include "CSSParser.h"
+#include "NotImplemented.h"
+
+
+namespace WebCore {
+
+void Gradient::platformDestroy()
+{
+    notImplemented();
+}
+
+PlatformGradient Gradient::platformGradient()
+{
+    notImplemented();
+    return 0;
+}
+
+void Gradient::fill(GraphicsContext*, const FloatRect&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
new file mode 100644
index 0000000..d785ef4
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -0,0 +1,536 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GraphicsContext.h"
+
+#include "CString.h"
+#include "Color.h"
+#include "Font.h"
+#include "FontData.h"
+#include "NotImplemented.h"
+#include "Path.h"
+#include "Pen.h"
+#include "TransformationMatrix.h"
+#include <GraphicsDefs.h>
+#include <Region.h>
+#include <View.h>
+#include <Window.h>
+#include <stdio.h>
+
+
+namespace WebCore {
+
+class GraphicsContextPlatformPrivate {
+public:
+    GraphicsContextPlatformPrivate(BView* view);
+    ~GraphicsContextPlatformPrivate();
+
+    BView* m_view;
+};
+
+GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate(BView* view)
+    : m_view(view)
+{
+}
+
+GraphicsContextPlatformPrivate::~GraphicsContextPlatformPrivate()
+{
+}
+
+GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
+    : m_common(createGraphicsContextPrivate())
+    , m_data(new GraphicsContextPlatformPrivate(context))
+{
+    setPaintingDisabled(!context);
+}
+
+GraphicsContext::~GraphicsContext()
+{
+    destroyGraphicsContextPrivate(m_common);
+    delete m_data;
+}
+
+PlatformGraphicsContext* GraphicsContext::platformContext() const
+{
+    return m_data->m_view;
+}
+
+void GraphicsContext::savePlatformState()
+{
+    m_data->m_view->PushState();
+}
+
+void GraphicsContext::restorePlatformState()
+{
+    m_data->m_view->PopState();
+}
+
+// Draws a filled rectangle with a stroked border.
+void GraphicsContext::drawRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->FillRect(rect);
+    if (strokeStyle() != NoStroke)
+        m_data->m_view->StrokeRect(rect, getHaikuStrokeStyle());
+}
+
+// This is only used to draw borders.
+void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
+{
+    if (paintingDisabled())
+        return;
+
+    if (strokeStyle() == NoStroke)
+        return;
+
+    m_data->m_view->StrokeLine(point1, point2, getHaikuStrokeStyle());
+}
+
+// This method is only used to draw the little circles used in lists.
+void GraphicsContext::drawEllipse(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->FillEllipse(rect);
+    if (strokeStyle() != NoStroke)
+        m_data->m_view->StrokeEllipse(rect, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSpan)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->StrokeArc(rect, startAngle, angleSpan, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::strokePath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::drawConvexPolygon(size_t pointsLength, const FloatPoint* points, bool shouldAntialias)
+{
+    if (paintingDisabled())
+        return;
+
+    BPoint bPoints[pointsLength];
+    for (size_t i = 0; i < pointsLength; i++)
+        bPoints[i] = points[i];
+
+    m_data->m_view->FillPolygon(bPoints, pointsLength);
+    if (strokeStyle() != NoStroke)
+        // Stroke with low color
+        m_data->m_view->StrokePolygon(bPoints, pointsLength, true, getHaikuStrokeStyle());
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    rgb_color oldColor = m_data->m_view->HighColor();
+    m_data->m_view->SetHighColor(color);
+    m_data->m_view->FillRect(rect);
+    m_data->m_view->SetHighColor(oldColor);
+}
+
+void GraphicsContext::fillRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+}
+
+void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
+{
+    if (paintingDisabled() || !color.alpha())
+        return;
+
+    notImplemented();
+    // FIXME: A simple implementation could just use FillRoundRect if all
+    // the sizes are the same, or even if they are not. Otherwise several
+    // FillRect and FillArc calls are needed.
+}
+
+void GraphicsContext::fillPath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::beginPath()
+{
+    notImplemented();
+}
+
+void GraphicsContext::addPath(const Path& path)
+{
+    notImplemented();
+}
+
+void GraphicsContext::clip(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    BRegion region(rect);
+    m_data->m_view->ConstrainClippingRegion(&region);
+}
+
+void GraphicsContext::drawFocusRing(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    const Vector<IntRect>& rects = focusRingRects();
+    unsigned rectCount = rects.size();
+
+    // FIXME: maybe we should implement this with BShape?
+
+    if (rects.size() > 1) {
+        BRegion    region;
+        for (int i = 0; i < rectCount; ++i)
+            region.Include(BRect(rects[i]));
+
+        m_data->m_view->SetHighColor(color);
+        m_data->m_view->StrokeRect(region.Frame(), B_MIXED_COLORS);
+    }
+}
+
+void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool printing)
+{
+    if (paintingDisabled())
+        return;
+
+    IntPoint endPoint = origin + IntSize(width, 0);
+    drawLine(origin, endPoint);
+}
+
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int width, bool grammar)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
+{
+    notImplemented();
+    return rect;
+}
+
+void GraphicsContext::beginTransparencyLayer(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::endTransparencyLayer()
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clearRect(const FloatRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::strokeRect(const FloatRect& rect, float width)
+{
+    if (paintingDisabled())
+        return;
+
+    float oldSize = m_data->m_view->PenSize();
+    m_data->m_view->SetPenSize(width);
+    m_data->m_view->StrokeRect(rect, getHaikuStrokeStyle());
+    m_data->m_view->SetPenSize(oldSize);
+}
+
+void GraphicsContext::setLineCap(LineCap lineCap)
+{
+    if (paintingDisabled())
+        return;
+
+    cap_mode mode = B_BUTT_CAP;
+    switch (lineCap) {
+    case RoundCap:
+        mode = B_ROUND_CAP;
+        break;
+    case SquareCap:
+        mode = B_SQUARE_CAP;
+        break;
+    case ButtCap:
+    default:
+        break;
+    }
+
+    m_data->m_view->SetLineMode(mode, m_data->m_view->LineJoinMode(), m_data->m_view->LineMiterLimit());
+}
+
+void GraphicsContext::setLineJoin(LineJoin lineJoin)
+{
+    if (paintingDisabled())
+        return;
+
+    join_mode mode = B_MITER_JOIN;
+    switch (lineJoin) {
+    case RoundJoin:
+        mode = B_ROUND_JOIN;
+        break;
+    case BevelJoin:
+        mode = B_BEVEL_JOIN;
+        break;
+    case MiterJoin:
+    default:
+        break;
+    }
+
+    m_data->m_view->SetLineMode(m_data->m_view->LineCapMode(), mode, m_data->m_view->LineMiterLimit());
+}
+
+void GraphicsContext::setMiterLimit(float limit)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetLineMode(m_data->m_view->LineCapMode(), m_data->m_view->LineJoinMode(), limit);
+}
+
+void GraphicsContext::setAlpha(float opacity)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setCompositeOperation(CompositeOperator op)
+{
+    if (paintingDisabled())
+        return;
+
+    drawing_mode mode = B_OP_COPY;
+    switch (op) {
+    case CompositeClear:
+    case CompositeCopy:
+        // Use the default above
+        break;
+    case CompositeSourceOver:
+        mode = B_OP_OVER;
+        break;
+    default:
+        printf("GraphicsContext::setCompositeOperation: Unsupported composite operation %s\n",
+                compositeOperatorName(op).utf8().data());
+    }
+    m_data->m_view->SetDrawingMode(mode);
+}
+
+void GraphicsContext::clip(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->ConstrainClippingRegion(path.platformPath());
+}
+
+void GraphicsContext::clipOut(const Path& path)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
+{
+    notImplemented();
+}
+
+TransformationMatrix GraphicsContext::getCTM() const
+{
+    notImplemented();
+    return TransformationMatrix();
+}
+
+void GraphicsContext::translate(float x, float y)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+IntPoint GraphicsContext::origin()
+{
+    notImplemented();
+    return IntPoint(0, 0);
+}
+
+void GraphicsContext::rotate(float radians)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::scale(const FloatSize& size)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipOut(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::concatCTM(const TransformationMatrix& transform)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformShouldAntialias(bool enable)
+{
+    if (paintingDisabled())
+        return;
+
+    notImplemented();
+}
+
+void GraphicsContext::setImageInterpolationQuality(InterpolationQuality)
+{
+}
+
+void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformFont(const Font& font)
+{
+    m_data->m_view->SetFont(font.primaryFont()->platformData().font());
+}
+
+void GraphicsContext::setPlatformStrokeColor(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetHighColor(color);
+}
+
+pattern GraphicsContext::getHaikuStrokeStyle()
+{
+    switch (strokeStyle()) {
+    case SolidStroke:
+        return B_SOLID_HIGH;
+        break;
+    case DottedStroke:
+        return B_MIXED_COLORS;
+        break;
+    case DashedStroke:
+        // FIXME: use a better dashed stroke!
+        notImplemented();
+        return B_MIXED_COLORS;
+        break;
+    default:
+        return B_SOLID_LOW;
+        break;
+    }
+}
+
+void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
+{
+    // FIXME: see getHaikuStrokeStyle.
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformStrokeThickness(float thickness)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetPenSize(thickness);
+}
+
+void GraphicsContext::setPlatformFillColor(const Color& color)
+{
+    if (paintingDisabled())
+        return;
+
+    m_data->m_view->SetHighColor(color);
+}
+
+void GraphicsContext::clearPlatformShadow()
+{
+    notImplemented();
+}
+
+void GraphicsContext::setPlatformShadow(IntSize const&, int, Color const&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IconHaiku.cpp b/WebCore/platform/graphics/haiku/IconHaiku.cpp
new file mode 100644
index 0000000..dccac4a
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IconHaiku.cpp
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+    notImplemented();
+}
+
+PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+{
+    notImplemented();
+    return 0;
+}
+
+void Icon::paint(GraphicsContext*, const IntRect&)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/ImageBufferData.h b/WebCore/platform/graphics/haiku/ImageBufferData.h
new file mode 100644
index 0000000..f978c34
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageBufferData.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+namespace WebCore {
+
+    class IntSize;
+
+    class ImageBufferData {
+    public:
+        ImageBufferData(const IntSize&);
+    };
+
+}  // namespace WebCore
+
+#endif  // ImageBufferData_h
+
diff --git a/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
new file mode 100644
index 0000000..276c968
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ImageBuffer.h"
+
+#include "GraphicsContext.h"
+#include "ImageData.h"
+#include "NotImplemented.h"
+
+
+namespace WebCore {
+
+ImageBufferData::ImageBufferData(const IntSize&)
+{
+}
+
+ImageBuffer::ImageBuffer(const IntSize&, ImageColorSpace imageColorSpace, bool& success)
+    : m_data(IntSize())
+{
+    notImplemented();
+    success = false;
+}
+
+ImageBuffer::~ImageBuffer()
+{
+}
+
+GraphicsContext* ImageBuffer::context() const
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+String ImageBuffer::toDataURL(const String&) const
+{
+    notImplemented();
+    return String();
+}
+
+Image* ImageBuffer::image() const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/ImageHaiku.cpp b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
new file mode 100644
index 0000000..323d6ab
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/ImageHaiku.cpp
@@ -0,0 +1,152 @@
+/*
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2006 Simon Hausmann <hausmann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2008 Andrea Anzani <andrea.anzani@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Image.h"
+
+#include "BitmapImage.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <Application.h>
+#include <Bitmap.h>
+#include <View.h>
+
+
+// This function loads resources from WebKit
+Vector<char> loadResourceIntoArray(const char*);
+
+
+namespace WebCore {
+
+bool FrameData::clear(bool clearMetadata)
+{
+    if (clearMetadata)
+        m_haveMetadata = false;
+
+    if (m_frame) {
+        delete m_frame;
+        m_frame = 0;
+        m_duration = 0.0f;
+        m_hasAlpha = true;
+        return true;
+    }
+
+    return false;
+}
+
+WTF::PassRefPtr<Image> Image::loadPlatformResource(const char* name)
+{
+    Vector<char> array = loadResourceIntoArray(name);
+    WTF::PassRefPtr<BitmapImage> image = BitmapImage::create();
+    RefPtr<SharedBuffer> buffer = SharedBuffer::create(array.data(), array.size());
+    image->setData(buffer, true);
+
+    return image;
+}
+
+void BitmapImage::initPlatformData()
+{
+}
+
+void BitmapImage::invalidatePlatformData()
+{
+}
+
+// Drawing Routines
+void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst, const FloatRect& src, CompositeOperator op)
+{
+    startAnimation();
+
+    BBitmap* image = nativeImageForCurrentFrame();
+    if (!image || !image->IsValid()) // If the image hasn't fully loaded.
+        return;
+
+    if (mayFillWithSolidColor()) {
+        fillWithSolidColor(ctxt, dst, solidColor(), op);
+        return;
+    }
+
+    ctxt->save();
+    ctxt->setCompositeOperation(op);
+
+    BRect srcRect(src);
+    BRect dstRect(dst);
+
+    // Test using example site at
+    // http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
+    ctxt->platformContext()->SetDrawingMode(B_OP_ALPHA);
+    ctxt->platformContext()->DrawBitmap(image, srcRect & image->Bounds(), dstRect);
+    ctxt->restore();
+}
+
+void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const TransformationMatrix& patternTransform, const FloatPoint& srcPoint, CompositeOperator op, const FloatRect& dstRect)
+{
+    // FIXME: finish this to support also phased position (srcPoint)
+    startAnimation();
+
+    BBitmap* image = nativeImageForCurrentFrame();
+    if (!image || !image->IsValid()) // If the image hasn't fully loaded.
+        return;
+
+    float currentW = 0;
+    float currentH = 0;
+
+    context->save();
+    context->platformContext()->SetDrawingMode(B_OP_ALPHA);
+    context->clip(enclosingIntRect(dstRect));
+
+    while (currentW < dstRect.width()) {
+        while (currentH < dstRect.height()) {
+            context->platformContext()->DrawBitmap(image, BPoint(dstRect.x() + currentW, dstRect.y() + currentH));
+            currentH += tileRect.height();
+        }
+        currentW += tileRect.width();
+        currentH = 0;
+    }
+    context->restore();
+}
+
+void BitmapImage::checkForSolidColor()
+{
+    // FIXME: need to check the RGBA32 buffer to see if it is 1x1.
+    m_isSolidColor = false;
+    m_checkedForSolidColor = true;
+}
+
+BBitmap* BitmapImage::getBBitmap() const
+{
+    return const_cast<BitmapImage*>(this)->frameAtIndex(0);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntPointHaiku.cpp b/WebCore/platform/graphics/haiku/IntPointHaiku.cpp
new file mode 100644
index 0000000..327e503
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntPointHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntPoint.h"
+
+#include <Point.h>
+
+
+namespace WebCore {
+
+IntPoint::IntPoint(const BPoint& point)
+    : m_x(static_cast<int>(point.x))
+    , m_y(static_cast<int>(point.y))
+{
+}
+
+IntPoint::operator BPoint() const
+{
+    return BPoint(m_x, m_y);
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntRectHaiku.cpp b/WebCore/platform/graphics/haiku/IntRectHaiku.cpp
new file mode 100644
index 0000000..74a0b9d
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntRectHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntRect.h"
+
+#include <Rect.h>
+
+
+namespace WebCore {
+
+IntRect::IntRect(const BRect& rect)
+    : m_location(rect.LeftTop())
+    , m_size(rect.IntegerWidth(), rect.IntegerHeight())
+{
+}
+
+IntRect::operator BRect() const
+{
+    return BRect(BPoint(x(), y()), BSize(width(), height()));
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp b/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp
new file mode 100644
index 0000000..08c3a9d
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/IntSizeHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <Size.h>
+
+
+namespace WebCore {
+
+IntSize::IntSize(const BSize& size)
+    : m_width(size.IntegerWidth())
+    , m_height(size.IntegerHeight())
+{
+}
+
+IntSize::operator BSize() const
+{
+    return BSize(width(), height());
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/PathHaiku.cpp b/WebCore/platform/graphics/haiku/PathHaiku.cpp
new file mode 100644
index 0000000..d0da025
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/PathHaiku.cpp
@@ -0,0 +1,161 @@
+/*
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Path.h"
+
+#include "FloatRect.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <Region.h>
+
+
+namespace WebCore {
+
+Path::Path()
+    : m_path(new BRegion())
+{
+}
+
+Path::~Path()
+{
+    delete m_path;
+}
+
+Path::Path(const Path& other)
+    : m_path(new BRegion(*other.platformPath()))
+{
+}
+
+Path& Path::operator=(const Path& other)
+{
+    if (&other != this)
+        m_path = other.platformPath();
+
+    return *this;
+}
+
+bool Path::hasCurrentPoint() const
+{
+    return !isEmpty();
+}
+
+bool Path::contains(const FloatPoint& point, WindRule rule) const
+{
+    return m_path->Contains(point);
+}
+
+void Path::translate(const FloatSize& size)
+{
+    notImplemented();
+}
+
+FloatRect Path::boundingRect() const
+{
+    return m_path->Frame();
+}
+
+void Path::moveTo(const FloatPoint& point)
+{
+    // FIXME: Use OffsetBy?
+    notImplemented();
+}
+
+void Path::addLineTo(const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    notImplemented();
+}
+
+void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
+{
+    notImplemented();
+}
+
+void Path::closeSubpath()
+{
+    notImplemented();
+}
+
+void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool anticlockwise)
+{
+    notImplemented();
+}
+
+void Path::addRect(const FloatRect& r)
+{
+    m_path->Include(r);
+}
+
+void Path::addEllipse(const FloatRect& r)
+{
+    notImplemented();
+}
+
+void Path::clear()
+{
+    m_path->MakeEmpty();
+}
+
+bool Path::isEmpty() const
+{
+    return !m_path->Frame().IsValid();
+}
+
+String Path::debugString() const
+{
+    notImplemented();
+    return String();
+}
+
+void Path::apply(void* info, PathApplierFunction function) const
+{
+    notImplemented();
+}
+
+void Path::transform(const TransformationMatrix& transform)
+{
+    notImplemented();
+}
+
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier* applier)
+{
+    notImplemented();
+    return FloatRect();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
new file mode 100644
index 0000000..34941c0
--- /dev/null
+++ b/WebCore/platform/graphics/haiku/SimpleFontDataHaiku.cpp
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SimpleFontData.h"
+
+#include "FloatRect.h"
+#include "FontCache.h"
+#include "FontDescription.h"
+#include "NotImplemented.h"
+#include <Rect.h>
+#include <unicode/uchar.h>
+#include <unicode/unorm.h>
+
+
+namespace WebCore {
+
+void SimpleFontData::platformInit()
+{
+    BFont* font = m_platformData.font();
+    if (!font)
+        return;
+
+    font_height height;
+    font->GetHeight(&height);
+    m_ascent = static_cast<int>(height.ascent);
+    m_descent = static_cast<int>(height.descent);
+    m_lineSpacing = m_ascent + m_descent;
+    m_xHeight = height.ascent * 0.56f; // Hack taken from the win port.
+    m_lineGap = height.leading;
+}
+
+void SimpleFontData::platformCharWidthInit()
+{
+    m_avgCharWidth = 0.f;
+    m_maxCharWidth = 0.f;
+    initCharWidths();
+}
+
+void SimpleFontData::platformDestroy()
+{
+    delete m_smallCapsFontData;
+    m_smallCapsFontData = 0;
+}
+
+SimpleFontData* SimpleFontData::smallCapsFontData(const FontDescription& fontDescription) const
+{
+    if (!m_smallCapsFontData) {
+        FontDescription desc = FontDescription(fontDescription);
+        desc.setSpecifiedSize(0.70f * fontDescription.computedSize());
+        const FontPlatformData* fontPlatformData = new FontPlatformData(desc, desc.family().family());
+        m_smallCapsFontData = new SimpleFontData(*fontPlatformData);
+    }
+    return m_smallCapsFontData;
+}
+
+bool SimpleFontData::containsCharacters(const UChar* characters, int length) const
+{
+    // FIXME: We will need to implement this to load non-ASCII encoding sites
+    return true;
+}
+
+void SimpleFontData::determinePitch()
+{
+    m_treatAsFixedPitch = m_platformData.font() && m_platformData.font()->IsFixed();
+}
+
+float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
+{
+    const char charArray[1] = { glyph };
+    float escapements[1];
+
+    if (m_platformData.font()) {
+        m_platformData.font()->GetEscapements(charArray, 1, escapements);
+        return escapements[0] * m_platformData.font()->Size();
+    }
+
+    return 0;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.h b/WebCore/platform/graphics/mac/Canvas3DLayer.h
new file mode 100644
index 0000000..6c65676
--- /dev/null
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Canvas3DLayer_h
+#define Canvas3DLayer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#import "WebLayer.h"
+
+namespace WebCore {
+    class GraphicsLayer;
+}
+
+@interface Canvas3DLayer : CAOpenGLLayer 
+{
+    WebCore::GraphicsLayer* m_layerOwner;
+    CGLContextObj m_contextObj;
+    GLuint m_texture;
+}
+
+-(id)initWithContext:(CGLContextObj)context texture:(GLuint)texture;
+
+@end
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Canvas3DLayer_h
diff --git a/WebCore/platform/graphics/mac/Canvas3DLayer.mm b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
new file mode 100644
index 0000000..545c58b
--- /dev/null
+++ b/WebCore/platform/graphics/mac/Canvas3DLayer.mm
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#if ENABLE(3D_CANVAS)
+
+#import "Canvas3DLayer.h"
+
+#import "GraphicsLayer.h"
+#import <QuartzCore/QuartzCore.h>
+#import <OpenGL/OpenGL.h>
+
+using namespace WebCore;
+
+@implementation Canvas3DLayer
+
+-(id)initWithContext:(CGLContextObj)context texture:(GLuint)texture
+{
+    m_contextObj = context;
+    m_texture = texture;
+    self = [super init];
+    return self;
+}
+
+-(CGLPixelFormatObj)copyCGLPixelFormatForDisplayMask:(uint32_t)mask
+{
+    CGLPixelFormatAttribute attribs[] =
+    {
+        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
+        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFADisplayMask, (CGLPixelFormatAttribute) mask,
+        (CGLPixelFormatAttribute) 0
+    };
+    
+    CGLPixelFormatObj pixelFormatObj;
+    GLint numPixelFormats;
+ 
+    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
+    return pixelFormatObj;
+}
+
+-(CGLContextObj)copyCGLContextForPixelFormat:(CGLPixelFormatObj)pixelFormat
+{
+    CGLContextObj contextObj;
+    CGLCreateContext(pixelFormat, m_contextObj, &contextObj);
+    return contextObj;
+}
+
+-(void)drawInCGLContext:(CGLContextObj)glContext pixelFormat:(CGLPixelFormatObj)pixelFormat forLayerTime:(CFTimeInterval)timeInterval displayTime:(const CVTimeStamp *)timeStamp
+{
+    CGRect frame = [self frame];
+        
+    // draw the FBO into the layer
+    glViewport(0, 0, frame.size.width, frame.size.height);
+    glMatrixMode(GL_PROJECTION);
+    glLoadIdentity();
+    glOrtho(-1, 1, -1, 1, -1, 1);
+    glMatrixMode(GL_MODELVIEW);
+    glLoadIdentity();
+
+    glEnable(GL_TEXTURE_2D);
+    glBindTexture(GL_TEXTURE_2D, m_texture);
+    
+    glBegin(GL_TRIANGLE_FAN);
+        glTexCoord2f(0, 0);
+        glVertex2f(-1, -1);
+        glTexCoord2f(1, 0);
+        glVertex2f(1, -1);
+        glTexCoord2f(1, 1);
+        glVertex2f(1, 1);
+        glTexCoord2f(0, 1);
+        glVertex2f(-1, 1);
+    glEnd();
+    
+    glBindTexture(GL_TEXTURE_2D, 0);
+    glDisable(GL_TEXTURE_2D);
+
+    // Call super to finalize the drawing. By default all it does is call glFlush().
+    [super drawInCGLContext:glContext pixelFormat:pixelFormat forLayerTime:timeInterval displayTime:timeStamp];
+}
+
+@end
+
+@implementation Canvas3DLayer(WebLayerAdditions)
+
+-(void)setLayerOwner:(GraphicsLayer*)aLayer
+{
+    m_layerOwner = aLayer;
+}
+
+-(GraphicsLayer*)layerOwner
+{
+    return m_layerOwner;
+}
+
+@end
+
+#endif // ENABLE(3D_CANVAS)
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/mac/CoreTextController.cpp b/WebCore/platform/graphics/mac/CoreTextController.cpp
index 05f29b5..b2682e4 100644
--- a/WebCore/platform/graphics/mac/CoreTextController.cpp
+++ b/WebCore/platform/graphics/mac/CoreTextController.cpp
@@ -365,7 +365,7 @@ void CoreTextController::collectCoreTextRunsForCharacters(const UChar* cp, unsig
 
     RetainPtr<CFStringRef> string(AdoptCF, CFStringCreateWithCharactersNoCopy(NULL, cp, length, kCFAllocatorNull));
 
-    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes()));
+    RetainPtr<CFAttributedStringRef> attributedString(AdoptCF, CFAttributedStringCreate(NULL, string.get(), fontData->getCFStringAttributes(m_font.fontDescription().textRenderingMode())));
 
     RetainPtr<CTTypesetterRef> typesetter;
 
diff --git a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
index e40bbab..5e72101 100644
--- a/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/mac/FontCustomPlatformData.cpp
@@ -46,11 +46,13 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
     ATSFontContainerRef containerRef = 0;
     ATSFontRef fontRef = 0;
 
+    RetainPtr<CGFontRef> cgFontRef;
+
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
     RetainPtr<CFDataRef> bufferData(AdoptCF, buffer->createCFData());
     RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(bufferData.get()));
     
-    CGFontRef cgFontRef = CGFontCreateWithDataProvider(dataProvider.get());
+    cgFontRef.adoptCF(CGFontCreateWithDataProvider(dataProvider.get()));
     if (!cgFontRef)
         return 0;
 #else
@@ -75,13 +77,11 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
         return 0;
     }
     
-    CGFontRef cgFontRef = CGFontCreateWithPlatformFont(&fontRef);
+    cgFontRef.adoptCF(CGFontCreateWithPlatformFont(&fontRef));
 #ifndef BUILDING_ON_TIGER
     // Workaround for <rdar://problem/5675504>.
-    if (cgFontRef && !CGFontGetNumberOfGlyphs(cgFontRef)) {
-        CFRelease(cgFontRef);
+    if (cgFontRef && !CGFontGetNumberOfGlyphs(cgFontRef.get()))
         cgFontRef = 0;
-    }
 #endif
     if (!cgFontRef) {
         ATSFontDeactivate(containerRef, NULL, kATSOptionFlagsDefault);
@@ -89,7 +89,7 @@ FontCustomPlatformData* createFontCustomPlatformData(SharedBuffer* buffer)
     }
 #endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
-    return new FontCustomPlatformData(containerRef, fontRef, cgFontRef);
+    return new FontCustomPlatformData(containerRef, fontRef, cgFontRef.releaseRef());
 }
 
 }
diff --git a/WebCore/platform/graphics/mac/FontMac.mm b/WebCore/platform/graphics/mac/FontMac.mm
index df9494a..b2b9a5c 100644
--- a/WebCore/platform/graphics/mac/FontMac.mm
+++ b/WebCore/platform/graphics/mac/FontMac.mm
@@ -50,10 +50,33 @@ bool Font::canReturnFallbackFontsForComplexText()
 void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer, int from, int numGlyphs, const FloatPoint& point) const
 {
     CGContextRef cgContext = context->platformContext();
+    bool newShouldUseFontSmoothing = shouldUseSmoothing();
+
+    switch(fontDescription().fontSmoothing()) {
+    case Antialiased: {
+        context->setShouldAntialias(true);
+        newShouldUseFontSmoothing = false;
+        break;
+    }
+    case SubpixelAntialiased: {
+        context->setShouldAntialias(true);
+        newShouldUseFontSmoothing = true;
+        break;
+    }
+    case NoSmoothing: {
+        context->setShouldAntialias(false);
+        newShouldUseFontSmoothing = false;
+        break;
+    }
+    case AutoSmoothing: {
+        // For the AutoSmooth case, don't do anything! Keep the default settings.
+        break; 
+    }
+    default: 
+        ASSERT_NOT_REACHED();
+    }
 
     bool originalShouldUseFontSmoothing = wkCGContextGetShouldSmoothFonts(cgContext);
-    bool newShouldUseFontSmoothing = shouldUseSmoothing();
-    
     if (originalShouldUseFontSmoothing != newShouldUseFontSmoothing)
         CGContextSetShouldSmoothFonts(cgContext, newShouldUseFontSmoothing);
     
diff --git a/WebCore/platform/graphics/mac/FontMacATSUI.mm b/WebCore/platform/graphics/mac/FontMacATSUI.mm
index 051abb7..409bda4 100644
--- a/WebCore/platform/graphics/mac/FontMacATSUI.mm
+++ b/WebCore/platform/graphics/mac/FontMacATSUI.mm
@@ -105,12 +105,12 @@ static bool fontHasMirroringInfo(ATSUFontID fontID)
     return false;
 }
 
-static void disableLigatures(const SimpleFontData* fontData)
+static void disableLigatures(const SimpleFontData* fontData, TextRenderingMode textMode)
 {
     // Don't be too aggressive: if the font doesn't contain 'a', then assume that any ligatures it contains are
     // in characters that always go through ATSUI, and therefore allow them. Geeza Pro is an example.
     // See bugzilla 5166.
-    if (fontData->platformData().allowsLigatures())
+    if (textMode == OptimizeLegibility || textMode == GeometricPrecision || fontData->platformData().allowsLigatures())
         return;
 
     ATSUFontFeatureType featureTypes[] = { kLigaturesType };
@@ -120,7 +120,7 @@ static void disableLigatures(const SimpleFontData* fontData)
         LOG_ERROR("ATSUSetFontFeatures failed (%d) -- ligatures remain enabled", status);
 }
 
-static void initializeATSUStyle(const SimpleFontData* fontData)
+static void initializeATSUStyle(const SimpleFontData* fontData, TextRenderingMode textMode)
 {
     if (fontData->m_ATSUStyleInitialized)
         return;
@@ -141,19 +141,28 @@ static void initializeATSUStyle(const SimpleFontData* fontData)
         transform = CGAffineTransformConcat(transform, CGAffineTransformMake(1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, 0, 0));
     Fixed fontSize = FloatToFixed(fontData->platformData().m_size);
     ByteCount styleSizes[4] = { sizeof(Fixed), sizeof(ATSUFontID), sizeof(CGAffineTransform), sizeof(Fract) };
-    // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
-    Fract kerningInhibitFactor = FloatToFract(1.0);
     
-    ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
-    ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
-    status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
-    if (status != noErr)
-        LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    if (!allowKerning) {
+        // Turn off automatic kerning until it is supported in the CG code path (bug 6136)
+        Fract kerningInhibitFactor = FloatToFract(1.0);
+        ATSUAttributeTag styleTags[4] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag, kATSUKerningInhibitFactorTag };
+        ATSUAttributeValuePtr styleValues[4] = { &fontSize, &fontID, &transform, &kerningInhibitFactor };
+        status = ATSUSetAttributes(fontData->m_ATSUStyle, 4, styleTags, styleSizes, styleValues);
+        if (status != noErr)
+            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    } else {
+        ATSUAttributeTag styleTags[3] = { kATSUSizeTag, kATSUFontTag, kATSUFontMatrixTag };
+        ATSUAttributeValuePtr styleValues[3] = { &fontSize, &fontID, &transform, };
+        status = ATSUSetAttributes(fontData->m_ATSUStyle, 3, styleTags, styleSizes, styleValues);
+        if (status != noErr)
+            LOG_ERROR("ATSUSetAttributes failed (%d)", status);
+    }
 
     fontData->m_ATSUMirrors = fontHasMirroringInfo(fontID);
 
     // Turn off ligatures such as 'fi' to match the CG code path's behavior, until bug 6135 is fixed.
-    disableLigatures(fontData);
+    disableLigatures(fontData, textMode);
 
     fontData->m_ATSUStyleInitialized = true;
 }
@@ -329,7 +338,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
     OSStatus status;
     ATSULayoutOperationOverrideSpecifier overrideSpecifier;
     
-    initializeATSUStyle(fontData);
+    initializeATSUStyle(fontData, m_font->fontDescription().textRenderingMode());
     
     // FIXME: This is currently missing the following required features that the CoreGraphics code path has:
     // - \n, \t, and nonbreaking space render as a space.
@@ -393,7 +402,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
             const FontData* fallbackFontData = m_font->fontDataForCharacters(m_run.characters() + substituteOffset, substituteLength);
             substituteFontData = fallbackFontData ? fallbackFontData->fontDataForCharacter(m_run[0]) : 0;
             if (substituteFontData) {
-                initializeATSUStyle(substituteFontData);
+                initializeATSUStyle(substituteFontData, m_font->fontDescription().textRenderingMode());
                 if (substituteFontData->m_ATSUStyle)
                     ATSUSetRunStyle(layout, substituteFontData->m_ATSUStyle, substituteOffset, substituteLength);
             } else
@@ -412,7 +421,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
             if (i == substituteOffset || i == substituteOffset + substituteLength) {
                 if (isSmallCap) {
                     isSmallCap = false;
-                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()));
+                    initializeATSUStyle(r->smallCapsFontData(m_font->fontDescription()), m_font->fontDescription().textRenderingMode());
                     ATSUSetRunStyle(layout, r->smallCapsFontData(m_font->fontDescription())->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
                 }
                 if (i == substituteOffset && substituteLength > 0)
@@ -456,7 +465,7 @@ void ATSULayoutParameters::initialize(const Font* font, const GraphicsContext* g
                 } else {
                     if (isSmallCap) {
                         isSmallCap = false;
-                        initializeATSUStyle(smallCapsData);
+                        initializeATSUStyle(smallCapsData, m_font->fontDescription().textRenderingMode());
                         ATSUSetRunStyle(layout, smallCapsData->m_ATSUStyle, firstSmallCap, i - firstSmallCap);
                     }
                     m_fonts[i] = r;
@@ -504,8 +513,8 @@ FloatRect Font::selectionRectForComplexText(const TextRun& run, const IntPoint&
         firstGlyphBounds = zeroTrapezoid;
     }
     
-    float beforeWidth = MIN(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
-    float afterWidth = MAX(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
+    float beforeWidth = min(FixedToFloat(firstGlyphBounds.lowerLeft.x), FixedToFloat(firstGlyphBounds.upperLeft.x));
+    float afterWidth = max(FixedToFloat(firstGlyphBounds.lowerRight.x), FixedToFloat(firstGlyphBounds.upperRight.x));
     
     FloatRect rect(point.x() + floorf(beforeWidth), point.y(), roundf(afterWidth) - floorf(beforeWidth), h);
 
@@ -591,8 +600,8 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     if (actualNumBounds != 1)
         LOG_ERROR("unexpected result from ATSUGetGlyphBounds(): actualNumBounds(%d) != 1", actualNumBounds);
 
-    return MAX(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
-           MIN(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
+    return max(FixedToFloat(firstGlyphBounds.upperRight.x), FixedToFloat(firstGlyphBounds.lowerRight.x)) -
+           min(FixedToFloat(firstGlyphBounds.upperLeft.x), FixedToFloat(firstGlyphBounds.lowerLeft.x));
 }
 
 int Font::offsetForPositionForComplexText(const TextRun& run, int x, bool /*includePartialGlyphs*/) const
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
new file mode 100644
index 0000000..cd66445
--- /dev/null
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.cpp
@@ -0,0 +1,1698 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "GraphicsContext3D.h"
+
+#include "CachedImage.h"
+#include "CanvasBuffer.h"
+#include "CanvasFramebuffer.h"
+#include "CanvasArray.h"
+#include "CanvasFloatArray.h"
+#include "CanvasIntArray.h"
+#include "CanvasObject.h"
+#include "CanvasProgram.h"
+#include "CanvasRenderbuffer.h"
+#include "CanvasShader.h"
+#include "CanvasTexture.h"
+#include "CanvasUnsignedByteArray.h"
+#include "CString.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLImageElement.h"
+#include "ImageBuffer.h"
+#include "NotImplemented.h"
+#include "WebKitCSSMatrix.h"
+
+#include <CoreGraphics/CGBitmapContext.h>
+
+namespace WebCore {
+
+GraphicsContext3D::GraphicsContext3D()
+{
+    CGLPixelFormatAttribute attribs[] =
+    {
+        (CGLPixelFormatAttribute) kCGLPFAAccelerated,
+        (CGLPixelFormatAttribute) kCGLPFAColorSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFADepthSize, (CGLPixelFormatAttribute) 32,
+        (CGLPixelFormatAttribute) kCGLPFASupersample,
+        (CGLPixelFormatAttribute) 0
+    };
+    
+    CGLPixelFormatObj pixelFormatObj;
+    GLint numPixelFormats;
+    
+    CGLChoosePixelFormat(attribs, &pixelFormatObj, &numPixelFormats);
+    
+    CGLCreateContext(pixelFormatObj, 0, &m_contextObj);
+    
+    CGLDestroyPixelFormat(pixelFormatObj);
+    
+    // Set the current context to the one given to us.
+    CGLSetCurrentContext(m_contextObj);
+    
+    // create a texture to render into
+    ::glGenTextures(1, &m_texture);
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP);
+    ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 1, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+    
+    // create an FBO
+    ::glGenFramebuffersEXT(1, &m_fbo);
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    
+    ::glGenRenderbuffersEXT(1, &m_depthBuffer);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthBuffer);
+    ::glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_DEPTH_COMPONENT, 1, 1);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0);
+    
+    ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_DEPTH_ATTACHMENT_EXT, GL_RENDERBUFFER_EXT, m_depthBuffer);
+    
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    CGLSetCurrentContext(m_contextObj);
+    ::glDeleteRenderbuffersEXT(1, & m_depthBuffer);
+    ::glDeleteTextures(1, &m_texture);
+    ::glDeleteFramebuffersEXT(1, &m_fbo);
+    CGLSetCurrentContext(0);
+    CGLDestroyContext(m_contextObj);
+}
+
+void GraphicsContext3D::checkError() const
+{
+    // FIXME: This needs to only be done in the debug context. It will probably throw an exception
+    // on error and print the error message to the debug console
+    GLenum error = ::glGetError();
+    if (error != GL_NO_ERROR)
+        notImplemented();
+}
+
+void GraphicsContext3D::makeContextCurrent()
+{
+    CGLSetCurrentContext(m_contextObj);
+}
+
+void GraphicsContext3D::beginPaint(CanvasRenderingContext3D* context)
+{
+    UNUSED_PARAM(context);
+}
+
+void GraphicsContext3D::endPaint()
+{
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    if (width == m_currentWidth && height == m_currentHeight)
+        return;
+    
+    m_currentWidth = width;
+    m_currentHeight = height;
+    
+    CGLSetCurrentContext(m_contextObj);
+    
+    ::glBindTexture(GL_TEXTURE_2D, m_texture);
+    ::glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, width, height, 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    ::glBindTexture(GL_TEXTURE_2D, 0);
+    
+    ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, m_depthBuffer);
+    ::glRenderbufferStorageEXT(GL_RENDERBUFFER_EXT, GL_DEPTH_COMPONENT, width, height);
+    ::glBindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0);
+    
+    ::glFramebufferTexture2DEXT(GL_FRAMEBUFFER_EXT, GL_COLOR_ATTACHMENT0_EXT, GL_TEXTURE_2D, m_texture, 0);
+    ::glFramebufferRenderbufferEXT(GL_FRAMEBUFFER_EXT, GL_DEPTH_ATTACHMENT_EXT, GL_RENDERBUFFER_EXT, m_depthBuffer);
+    GLenum status = ::glCheckFramebufferStatusEXT(GL_FRAMEBUFFER_EXT);
+    if (status != GL_FRAMEBUFFER_COMPLETE_EXT) {
+        // FIXME: cleanup
+        notImplemented();
+    }
+
+    ::glViewport(0, 0, m_currentWidth, m_currentHeight);
+    ::glClear(GL_COLOR_BUFFER_BIT);
+    ::glFlush();
+}
+
+static inline void ensureContext(CGLContextObj context)
+{
+    CGLContextObj currentContext = CGLGetCurrentContext();
+    if (currentContext != context)
+        CGLSetCurrentContext(context);
+}
+
+void GraphicsContext3D::activeTexture(unsigned long texture)
+{
+    ensureContext(m_contextObj);
+    ::glActiveTexture(texture);
+}
+
+void GraphicsContext3D::attachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    ensureContext(m_contextObj);
+    ::glAttachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::bindAttribLocation(CanvasProgram* program, unsigned long index, const String& name)
+{
+    if (!program)
+        return;
+    ensureContext(m_contextObj);
+    ::glBindAttribLocation((GLuint) program->object(), index, name.utf8().data());
+}
+
+void GraphicsContext3D::bindBuffer(unsigned long target, CanvasBuffer* buffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindBuffer(target, buffer ? (GLuint) buffer->object() : 0);
+}
+
+
+void GraphicsContext3D::bindFramebuffer(unsigned long target, CanvasFramebuffer* buffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindFramebufferEXT(target, buffer ? (GLuint) buffer->object() : m_fbo);
+}
+
+void GraphicsContext3D::bindRenderbuffer(unsigned long target, CanvasRenderbuffer* renderbuffer)
+{
+    ensureContext(m_contextObj);
+    ::glBindBuffer(target, renderbuffer ? (GLuint) renderbuffer->object() : 0);
+}
+
+
+void GraphicsContext3D::bindTexture(unsigned long target, CanvasTexture* texture)
+{
+    ensureContext(m_contextObj);
+    ::glBindTexture(target, texture ? (GLuint) texture->object() : 0);
+}
+
+void GraphicsContext3D::blendColor(double red, double green, double blue, double alpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendColor(static_cast<float>(red), static_cast<float>(green), static_cast<float>(blue), static_cast<float>(alpha));
+}
+
+void GraphicsContext3D::blendEquation( unsigned long mode )
+{
+    ensureContext(m_contextObj);
+    ::glBlendEquation(mode);
+}
+
+void GraphicsContext3D::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendEquationSeparate(modeRGB, modeAlpha);
+}
+
+
+void GraphicsContext3D::blendFunc(unsigned long sfactor, unsigned long dfactor)
+{
+    ensureContext(m_contextObj);
+    ::glBlendFunc(sfactor, dfactor);
+}       
+
+void GraphicsContext3D::blendFuncSeparate(unsigned long srcRGB, unsigned long dstRGB, unsigned long srcAlpha, unsigned long dstAlpha)
+{
+    ensureContext(m_contextObj);
+    ::glBlendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3D::bufferData(unsigned long target, int size, unsigned long usage)
+{
+    ensureContext(m_contextObj);
+    ::glBufferData(target, size, 0, usage);
+}
+void GraphicsContext3D::bufferData(unsigned long target, CanvasArray* array, unsigned long usage)
+{
+    if (!array || !array->length())
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glBufferData(target, array->sizeInBytes(), array->baseAddress(), usage);
+}
+
+void GraphicsContext3D::bufferSubData(unsigned long target, long offset, CanvasArray* array)
+{
+    if (!array || !array->length())
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glBufferSubData(target, offset, array->sizeInBytes(), array->baseAddress());
+}
+
+unsigned long GraphicsContext3D::checkFramebufferStatus(unsigned long target)
+{
+    ensureContext(m_contextObj);
+    return ::glCheckFramebufferStatusEXT(target);
+}
+
+void GraphicsContext3D::clearColor(double r, double g, double b, double a)
+{
+    ensureContext(m_contextObj);
+    ::glClearColor(static_cast<float>(r), static_cast<float>(g), static_cast<float>(b), static_cast<float>(a));
+}
+
+void GraphicsContext3D::clear(unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glClear(mask);
+}
+
+void GraphicsContext3D::clearDepth(double depth)
+{
+    ensureContext(m_contextObj);
+    ::glClearDepth(depth);
+}
+
+void GraphicsContext3D::clearStencil(long s)
+{
+    ensureContext(m_contextObj);
+    ::glClearStencil(s);
+}
+
+void GraphicsContext3D::colorMask(bool red, bool green, bool blue, bool alpha)
+{
+    ensureContext(m_contextObj);
+    ::glColorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::compileShader(CanvasShader* shader)
+{
+    if (!shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glCompileShader((GLuint) shader->object());
+}
+
+void GraphicsContext3D::copyTexImage2D(unsigned long target, long level, unsigned long internalformat, long x, long y, unsigned long width, unsigned long height, long border)
+{
+    ensureContext(m_contextObj);
+    ::glCopyTexImage2D(target, level, internalformat, x, y, width, height, border);
+}
+
+void GraphicsContext3D::copyTexSubImage2D(unsigned long target, long level, long xoffset, long yoffset, long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
+}
+
+void GraphicsContext3D::cullFace(unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glCullFace(mode);
+}
+
+void GraphicsContext3D::depthFunc(unsigned long func)
+{
+    ensureContext(m_contextObj);
+    ::glDepthFunc(func);
+}
+
+void GraphicsContext3D::depthMask(bool flag)
+{
+    ensureContext(m_contextObj);
+    ::glDepthMask(flag);
+}
+
+void GraphicsContext3D::depthRange(double zNear, double zFar)
+{
+    ensureContext(m_contextObj);
+    ::glDepthRange(zNear, zFar);
+}
+
+void GraphicsContext3D::detachShader(CanvasProgram* program, CanvasShader* shader)
+{
+    if (!program || !shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glDetachShader((GLuint) program->object(), (GLuint) shader->object());
+}
+
+void GraphicsContext3D::disable(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    ::glDisable(cap);
+}
+
+void GraphicsContext3D::disableVertexAttribArray(unsigned long index)
+{
+    ensureContext(m_contextObj);
+    ::glDisableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(unsigned long mode, long first, long count)
+{
+    ensureContext(m_contextObj);
+    ::glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(unsigned long mode, unsigned long count, unsigned long type, long offset)
+{
+    ensureContext(m_contextObj);
+    ::glDrawElements(mode, count, type, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::enable(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    ::glEnable(cap);
+}
+
+void GraphicsContext3D::enableVertexAttribArray(unsigned long index)
+{
+    ensureContext(m_contextObj);
+    ::glEnableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::finish()
+{
+    ensureContext(m_contextObj);
+    ::glFinish();
+}
+
+void GraphicsContext3D::flush()
+{
+    ensureContext(m_contextObj);
+    ::glFlush();
+}
+
+void GraphicsContext3D::framebufferRenderbuffer(unsigned long target, unsigned long attachment, unsigned long renderbuffertarget, CanvasRenderbuffer* buffer)
+{
+    if (!buffer)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glFramebufferRenderbufferEXT(target, attachment, renderbuffertarget, (GLuint) buffer->object());
+}
+
+void GraphicsContext3D::framebufferTexture2D(unsigned long target, unsigned long attachment, unsigned long textarget, CanvasTexture* texture, long level)
+{
+    if (!texture)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glFramebufferTexture2DEXT(target, attachment, textarget, (GLuint) texture->object(), level);
+}
+
+void GraphicsContext3D::frontFace(unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glFrontFace(mode);
+}
+
+void GraphicsContext3D::generateMipmap(unsigned long target)
+{
+    ensureContext(m_contextObj);
+    ::glGenerateMipmapEXT(target);
+}
+
+int GraphicsContext3D::getAttribLocation(CanvasProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    return ::glGetAttribLocation((GLuint) program->object(), name.utf8().data());
+}
+
+unsigned long GraphicsContext3D::getError()
+{
+    ensureContext(m_contextObj);
+    return ::glGetError();
+}
+
+String GraphicsContext3D::getString(unsigned long name)
+{
+    ensureContext(m_contextObj);
+    return String((const char*) ::glGetString(name));
+}
+
+void GraphicsContext3D::hint(unsigned long target, unsigned long mode)
+{
+    ensureContext(m_contextObj);
+    ::glHint(target, mode);
+}
+
+bool GraphicsContext3D::isBuffer(CanvasBuffer* buffer)
+{
+    if (!buffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsBuffer((GLuint) buffer->object());
+}
+
+bool GraphicsContext3D::isEnabled(unsigned long cap)
+{
+    ensureContext(m_contextObj);
+    return ::glIsEnabled(cap);
+}
+
+bool GraphicsContext3D::isFramebuffer(CanvasFramebuffer* framebuffer)
+{
+    if (!framebuffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsFramebufferEXT((GLuint) framebuffer->object());
+}
+
+bool GraphicsContext3D::isProgram(CanvasProgram* program)
+{
+    if (!program)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsProgram((GLuint) program->object());
+}
+
+bool GraphicsContext3D::isRenderbuffer(CanvasRenderbuffer* renderbuffer)
+{
+    if (!renderbuffer)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsRenderbufferEXT((GLuint) renderbuffer->object());
+}
+
+bool GraphicsContext3D::isShader(CanvasShader* shader)
+{
+    if (!shader)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsShader((GLuint) shader->object());
+}
+
+bool GraphicsContext3D::isTexture(CanvasTexture* texture)
+{
+    if (!texture)
+        return false;
+    
+    ensureContext(m_contextObj);
+    return ::glIsTexture((GLuint) texture->object());
+}
+
+void GraphicsContext3D::lineWidth(double width)
+{
+    ensureContext(m_contextObj);
+    ::glLineWidth(static_cast<float>(width));
+}
+
+void GraphicsContext3D::linkProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glLinkProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::pixelStorei(unsigned long pname, long param)
+{
+    ensureContext(m_contextObj);
+    ::glPixelStorei(pname, param);
+}
+
+void GraphicsContext3D::polygonOffset(double factor, double units)
+{
+    ensureContext(m_contextObj);
+    ::glPolygonOffset(static_cast<float>(factor), static_cast<float>(units));
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    // FIXME: This is not implemented on desktop OpenGL. We need to have ifdefs for the different GL variants
+    ensureContext(m_contextObj);
+    //::glReleaseShaderCompiler();
+}
+
+void GraphicsContext3D::renderbufferStorage(unsigned long target, unsigned long internalformat, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glRenderbufferStorageEXT(target, internalformat, width, height);
+}
+
+void GraphicsContext3D::sampleCoverage(double value, bool invert)
+{
+    ensureContext(m_contextObj);
+    ::glSampleCoverage(static_cast<float>(value), invert);
+}
+
+void GraphicsContext3D::scissor(long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glScissor(x, y, width, height);
+}
+
+void GraphicsContext3D::shaderSource(CanvasShader* shader, const String& string)
+{
+    if (!shader)
+        return;
+    
+    ensureContext(m_contextObj);
+    const CString& cs = string.utf8();
+    const char* s = cs.data();
+    
+    int length = string.length();
+    ::glShaderSource((GLuint) shader->object(), 1, &s, &length);
+}
+
+void GraphicsContext3D::stencilFunc(unsigned long func, long ref, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3D::stencilFuncSeparate(unsigned long face, unsigned long func, long ref, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3D::stencilMask(unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilMask(mask);
+}
+
+void GraphicsContext3D::stencilMaskSeparate(unsigned long face, unsigned long mask)
+{
+    ensureContext(m_contextObj);
+    ::glStencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3D::stencilOp(unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    ensureContext(m_contextObj);
+    ::glStencilOp(fail, zfail, zpass);
+}
+
+void GraphicsContext3D::stencilOpSeparate(unsigned long face, unsigned long fail, unsigned long zfail, unsigned long zpass)
+{
+    ensureContext(m_contextObj);
+    ::glStencilOpSeparate(face, fail, zfail, zpass);
+}
+
+void GraphicsContext3D::texParameterf(unsigned target, unsigned pname, float value)
+{
+    ensureContext(m_contextObj);
+    ::glTexParameterf(target, pname, static_cast<float>(value));
+}
+
+void GraphicsContext3D::texParameteri(unsigned target, unsigned pname, int value)
+{
+    ensureContext(m_contextObj);
+    ::glTexParameteri(target, pname, static_cast<float>(value));
+}
+
+void GraphicsContext3D::uniform1f(long location, float v0)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1f(location, v0);
+}
+
+void GraphicsContext3D::uniform1fv(long location, float* array, int size)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2f(long location, float v0, float v1)
+{
+    ensureContext(m_contextObj);
+    ::glUniform2f(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 2
+    ensureContext(m_contextObj);
+    ::glUniform2fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3f(long location, float v0, float v1, float v2)
+{
+    ensureContext(m_contextObj);
+    ::glUniform3f(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 3
+    ensureContext(m_contextObj);
+    ::glUniform3fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4f(long location, float v0, float v1, float v2, float v3)
+{
+    ensureContext(m_contextObj);
+    ::glUniform4f(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4fv(long location, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniform4fv(location, size, array);
+}
+
+void GraphicsContext3D::uniform1i(long location, int v0)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1i(location, v0);
+}
+
+void GraphicsContext3D::uniform1iv(long location, int* array, int size)
+{
+    ensureContext(m_contextObj);
+    ::glUniform1iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform2i(long location, int v0, int v1)
+{
+    ensureContext(m_contextObj);
+    ::glUniform2i(location, v0, v1);
+}
+
+void GraphicsContext3D::uniform2iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 2
+    ensureContext(m_contextObj);
+    ::glUniform2iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform3i(long location, int v0, int v1, int v2)
+{
+    ensureContext(m_contextObj);
+    ::glUniform3i(location, v0, v1, v2);
+}
+
+void GraphicsContext3D::uniform3iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 3
+    ensureContext(m_contextObj);
+    ::glUniform3iv(location, size, array);
+}
+
+void GraphicsContext3D::uniform4i(long location, int v0, int v1, int v2, int v3)
+{
+    ensureContext(m_contextObj);
+    ::glUniform4i(location, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::uniform4iv(long location, int* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniform4iv(location, size, array);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 4
+    ensureContext(m_contextObj);
+    ::glUniformMatrix2fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 9
+    ensureContext(m_contextObj);
+    ::glUniformMatrix3fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* array, int size)
+{
+    // FIXME: length needs to be a multiple of 16
+    ensureContext(m_contextObj);
+    ::glUniformMatrix4fv(location, size, transpose, array);
+}
+
+void GraphicsContext3D::useProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glUseProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::validateProgram(CanvasProgram* program)
+{
+    if (!program)
+        return;
+    
+    ensureContext(m_contextObj);
+    ::glValidateProgram((GLuint) program->object());
+}
+
+void GraphicsContext3D::vertexAttrib1f(unsigned long indx, float v0)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib1f(indx, v0);
+}
+
+void GraphicsContext3D::vertexAttrib1fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib1fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib2f(unsigned long indx, float v0, float v1)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib2f(indx, v0, v1);
+}
+
+void GraphicsContext3D::vertexAttrib2fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib2fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib3f(indx, v0, v1, v2);
+}
+
+void GraphicsContext3D::vertexAttrib3fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib3fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib4f(indx, v0, v1, v2, v3);
+}
+
+void GraphicsContext3D::vertexAttrib4fv(unsigned long indx, float* array)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttrib4fv(indx, array);
+}
+
+void GraphicsContext3D::vertexAttribPointer(unsigned long indx, int size, int type, bool normalized, unsigned long stride, unsigned long offset)
+{
+    ensureContext(m_contextObj);
+    ::glVertexAttribPointer(indx, size, type, normalized, stride, reinterpret_cast<void*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3D::viewport(long x, long y, unsigned long width, unsigned long height)
+{
+    ensureContext(m_contextObj);
+    ::glViewport(static_cast<GLint>(x), static_cast<GLint>(y), static_cast<GLsizei>(width), static_cast<GLsizei>(height));
+}
+
+static int sizeForGetParam(unsigned long pname)
+{
+    switch(pname) {
+        case GL_ACTIVE_TEXTURE:                  return 1;
+        case GL_ALIASED_LINE_WIDTH_RANGE:        return 2;
+        case GL_ALIASED_POINT_SIZE_RANGE:        return 2;
+        case GL_ALPHA_BITS:                      return 1;
+        case GL_ARRAY_BUFFER_BINDING:            return 1; // (* actually a CanvasBuffer*)
+        case GL_BLEND:                           return 1;
+        case GL_BLEND_COLOR:                     return 4;
+        case GL_BLEND_DST_ALPHA:                 return 1;
+        case GL_BLEND_DST_RGB:                   return 1;
+        case GL_BLEND_EQUATION_ALPHA:            return 1;
+        case GL_BLEND_EQUATION_RGB:              return 1;
+        case GL_BLEND_SRC_ALPHA:                 return 1;
+        case GL_BLEND_SRC_RGB:                   return 1;
+        case GL_BLUE_BITS:                       return 1;
+        case GL_COLOR_CLEAR_VALUE:               return 4;
+        case GL_COLOR_WRITEMASK:                 return 4;
+        case GL_COMPRESSED_TEXTURE_FORMATS:      return GL_NUM_COMPRESSED_TEXTURE_FORMATS;
+        case GL_CULL_FACE:                       return 1;
+        case GL_CULL_FACE_MODE:                  return 1;
+        case GL_CURRENT_PROGRAM:                 return 1; // (* actually a CanvasProgram*)
+        case GL_DEPTH_BITS:                      return 1;
+        case GL_DEPTH_CLEAR_VALUE:               return 1;
+        case GL_DEPTH_FUNC:                      return 1;
+        case GL_DEPTH_RANGE:                     return 2;
+        case GL_DEPTH_TEST:                      return 1;
+        case GL_DEPTH_WRITEMASK:                 return 1;
+        case GL_DITHER:                          return 1;
+        case GL_ELEMENT_ARRAY_BUFFER_BINDING:    return 1; // (* actually a CanvasBuffer*)
+        case GL_FRAMEBUFFER_BINDING_EXT:         return 1; // (* actually a CanvasFramebuffer*)
+        case GL_FRONT_FACE:                      return 1;
+        case GL_GENERATE_MIPMAP_HINT:            return 1;
+        case GL_GREEN_BITS:                      return 1;
+            //case GL_IMPLEMENTATION_COLOR_READ_FORMAT:return 1;
+            //case GL_IMPLEMENTATION_COLOR_READ_TYPE:  return 1;
+        case GL_LINE_WIDTH:                      return 1;
+        case GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS:return 1;
+        case GL_MAX_CUBE_MAP_TEXTURE_SIZE:       return 1;
+            //case GL_MAX_FRAGMENT_UNIFORM_VECTORS:    return 1;
+        case GL_MAX_RENDERBUFFER_SIZE_EXT:       return 1;
+        case GL_MAX_TEXTURE_IMAGE_UNITS:         return 1;
+        case GL_MAX_TEXTURE_SIZE:                return 1;
+            //case GL_MAX_VARYING_VECTORS:             return 1;
+        case GL_MAX_VERTEX_ATTRIBS:              return 1;
+        case GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS:  return 1;
+            //case GL_MAX_VERTEX_UNIFORM_VECTORS:      return 1;
+        case GL_MAX_VIEWPORT_DIMS:               return 2;
+        case GL_NUM_COMPRESSED_TEXTURE_FORMATS:  return 1;
+            //case GL_NUM_SHADER_BINARY_FORMATS:       return 1;
+        case GL_PACK_ALIGNMENT:                  return 1;
+        case GL_POLYGON_OFFSET_FACTOR:           return 1;
+        case GL_POLYGON_OFFSET_FILL:             return 1;
+        case GL_POLYGON_OFFSET_UNITS:            return 1;
+        case GL_RED_BITS:                        return 1;
+        case GL_RENDERBUFFER_BINDING_EXT:        return 1; // (* actually a CanvasRenderbuffer*)
+        case GL_SAMPLE_BUFFERS:                  return 1;
+        case GL_SAMPLE_COVERAGE_INVERT:          return 1;
+        case GL_SAMPLE_COVERAGE_VALUE:           return 1;
+        case GL_SAMPLES:                         return 1;
+        case GL_SCISSOR_BOX:                     return 4;
+        case GL_SCISSOR_TEST:                    return 1;
+            //case GL_SHADER_BINARY_FORMATS:           return GL_NUM_SHADER_BINARY_FORMATS;
+            //case GL_SHADER_COMPILER:                 return 1;
+        case GL_STENCIL_BACK_FAIL:               return 1;
+        case GL_STENCIL_BACK_FUNC:               return 1;
+        case GL_STENCIL_BACK_PASS_DEPTH_FAIL:    return 1;
+        case GL_STENCIL_BACK_PASS_DEPTH_PASS:    return 1;
+        case GL_STENCIL_BACK_REF:                return 1;
+        case GL_STENCIL_BACK_VALUE_MASK:         return 1;
+        case GL_STENCIL_BACK_WRITEMASK:          return 1;
+        case GL_STENCIL_BITS:                    return 1;
+        case GL_STENCIL_CLEAR_VALUE:             return 1;
+        case GL_STENCIL_FAIL:                    return 1;
+        case GL_STENCIL_FUNC:                    return 1;
+        case GL_STENCIL_PASS_DEPTH_FAIL:         return 1;
+        case GL_STENCIL_PASS_DEPTH_PASS:         return 1;
+        case GL_STENCIL_REF:                     return 1;
+        case GL_STENCIL_TEST:                    return 1;
+        case GL_STENCIL_VALUE_MASK:              return 1;
+        case GL_STENCIL_WRITEMASK:               return 1;
+        case GL_SUBPIXEL_BITS:                   return 1;
+        case GL_TEXTURE_BINDING_2D:              return 1; // (* actually a CanvasTexture*)
+        case GL_TEXTURE_BINDING_CUBE_MAP:        return 1; // (* actually a CanvasTexture*)
+        case GL_UNPACK_ALIGNMENT:                return 1;
+        case GL_VIEWPORT:                        return 4;
+    }
+    
+    return -1;
+}
+
+bool GraphicsContext3D::getBoolean(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLboolean buf[4];
+    GLboolean* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
+        isAlloced = true;
+    }
+            
+    ::glGetBooleanv(pname, pbuf);
+    
+    bool value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasUnsignedByteArray> GraphicsContext3D::getBooleanv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasUnsignedByteArray> array = CanvasUnsignedByteArray::create(size);
+    bool isAlloced = false;
+    GLboolean buf[4];
+    GLboolean* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLboolean*) malloc(size * sizeof(GLboolean));
+        isAlloced = true;
+    }
+            
+    ::glGetBooleanv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<unsigned char>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+float GraphicsContext3D::getFloat(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLfloat buf[4];
+    GLfloat* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
+        isAlloced = true;
+    }
+            
+    ::glGetFloatv(pname, pbuf);
+    
+    float value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getFloatv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
+    bool isAlloced = false;
+    GLfloat buf[4];
+    GLfloat* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLfloat*) malloc(size * sizeof(GLfloat));
+        isAlloced = true;
+    }
+            
+    ::glGetFloatv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<float>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+int GraphicsContext3D::getInteger(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    bool isAlloced = false;
+    GLint buf[4];
+    GLint* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLint*) malloc(size * sizeof(GLint));
+        isAlloced = true;
+    }
+            
+    ::glGetIntegerv(pname, pbuf);
+    
+    int value = pbuf[0];
+
+    if (isAlloced)
+        free(pbuf);
+    
+    return value;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getIntegerv(unsigned long pname)
+{
+    int size = sizeForGetParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
+    bool isAlloced = false;
+    GLint buf[4];
+    GLint* pbuf = buf;
+            
+    if (size > 4) {
+        pbuf = (GLint*) malloc(size * sizeof(GLint));
+        isAlloced = true;
+    }
+            
+    ::glGetIntegerv(pname, pbuf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<int>(pbuf[i]));
+            
+    if (isAlloced)
+        free(pbuf);
+    
+    return array;
+}
+
+int GraphicsContext3D::getBufferParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getBufferParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getFramebufferAttachmentParameteri(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getFramebufferAttachmentParameteriv(unsigned long target, unsigned long attachment, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetFramebufferAttachmentParameterivEXT(target, attachment, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getProgrami(CanvasProgram* program, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetProgramiv((GLuint) program->object(), pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getProgramiv(CanvasProgram* program, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetProgramiv((GLuint) program->object(), pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+String GraphicsContext3D::getProgramInfoLog(CanvasProgram* program)
+{
+    if (!program)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetProgramiv((GLuint) program->object(), GL_INFO_LOG_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetProgramInfoLog((GLuint) program->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+int GraphicsContext3D::getRenderbufferParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getRenderbufferParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetBufferParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getShaderi(CanvasShader* shader, unsigned long pname)
+{
+    if (!shader)
+        return 0;
+    
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getShaderiv(CanvasShader* shader, unsigned long pname)
+{
+    if (!shader)
+        return 0;
+    
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetShaderiv((GLuint) shader->object(), pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+String GraphicsContext3D::getShaderInfoLog(CanvasShader* shader)
+{
+    if (!shader)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetShaderiv((GLuint) shader->object(), GL_INFO_LOG_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetShaderInfoLog((GLuint) shader->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+String GraphicsContext3D::getShaderSource(CanvasShader* shader)
+{
+    if (!shader)
+        return String();
+    
+    ensureContext(m_contextObj);
+    GLint length;
+    ::glGetShaderiv((GLuint) shader->object(), GL_SHADER_SOURCE_LENGTH, &length);
+    
+    GLsizei size;
+    GLchar* info = (GLchar*) malloc(length);
+    ::glGetShaderSource((GLuint) shader->object(), length, &size, info);
+    String s(info);
+    free(info);
+    return s;
+}
+
+
+float GraphicsContext3D::getTexParameterf(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLfloat data;
+    ::glGetTexParameterfv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getTexParameterfv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(1);
+    GLfloat data;
+    ::glGetTexParameterfv(target, pname, &data);
+    array->set(0, static_cast<float>(data));
+    
+    return array;
+}
+
+int GraphicsContext3D::getTexParameteri(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint data;
+    ::glGetTexParameteriv(target, pname, &data);
+    return data;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getTexParameteriv(unsigned long target, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(1);
+    GLint data;
+    ::glGetTexParameteriv(target, pname, &data);
+    array->set(0, static_cast<int>(data));
+    
+    return array;
+}
+
+float GraphicsContext3D::getUniformf(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getUniformfv(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+int GraphicsContext3D::getUniformi(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getUniformiv(CanvasProgram* program, long location)
+{
+    // FIXME: We need to query glGetUniformLocation to determine the size needed
+    UNUSED_PARAM(program);
+    UNUSED_PARAM(location);
+    notImplemented();
+    return 0;
+}
+
+long GraphicsContext3D::getUniformLocation(CanvasProgram* program, const String& name)
+{
+    if (!program)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    return ::glGetUniformLocation((GLuint) program->object(), name.utf8().data());
+}
+
+static int sizeForGetVertexAttribParam(unsigned long pname)
+{
+    switch(pname) {
+        case GL_VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:     return 1; // (* actually a CanvasBuffer*)
+        case GL_VERTEX_ATTRIB_ARRAY_ENABLED:            return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_SIZE:               return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_STRIDE:             return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_TYPE:               return 1;
+        case GL_VERTEX_ATTRIB_ARRAY_NORMALIZED:         return 1;
+        case GL_CURRENT_VERTEX_ATTRIB:                  return 4;
+    }
+    
+    return -1;
+}
+
+float GraphicsContext3D::getVertexAttribf(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLfloat buf[4];
+    ::glGetVertexAttribfv(index, pname, buf);
+    return buf[0];
+}
+
+PassRefPtr<CanvasFloatArray> GraphicsContext3D::getVertexAttribfv(unsigned long index, unsigned long pname)
+{
+    int size = sizeForGetVertexAttribParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasFloatArray> array = CanvasFloatArray::create(size);
+    GLfloat buf[4];
+    ::glGetVertexAttribfv(index, pname, buf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<float>(buf[i]));
+    
+    return array;
+}
+
+int GraphicsContext3D::getVertexAttribi(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    GLint buf[4];
+    ::glGetVertexAttribiv(index, pname, buf);
+    return buf[0];
+}
+
+PassRefPtr<CanvasIntArray> GraphicsContext3D::getVertexAttribiv(unsigned long index, unsigned long pname)
+{
+    int size = sizeForGetVertexAttribParam(pname);
+    if (size < 1) 
+        return 0;
+    
+    ensureContext(m_contextObj);
+    
+    RefPtr<CanvasIntArray> array = CanvasIntArray::create(size);
+    GLint buf[4];
+    ::glGetVertexAttribiv(index, pname, buf);
+            
+    for (int i = 0; i < size; ++i)
+        array->set(i, static_cast<int>(buf[i]));
+    
+    return array;
+}
+
+long GraphicsContext3D::getVertexAttribOffset(unsigned long index, unsigned long pname)
+{
+    ensureContext(m_contextObj);
+    
+    void* pointer;
+    ::glGetVertexAttribPointerv(index, pname, &pointer);
+    return reinterpret_cast<long>(pointer);
+}
+
+// Assumes the texture you want to go into is bound
+static void imageToTexture(Image* image, unsigned target, unsigned level)
+{
+    if (!image)
+        return;
+    
+    CGImageRef textureImage = image->getCGImageRef();
+    if (!textureImage)
+        return;
+    
+    size_t textureWidth = CGImageGetWidth(textureImage);
+    size_t textureHeight = CGImageGetHeight(textureImage);
+    
+    GLubyte* textureData = (GLubyte*) malloc(textureWidth * textureHeight * 4);
+    CGContextRef textureContext = CGBitmapContextCreate(textureData, textureWidth, textureHeight, 8, textureWidth * 4, 
+                                                        CGImageGetColorSpace(textureImage), kCGImageAlphaPremultipliedLast);
+    
+    CGContextDrawImage(textureContext, CGRectMake(0, 0, (CGFloat)textureWidth, (CGFloat)textureHeight), textureImage);
+    CGContextRelease(textureContext);
+    
+    ::glTexImage2D(target, level, GL_RGBA, textureWidth, textureHeight, 0, GL_RGBA, GL_UNSIGNED_BYTE, textureData);
+    free(textureData);
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, CanvasArray* pixels)
+{
+    // FIXME: Need to do bounds checking on the buffer here.
+    ::glTexImage2D(target, level, internalformat, width, height, border, format, type, pixels->baseAddress());
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, unsigned internalformat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, ImageData* pixels)
+{
+    // FIXME: need to implement this form
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(internalformat);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(border);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    
+    if (!image)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    CachedImage* cachedImage = image->cachedImage();
+    if (!cachedImage)
+        return -1;
+    
+    imageToTexture(cachedImage->image(), target, level);
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    
+    if (!canvas)
+        return -1;
+    
+    ensureContext(m_contextObj);
+    ImageBuffer* buffer = canvas->buffer();
+    if (!buffer)
+        return -1;
+    
+    imageToTexture(buffer->image(), target, level);
+    return 0;
+}
+
+int GraphicsContext3D::texImage2D(unsigned target, unsigned level, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: need to implement this form
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(video);
+
+    // FIXME: need to support flipY and premultiplyAlpha
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, CanvasArray* pixels)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, unsigned format, unsigned type, ImageData* pixels)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(format);
+    UNUSED_PARAM(type);
+    UNUSED_PARAM(pixels);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLImageElement* image, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(image);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLCanvasElement* canvas, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(canvas);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+int GraphicsContext3D::texSubImage2D(unsigned target, unsigned level, unsigned xoff, unsigned yoff, unsigned width, unsigned height, HTMLVideoElement* video, bool flipY, bool premultiplyAlpha)
+{
+    // FIXME: we will need to deal with PixelStore params when dealing with image buffers that differ from the subimage size
+    UNUSED_PARAM(target);
+    UNUSED_PARAM(level);
+    UNUSED_PARAM(xoff);
+    UNUSED_PARAM(yoff);
+    UNUSED_PARAM(width);
+    UNUSED_PARAM(height);
+    UNUSED_PARAM(video);
+
+    // FIXME: need to support flipY and premultiplyAlpha    
+    UNUSED_PARAM(flipY);
+    UNUSED_PARAM(premultiplyAlpha);
+    return -1;
+}
+
+unsigned GraphicsContext3D::createBuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenBuffers(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createFramebuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenFramebuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createProgram()
+{
+    ensureContext(m_contextObj);
+    return glCreateProgram();
+}
+
+unsigned GraphicsContext3D::createRenderbuffer()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenRenderbuffersEXT(1, &o);
+    return o;
+}
+
+unsigned GraphicsContext3D::createShader(ShaderType type)
+{
+    ensureContext(m_contextObj);
+    return glCreateShader((type == FRAGMENT_SHADER) ? GL_FRAGMENT_SHADER : GL_VERTEX_SHADER);
+}
+
+unsigned GraphicsContext3D::createTexture()
+{
+    ensureContext(m_contextObj);
+    GLuint o;
+    glGenTextures(1, &o);
+    return o;
+}
+
+void GraphicsContext3D::deleteBuffer(unsigned buffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(unsigned framebuffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteFramebuffersEXT(1, &framebuffer);
+}
+
+void GraphicsContext3D::deleteProgram(unsigned program)
+{
+    ensureContext(m_contextObj);
+    glDeleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(unsigned renderbuffer)
+{
+    ensureContext(m_contextObj);
+    glDeleteRenderbuffersEXT(1, &renderbuffer);
+}
+
+void GraphicsContext3D::deleteShader(unsigned shader)
+{
+    ensureContext(m_contextObj);
+    glDeleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(unsigned texture)
+{
+    ensureContext(m_contextObj);
+    glDeleteTextures(1, &texture);
+}
+
+int GraphicsContext3D::sizeInBytes(int type)
+{
+    switch (type) {
+        case GL_BYTE:
+            return sizeof(GLbyte);
+        case GL_UNSIGNED_BYTE:
+            return sizeof(GLubyte);
+        case GL_SHORT:
+            return sizeof(GLshort);
+        case GL_UNSIGNED_SHORT:
+            return sizeof(GLushort);
+        case GL_INT:
+            return sizeof(GLint);
+        case GL_UNSIGNED_INT:
+            return sizeof(GLuint);
+        case GL_FLOAT:
+            return sizeof(GLfloat);
+        default:
+            return 0;
+    }
+}
+
+}
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/mac/GraphicsContextMac.mm b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
index 2404319..6c9b872 100644
--- a/WebCore/platform/graphics/mac/GraphicsContextMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
@@ -50,27 +50,26 @@ void GraphicsContext::drawFocusRing(const Color& color)
 
     int radius = (focusRingWidth() - 1) / 2;
     int offset = radius + focusRingOffset();
-    CGColorRef colorRef = color.isValid() ? createCGColor(color) : 0;
+    RetainPtr<CGColorRef> colorRef;
+    if (color.isValid())
+        colorRef.adoptCF(createCGColor(color));
 
-    CGMutablePathRef focusRingPath = CGPathCreateMutable();
+    RetainPtr<CGMutablePathRef> focusRingPath(AdoptCF, CGPathCreateMutable());
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
-        CGPathAddRect(focusRingPath, 0, CGRectInset(rects[i], -offset, -offset));
+        CGPathAddRect(focusRingPath.get(), 0, CGRectInset(rects[i], -offset, -offset));
 
     CGContextRef context = platformContext();
 #ifdef BUILDING_ON_TIGER
     CGContextBeginTransparencyLayer(context, NULL);
 #endif
     CGContextBeginPath(context);
-    CGContextAddPath(context, focusRingPath);
-    wkDrawFocusRing(context, colorRef, radius);
+    CGContextAddPath(context, focusRingPath.get());
+    wkDrawFocusRing(context, colorRef.get(), radius);
 #ifdef BUILDING_ON_TIGER
     CGContextEndTransparencyLayer(context);
 #endif
-    CGColorRelease(colorRef);
-
-    CGPathRelease(focusRingPath);
 }
 
 #ifdef BUILDING_ON_TIGER // Post-Tiger's setCompositeOperation() is defined in GraphicsContextCG.cpp.
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index ebdc6ac..d0e1108 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -62,6 +62,8 @@ public:
 
     virtual void removeFromParent();
 
+    virtual void setMaskLayer(GraphicsLayer*);
+
     virtual void setPosition(const FloatPoint&);
     virtual void setAnchorPoint(const FloatPoint3D&);
     virtual void setSize(const FloatSize&);
@@ -86,6 +88,10 @@ public:
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
 
+#if ENABLE(3D_CANVAS)
+    virtual void setGraphicsContext3DNeedsDisplay();
+#endif
+    
     virtual void setContentsRect(const IntRect&);
     
     virtual void suspendAnimations(double time);
@@ -98,6 +104,9 @@ public:
     
     virtual void setContentsToImage(Image*);
     virtual void setContentsToVideo(PlatformLayer*);
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
+#endif
     
     virtual PlatformLayer* platformLayer() const;
 
@@ -170,8 +179,12 @@ private:
 
     void updateContentsImage();
     void updateContentsVideo();
+#if ENABLE(3D_CANVAS)
+    void updateContentsGraphicsContext3D();
+#endif
     void updateContentsRect();
     void updateGeometryOrientation();
+    void updateMaskLayer();
 
     void updateLayerAnimations();
 
@@ -199,8 +212,12 @@ private:
         DirtyRectsChanged = 1 << 16,
         ContentsImageChanged = 1 << 17,
         ContentsVideoChanged = 1 << 18,
-        ContentsRectChanged = 1 << 19,
-        GeometryOrientationChanged = 1 << 20
+#if ENABLE(3D_CANVAS)
+        ContentsGraphicsContext3DChanged = 1 << 19,
+#endif
+        ContentsRectChanged = 1 << 20,
+        GeometryOrientationChanged = 1 << 21,
+        MaskLayerChanged = 1 << 22
     };
     typedef unsigned LayerChangeFlags;
     void noteLayerPropertyChanged(LayerChangeFlags flags);
@@ -215,6 +232,9 @@ private:
         NoContentsLayer = 0,
         ContentsLayerForImage,
         ContentsLayerForVideo
+#if ENABLE(3D_CANVAS)
+        ,ContentsLayerForGraphicsLayer3D
+#endif
     };
     
     ContentsLayerPurpose m_contentsLayerPurpose;
@@ -260,6 +280,11 @@ private:
     Vector<FloatRect> m_dirtyRects;
     
     LayerChangeFlags m_uncommittedChanges;
+    
+#if ENABLE(3D_CANVAS)
+    PlatformGraphicsContext3D m_platformGraphicsContext3D;
+    Platform3DObject m_platformTexture;
+#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index e5b9035..e9960f1 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -31,6 +31,9 @@
 
 #import "Animation.h"
 #import "BlockExceptions.h"
+#if ENABLE(3D_CANVAS)
+#import "Canvas3DLayer.h"
+#endif
 #import "CString.h"
 #import "FloatConversion.h"
 #import "FloatRect.h"
@@ -145,11 +148,11 @@ static NSValue* getTransformFunctionValue(const TransformOperation* transformOp,
         case TransformOperation::ROTATE_Y:
             return [NSNumber numberWithDouble:transformOp ? deg2rad(static_cast<const RotateTransformOperation*>(transformOp)->angle()) : 0];
         case TransformOperation::SCALE_X:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 1];
         case TransformOperation::SCALE_Y:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 1];
         case TransformOperation::SCALE_Z:
-            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 0];
+            return [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 1];
         case TransformOperation::TRANSLATE_X:
             return [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->x(size) : 0];
         case TransformOperation::TRANSLATE_Y:
@@ -157,13 +160,23 @@ static NSValue* getTransformFunctionValue(const TransformOperation* transformOp,
         case TransformOperation::TRANSLATE_Z:
             return [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->z(size) : 0];
         case TransformOperation::SCALE:
+        case TransformOperation::SCALE_3D:
+            return [NSArray arrayWithObjects:
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->x() : 1],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->y() : 1],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const ScaleTransformOperation*>(transformOp)->z() : 1],
+                        nil];
         case TransformOperation::TRANSLATE:
+        case TransformOperation::TRANSLATE_3D:
+            return [NSArray arrayWithObjects:
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->x(size) : 0],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->y(size) : 0],
+                        [NSNumber numberWithDouble:transformOp ? static_cast<const TranslateTransformOperation*>(transformOp)->z(size) : 0],
+                        nil];
         case TransformOperation::SKEW_X:
         case TransformOperation::SKEW_Y:
         case TransformOperation::SKEW:
         case TransformOperation::MATRIX:
-        case TransformOperation::SCALE_3D:
-        case TransformOperation::TRANSLATE_3D:
         case TransformOperation::ROTATE_3D:
         case TransformOperation::MATRIX_3D:
         case TransformOperation::PERSPECTIVE:
@@ -204,6 +217,12 @@ static NSString* getValueFunctionNameForTransformOperation(TransformOperation::O
             return @"translateY"; // kCAValueFunctionTranslateY;
         case TransformOperation::TRANSLATE_Z:
             return @"translateZ"; // kCAValueFunctionTranslateZ;
+        case TransformOperation::SCALE:
+        case TransformOperation::SCALE_3D:
+            return @"scale"; // kCAValueFunctionScale;
+        case TransformOperation::TRANSLATE:
+        case TransformOperation::TRANSLATE_3D:
+            return @"translate"; // kCAValueFunctionTranslate;
         default:
             return nil;
     }
@@ -331,7 +350,7 @@ static NSDictionary* nullActionsDictionary()
     return actions;
 }
 
-GraphicsLayer* GraphicsLayer::createGraphicsLayer(GraphicsLayerClient* client)
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 {
     return new GraphicsLayerCA(client);
 }
@@ -341,6 +360,10 @@ GraphicsLayerCA::GraphicsLayerCA(GraphicsLayerClient* client)
 , m_contentsLayerPurpose(NoContentsLayer)
 , m_contentsLayerHasBackgroundColor(false)
 , m_uncommittedChanges(NoChange)
+#if ENABLE(3D_CANVAS)
+, m_platformGraphicsContext3D(NullPlatformGraphicsContext3D)
+, m_platformTexture(NullPlatform3DObject)
+#endif
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS
     m_layer.adoptNS([[WebLayer alloc] init]);
@@ -432,6 +455,15 @@ void GraphicsLayerCA::removeFromParent()
     GraphicsLayer::removeFromParent();
 }
 
+void GraphicsLayerCA::setMaskLayer(GraphicsLayer* layer)
+{
+    if (layer == m_maskLayer)
+        return;
+
+    GraphicsLayer::setMaskLayer(layer);
+    noteLayerPropertyChanged(MaskLayerChanged);
+}
+
 void GraphicsLayerCA::setPosition(const FloatPoint& point)
 {
     if (point == m_position)
@@ -672,10 +704,10 @@ void GraphicsLayerCA::setContentsToImage(Image* image)
         CGColorSpaceRef colorSpace = CGImageGetColorSpace(m_pendingContentsImage.get());
 
         static CGColorSpaceRef deviceRGB = CGColorSpaceCreateDeviceRGB();
-        if (CFEqual(colorSpace, deviceRGB)) {
-            // CoreGraphics renders images tagged with DeviceRGB using GenericRGB. When we hand such
+        if (colorSpace && CFEqual(colorSpace, deviceRGB)) {
+            // CoreGraphics renders images tagged with DeviceRGB using the color space of the main display. When we hand such
             // images to CA we need to tag them similarly so CA rendering matches CG rendering.
-            static CGColorSpaceRef genericRGB = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGB);
+            static CGColorSpaceRef genericRGB = CGDisplayCopyColorSpace(kCGDirectMainDisplay);
             m_pendingContentsImage.adoptCF(CGImageCreateCopyWithColorSpace(m_pendingContentsImage.get(), genericRGB));
         }
         m_contentsLayerPurpose = ContentsLayerForImage;
@@ -733,6 +765,9 @@ void GraphicsLayerCA::recursiveCommitChanges()
 {
     commitLayerChanges();
 
+    if (m_maskLayer)
+        static_cast<GraphicsLayerCA*>(m_maskLayer)->commitLayerChanges();
+
     const Vector<GraphicsLayer*>& childLayers = children();
     size_t numChildren = childLayers.size();
     for (size_t i = 0; i < numChildren; ++i) {
@@ -763,7 +798,12 @@ void GraphicsLayerCA::commitLayerChanges()
         
     if (m_uncommittedChanges & ContentsVideoChanged) // Needs to happen before ChildrenChanged
         updateContentsVideo();
-
+    
+#if ENABLE(3D_CANVAS)
+    if (m_uncommittedChanges & ContentsGraphicsContext3DChanged) // Needs to happen before ChildrenChanged
+        updateContentsGraphicsContext3D();
+#endif
+    
     if (m_uncommittedChanges & BackgroundColorChanged)  // Needs to happen before ChildrenChanged, and after updating image or video
         updateLayerBackgroundColor();
 
@@ -812,6 +852,9 @@ void GraphicsLayerCA::commitLayerChanges()
     if (m_uncommittedChanges & GeometryOrientationChanged)
         updateGeometryOrientation();
 
+    if (m_uncommittedChanges & MaskLayerChanged)
+        updateMaskLayer();
+
     m_uncommittedChanges = NoChange;
     END_BLOCK_OBJC_EXCEPTIONS
 }
@@ -821,10 +864,12 @@ void GraphicsLayerCA::updateSublayerList()
     NSMutableArray* newSublayers = nil;
 
     if (m_transformLayer) {
-        // FIXME: add the primary layer in the correct order with negative z-order children.
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
         newSublayers = [[NSMutableArray alloc] initWithObjects:m_layer.get(), nil];
     } else if (m_contentsLayer) {
         // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
         newSublayers = [[NSMutableArray alloc] initWithObjects:m_contentsLayer.get(), nil];
     }
     
@@ -1061,6 +1106,18 @@ void GraphicsLayerCA::updateContentsVideo()
     }
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::updateContentsGraphicsContext3D()
+{
+    // Canvas3D layer was set as m_contentsLayer, and will get parented in updateSublayerList().
+    if (m_contentsLayer) {
+        setupContentsLayer(m_contentsLayer.get());
+        [m_contentsLayer.get() setNeedsDisplay];
+        updateContentsRect();
+    }
+}
+#endif
+    
 void GraphicsLayerCA::updateContentsRect()
 {
     if (!m_contentsLayer)
@@ -1094,6 +1151,12 @@ void GraphicsLayerCA::updateGeometryOrientation()
 #endif
 }
 
+void GraphicsLayerCA::updateMaskLayer()
+{
+    CALayer* maskCALayer = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    [m_layer.get() setMask:maskCALayer];
+}
+
 void GraphicsLayerCA::updateLayerAnimations()
 {
     if (m_transitionPropertiesToRemove.size()) {
@@ -1247,6 +1310,40 @@ void GraphicsLayerCA::pauseAnimationOnLayer(AnimatedPropertyID property, int ind
     [layer addAnimation:pausedAnim forKey:animationName];  // This will replace the running animation.
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::setContentsToGraphicsContext3D(const GraphicsContext3D* graphicsContext3D)
+{
+    PlatformGraphicsContext3D context = graphicsContext3D->platformGraphicsContext3D();
+    Platform3DObject texture = graphicsContext3D->platformTexture();
+    
+    if (context == m_platformGraphicsContext3D && texture == m_platformTexture)
+        return;
+        
+    m_platformGraphicsContext3D = context;
+    m_platformTexture = texture;
+    
+    noteLayerPropertyChanged(ChildrenChanged);
+    
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+
+    if (m_platformGraphicsContext3D != NullPlatformGraphicsContext3D && m_platformTexture != NullPlatform3DObject) {
+        // create the inner 3d layer
+        m_contentsLayer.adoptNS([[Canvas3DLayer alloc] initWithContext:static_cast<CGLContextObj>(m_platformGraphicsContext3D) texture:static_cast<GLuint>(m_platformTexture)]);
+#ifndef NDEBUG
+        [m_contentsLayer.get() setName:@"3D Layer"];
+#endif        
+    } else {
+        // remove the inner layer
+        m_contentsLayer = 0;
+    }
+    
+    END_BLOCK_OBJC_EXCEPTIONS
+    
+    noteLayerPropertyChanged(ContentsGraphicsContext3DChanged);
+    m_contentsLayerPurpose = m_contentsLayer ? ContentsLayerForGraphicsLayer3D : NoContentsLayer;
+}
+#endif
+    
 void GraphicsLayerCA::repaintLayerDirtyRects()
 {
     if (!m_dirtyRects.size())
@@ -1765,6 +1862,14 @@ void GraphicsLayerCA::noteLayerPropertyChanged(LayerChangeFlags flags)
     m_uncommittedChanges |= flags;
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerCA::setGraphicsContext3DNeedsDisplay()
+{
+    if (m_contentsLayerPurpose == ContentsLayerForGraphicsLayer3D)
+        [m_contentsLayer.get() setNeedsDisplay];
+}
+#endif
+    
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/mac/ImageMac.mm b/WebCore/platform/graphics/mac/ImageMac.mm
index a0d257b..672c3c8 100644
--- a/WebCore/platform/graphics/mac/ImageMac.mm
+++ b/WebCore/platform/graphics/mac/ImageMac.mm
@@ -94,16 +94,15 @@ CFDataRef BitmapImage::getTIFFRepresentation()
     
     RetainPtr<CFMutableDataRef> data(AdoptCF, CFDataCreateMutable(0, 0));
     // FIXME:  Use type kCGImageTypeIdentifierTIFF constant once is becomes available in the API
-    CGImageDestinationRef destination = CGImageDestinationCreateWithData(data.get(), CFSTR("public.tiff"), numValidFrames, 0);
-    
+    RetainPtr<CGImageDestinationRef> destination(AdoptCF, CGImageDestinationCreateWithData(data.get(), CFSTR("public.tiff"), numValidFrames, 0));
+
     if (!destination)
         return 0;
     
     for (unsigned i = 0; i < numValidFrames; ++i)
-        CGImageDestinationAddImage(destination, images[i], 0);
+        CGImageDestinationAddImage(destination.get(), images[i], 0);
 
-    CGImageDestinationFinalize(destination);
-    CFRelease(destination);
+    CGImageDestinationFinalize(destination.get());
 
     m_tiffRep = data;
     return m_tiffRep.get();
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
index 54eea00..0a63626 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.h
@@ -77,8 +77,12 @@ private:
     static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
     static bool isAvailable();
 
+    PlatformMedia platformMedia() const;
+
     IntSize naturalSize() const;
     bool hasVideo() const;
+    bool hasAudio() const;
+    bool supportsFullscreen() const;
     
     void load(const String& url);
     void cancelLoad();
@@ -104,7 +108,7 @@ private:
     MediaPlayer::NetworkState networkState() const { return m_networkState; }
     MediaPlayer::ReadyState readyState() const { return m_readyState; }
     
-    float maxTimeBuffered() const;
+    PassRefPtr<TimeRanges> buffered() const;
     float maxTimeSeekable() const;
     unsigned bytesLoaded() const;
     bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index c1d7fcb..30d0c82 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -39,6 +39,7 @@
 #import "KURL.h"
 #import "MIMETypeRegistry.h"
 #import "SoftLinking.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import <QTKit/QTKit.h>
 #import <objc/objc-runtime.h>
@@ -84,6 +85,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieAskUnresolvedDataRefsAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDataSizeAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieDidEndNotification, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieHasVideoAttribute, NSString *)
+SOFT_LINK_POINTER(QTKit, QTMovieHasAudioAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieIsActiveAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateAttribute, NSString *)
 SOFT_LINK_POINTER(QTKit, QTMovieLoadStateDidChangeNotification, NSString *)
@@ -119,6 +121,7 @@ SOFT_LINK_POINTER(QTKit, QTMovieApertureModeAttribute, NSString *)
 #define QTMovieDataSizeAttribute getQTMovieDataSizeAttribute()
 #define QTMovieDidEndNotification getQTMovieDidEndNotification()
 #define QTMovieHasVideoAttribute getQTMovieHasVideoAttribute()
+#define QTMovieHasAudioAttribute getQTMovieHasAudioAttribute()
 #define QTMovieIsActiveAttribute getQTMovieIsActiveAttribute()
 #define QTMovieLoadStateAttribute getQTMovieLoadStateAttribute()
 #define QTMovieLoadStateDidChangeNotification getQTMovieLoadStateDidChangeNotification()
@@ -230,7 +233,7 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
 
 void MediaPlayerPrivate::createQTMovie(const String& url)
 {
-    NSURL *cocoaURL = KURL(url);
+    NSURL *cocoaURL = KURL(ParsedURLString, url);
     NSDictionary *movieAttributes = [NSDictionary dictionaryWithObjectsAndKeys:
                        cocoaURL, QTMovieURLAttribute,
                        [NSNumber numberWithBool:m_player->preservesPitch()], QTMovieRateChangesPreservePitchAttribute,
@@ -562,6 +565,12 @@ void MediaPlayerPrivate::load(const String& url)
     [m_objcObserver.get() setDelayCallbacks:NO];
 }
 
+PlatformMedia MediaPlayerPrivate::platformMedia() const
+{
+    PlatformMedia plaftformMedia = { m_qtMovie.get() };
+    return plaftformMedia;
+}
+
 void MediaPlayerPrivate::play()
 {
     if (!metaDataAvailable())
@@ -719,18 +728,28 @@ bool MediaPlayerPrivate::hasVideo() const
     return [[m_qtMovie.get() attributeForKey:QTMovieHasVideoAttribute] boolValue];
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    if (!m_qtMovie)
+        return false;
+    return [[m_qtMovie.get() attributeForKey:QTMovieHasAudioAttribute] boolValue];
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{   
+    return true;
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
-    if (!metaDataAvailable())
-        return;
-    [m_qtMovie.get() setVolume:volume];  
+    if (m_qtMovie)
+        [m_qtMovie.get() setVolume:volume];  
 }
 
 void MediaPlayerPrivate::setRate(float rate)
 {
-    if (!metaDataAvailable())
-        return;
-    [m_qtMovie.get() setRate:rate];
+    if (m_qtMovie)
+        [m_qtMovie.get() setRate:rate];
 }
 
 void MediaPlayerPrivate::setPreservesPitch(bool preservesPitch)
@@ -758,10 +777,13 @@ int MediaPlayerPrivate::dataRate() const
     return wkQTMovieDataRate(m_qtMovie.get()); 
 }
 
-
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
-    return maxTimeLoaded();
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
+    if (loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
diff --git a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index cdde7cf..97a7251 100644
--- a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -50,6 +50,8 @@
 - (BOOL)_isFakeFixedPitch;
 @end
 
+using namespace std;
+
 namespace WebCore {
   
 const float smallCapsFontSizeMultiplier = 0.7f;
@@ -269,7 +271,7 @@ void SimpleFontData::platformInit()
         // and web pages that foolishly use this metric for width will be laid out
         // poorly if we return an accurate height. Classic case is Times 13 point,
         // which has an "x" that is 7x6 pixels.
-        m_xHeight = MAX(NSMaxX(xBox), NSMaxY(xBox));
+        m_xHeight = max(NSMaxX(xBox), NSMaxY(xBox));
     } else
         m_xHeight = [m_platformData.font() xHeight];
 }
@@ -443,13 +445,13 @@ CTFontRef SimpleFontData::getCTFont() const
     return m_CTFont.get();
 }
 
-CFDictionaryRef SimpleFontData::getCFStringAttributes() const
+CFDictionaryRef SimpleFontData::getCFStringAttributes(TextRenderingMode textMode) const
 {
     if (m_CFStringAttributes)
         return m_CFStringAttributes.get();
 
-    static const float kerningAdjustmentValue = 0;
-    static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
+    bool allowKerning = textMode == OptimizeLegibility || textMode == GeometricPrecision;
+    bool allowLigatures = platformData().allowsLigatures() || allowKerning;
 
     static const int ligaturesNotAllowedValue = 0;
     static CFNumberRef ligaturesNotAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesNotAllowedValue);
@@ -457,10 +459,23 @@ CFDictionaryRef SimpleFontData::getCFStringAttributes() const
     static const int ligaturesAllowedValue = 1;
     static CFNumberRef ligaturesAllowed = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &ligaturesAllowedValue);
 
-    static const void* attributeKeys[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName };
-    const void* attributeValues[] = { getCTFont(), kerningAdjustment, platformData().allowsLigatures() ? ligaturesAllowed : ligaturesNotAllowed };
-
-    m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, attributeKeys, attributeValues, sizeof(attributeKeys) / sizeof(*attributeKeys), &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    if (!allowKerning) {
+        static const float kerningAdjustmentValue = 0;
+        static CFNumberRef kerningAdjustment = CFNumberCreate(kCFAllocatorDefault, kCFNumberFloatType, &kerningAdjustmentValue);
+        static const void* keysWithKerningDisabled[] = { kCTFontAttributeName, kCTKernAttributeName, kCTLigatureAttributeName };
+        const void* valuesWithKerningDisabled[] = { getCTFont(), kerningAdjustment, allowLigatures
+            ? ligaturesAllowed : ligaturesNotAllowed };
+        m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, keysWithKerningDisabled, valuesWithKerningDisabled,
+            sizeof(keysWithKerningDisabled) / sizeof(*keysWithKerningDisabled),
+            &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    } else {
+        // By omitting the kCTKernAttributeName attribute, we get Core Text's standard kerning.
+        static const void* keysWithKerningEnabled[] = { kCTFontAttributeName, kCTLigatureAttributeName };
+        const void* valuesWithKerningEnabled[] = { getCTFont(), allowLigatures ? ligaturesAllowed : ligaturesNotAllowed };
+        m_CFStringAttributes.adoptCF(CFDictionaryCreate(NULL, keysWithKerningEnabled, valuesWithKerningEnabled,
+            sizeof(keysWithKerningEnabled) / sizeof(*keysWithKerningEnabled),
+            &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks));
+    }
 
     return m_CFStringAttributes.get();
 }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
index 895887f..b2e3d92 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -339,7 +340,10 @@ bool getEOTHeader(SharedBuffer* fontData, EOTHeader& eotHeader, size_t& overlayD
     return true;
 }
 
-HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+// code shared by renameFont and renameAndActivateFont
+// adds fontName to the font table in fontData, and writes the new font table to rewrittenFontTable
+// returns the size of the name table (which is used by renameAndActivateFont), or 0 on early abort
+static size_t renameFontInternal(SharedBuffer* fontData, const String& fontName, Vector<char> &rewrittenFontData)
 {
     size_t originalDataSize = fontData->size();
     const sfntHeader* sfnt = reinterpret_cast<const sfntHeader*>(fontData->data());
@@ -357,7 +361,7 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     // Rounded up to a multiple of 4 to simplify the checksum calculation.
     size_t nameTableSize = ((offsetof(nameTable, nameRecords) + nameRecordCount * sizeof(nameRecord) + fontName.length() * sizeof(UChar)) & ~3) + 4;
 
-    Vector<char> rewrittenFontData(fontData->size() + nameTableSize);
+    rewrittenFontData.resize(fontData->size() + nameTableSize);
     char* data = rewrittenFontData.data();
     memcpy(data, fontData->data(), originalDataSize);
 
@@ -394,8 +398,42 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
     for (unsigned i = 0; i * sizeof(BigEndianULong) < nameTableSize; ++i)
         rewrittenSfnt->tables[t].checkSum = rewrittenSfnt->tables[t].checkSum + reinterpret_cast<BigEndianULong*>(name)[i];
 
+    return nameTableSize;
+}
+
+#if PLATFORM(WINCE)
+// AddFontMemResourceEx does not exist on WinCE, so we must handle the font data manually
+// This function just renames the font and overwrites the old font data with the new
+bool renameFont(SharedBuffer* fontData, const String& fontName)
+{
+    // abort if the data is too small to be a font header with a "tables" entry
+    if (fontData->size() < offsetof(sfntHeader, tables))
+        return false;
+
+    // abort if the data is too small to hold all the tables specified in the header
+    const sfntHeader* header = reinterpret_cast<const sfntHeader*>(fontData->data());
+    if (fontData->size() < offsetof(sfntHeader, tables) + header->numTables * sizeof(TableDirectoryEntry))
+        return false;
+
+    Vector<char> rewrittenFontData;
+    if (!renameFontInternal(fontData, fontName, rewrittenFontData))
+        return false;
+
+    fontData->clear();
+    fontData->append(rewrittenFontData.data(), rewrittenFontData.size());
+    return true;
+}
+#else
+// Rename the font and install the new font data into the system
+HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
+{
+    Vector<char> rewrittenFontData;
+    size_t nameTableSize = renameFontInternal(fontData, fontName, rewrittenFontData);
+    if (!nameTableSize)
+        return 0;
+
     DWORD numFonts = 0;
-    HANDLE fontHandle = AddFontMemResourceEx(data, originalDataSize + nameTableSize, 0, &numFonts);
+    HANDLE fontHandle = AddFontMemResourceEx(rewrittenFontData.data(), fontData->size() + nameTableSize, 0, &numFonts);
 
     if (fontHandle && numFonts != 1) {
         RemoveFontMemResourceEx(fontHandle);
@@ -404,5 +442,6 @@ HANDLE renameAndActivateFont(SharedBuffer* fontData, const String& fontName)
 
     return fontHandle;
 }
+#endif
 
 }
diff --git a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
index 13dad6f..4c75314 100644
--- a/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
+++ b/WebCore/platform/graphics/opentype/OpenTypeUtilities.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008, 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +36,10 @@ struct BigEndianUShort;
 struct EOTPrefix;
 class SharedBuffer;
 
+#if PLATFORM(WINCE)
+typedef unsigned __int8 UInt8;
+#endif
+
 struct EOTHeader {
     EOTHeader();
 
diff --git a/WebCore/platform/graphics/qt/ColorQt.cpp b/WebCore/platform/graphics/qt/ColorQt.cpp
index 5d16740..151766a 100644
--- a/WebCore/platform/graphics/qt/ColorQt.cpp
+++ b/WebCore/platform/graphics/qt/ColorQt.cpp
@@ -40,7 +40,10 @@ Color::Color(const QColor& c)
 
 Color::operator QColor() const
 {
-    return QColor(red(), green(), blue(), alpha());
+    if (m_valid)
+        return QColor(red(), green(), blue(), alpha());
+    else
+        return QColor();
 }
 
 }
diff --git a/WebCore/platform/graphics/qt/FontCacheQt.cpp b/WebCore/platform/graphics/qt/FontCacheQt.cpp
index 5d29389..1113eae 100644
--- a/WebCore/platform/graphics/qt/FontCacheQt.cpp
+++ b/WebCore/platform/graphics/qt/FontCacheQt.cpp
@@ -48,7 +48,7 @@ FontCache::FontCache()
 {
 }
 
-void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigned>& traitsMasks)
+void FontCache::getTraitsInFamily(const AtomicString&, Vector<unsigned>&)
 {
 }
 
@@ -58,8 +58,8 @@ class FontPlatformDataCacheKey {
 public:
     FontPlatformDataCacheKey(const FontDescription& description)
         : m_familyName()
-        , m_bold(false)
         , m_size(description.computedPixelSize())
+        , m_bold(false)
         , m_italic(description.italic())
         , m_smallCaps(description.smallCaps())
         , m_hash(0)
@@ -177,7 +177,7 @@ typedef HashMap<FontPlatformDataCacheKey, FontPlatformData*, FontPlatformDataCac
 // using Q_GLOBAL_STATIC leads to crash. TODO investigate the way to fix this.
 static FontPlatformDataCache* gFontPlatformDataCache = 0;
 
-FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString& family, bool checkingAlternateName)
+FontPlatformData* FontCache::getCachedFontPlatformData(const FontDescription& description, const AtomicString&, bool)
 {
     if (!gFontPlatformDataCache)
         gFontPlatformDataCache = new FontPlatformDataCache;
diff --git a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
index c29fd56..8e1e4f6 100644
--- a/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
+++ b/WebCore/platform/graphics/qt/FontFallbackListQt.cpp
@@ -130,7 +130,7 @@ const FontData* FontFallbackList::fontDataForCharacters(const WebCore::Font* fon
     return primaryFontData(font);
 }
 
-void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData& platformData)
+void FontFallbackList::setPlatformFont(const WebCore::FontPlatformData&)
 {
     m_familyIndex = cAllFamiliesScanned;
 }
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index e8eb923..c5960ac 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -197,7 +197,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
     return w + run.padding();
 }
 
-int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool includePartialGlyphs) const
+int Font::offsetForPositionForComplexText(const TextRun& run, int position, bool) const
 {
     const QString string = fixSpacing(qstring(run));
     QTextLayout layout(string, font());
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index e259a4e..fa7b070 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -34,29 +34,29 @@
  */
 
 #include "config.h"
+#include "GraphicsContext.h"
 
 #ifdef Q_WS_WIN
 #include <windows.h>
 #endif
 
-#include "TransformationMatrix.h"
 #include "Color.h"
 #include "FloatConversion.h"
 #include "Font.h"
-#include "GraphicsContext.h"
 #include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
+#include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "Pen.h"
-#include "NotImplemented.h"
+#include "TransformationMatrix.h"
 
 #include <QBrush>
 #include <QDebug>
 #include <QGradient>
-#include <QPainter>
 #include <QPaintDevice>
 #include <QPaintEngine>
+#include <QPainter>
 #include <QPainterPath>
 #include <QPixmap>
 #include <QPolygonF>
@@ -72,35 +72,35 @@ namespace WebCore {
 static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op)
 {
     switch (op) {
-        case CompositeClear:
-            return QPainter::CompositionMode_Clear;
-        case CompositeCopy:
-            return QPainter::CompositionMode_Source;
-        case CompositeSourceOver:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositeSourceIn:
-            return QPainter::CompositionMode_SourceIn;
-        case CompositeSourceOut:
-            return QPainter::CompositionMode_SourceOut;
-        case CompositeSourceAtop:
-            return QPainter::CompositionMode_SourceAtop;
-        case CompositeDestinationOver:
-            return QPainter::CompositionMode_DestinationOver;
-        case CompositeDestinationIn:
-            return QPainter::CompositionMode_DestinationIn;
-        case CompositeDestinationOut:
-            return QPainter::CompositionMode_DestinationOut;
-        case CompositeDestinationAtop:
-            return QPainter::CompositionMode_DestinationAtop;
-        case CompositeXOR:
-            return QPainter::CompositionMode_Xor;
-        case CompositePlusDarker:
-            // there is no exact match, but this is the closest
-            return QPainter::CompositionMode_Darken;
-        case CompositeHighlight:
-            return QPainter::CompositionMode_SourceOver;
-        case CompositePlusLighter:
-            return QPainter::CompositionMode_Plus;
+    case CompositeClear:
+        return QPainter::CompositionMode_Clear;
+    case CompositeCopy:
+        return QPainter::CompositionMode_Source;
+    case CompositeSourceOver:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositeSourceIn:
+        return QPainter::CompositionMode_SourceIn;
+    case CompositeSourceOut:
+        return QPainter::CompositionMode_SourceOut;
+    case CompositeSourceAtop:
+        return QPainter::CompositionMode_SourceAtop;
+    case CompositeDestinationOver:
+        return QPainter::CompositionMode_DestinationOver;
+    case CompositeDestinationIn:
+        return QPainter::CompositionMode_DestinationIn;
+    case CompositeDestinationOut:
+        return QPainter::CompositionMode_DestinationOut;
+    case CompositeDestinationAtop:
+        return QPainter::CompositionMode_DestinationAtop;
+    case CompositeXOR:
+        return QPainter::CompositionMode_Xor;
+    case CompositePlusDarker:
+        // there is no exact match, but this is the closest
+        return QPainter::CompositionMode_Darken;
+    case CompositeHighlight:
+        return QPainter::CompositionMode_SourceOver;
+    case CompositePlusLighter:
+        return QPainter::CompositionMode_Plus;
     }
 
     return QPainter::CompositionMode_SourceOver;
@@ -109,12 +109,12 @@ static inline QPainter::CompositionMode toQtCompositionMode(CompositeOperator op
 static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 {
     switch (lc) {
-        case ButtCap:
-            return Qt::FlatCap;
-        case RoundCap:
-            return Qt::RoundCap;
-        case SquareCap:
-            return Qt::SquareCap;
+    case ButtCap:
+        return Qt::FlatCap;
+    case RoundCap:
+        return Qt::RoundCap;
+    case SquareCap:
+        return Qt::SquareCap;
     }
 
     return Qt::FlatCap;
@@ -123,12 +123,12 @@ static inline Qt::PenCapStyle toQtLineCap(LineCap lc)
 static inline Qt::PenJoinStyle toQtLineJoin(LineJoin lj)
 {
     switch (lj) {
-        case MiterJoin:
-            return Qt::SvgMiterJoin;
-        case RoundJoin:
-            return Qt::RoundJoin;
-        case BevelJoin:
-            return Qt::BevelJoin;
+    case MiterJoin:
+        return Qt::SvgMiterJoin;
+    case RoundJoin:
+        return Qt::RoundJoin;
+    case BevelJoin:
+        return Qt::BevelJoin;
     }
 
     return Qt::MiterJoin;
@@ -210,8 +210,8 @@ public:
                 return redirect;
 
             return painter;
-        } else
-            return &layers.top()->painter;
+        }
+        return &layers.top()->painter;
     }
 
     bool antiAliasingForRectsAndLines;
@@ -411,46 +411,25 @@ void GraphicsContext::drawRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        IntRect shadowRect = rect;
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        shadowRect.inflate(static_cast<int>(p->pen().widthF()));
+        p->fillRect(shadowRect, QColor(shadowColor));
+    }
+
     p->drawRect(rect);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-// FIXME: Now that this is refactored, it should be shared by all contexts.
-static void adjustLineToPixelBoundaries(FloatPoint& p1, FloatPoint& p2, float strokeWidth,
-                                        const StrokeStyle& penStyle)
-{
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float arithmetic
-    // works out.  For example, with a border width of 3, KHTML will pass us (y1+y2)/2, e.g.,
-    // (50+53)/2 = 103/2 = 51 when we want 51.5.  It is always true that an even width gave
-    // us a perfect position, but an odd width gave us a position that is off by exactly 0.5.
-    if (penStyle == DottedStroke || penStyle == DashedStroke) {
-        if (p1.x() == p2.x()) {
-            p1.setY(p1.y() + strokeWidth);
-            p2.setY(p2.y() - strokeWidth);
-        } else {
-            p1.setX(p1.x() + strokeWidth);
-            p2.setX(p2.x() - strokeWidth);
-        }
-    }
-
-    if (((int) strokeWidth) % 2) {
-        if (p1.x() == p2.x()) {
-            // We're a vertical line.  Adjust our x.
-            p1.setX(p1.x() + 0.5);
-            p2.setX(p2.x() + 0.5);
-        } else {
-            // We're a horizontal line. Adjust our y.
-            p1.setY(p1.y() + 0.5);
-            p2.setY(p2.y() + 0.5);
-        }
-    }
-}
-
 // This is only used to draw borders.
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
 {
@@ -468,7 +447,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     FloatPoint p2 = point2;
     bool isVerticalLine = (p1.x() == p2.x());
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
     adjustLineToPixelBoundaries(p1, p2, width, style);
@@ -479,22 +458,22 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     if (textDrawingMode() == cTextFill && getShadow(shadowSize, shadowBlur, shadowColor)) {
         p->save();
         p->translate(shadowSize.width(), shadowSize.height());
-        p->setPen(QColor(shadowColor));
+        p->setPen(shadowColor);
         p->drawLine(p1, p2);
         p->restore();
     }
 
     int patWidth = 0;
     switch (style) {
-        case NoStroke:
-        case SolidStroke:
-            break;
-        case DottedStroke:
-            patWidth = (int)width;
-            break;
-        case DashedStroke:
-            patWidth = 3 * (int)width;
-            break;
+    case NoStroke:
+    case SolidStroke:
+        break;
+    case DottedStroke:
+        patWidth = static_cast<int>(width);
+        break;
+    case DashedStroke:
+        patWidth = 3 * static_cast<int>(width);
+        break;
     }
 
     if (patWidth) {
@@ -523,7 +502,7 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         if (patWidth == 1)
             patternOffset = 1.0f;
         else {
-            bool evenNumberOfSegments = numSegments % 2 == 0;
+            bool evenNumberOfSegments = !(numSegments % 2);
             if (remainder)
                 evenNumberOfSegments = !evenNumberOfSegments;
             if (evenNumberOfSegments) {
@@ -571,11 +550,25 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     if (paintingDisabled() || strokeStyle() == NoStroke || strokeThickness() <= 0.0f || !strokeColor().alpha())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
 
-    p->drawArc(rect, startAngle * 16, angleSpan * 16);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    startAngle *= 16;
+    angleSpan *= 16;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        QPen pen(p->pen());
+        pen.setColor(shadowColor);
+        p->setPen(pen);
+        p->drawArc(rect, startAngle, angleSpan);
+        p->restore();
+    }
+    p->drawArc(rect, startAngle, angleSpan);
 
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
@@ -593,9 +586,25 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     for (size_t i = 0; i < npoints; i++)
         polygon[i] = points[i];
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->setRenderHint(QPainter::Antialiasing, shouldAntialias);
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->save();
+        p->translate(shadowSize.width(), shadowSize.height());
+        if (p->brush().style() != Qt::NoBrush)
+            p->setBrush(QBrush(shadowColor));
+        QPen pen(p->pen());
+        if (pen.style() != Qt::NoPen) {
+            pen.setColor(shadowColor);
+            p->setPen(pen);
+        }
+        p->drawConvexPolygon(polygon);
+        p->restore();
+    }
     p->drawConvexPolygon(polygon);
     p->restore();
 }
@@ -605,34 +614,50 @@ QPen GraphicsContext::pen()
     if (paintingDisabled())
         return QPen();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     return p->pen();
 }
 
+static void inline drawFilledShadowPath(GraphicsContext* context, QPainter* p, const QPainterPath *path)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        p->translate(shadowSize.width(), shadowSize.height());
+        p->fillPath(*path, QBrush(shadowColor));
+        p->translate(-shadowSize.width(), -shadowSize.height());
+    }
+}
+
 void GraphicsContext::fillPath()
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillPath(path, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillPath(path, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawFilledShadowPath(this, p, &path);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillPath(path, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillPath(path, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillPath(path, brush);
+            break;
+        }
     }
     m_data->currentPath = QPainterPath();
 }
@@ -642,59 +667,88 @@ void GraphicsContext::strokePath()
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QPen pen = p->pen();
+    QPainter* p = m_data->p();
+    QPen pen(p->pen());
     QPainterPath path = m_data->currentPath;
     path.setFillRule(toQtFillRule(fillRule()));
 
-    switch (m_common->state.strokeColorSpace) {
-    case SolidColorSpace:
-        if (strokeColor().alpha())
+    if ((m_common->state.strokeColorSpace != SolidColorSpace)
+            || (strokeColor().alpha())) {
+        IntSize shadowSize;
+        int shadowBlur;
+        Color shadowColor;
+        if (getShadow(shadowSize, shadowBlur, shadowColor)) {
+            QTransform t(p->worldTransform());
+            p->translate(shadowSize.width(), shadowSize.height());
+            QPen shadowPen(pen);
+            shadowPen.setColor(shadowColor);
+            p->strokePath(path, shadowPen);
+            p->setWorldTransform(t);
+        }
+        switch (m_common->state.strokeColorSpace) {
+        case SolidColorSpace:
+            if (strokeColor().alpha())
+                p->strokePath(path, pen);
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
+            p->setPen(pen);
             p->strokePath(path, pen);
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        pen.setBrush(QBrush(m_common->state.strokePattern->createPlatformPattern(affine)));
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
-    case GradientColorSpace: {
-        QBrush brush(*m_common->state.strokeGradient->platformGradient());
-        brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
-        pen.setBrush(brush);
-        p->setPen(pen);
-        p->strokePath(path, pen);
-        break;
-    }
+            break;
+        }
+        case GradientColorSpace: {
+            QBrush brush(*m_common->state.strokeGradient->platformGradient());
+            brush.setTransform(m_common->state.strokeGradient->gradientSpaceTransform());
+            pen.setBrush(brush);
+            p->setPen(pen);
+            p->strokePath(path, pen);
+            break;
+        }
+        }
     }
     m_data->currentPath = QPainterPath();
 }
 
+static inline void drawBorderlessRectShadow(GraphicsContext* context, QPainter* p, const FloatRect& rect)
+{
+    IntSize shadowSize;
+    int shadowBlur;
+    Color shadowColor;
+    if (context->getShadow(shadowSize, shadowBlur, shadowColor)) {
+        FloatRect shadowRect(rect);
+        shadowRect.move(shadowSize.width(), shadowSize.height());
+        p->fillRect(shadowRect, QColor(shadowColor));
+    }
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect)
 {
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
-    switch (m_common->state.fillColorSpace) {
-    case SolidColorSpace:
-        if (fillColor().alpha())
-            p->fillRect(rect, p->brush());
-        break;
-    case PatternColorSpace: {
-        TransformationMatrix affine;
-        p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
-        break;
-    }
-    case GradientColorSpace:
-        QBrush brush(*m_common->state.fillGradient->platformGradient());
-        brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
-        p->fillRect(rect, brush);
-        break;
+    if ((m_common->state.fillColorSpace != SolidColorSpace)
+            || (fillColor().alpha())) {
+        drawBorderlessRectShadow(this, p, rect);
+        switch (m_common->state.fillColorSpace) {
+        case SolidColorSpace:
+            if (fillColor().alpha())
+                p->fillRect(rect, p->brush());
+            break;
+        case PatternColorSpace: {
+            TransformationMatrix affine;
+            p->fillRect(rect, QBrush(m_common->state.fillPattern->createPlatformPattern(affine)));
+            break;
+        }
+        case GradientColorSpace:
+            QBrush brush(*m_common->state.fillGradient->platformGradient());
+            brush.setTransform(m_common->state.fillGradient->gradientSpaceTransform());
+            p->fillRect(rect, brush);
+            break;
+        }
     }
-    m_data->currentPath = QPainterPath();
 }
 
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
@@ -702,8 +756,10 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& c)
     if (paintingDisabled())
         return;
 
-    m_data->solidColor.setColor(QColor(c));
-    m_data->p()->fillRect(rect, m_data->solidColor);
+    m_data->solidColor.setColor(c);
+    QPainter* p = m_data->p();
+    drawBorderlessRectShadow(this, p, rect);
+    p->fillRect(rect, m_data->solidColor);
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color)
@@ -712,7 +768,9 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
         return;
 
     Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
-    m_data->p()->fillPath(*path.platformPath(), QColor(color));
+    QPainter* p = m_data->p();
+    drawFilledShadowPath(this, p, path.platformPath());
+    p->fillPath(*path.platformPath(), QColor(color));
 }
 
 void GraphicsContext::beginPath()
@@ -750,7 +808,7 @@ void GraphicsContext::clipPath(WindRule clipRule)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainterPath newPath = m_data->currentPath;
     newPath.setFillRule(clipRule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
     p->setClipPath(newPath);
@@ -769,10 +827,10 @@ void GraphicsContext::drawFocusRing(const Color& color)
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
 
-    if (rects.size() == 0)
+    if (!rects.size())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, m_data->antiAliasingForRectsAndLines);
 
@@ -793,7 +851,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
     QPainterPath newPath = stroker.createStroke(path);
     p->strokePath(newPath, nPen);
 #else
-    for (int i = 0; i < rectCount; ++i)
+    for (unsigned i = 0; i < rectCount; ++i)
         p->drawRect(QRectF(rects[i]));
 #endif
     p->setPen(oldPen);
@@ -802,7 +860,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
     p->setRenderHint(QPainter::Antialiasing, antiAlias);
 }
 
-void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool printing)
+void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool)
 {
     if (paintingDisabled())
         return;
@@ -811,8 +869,7 @@ void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool pr
     drawLine(origin, endPoint);
 }
 
-void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&,
-                                                         int width, bool grammar)
+void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint&, int, bool)
 {
     if (paintingDisabled())
         return;
@@ -829,10 +886,16 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& frect)
     return FloatRect(QRectF(result));
 }
 
-void GraphicsContext::setPlatformShadow(const IntSize& pos, int blur, const Color &color)
+void GraphicsContext::setPlatformShadow(const IntSize& size, int, const Color&)
 {
     // Qt doesn't support shadows natively, they are drawn manually in the draw*
     // functions
+
+    if (m_common->state.shadowsIgnoreTransforms) {
+        // Meaning that this graphics context is associated with a CanvasRenderingContext
+        // We flip the height since CG and HTML5 Canvas have opposite Y axis
+        m_common->state.shadowSize = IntSize(size.width(), -size.height());
+    }
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -848,8 +911,8 @@ void GraphicsContext::beginTransparencyLayer(float opacity)
 
     int x, y, w, h;
     x = y = 0;
-    QPainter *p = m_data->p();
-    const QPaintDevice *device = p->device();
+    QPainter* p = m_data->p();
+    const QPaintDevice* device = p->device();
     w = device->width();
     h = device->height();
 
@@ -871,10 +934,10 @@ void GraphicsContext::endTransparencyLayer()
     if (paintingDisabled())
         return;
 
-    TransparencyLayer *layer = m_data->layers.pop();
+    TransparencyLayer* layer = m_data->layers.pop();
     layer->painter.end();
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->save();
     p->resetTransform();
     p->setOpacity(layer->opacity);
@@ -889,7 +952,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPainter::CompositionMode currentCompositionMode = p->compositionMode();
     if (p->paintEngine()->hasFeature(QPaintEngine::PorterDuff))
         p->setCompositionMode(QPainter::CompositionMode_Source);
@@ -916,7 +979,7 @@ void GraphicsContext::setLineCap(LineCap lc)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setCapStyle(toQtLineCap(lc));
     p->setPen(nPen);
@@ -948,7 +1011,7 @@ void GraphicsContext::setLineJoin(LineJoin lj)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setJoinStyle(toQtLineJoin(lj));
     p->setPen(nPen);
@@ -959,7 +1022,7 @@ void GraphicsContext::setMiterLimit(float limit)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen nPen = p->pen();
     nPen.setMiterLimit(limit);
     p->setPen(nPen);
@@ -969,7 +1032,7 @@ void GraphicsContext::setAlpha(float opacity)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     p->setOpacity(opacity);
 }
 
@@ -995,15 +1058,19 @@ void GraphicsContext::clipOut(const Path& path)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath clippedOut = *path.platformPath();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addPath(clippedOut);
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addPath(clippedOut);
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        newClip.addRect(p->window());
+        newClip.addPath(clippedOut & newClip);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::translate(float x, float y)
@@ -1061,14 +1128,21 @@ void GraphicsContext::clipOut(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addRect(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addRect(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addRect(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
@@ -1076,14 +1150,21 @@ void GraphicsContext::clipOutEllipseInRect(const IntRect& rect)
     if (paintingDisabled())
         return;
 
-    QPainter *p = m_data->p();
-    QRectF clipBounds = p->clipPath().boundingRect();
+    QPainter* p = m_data->p();
     QPainterPath newClip;
     newClip.setFillRule(Qt::OddEvenFill);
-    newClip.addRect(clipBounds);
-    newClip.addEllipse(QRect(rect));
-
-    p->setClipPath(newClip, Qt::IntersectClip);
+    if (p->hasClipping()) {
+        newClip.addRect(p->clipPath().boundingRect());
+        newClip.addEllipse(QRect(rect));
+        p->setClipPath(newClip, Qt::IntersectClip);
+    } else {
+        QRect clipOutRect(rect);
+        QRect window(p->window());
+        clipOutRect &= window;
+        newClip.addRect(window);
+        newClip.addEllipse(clipOutRect);
+        p->setClipPath(newClip);
+    }
 }
 
 void GraphicsContext::clipToImageBuffer(const FloatRect&, const ImageBuffer*)
@@ -1109,7 +1190,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect,
 
     path.setFillRule(Qt::OddEvenFill);
 
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
 
     const bool antiAlias = p->testRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::Antialiasing, true);
@@ -1134,7 +1215,7 @@ void GraphicsContext::concatCTM(const TransformationMatrix& transform)
     }
 }
 
-void GraphicsContext::setURLForRect(const KURL& link, const IntRect& destRect)
+void GraphicsContext::setURLForRect(const KURL&, const IntRect&)
 {
     notImplemented();
 }
@@ -1143,7 +1224,7 @@ void GraphicsContext::setPlatformStrokeColor(const Color& color)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setColor(color);
     p->setPen(newPen);
@@ -1153,7 +1234,7 @@ void GraphicsContext::setPlatformStrokeStyle(const StrokeStyle& strokeStyle)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setStyle(toQPenStyle(strokeStyle));
     p->setPen(newPen);
@@ -1163,7 +1244,7 @@ void GraphicsContext::setPlatformStrokeThickness(float thickness)
 {
     if (paintingDisabled())
         return;
-    QPainter *p = m_data->p();
+    QPainter* p = m_data->p();
     QPen newPen(p->pen());
     newPen.setWidthF(thickness);
     p->setPen(newPen);
@@ -1184,7 +1265,6 @@ void GraphicsContext::setPlatformShouldAntialias(bool enable)
 }
 
 #ifdef Q_WS_WIN
-#include <windows.h>
 
 HDC GraphicsContext::getWindowsContext(const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
diff --git a/WebCore/platform/graphics/qt/IconQt.cpp b/WebCore/platform/graphics/qt/IconQt.cpp
index 34c3c47..98f4606 100644
--- a/WebCore/platform/graphics/qt/IconQt.cpp
+++ b/WebCore/platform/graphics/qt/IconQt.cpp
@@ -47,7 +47,7 @@ PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
     return i.release();
 }
 
-PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>&)
 {
     //FIXME: Implement this
     return 0;
diff --git a/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 22a5a43..5255428 100644
--- a/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -68,7 +68,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     painter->setCompositionMode(QPainter::CompositionMode_SourceOver);
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -125,12 +125,13 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
         m_data.m_painter->begin(&m_data.m_pixmap);
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& imageData, const IntSize& size)
 {
     PassRefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
-    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > m_size.width() || (rect.y() + rect.height()) > m_size.height())
+    if (rect.x() < 0 || rect.y() < 0 || (rect.x() + rect.width()) > size.width() || (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originx = rect.x();
@@ -140,8 +141,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originx = 0;
     }
     int endx = rect.x() + rect.width();
-    if (endx > m_size.width())
-        endx = m_size.width();
+    if (endx > size.width())
+        endx = size.width();
     int numColumns = endx - originx;
 
     int originy = rect.y();
@@ -151,11 +152,16 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originy = 0;
     }
     int endy = rect.y() + rect.height();
-    if (endy > m_size.height())
-        endy = m_size.height();
+    if (endy > size.height())
+        endy = size.height();
     int numRows = endy - originy;
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = imageData.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
+
     ASSERT(!image.isNull());
 
     unsigned destBytesPerRow = 4 * rect.width();
@@ -176,7 +182,18 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, m_data, m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, m_data, m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, ImageBufferData& data, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -184,49 +201,65 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect, con
     int originx = sourceRect.x();
     int destx = destPoint.x() + sourceRect.x();
     ASSERT(destx >= 0);
-    ASSERT(destx < m_size.width());
+    ASSERT(destx < size.width());
     ASSERT(originx >= 0);
     ASSERT(originx <= sourceRect.right());
 
     int endx = destPoint.x() + sourceRect.right();
-    ASSERT(endx <= m_size.width());
+    ASSERT(endx <= size.width());
 
     int numColumns = endx - destx;
 
     int originy = sourceRect.y();
     int desty = destPoint.y() + sourceRect.y();
     ASSERT(desty >= 0);
-    ASSERT(desty < m_size.height());
+    ASSERT(desty < size.height());
     ASSERT(originy >= 0);
     ASSERT(originy <= sourceRect.bottom());
 
     int endy = destPoint.y() + sourceRect.bottom();
-    ASSERT(endy <= m_size.height());
+    ASSERT(endy <= size.height());
     int numRows = endy - desty;
 
     unsigned srcBytesPerRow = 4 * source->width();
 
-    bool isPainting = m_data.m_painter->isActive();
+    bool isPainting = data.m_painter->isActive();
     if (isPainting)
-        m_data.m_painter->end();
+        data.m_painter->end();
 
-    QImage image = m_data.m_pixmap.toImage().convertToFormat(QImage::Format_ARGB32);
+    QImage image = data.m_pixmap.toImage();
+    if (multiplied == Unmultiplied)
+        image = image.convertToFormat(QImage::Format_ARGB32);
+    else
+        image = image.convertToFormat(QImage::Format_ARGB32_Premultiplied);
 
     unsigned char* srcRows = source->data()->data()->data() + originy * srcBytesPerRow + originx * 4;
     for (int y = 0; y < numRows; ++y) {
         quint32* scanLine = reinterpret_cast<quint32*>(image.scanLine(y + desty));
         for (int x = 0; x < numColumns; x++) {
-            int basex = x * 4;
-            scanLine[x + destx] = reinterpret_cast<quint32*>(srcRows + basex)[0];
+            // ImageData stores the pixels in RGBA while QImage is ARGB
+            quint32 pixel = reinterpret_cast<quint32*>(srcRows + 4 * x)[0];
+            pixel = ((pixel << 16) & 0xff0000) | ((pixel >> 16) & 0xff) | (pixel & 0xff00ff00);
+            scanLine[x + destx] = pixel;
         }
 
         srcRows += srcBytesPerRow;
     }
 
-    m_data.m_pixmap = QPixmap::fromImage(image);
+    data.m_pixmap = QPixmap::fromImage(image);
 
     if (isPainting)
-        m_data.m_painter->begin(&m_data.m_pixmap);
+        data.m_painter->begin(&data.m_pixmap);
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, m_data, m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, m_data, m_size);
 }
 
 // We get a mimeType here but QImageWriter does not support mimetypes but
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
index 7bbdcc0..3a27fe3 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.cpp
@@ -35,150 +35,9 @@
 #include <QtGui/QImageReader>
 #include <qdebug.h>
 
-namespace {
-    const  QImage::Format DesiredFormat = QImage::Format_ARGB32;
-    const  bool debugImageDecoderQt = false;
-}
-
 namespace WebCore {
-ImageDecoderQt::ImageData::ImageData(const QImage& image, ImageState imageState, int duration) :
-    m_image(image), m_imageState(imageState), m_duration(duration)
-{
-}
-
-// Context, maintains IODevice on a data buffer.
-class ImageDecoderQt::ReadContext {
-public:
-
-    enum LoadMode {
-        // Load images incrementally. This is still experimental and
-        // will cause the image plugins to report errors.
-        // Also note that as of Qt 4.2.2, the JPEG loader does not return error codes
-        // on "preliminary end of data".
-        LoadIncrementally,
-            // Load images only if  all data have been received
-            LoadComplete };
-
-    ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target);
-
-    enum ReadResult { ReadEOF, ReadFailed, ReadPartial, ReadComplete };
-
-    // Append data and read out all images. Returns the result
-    // of the last read operation, so, even if  ReadPartial is returned,
-    // a few images might have been read.
-    ReadResult read(bool allDataReceived);
-
-    QImageReader *reader() { return &m_reader; }
 
-private:
-    enum IncrementalReadResult { IncrementalReadFailed, IncrementalReadPartial, IncrementalReadComplete };
-    // Incrementally read an image
-    IncrementalReadResult readImageLines(ImageData &);
-
-    const LoadMode m_loadMode;
-
-    QByteArray m_data;
-    QBuffer m_buffer;
-    QImageReader m_reader;
-
-    ImageList &m_target;
-
-    // Detected data format of the stream
-    enum QImage::Format m_dataFormat;
-    QSize m_size;
-
-};
-
-ImageDecoderQt::ReadContext::ReadContext(const IncomingData & data, LoadMode loadMode, ImageList &target)
-    : m_loadMode(loadMode)
-    , m_data(data.data(), data.size())
-    , m_buffer(&m_data)
-    , m_reader(&m_buffer)
-    , m_target(target)
-    , m_dataFormat(QImage::Format_Invalid)
-{
-    m_buffer.open(QIODevice::ReadOnly);
-}
-
-
-ImageDecoderQt::ReadContext::ReadResult
-        ImageDecoderQt::ReadContext::read(bool allDataReceived)
-{
-    // Complete mode: Read only all all data received
-    if (m_loadMode == LoadComplete && !allDataReceived)
-        return ReadPartial;
-
-    // Attempt to read out all images
-    while (true) {
-        if (m_target.empty() || m_target.back().m_imageState == ImageComplete) {
-            // Start a new image.
-            if (!m_reader.canRead())
-                return ReadEOF;
-
-            // Attempt to construct an empty image of the matching size and format
-            // for efficient reading
-            QImage newImage = m_dataFormat != QImage::Format_Invalid  ?
-                          QImage(m_size, m_dataFormat) : QImage();
-            m_target.push_back(ImageData(newImage));
-        }
-
-        // read chunks
-        switch (readImageLines(m_target.back())) {
-        case IncrementalReadFailed:
-            m_target.pop_back();
-            return ReadFailed;
-        case IncrementalReadPartial:
-            return ReadPartial;
-        case IncrementalReadComplete:
-            m_target.back().m_imageState = ImageComplete;
-            //store for next
-            m_dataFormat = m_target.back().m_image.format();
-            m_size = m_target.back().m_image.size();
-            const bool supportsAnimation = m_reader.supportsAnimation();
-
-            if (debugImageDecoderQt)
-                qDebug() << "readImage(): #" << m_target.size() << " complete, " << m_size
-                    << " format " << m_dataFormat <<  " supportsAnimation=" <<  supportsAnimation;
-            // No point in readinfg further
-            if (!supportsAnimation)
-                return ReadComplete;
-
-            break;
-        }
-    }
-    return ReadComplete;
-}
-
-
-
-ImageDecoderQt::ReadContext::IncrementalReadResult
-        ImageDecoderQt::ReadContext::readImageLines(ImageData &imageData)
-{
-    // TODO: Implement incremental reading here,
-    // set state to reflect complete header, etc.
-    // For now, we read the whole image.
-
-    const qint64 startPos = m_buffer.pos();
-    // Oops, failed. Rewind.
-    if (!m_reader.read(&imageData.m_image)) {
-        m_buffer.seek(startPos);
-        const bool gotHeader = imageData.m_image.size().width();
-
-        if (debugImageDecoderQt)
-            qDebug() << "readImageLines(): read() failed: " << m_reader.errorString()
-                << " got header=" << gotHeader;
-        // [Experimental] Did we manage to read the header?
-        if (gotHeader) {
-            imageData.m_imageState = ImageHeaderValid;
-            return IncrementalReadPartial;
-        }
-        return IncrementalReadFailed;
-    }
-    imageData.m_duration = m_reader.nextImageDelay();
-    return IncrementalReadComplete;
-}
-
-ImageDecoderQt* ImageDecoderQt::create(const SharedBuffer& data)
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
 {
     // We need at least 4 bytes to figure out what kind of image we're dealing with.
     if (data.size() < 4)
@@ -189,149 +48,196 @@ ImageDecoderQt* ImageDecoderQt::create(const SharedBuffer& data)
     if (!buffer.open(QBuffer::ReadOnly))
         return 0;
 
-    QString imageFormat = QString::fromLatin1(QImageReader::imageFormat(&buffer).toLower());
+    QByteArray imageFormat = QImageReader::imageFormat(&buffer);
     if (imageFormat.isEmpty())
         return 0; // Image format not supported
 
     return new ImageDecoderQt(imageFormat);
 }
 
-ImageDecoderQt::ImageDecoderQt(const QString &imageFormat)
-    : m_hasAlphaChannel(false)
-    , m_imageFormat(imageFormat)
+ImageDecoderQt::ImageDecoderQt(const QByteArray& imageFormat)
+    : m_buffer(0)
+    , m_reader(0)
+    , m_repetitionCount(-1)
 {
 }
 
 ImageDecoderQt::~ImageDecoderQt()
 {
+    delete m_reader;
+    delete m_buffer;
 }
 
-bool ImageDecoderQt::hasFirstImageHeader() const
+void ImageDecoderQt::setData(SharedBuffer* data, bool allDataReceived)
 {
-    return  !m_imageList.empty() && m_imageList[0].m_imageState >= ImageHeaderValid;
-}
+    if (m_failed)
+        return;
 
-void ImageDecoderQt::reset()
-{
-    m_hasAlphaChannel = false;
-    m_failed = false;
-    m_imageList.clear();
-    m_pixmapCache.clear();
-    m_loopCount = cAnimationNone;
-}
+    // Cache our own new data.
+    ImageDecoder::setData(data, allDataReceived);
 
-void ImageDecoderQt::setData(const IncomingData &data, bool allDataReceived)
-{
-    reset();
-    ReadContext readContext(data, ReadContext::LoadComplete, m_imageList);
-
-    if (debugImageDecoderQt)
-        qDebug() << " setData " << data.size() << " image bytes, complete=" << allDataReceived;
-
-    const  ReadContext::ReadResult readResult =  readContext.read(allDataReceived);
-
-    if (hasFirstImageHeader())
-        m_hasAlphaChannel = m_imageList[0].m_image.hasAlphaChannel();
-
-    if (debugImageDecoderQt)
-        qDebug()  << " read returns " << readResult;
-
-    switch (readResult) {
-    case ReadContext::ReadFailed:
-        m_failed = true;
-        break;
-    case ReadContext::ReadEOF:
-    case ReadContext::ReadPartial:
-    case ReadContext::ReadComplete:
-        // Did we read anything - try to set the size.
-        if (hasFirstImageHeader()) {
-            QSize imgSize = m_imageList[0].m_image.size();
-            setSize(imgSize.width(), imgSize.height());
-
-            if (readContext.reader()->supportsAnimation()) {
-                if (readContext.reader()->loopCount() != -1)
-                    m_loopCount = readContext.reader()->loopCount();
-                else
-                    m_loopCount = 0; //loop forever
-            }
-        }
-        break;
-    }
-}
+    // No progressive loading possible
+    if (!allDataReceived)
+        return;
+
+    // We expect to be only called once with allDataReceived
+    ASSERT(!m_buffer);
+    ASSERT(!m_reader);
 
+    // Attempt to load the data
+    QByteArray imageData = QByteArray::fromRawData(m_data->data(), m_data->size());
+    m_buffer = new QBuffer;
+    m_buffer->setData(imageData);
+    m_buffer->open(QBuffer::ReadOnly);
+    m_reader = new QImageReader(m_buffer);
+
+    if (!m_reader->canRead())
+        failRead();
+}
 
 bool ImageDecoderQt::isSizeAvailable()
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::isSizeAvailable() returns" << ImageDecoder::isSizeAvailable();
+    if (!m_failed && !ImageDecoder::isSizeAvailable() && m_reader)
+        internalDecodeSize();
+
     return ImageDecoder::isSizeAvailable();
 }
 
-size_t ImageDecoderQt::frameCount() const
+size_t ImageDecoderQt::frameCount()
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::frameCount() returns" << m_imageList.size();
-    return m_imageList.size();
+    if (m_frameBufferCache.isEmpty() && m_reader) {
+        if (m_reader->supportsAnimation()) {
+            int imageCount = m_reader->imageCount();
+
+            // Fixup for Qt decoders... imageCount() is wrong
+            // and jumpToNextImage does not work either... so
+            // we will have to parse everything...
+            if (imageCount == 0)
+                forceLoadEverything();
+            else
+                m_frameBufferCache.resize(imageCount);
+        } else {
+            m_frameBufferCache.resize(1);
+        }
+    }
+
+    return m_frameBufferCache.size();
 }
 
 int ImageDecoderQt::repetitionCount() const
 {
-    if (debugImageDecoderQt)
-        qDebug() << " ImageDecoderQt::repetitionCount() returns" << m_loopCount;
-    return m_loopCount;
+    if (m_reader && m_reader->supportsAnimation())
+        m_repetitionCount = qMax(0, m_reader->loopCount());
+
+    return m_repetitionCount;
 }
 
-bool ImageDecoderQt::supportsAlpha() const
+String ImageDecoderQt::filenameExtension() const
 {
-    return m_hasAlphaChannel;
-}
+    return m_format;
+};
 
-int ImageDecoderQt::duration(size_t index) const
+RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
 {
-    if (index >= m_imageList.size())
+    // this information might not have been set
+    int count = m_frameBufferCache.size();
+    if (count == 0) {
+        internalDecodeSize();
+        count = frameCount();
+    }
+
+    if (index >= static_cast<size_t>(count))
         return 0;
-    return  m_imageList[index].m_duration;
+
+    RGBA32Buffer& frame = m_frameBufferCache[index];
+    if (frame.status() != RGBA32Buffer::FrameComplete && m_reader)
+        internalReadImage(index);
+    return &frame;
 }
 
-String ImageDecoderQt::filenameExtension() const
+void ImageDecoderQt::clearFrameBufferCache(size_t index)
 {
-    if (debugImageDecoderQt)
-           qDebug() << " ImageDecoderQt::filenameExtension() returns" << m_imageFormat;
-    return m_imageFormat;
-};
+    // Currently QImageReader will be asked to read everything. This
+    // might change when we read gif images on demand. For now we
+    // can have a rather simple implementation.
+    if (index > m_frameBufferCache.size())
+        return;
 
-RGBA32Buffer* ImageDecoderQt::frameBufferAtIndex(size_t index)
+    for (size_t i = 0; i < index; ++index)
+        m_frameBufferCache[index].clear();
+}
+
+void ImageDecoderQt::internalDecodeSize()
 {
-    Q_ASSERT("use imageAtIndex instead");
-    return 0;
+    ASSERT(m_reader);
+
+    QSize size = m_reader->size();
+    setSize(size.width(), size.height());
 }
 
-QPixmap* ImageDecoderQt::imageAtIndex(size_t index) const
+void ImageDecoderQt::internalReadImage(size_t frameIndex)
 {
-    if (debugImageDecoderQt)
-        qDebug() << "ImageDecoderQt::imageAtIndex(" << index << ')';
+    ASSERT(m_reader);
 
-    if (index >= m_imageList.size())
-        return 0;
+    if (m_reader->supportsAnimation())
+        m_reader->jumpToImage(frameIndex);
+    else if (frameIndex != 0)
+        return failRead();
 
-    if (!m_pixmapCache.contains(index)) {
-        m_pixmapCache.insert(index,
-                             QPixmap::fromImage(m_imageList[index].m_image));
+    internalHandleCurrentImage(frameIndex);
 
-        // store null image since the converted pixmap is already in pixmap cache
-        Q_ASSERT(m_imageList[index].m_imageState == ImageComplete);
-        m_imageList[index].m_image = QImage();
-    }
-    return  &m_pixmapCache[index];
+    // Attempt to return some memory
+    for (int i = 0; i < m_frameBufferCache.size(); ++i)
+        if (m_frameBufferCache[i].status() != RGBA32Buffer::FrameComplete)
+            return;
+
+    delete m_reader;
+    delete m_buffer;
+    m_buffer = 0;
+    m_reader = 0;
 }
 
-void ImageDecoderQt::clearFrame(size_t index)
+void ImageDecoderQt::internalHandleCurrentImage(size_t frameIndex)
 {
-    if (m_imageList.size() < (int)index)
-        m_imageList[index].m_image = QImage();
-    m_pixmapCache.take(index);
+    // Now get the QImage from Qt and place it in the RGBA32Buffer
+    QImage img;
+    if (!m_reader->read(&img))
+        return failRead();
+
+    // now into the RGBA32Buffer - even if the image is not
+    QSize imageSize = img.size();
+    RGBA32Buffer* const buffer = &m_frameBufferCache[frameIndex];
+    buffer->setRect(m_reader->currentImageRect());
+    buffer->setStatus(RGBA32Buffer::FrameComplete);
+    buffer->setDuration(m_reader->nextImageDelay());
+    buffer->setDecodedImage(img);
 }
 
+// We will parse everything and we have no idea how
+// many images we have... We will have to find out the
+// hard way.
+void ImageDecoderQt::forceLoadEverything()
+{
+    int imageCount = 0;
+
+    do {
+        m_frameBufferCache.resize(++imageCount);
+        internalHandleCurrentImage(imageCount - 1);
+    } while(!m_failed);
+
+    // reset the failed state and resize the vector...
+    m_frameBufferCache.resize(imageCount - 1);
+    m_failed = false;
+}
+
+void ImageDecoderQt::failRead()
+{
+    setFailed();
+    delete m_reader;
+    delete m_buffer;
+    m_reader = 0;
+    m_buffer = 0;
+}
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/graphics/qt/ImageDecoderQt.h b/WebCore/platform/graphics/qt/ImageDecoderQt.h
index fc52479..7b3b686 100644
--- a/WebCore/platform/graphics/qt/ImageDecoderQt.h
+++ b/WebCore/platform/graphics/qt/ImageDecoderQt.h
@@ -28,10 +28,11 @@
 #define ImageDecoderQt_h
 
 #include "ImageDecoder.h"
-#include <QtGui/QImage>
+#include <QtGui/QImageReader>
 #include <QtGui/QPixmap>
 #include <QtCore/QList>
 #include <QtCore/QHash>
+#include <QtCore/QBuffer>
 
 namespace WebCore {
 
@@ -39,54 +40,35 @@ namespace WebCore {
 class ImageDecoderQt : public ImageDecoder
 {
 public:
-    static ImageDecoderQt* create(const SharedBuffer& data);
+    ImageDecoderQt(const QByteArray& imageFormat);
     ~ImageDecoderQt();
 
-    typedef Vector<char> IncomingData;
-
-    virtual void setData(const IncomingData& data, bool allDataReceived);
+    virtual void setData(SharedBuffer* data, bool allDataReceived);
     virtual bool isSizeAvailable();
-    virtual size_t frameCount() const;
+    virtual size_t frameCount();
     virtual int repetitionCount() const;
     virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
 
-    QPixmap* imageAtIndex(size_t index) const;
-    virtual bool supportsAlpha() const;
-    int duration(size_t index) const;
     virtual String filenameExtension() const;
 
-    void clearFrame(size_t index);
+    virtual void clearFrameBufferCache(size_t clearBeforeFrame);
 
 private:
-    ImageDecoderQt(const QString &imageFormat);
     ImageDecoderQt(const ImageDecoderQt&);
     ImageDecoderQt &operator=(const ImageDecoderQt&);
 
-    class ReadContext;
-    void reset();
-    bool hasFirstImageHeader() const;
-
-    enum ImageState {
-        // Started image reading
-        ImagePartial,
-            // Header (size / alpha) are known
-            ImageHeaderValid,
-            // Image is complete
-            ImageComplete };
-
-    struct ImageData {
-        ImageData(const QImage& image, ImageState imageState = ImagePartial, int duration=0);
-        QImage m_image;
-        ImageState m_imageState;
-        int m_duration;
-    };
-
-    bool m_hasAlphaChannel;
-    typedef QList<ImageData> ImageList;
-    mutable ImageList m_imageList;
-    mutable QHash<int, QPixmap> m_pixmapCache;
-    int m_loopCount;
-    QString m_imageFormat;
+private:
+    void internalDecodeSize();
+    void internalReadImage(size_t);
+    void internalHandleCurrentImage(size_t);
+    void forceLoadEverything();
+    void failRead();
+
+private:
+    String m_format;
+    QBuffer* m_buffer;
+    QImageReader* m_reader;
+    mutable int m_repetitionCount;
 };
 
 
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index 5d40e26..da6ddac 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -76,6 +76,7 @@ bool FrameData::clear(bool clearMetadata)
         m_haveMetadata = false;
 
     if (m_frame) {
+        delete m_frame;
         m_frame = 0;
         return true;
     }
diff --git a/WebCore/platform/graphics/qt/ImageSourceQt.cpp b/WebCore/platform/graphics/qt/ImageSourceQt.cpp
deleted file mode 100644
index 8ae449c..0000000
--- a/WebCore/platform/graphics/qt/ImageSourceQt.cpp
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved. 
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ImageSource.h"
-#include "ImageDecoderQt.h"
-#include "SharedBuffer.h"
-
-#include <QBuffer>
-#include <QImage>
-#include <QImageReader>
-
-namespace WebCore {
-
-ImageSource::ImageSource()
-    : m_decoder(0)
-{
-}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (!m_decoder)
-        m_decoder = ImageDecoderQt::create(*data);
-
-    if (!m_decoder)
-        return;
-
-    m_decoder->setData(data->buffer(), allDataReceived);
-}
-
-String ImageSource::filenameExtension() const
-{
-    if (!m_decoder)
-        return String();
-
-    return m_decoder->filenameExtension();
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-size_t ImageSource::frameCount() const
-{
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->frameCount();
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    return m_decoder->imageAtIndex(index);
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = m_decoder->duration(index) / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    const QPixmap* source = m_decoder->imageAtIndex(index);
-    if (!source)
-        return false;
-
-    return source->hasAlphaChannel();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    return (m_decoder && m_decoder->imageAtIndex(index));
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-}
-
-// vim: ts=4 sw=4 et
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
index 76b1494..7078d16 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.cpp
@@ -27,6 +27,7 @@
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "NotImplemented.h"
+#include "TimeRanges.h"
 #include "Widget.h"
 #include <wtf/HashSet.h>
 
@@ -37,9 +38,9 @@
 #include <QUrl>
 #include <QEvent>
 
-#include <Phonon/AudioOutput>
-#include <Phonon/MediaObject>
-#include <Phonon/VideoWidget>
+#include <audiooutput.h>
+#include <mediaobject.h>
+#include <videowidget.h>
 
 using namespace Phonon;
 
@@ -146,7 +147,7 @@ void MediaPlayerPrivate::getSupportedTypes(HashSet<String>&)
     notImplemented();
 }
 
-MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String&, const String&)
 {
     // FIXME: do the real thing
     notImplemented();
@@ -160,6 +161,14 @@ bool MediaPlayerPrivate::hasVideo() const
     return hasVideo;
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    // FIXME: Phonon::MediaObject does not have such a hasAudio() function
+    bool hasAudio = true;
+    LOG(Media, "MediaPlayerPrivatePhonon::hasAudio() -> %s", hasAudio ? "true" : "false");
+    return hasAudio;
+}
+
 void MediaPlayerPrivate::load(const String& url)
 {
     LOG(Media, "MediaPlayerPrivatePhonon::load(\"%s\")", url.utf8().data());
@@ -247,15 +256,15 @@ float MediaPlayerPrivate::currentTime() const
     return currentTime;
 }
 
-void MediaPlayerPrivate::setEndTime(float endTime)
+void MediaPlayerPrivate::setEndTime(float)
 {
     notImplemented();
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
     notImplemented();
-    return 0.0f;
+    return TimeRanges::create();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
index 9572d61..e1193b6 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivatePhonon.h
@@ -80,6 +80,7 @@ namespace WebCore {
 
         IntSize naturalSize() const;
         bool hasVideo() const;
+        bool hasAudio() const;
 
         void load(const String &url);
         void cancelLoad();
@@ -104,7 +105,7 @@ namespace WebCore {
         MediaPlayer::NetworkState networkState() const;
         MediaPlayer::ReadyState readyState() const;
 
-        float maxTimeBuffered() const;
+        PassRefPtr<TimeRanges> buffered() const;
         float maxTimeSeekable() const;
         unsigned bytesLoaded() const;
         bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
index f823f84..f093d7d 100644
--- a/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
+++ b/WebCore/platform/graphics/qt/SimpleFontDataQt.cpp
@@ -33,7 +33,7 @@ void SimpleFontData::determinePitch()
     m_treatAsFixedPitch = m_platformData.font().fixedPitch();
 }
 
-bool SimpleFontData::containsCharacters(const UChar*, int length) const
+bool SimpleFontData::containsCharacters(const UChar*, int) const
 {
     return true;
 }
diff --git a/WebCore/platform/graphics/qt/StillImageQt.h b/WebCore/platform/graphics/qt/StillImageQt.h
index 2b2c1f7..6c417b1 100644
--- a/WebCore/platform/graphics/qt/StillImageQt.h
+++ b/WebCore/platform/graphics/qt/StillImageQt.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
         // FIXME: StillImages are underreporting decoded sizes and will be unable
         // to prune because these functions are not implemented yet.
-        virtual void destroyDecodedData(bool destroyAll = true) { }
+        virtual void destroyDecodedData(bool destroyAll = true) { Q_UNUSED(destroyAll); }
         virtual unsigned decodedSize() const { return 0; }
 
         virtual IntSize size() const;
diff --git a/WebCore/platform/graphics/skia/GradientSkia.cpp b/WebCore/platform/graphics/skia/GradientSkia.cpp
index 3bdddb2..268b17e 100644
--- a/WebCore/platform/graphics/skia/GradientSkia.cpp
+++ b/WebCore/platform/graphics/skia/GradientSkia.cpp
@@ -152,19 +152,21 @@ SkShader* Gradient::platformGradient()
     }
 
     if (m_radial) {
-        // FIXME: CSS radial Gradients allow an offset focal point (the
-        // "start circle"), but skia doesn't seem to support that, so this just
-        // ignores m_p0/m_r0 and draws the gradient centered in the "end
-        // circle" (m_p1/m_r1).
-        // See http://webkit.org/blog/175/introducing-css-gradients/ for a
-        // description of the expected behavior.
-        
-        // The radius we give to Skia must be positive (and non-zero).  If
-        // we're given a zero radius, just ask for a very small radius so
-        // Skia will still return an object.
-        SkScalar radius = m_r1 > 0 ? WebCoreFloatToSkScalar(m_r1) : SK_ScalarMin;
-        m_gradient = SkGradientShader::CreateRadial(m_p1,
-            radius, colors, pos, static_cast<int>(countUsed), tile);
+        // Since the two-point radial gradient is slower than the plain radial,
+        // only use it if we have to.
+        if (m_p0 != m_p1) {
+            // The radii we give to Skia must be positive.  If we're given a 
+            // negative radius, ask for zero instead.
+            SkScalar radius0 = m_r0 >= 0.0f ? WebCoreFloatToSkScalar(m_r0) : 0;
+            SkScalar radius1 = m_r1 >= 0.0f ? WebCoreFloatToSkScalar(m_r1) : 0;
+            m_gradient = SkGradientShader::CreateTwoPointRadial(m_p0, radius0, m_p1, radius1, colors, pos, static_cast<int>(countUsed), tile);
+        } else {
+            // The radius we give to Skia must be positive (and non-zero).  If
+            // we're given a zero radius, just ask for a very small radius so
+            // Skia will still return an object.
+            SkScalar radius = m_r1 > 0 ? WebCoreFloatToSkScalar(m_r1) : SK_ScalarMin;
+            m_gradient = SkGradientShader::CreateRadial(m_p1, radius, colors, pos, static_cast<int>(countUsed), tile);
+        }
     } else {
         SkPoint pts[2] = { m_p0, m_p1 };
         m_gradient = SkGradientShader::CreateLinear(pts, colors, pos,
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index bbb42c9..c9f1349 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -31,11 +31,11 @@
 #include "config.h"
 #include "GraphicsContext.h"
 
-#include "GraphicsContextPlatformPrivate.h"
-#include "GraphicsContextPrivate.h"
 #include "Color.h"
 #include "FloatRect.h"
 #include "Gradient.h"
+#include "GraphicsContextPlatformPrivate.h"
+#include "GraphicsContextPrivate.h"
 #include "ImageBuffer.h"
 #include "IntRect.h"
 #include "NativeImageSkia.h"
@@ -46,9 +46,9 @@
 #include "SkBitmap.h"
 #include "SkBlurDrawLooper.h"
 #include "SkCornerPathEffect.h"
-#include "skia/ext/platform_canvas.h"
-#include "SkiaUtils.h"
 #include "SkShader.h"
+#include "SkiaUtils.h"
+#include "skia/ext/platform_canvas.h"
 
 #include <math.h>
 #include <wtf/Assertions.h>
@@ -60,6 +60,23 @@ namespace WebCore {
 
 namespace {
 
+inline int fastMod(int value, int max)
+{
+    int sign = SkExtractSign(value);
+    
+    value = SkApplySign(value, sign);
+    if (value >= max)
+        value %= max;
+    return SkApplySign(value, sign);
+}
+
+inline float square(float n)
+{
+    return n * n;
+}
+
+}  // namespace
+
 // "Seatbelt" functions ------------------------------------------------------
 //
 // These functions check certain graphics primitives for being "safe".
@@ -195,23 +212,6 @@ void addCornerArc(SkPath* path, const SkRect& rect, const IntSize& size, int sta
     path->arcTo(r, SkIntToScalar(startAngle), SkIntToScalar(90), false);
 }
 
-inline int fastMod(int value, int max)
-{
-    int sign = SkExtractSign(value);
-
-    value = SkApplySign(value, sign);
-    if (value >= max)
-        value %= max;
-    return SkApplySign(value, sign);
-}
-
-inline float square(float n)
-{
-    return n * n;
-}
-
-}  // namespace
-
 // -----------------------------------------------------------------------------
 
 // This may be called with a NULL pointer to create a graphics context that has
@@ -293,7 +293,7 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     path.addOval(r, SkPath::kCW_Direction);
     // only perform the inset if we won't invert r
     if (2 * thickness < rect.width() && 2 * thickness < rect.height()) {
-        r.inset(SkIntToScalar(thickness) ,SkIntToScalar(thickness));
+        r.inset(SkIntToScalar(thickness), SkIntToScalar(thickness));
         path.addOval(r, SkPath::kCCW_Direction);
     }
     platformContext()->canvas()->clipPath(path);
@@ -403,6 +403,9 @@ void GraphicsContext::clipPath(WindRule clipRule)
         return;
 
     SkPath path = platformContext()->currentPathInLocalCoordinates();
+    if (!isPathSkiaSafe(getCTM(), path))
+        return;
+
     path.setFillType(clipRule == RULE_EVENODD ? SkPath::kEvenOdd_FillType : SkPath::kWinding_FillType);
     platformContext()->canvas()->clipPath(path);
 }
@@ -487,7 +490,7 @@ void GraphicsContext::drawFocusRing(const Color& color)
 
     const Vector<IntRect>& rects = focusRingRects();
     unsigned rectCount = rects.size();
-    if (0 == rectCount)
+    if (!rectCount)
         return;
 
     SkRegion focusRingRegion;
@@ -521,26 +524,28 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         return;
 
     SkPaint paint;
-    SkPoint pts[2] = { (SkPoint)point1, (SkPoint)point2 };
-    if (!isPointSkiaSafe(getCTM(), pts[0]) || !isPointSkiaSafe(getCTM(), pts[1]))
+    if (!isPointSkiaSafe(getCTM(), point1) || !isPointSkiaSafe(getCTM(), point2))
         return;
 
+    FloatPoint p1 = point1;
+    FloatPoint p2 = point2;
+    bool isVerticalLine = (p1.x() == p2.x());
+    int width = roundf(strokeThickness());
+
     // We know these are vertical or horizontal lines, so the length will just
     // be the sum of the displacement component vectors give or take 1 -
     // probably worth the speed up of no square root, which also won't be exact.
-    SkPoint disp = pts[1] - pts[0];
-    int length = SkScalarRound(disp.fX + disp.fY);
+    FloatSize disp = p2 - p1;
+    int length = SkScalarRound(disp.width() + disp.height());
     platformContext()->setupPaintForStroking(&paint, 0, length);
-    int width = roundf(strokeThickness());
-    bool isVerticalLine = pts[0].fX == pts[1].fX;
 
     if (strokeStyle() == DottedStroke || strokeStyle() == DashedStroke) {
         // Do a rect fill of our endpoints.  This ensures we always have the
         // appearance of being a border.  We then draw the actual dotted/dashed line.
 
         SkRect r1, r2;
-        r1.set(pts[0].fX, pts[0].fY, pts[0].fX + width, pts[0].fY + width);
-        r2.set(pts[1].fX, pts[1].fY, pts[1].fX + width, pts[1].fY + width);
+        r1.set(p1.x(), p1.y(), p1.x() + width, p1.y() + width);
+        r2.set(p2.x(), p2.y(), p2.x() + width, p2.y() + width);
 
         if (isVerticalLine) {
             r1.offset(-width / 2, 0);
@@ -553,35 +558,11 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
         fillPaint.setColor(paint.getColor());
         platformContext()->canvas()->drawRect(r1, fillPaint);
         platformContext()->canvas()->drawRect(r2, fillPaint);
-
-        // Since we've already rendered the endcaps, adjust the endpoints to
-        // exclude them from the line itself.
-        if (isVerticalLine) {
-            pts[0].fY += width;
-            pts[1].fY -= width;
-        } else {
-            pts[0].fX += width;
-            pts[1].fX -= width;
-        }
     }
 
-    // "Borrowed" this comment and idea from GraphicsContextCG.cpp
-    //
-    // For odd widths, we add in 0.5 to the appropriate x/y so that the float
-    // arithmetic works out.  For example, with a border width of 3, KHTML will
-    // pass us (y1+y2)/2, e.g., (50+53)/2 = 103/2 = 51 when we want 51.5.  It is
-    // always true that an even width gave us a perfect position, but an odd
-    // width gave us a position that is off by exactly 0.5.
+    adjustLineToPixelBoundaries(p1, p2, width, penStyle);
+    SkPoint pts[2] = { (SkPoint)p1, (SkPoint)p2 };
 
-    if (width & 1) {  // Odd.
-        if (isVerticalLine) {
-            pts[0].fX = pts[0].fX + SK_ScalarHalf;
-            pts[1].fX = pts[0].fX;
-        } else {  // Horizontal line
-            pts[0].fY = pts[0].fY + SK_ScalarHalf;
-            pts[1].fY = pts[0].fY;
-        }
-    }
     platformContext()->canvas()->drawPoints(SkCanvas::kLines_PointMode, 2, pts, paint);
 }
 
@@ -844,9 +825,9 @@ FloatRect GraphicsContext::roundToDevicePixels(const FloatRect& rect)
     deviceLowerRight.setY(roundf(deviceLowerRight.y()));
 
     // Don't let the height or width round to 0 unless either was originally 0
-    if (deviceOrigin.y() == deviceLowerRight.y() && rect.height() != 0)
+    if (deviceOrigin.y() == deviceLowerRight.y() && rect.height())
         deviceLowerRight.move(0, 1);
-    if (deviceOrigin.x() == deviceLowerRight.x() && rect.width() != 0)
+    if (deviceOrigin.x() == deviceLowerRight.x() && rect.width())
         deviceLowerRight.move(1, 0);
 
     FloatPoint roundedOrigin(deviceOrigin.x() / deviceScaleX,
@@ -919,7 +900,7 @@ void GraphicsContext::setLineDash(const DashArray& dashes, float dashOffset)
         return;
     }
 
-    size_t count = (dashLength % 2) == 0 ? dashLength : dashLength * 2;
+    size_t count = !(dashLength % 2) ? dashLength : dashLength * 2;
     SkScalar* intervals = new SkScalar[count];
 
     for (unsigned int i = 0; i < count; i++)
@@ -990,8 +971,8 @@ void GraphicsContext::setPlatformShadow(const IntSize& size,
         return;
 
     // Detect when there's no effective shadow and clear the looper.
-    if (size.width() == 0 && size.height() == 0 && blurInt == 0) {
-        platformContext()->setDrawLooper(NULL);
+    if (!size.width() && !size.height() && !blurInt) {
+        platformContext()->setDrawLooper(0);
         return;
     }
 
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 7935ff1..a5c8926 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -39,6 +39,7 @@
 #include "ImageData.h"
 #include "PlatformContextSkia.h"
 #include "PNGImageEncoder.h"
+#include "SkColorPriv.h"
 #include "SkiaUtils.h"
 
 using namespace std;
@@ -118,16 +119,16 @@ void ImageBuffer::platformTransformColorSpace(const Vector<int>& lookUpTable)
     }
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
+template <Multiply multiplied>
+PassRefPtr<ImageData> getImageData(const IntRect& rect, const SkBitmap& bitmap, 
+                                   const IntSize& size)
 {
-    ASSERT(context());
-
     RefPtr<ImageData> result = ImageData::create(rect.width(), rect.height());
     unsigned char* data = result->data()->data()->data();
 
     if (rect.x() < 0 || rect.y() < 0 ||
-        (rect.x() + rect.width()) > m_size.width() ||
-        (rect.y() + rect.height()) > m_size.height())
+        (rect.x() + rect.width()) > size.width() ||
+        (rect.y() + rect.height()) > size.height())
         memset(data, 0, result->data()->length());
 
     int originX = rect.x();
@@ -137,8 +138,8 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originX = 0;
     }
     int endX = rect.x() + rect.width();
-    if (endX > m_size.width())
-        endX = m_size.width();
+    if (endX > size.width())
+        endX = size.width();
     int numColumns = endX - originX;
 
     int originY = rect.y();
@@ -148,11 +149,10 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
         originY = 0;
     }
     int endY = rect.y() + rect.height();
-    if (endY > m_size.height())
-        endY = m_size.height();
+    if (endY > size.height())
+        endY = size.height();
     int numRows = endY - originY;
 
-    const SkBitmap& bitmap = *context()->platformContext()->bitmap();
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
 
@@ -162,12 +162,21 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     for (int y = 0; y < numRows; ++y) {
         uint32_t* srcRow = bitmap.getAddr32(originX, originY + y);
         for (int x = 0; x < numColumns; ++x) {
-            SkColor color = SkPMColorToColor(srcRow[x]);
             unsigned char* destPixel = &destRow[x * 4];
-            destPixel[0] = SkColorGetR(color);
-            destPixel[1] = SkColorGetG(color);
-            destPixel[2] = SkColorGetB(color);
-            destPixel[3] = SkColorGetA(color);
+            if (multiplied == Unmultiplied) {
+                SkColor color = SkPMColorToColor(srcRow[x]);
+                destPixel[0] = SkColorGetR(color);
+                destPixel[1] = SkColorGetG(color);
+                destPixel[2] = SkColorGetB(color);
+                destPixel[3] = SkColorGetA(color);
+            } else {
+                // Input and output are both pre-multiplied, we just need to re-arrange the
+                // bytes from the bitmap format to RGBA.
+                destPixel[0] = SkGetPackedR32(srcRow[x]);
+                destPixel[1] = SkGetPackedG32(srcRow[x]);
+                destPixel[2] = SkGetPackedB32(srcRow[x]);
+                destPixel[3] = SkGetPackedA32(srcRow[x]);
+            }
         }
         destRow += destBytesPerRow;
     }
@@ -175,8 +184,19 @@ PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect& rect) const
     return result;
 }
 
-void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
-                               const IntPoint& destPoint)
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Unmultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<Premultiplied>(rect, *context()->platformContext()->bitmap(), m_size);
+}
+
+template <Multiply multiplied>
+void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint& destPoint, 
+                  const SkBitmap& bitmap, const IntSize& size)
 {
     ASSERT(sourceRect.width() > 0);
     ASSERT(sourceRect.height() > 0);
@@ -184,27 +204,26 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
     int originX = sourceRect.x();
     int destX = destPoint.x() + sourceRect.x();
     ASSERT(destX >= 0);
-    ASSERT(destX < m_size.width());
+    ASSERT(destX < size.width());
     ASSERT(originX >= 0);
     ASSERT(originX < sourceRect.right());
 
     int endX = destPoint.x() + sourceRect.right();
-    ASSERT(endX <= m_size.width());
+    ASSERT(endX <= size.width());
 
     int numColumns = endX - destX;
 
     int originY = sourceRect.y();
     int destY = destPoint.y() + sourceRect.y();
     ASSERT(destY >= 0);
-    ASSERT(destY < m_size.height());
+    ASSERT(destY < size.height());
     ASSERT(originY >= 0);
     ASSERT(originY < sourceRect.bottom());
 
     int endY = destPoint.y() + sourceRect.bottom();
-    ASSERT(endY <= m_size.height());
+    ASSERT(endY <= size.height());
     int numRows = endY - destY;
 
-    const SkBitmap& bitmap = *context()->platformContext()->bitmap();
     ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
     SkAutoLockPixels bitmapLock(bitmap);
 
@@ -216,13 +235,27 @@ void ImageBuffer::putImageData(ImageData* source, const IntRect& sourceRect,
         uint32_t* destRow = bitmap.getAddr32(destX, destY + y);
         for (int x = 0; x < numColumns; ++x) {
             const unsigned char* srcPixel = &srcRow[x * 4];
-            destRow[x] = SkPreMultiplyARGB(srcPixel[3], srcPixel[0],
-                                           srcPixel[1], srcPixel[2]);
+            if (multiplied == Unmultiplied)
+                destRow[x] = SkPreMultiplyARGB(srcPixel[3], srcPixel[0],
+                                               srcPixel[1], srcPixel[2]);
+            else
+                destRow[x] = SkPackARGB32(srcPixel[3], srcPixel[0],
+                                          srcPixel[1], srcPixel[2]);
         }
         srcRow += srcBytesPerRow;
     }
 }
 
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Unmultiplied>(source, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<Premultiplied>(source, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
+}
+
 String ImageBuffer::toDataURL(const String&) const
 {
     // Encode the image into a vector.
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index 45c3dcd..ecab364 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -41,6 +41,7 @@
 #include "PlatformContextSkia.h"
 #include "PlatformString.h"
 #include "SkiaUtils.h"
+#include "SkRect.h"
 #include "SkShader.h"
 #include "TransformationMatrix.h"
 
@@ -158,8 +159,8 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     // We will always draw in integer sizes, so round the destination rect.
     SkIRect destRectRounded;
     destRect.round(&destRectRounded);
-    SkIRect resizedImageRect;  // Represents the size of the resized image.
-    resizedImageRect.set(0, 0, destRectRounded.width(), destRectRounded.height());
+    SkIRect resizedImageRect =  // Represents the size of the resized image.
+        { 0, 0, destRectRounded.width(), destRectRounded.height() };
 
     if (srcIsFull && bitmap.hasResizedBitmap(destRectRounded.width(), destRectRounded.height())) {
         // Yay, this bitmap frame already has a resized version.
@@ -196,25 +197,19 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     } else {
         // We should only resize the exposed part of the bitmap to do the
         // minimal possible work.
-        gfx::Rect destBitmapSubset(destBitmapSubsetSkI.fLeft,
-                                   destBitmapSubsetSkI.fTop,
-                                   destBitmapSubsetSkI.width(),
-                                   destBitmapSubsetSkI.height());
 
         // Resample the needed part of the image.
         SkBitmap resampled = skia::ImageOperations::Resize(subset,
             skia::ImageOperations::RESIZE_LANCZOS3,
             destRectRounded.width(), destRectRounded.height(),
-            destBitmapSubset);
+            destBitmapSubsetSkI);
 
         // Compute where the new bitmap should be drawn. Since our new bitmap
         // may be smaller than the original, we have to shift it over by the
         // same amount that we cut off the top and left.
-        SkRect offsetDestRect = {
-            destBitmapSubset.x() + destRect.fLeft,
-            destBitmapSubset.y() + destRect.fTop,
-            destBitmapSubset.right() + destRect.fLeft,
-            destBitmapSubset.bottom() + destRect.fTop };
+        destBitmapSubsetSkI.offset(destRect.fLeft, destRect.fTop);
+        SkRect offsetDestRect;
+        offsetDestRect.set(destBitmapSubsetSkI);
 
         canvas.drawBitmapRect(resampled, 0, offsetDestRect, &paint);
     }
diff --git a/WebCore/platform/graphics/skia/ImageSourceSkia.cpp b/WebCore/platform/graphics/skia/ImageSourceSkia.cpp
deleted file mode 100644
index 1647b86..0000000
--- a/WebCore/platform/graphics/skia/ImageSourceSkia.cpp
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright (c) 2008, Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-
-#include "config.h"
-#include "ImageSource.h"
-#include "SharedBuffer.h"
-
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "PNGImageDecoder.h"
-#include "BMPImageDecoder.h"
-#include "XBMImageDecoder.h"
-
-#include "SkBitmap.h"
-
-namespace WebCore {
-
-ImageDecoder* createDecoder(const Vector<char>& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-   
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
-ImageSource::ImageSource()
-    : m_decoder(0)
-{}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (!m_decoder)
-        m_decoder = createDecoder(data->buffer());
-
-    // CreateDecoder will return NULL if the decoder could not be created. Plus,
-    // we should not send more data to a decoder which has already decided it
-    // has failed.
-    if (!m_decoder || m_decoder->failed())
-        return;
-    m_decoder->setData(data, allDataReceived);
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-size_t ImageSource::frameCount() const
-{
-    if (!m_decoder)
-        return 0;
-    return m_decoder->failed() ? 0 : m_decoder->frameCount();
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    // Note that the buffer can have NULL bytes even when it is marked as
-    // non-empty. It seems "FrameEmpty" is only set before the frame has been
-    // initialized. If it is decoded and it happens to be empty, it will be
-    // marked as "FrameComplete" but will still have NULL bytes.
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    // Copy the bitmap.  The pixel data is refcounted internally by SkBitmap, so
-    // this doesn't cost much.  
-    return buffer->asNewNativeImage();
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    // Many annoying ads specify a 0 duration to make an image flash as quickly
-    // as possible.  We follow WinIE's behavior and use a duration of 100 ms
-    // for any frames that specify a duration of <= 50 ms.  See
-    // <http://bugs.webkit.org/show_bug.cgi?id=14413> or Radar 4051389 for
-    // more.
-    const float duration = buffer->duration() / 1000.0f;
-    return (duration < 0.051f) ? 0.100f : duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return false;
-
-    return buffer->hasAlpha();
-}
-
-String ImageSource::filenameExtension() const
-{
-    return m_decoder ? m_decoder->filenameExtension() : String();
-}
-
-}
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index e0a292c..1fb62fc 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -46,6 +46,11 @@
 
 #include <wtf/MathExtras.h>
 
+namespace WebCore 
+{
+extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
+}
+
 // State -----------------------------------------------------------------------
 
 // Encapsulates the additional painting state information we store for each
@@ -278,6 +283,7 @@ void PlatformContextSkia::drawRect(SkRect rect)
         SkShader* oldFillShader = m_state->m_fillShader;
         oldFillShader->safeRef();
         setFillColor(m_state->m_strokeColor);
+        paint.reset();
         setupPaintForFilling(&paint);
         SkRect topBorder = { rect.fLeft, rect.fTop, rect.fRight, rect.fTop + 1 };
         canvas()->drawRect(topBorder, paint);
@@ -295,7 +301,7 @@ void PlatformContextSkia::drawRect(SkRect rect)
 
 void PlatformContextSkia::setupPaintCommon(SkPaint* paint) const
 {
-#ifdef SK_DEBUGx
+#if defined(SK_DEBUG)
     {
         SkPaint defaultPaint;
         SkASSERT(*paint == defaultPaint);
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index 803f5db..e2ed130 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -297,6 +297,30 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
     CGContextRef cgContext = graphicsContext->platformContext();
     bool shouldUseFontSmoothing = WebCoreShouldUseFontSmoothing();
 
+    switch(fontDescription().fontSmoothing()) {
+    case Antialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case SubpixelAntialiased: {
+        graphicsContext->setShouldAntialias(true);
+        shouldUseFontSmoothing = true;
+        break;
+    }
+    case NoSmoothing: {
+        graphicsContext->setShouldAntialias(false);
+        shouldUseFontSmoothing = false;
+        break;
+    }
+    case AutoSmoothing: {
+        // For the AutoSmooth case, don't do anything! Keep the default settings.
+        break; 
+    }
+    default: 
+        ASSERT_NOT_REACHED();
+    }
+
     if (font->platformData().useGDI()) {
         if (!shouldUseFontSmoothing || (graphicsContext->textDrawingMode() & cTextStroke)) {
             drawGDIGlyphs(graphicsContext, font, glyphBuffer, from, numGlyphs, point);
diff --git a/WebCore/platform/graphics/win/FontCacheWin.cpp b/WebCore/platform/graphics/win/FontCacheWin.cpp
index 887bf79..8663623 100644
--- a/WebCore/platform/graphics/win/FontCacheWin.cpp
+++ b/WebCore/platform/graphics/win/FontCacheWin.cpp
@@ -33,8 +33,9 @@
 #include "SimpleFontData.h"
 #include "StringHash.h"
 #include "UnicodeRange.h"
-#include <windows.h>
 #include <mlang.h>
+#include <windows.h>
+#include <wtf/StdLibExtras.h>
 #if PLATFORM(CG)
 #include <ApplicationServices/ApplicationServices.h>
 #include <WebKitSystemInterface/WebKitSystemInterface.h>
@@ -305,7 +306,17 @@ FontPlatformData* FontCache::getLastResortFallbackFont(const FontDescription& fo
     // FIXME: Would be even better to somehow get the user's default font here.  For now we'll pick
     // the default that the user would get without changing any prefs.
     static AtomicString timesStr("Times New Roman");
-    return getCachedFontPlatformData(fontDescription, timesStr);
+    if (FontPlatformData* platformFont = getCachedFontPlatformData(fontDescription, timesStr))
+        return platformFont;
+
+    DEFINE_STATIC_LOCAL(String, defaultGUIFontFamily, ());
+    if (defaultGUIFontFamily.isEmpty()) {
+        HFONT defaultGUIFont = static_cast<HFONT>(GetStockObject(DEFAULT_GUI_FONT));
+        LOGFONT logFont;
+        GetObject(defaultGUIFont, sizeof(logFont), &logFont);
+        defaultGUIFontFamily = String(logFont.lfFaceName, wcsnlen(logFont.lfFaceName, LF_FACESIZE));
+    }
+    return getCachedFontPlatformData(fontDescription, defaultGUIFontFamily);
 }
 
 static LONG toGDIFontWeight(FontWeight fontWeight)
diff --git a/WebCore/platform/graphics/win/FontDatabase.cpp b/WebCore/platform/graphics/win/FontDatabase.cpp
index 1308ff0..d0773ea 100644
--- a/WebCore/platform/graphics/win/FontDatabase.cpp
+++ b/WebCore/platform/graphics/win/FontDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -99,17 +99,12 @@ static RetainPtr<CFPropertyListRef> readFontPlist()
     return plist;
 }
 
-static bool populateFontDatabaseFromPlist()
+static bool populateFontDatabaseFromPlist(CFPropertyListRef plist)
 {
-    RetainPtr<CFPropertyListRef> plist = readFontPlist();
     if (!plist)
         return false;
 
-    RetainPtr<CFDataRef> data(AdoptCF, CFPropertyListCreateXMLData(0, plist.get()));
-    if (!data)
-        return false;
-
-    wkAddFontsFromPlistRepresentation(data.get());
+    wkAddFontsFromPlist(plist);
     return true;
 }
 
@@ -123,15 +118,69 @@ static bool populateFontDatabaseFromFileSystem()
     return true;
 }
 
-static void writeFontDatabaseToPlist()
+static CFStringRef fontFilenamesFromRegistryKey()
+{
+    static CFStringRef key = CFSTR("WebKitFontFilenamesFromRegistry");
+    return key;
+}
+
+static void writeFontDatabaseToPlist(CFPropertyListRef cgFontDBPropertyList, CFPropertyListRef filenamesFromRegistry)
 {
-    RetainPtr<CFDataRef> data(AdoptCF, wkCreateFontsPlistRepresentation());
+    if (!cgFontDBPropertyList)
+        return;
+
+    RetainPtr<CFDataRef> data;
+
+    if (!filenamesFromRegistry || CFGetTypeID(cgFontDBPropertyList) != CFDictionaryGetTypeID())
+        data.adoptCF(CFPropertyListCreateXMLData(kCFAllocatorDefault, cgFontDBPropertyList));
+    else {
+        RetainPtr<CFMutableDictionaryRef> dictionary(AdoptCF, CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 2, static_cast<CFDictionaryRef>(cgFontDBPropertyList)));
+        CFDictionarySetValue(dictionary.get(), fontFilenamesFromRegistryKey(), filenamesFromRegistry);
+        data.adoptCF(CFPropertyListCreateXMLData(kCFAllocatorDefault, dictionary.get()));
+    }
+
     if (!data)
         return;
 
     safeCreateFile(fontsPlistPath(), data.get());
 }
 
+static RetainPtr<CFArrayRef> fontFilenamesFromRegistry()
+{
+    RetainPtr<CFMutableArrayRef> filenames(AdoptCF, CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks));
+
+    HKEY key;
+    if (FAILED(RegOpenKeyEx(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Fonts"), 0, KEY_READ, &key)))
+        return filenames;
+
+    DWORD valueCount;
+    DWORD maxNameLength;
+    DWORD maxValueLength;
+    if (FAILED(RegQueryInfoKey(key, 0, 0, 0, 0, 0, 0, &valueCount, &maxNameLength, &maxValueLength, 0, 0))) {
+        RegCloseKey(key);
+        return filenames;
+    }
+
+    Vector<TCHAR> name(maxNameLength + 1);
+    Vector<BYTE> value(maxValueLength + 1);
+
+    for (size_t i = 0; i < valueCount; ++i) {
+        DWORD nameLength = name.size();
+        DWORD valueLength = value.size();
+        DWORD type;
+        if (FAILED(RegEnumValue(key, i, name.data(), &nameLength, 0, &type, value.data(), &valueLength)))
+            continue;
+        if (type != REG_SZ)
+            continue;
+
+        RetainPtr<CFDataRef> filename(AdoptCF, CFDataCreate(kCFAllocatorDefault, value.data(), valueLength));
+        CFArrayAppendValue(filenames.get(), filename.get());
+    }
+
+    RegCloseKey(key);
+    return filenames;
+}
+
 void populateFontDatabase()
 {
     static bool initialized;
@@ -139,12 +188,27 @@ void populateFontDatabase()
         return;
     initialized = true;
 
-    if (!systemHasFontsNewerThanFontsPlist())
-        if (populateFontDatabaseFromPlist())
+    RetainPtr<CFPropertyListRef> propertyList = readFontPlist();
+    RetainPtr<CFArrayRef> lastFilenamesFromRegistry;
+    if (propertyList && CFGetTypeID(propertyList.get()) == CFDictionaryGetTypeID()) {
+        CFDictionaryRef dictionary = static_cast<CFDictionaryRef>(propertyList.get());
+        CFArrayRef array = static_cast<CFArrayRef>(CFDictionaryGetValue(dictionary, fontFilenamesFromRegistryKey()));
+        if (array && CFGetTypeID(array) == CFArrayGetTypeID())
+            lastFilenamesFromRegistry = array;
+    }
+    RetainPtr<CFArrayRef> currentFilenamesFromRegistry = fontFilenamesFromRegistry();
+    bool registryChanged = !lastFilenamesFromRegistry || !CFEqual(lastFilenamesFromRegistry.get(), currentFilenamesFromRegistry.get());
+
+    if (!registryChanged && !systemHasFontsNewerThanFontsPlist()) {
+        if (populateFontDatabaseFromPlist(propertyList.get()))
             return;
+    }
 
-    if (populateFontDatabaseFromFileSystem())
-        writeFontDatabaseToPlist();
+    if (populateFontDatabaseFromFileSystem()) {
+        wkAddFontsFromRegistry();
+        RetainPtr<CFPropertyListRef> cgFontDBPropertyList(AdoptCF, wkCreateFontsPlist());
+        writeFontDatabaseToPlist(cgFontDBPropertyList.get(), currentFilenamesFromRegistry.get());
+    }
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/FontPlatformData.h b/WebCore/platform/graphics/win/FontPlatformData.h
index 0660d90..5084469 100644
--- a/WebCore/platform/graphics/win/FontPlatformData.h
+++ b/WebCore/platform/graphics/win/FontPlatformData.h
@@ -78,7 +78,6 @@ public:
 #if PLATFORM(CG)
     CGFontRef cgFont() const { return m_cgFont.get(); }
 #elif PLATFORM(CAIRO)
-    void setFont(cairo_t* ft) const;
     cairo_font_face_t* fontFace() const { return m_fontFace; }
     cairo_scaled_font_t* scaledFont() const { return m_scaledFont; }
 #endif
diff --git a/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp b/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
index b56a71c..9fce68a 100644
--- a/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/FontPlatformDataCairoWin.cpp
@@ -96,12 +96,6 @@ FontPlatformData::FontPlatformData(const FontPlatformData& source)
         m_scaledFont = cairo_scaled_font_reference(source.m_scaledFont);
 }
 
-void FontPlatformData::setFont(cairo_t* cr) const
-{
-    ASSERT(m_scaledFont);
-
-    cairo_set_scaled_font(cr, m_scaledFont);
-}
 
 FontPlatformData::~FontPlatformData()
 {
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index 9eaf54b..1923ecc 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -65,7 +65,7 @@ GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate(CGContextWithHDC(hdc, hasAlpha)))
 {
-    CGContextRelease(m_data->m_cgContext);
+    CGContextRelease(m_data->m_cgContext.get());
     m_data->m_hdc = hdc;
     setPaintingDisabled(!m_data->m_cgContext);
     if (m_data->m_cgContext) {
@@ -98,7 +98,7 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
         CGColorSpaceRelease(deviceRGB);
 
         CGImageRef image = CGBitmapContextCreateImage(bitmapContext);
-        CGContextDrawImage(m_data->m_cgContext, dstRect, image);
+        CGContextDrawImage(m_data->m_cgContext.get(), dstRect, image);
         
         // Delete all our junk.
         CGImageRelease(image);
@@ -121,7 +121,7 @@ void GraphicsContext::drawWindowsBitmap(WindowsBitmap* image, const IntPoint& po
     RetainPtr<CGDataProviderRef> dataProvider(AdoptCF, CGDataProviderCreateWithCFData(imageData.get()));
     RetainPtr<CGImageRef> cgImage(AdoptCF, CGImageCreate(image->size().width(), image->size().height(), 8, 32, image->bytesPerRow(), deviceRGB.get(),
                                                          kCGBitmapByteOrder32Little | kCGImageAlphaFirst, dataProvider.get(), 0, true, kCGRenderingIntentDefault));
-    CGContextDrawImage(m_data->m_cgContext, CGRectMake(point.x(), point.y(), image->size().width(), image->size().height()), cgImage.get());   
+    CGContextDrawImage(m_data->m_cgContext.get(), CGRectMake(point.x(), point.y(), image->size().width(), image->size().height()), cgImage.get());   
 }
 
 void GraphicsContext::drawFocusRing(const Color& color)
@@ -243,7 +243,7 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& point,
 
 void GraphicsContextPlatformPrivate::flush()
 {
-    CGContextFlush(m_cgContext);
+    CGContextFlush(m_cgContext.get());
 }
 
 }
diff --git a/WebCore/platform/graphics/win/ImageCGWin.cpp b/WebCore/platform/graphics/win/ImageCGWin.cpp
index 8a8e943..285fb71 100644
--- a/WebCore/platform/graphics/win/ImageCGWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Image.h"
 #include "BitmapImage.h"
+#include "BitmapInfo.h"
 #include "GraphicsContext.h"
 #include <ApplicationServices/ApplicationServices.h>
 
@@ -34,6 +35,30 @@
 
 namespace WebCore {
 
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    RetainPtr<CGColorSpaceRef> deviceRGB(AdoptCF, CGColorSpaceCreateDeviceRGB());
+    RetainPtr<CGContextRef> bitmapContext(AdoptCF, CGBitmapContextCreate(dibSection.dsBm.bmBits, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight, 8,
+        dibSection.dsBm.bmWidthBytes, deviceRGB.get(), kCGBitmapByteOrder32Little | kCGImageAlphaPremultipliedFirst));
+
+    // The BitmapImage takes ownership of this.
+    CGImageRef cgImage = CGBitmapContextCreateImage(bitmapContext.get());
+
+    return adoptRef(new BitmapImage(cgImage));
+}
+
 bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 {
     ASSERT(bmp);
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index 591375f..0b27438 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -28,12 +28,33 @@
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
 #include <cairo.h>
+#include <cairo-win32.h>
 
 #include <windows.h>
 #include "PlatformString.h"
 
 namespace WebCore {
 
+PassRefPtr<BitmapImage> BitmapImage::create(HBITMAP hBitmap)
+{
+    DIBSECTION dibSection;
+    if (!GetObject(hBitmap, sizeof(DIBSECTION), &dibSection))
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBitsPixel == 32);
+    if (dibSection.dsBm.bmBitsPixel != 32)
+        return 0;
+
+    ASSERT(dibSection.dsBm.bmBits);
+    if (!dibSection.dsBm.bmBits)
+        return 0;
+
+    cairo_surface_t* image = cairo_win32_surface_create_with_dib (CAIRO_FORMAT_ARGB32, dibSection.dsBm.bmWidth, dibSection.dsBm.bmHeight);
+
+    // The BitmapImage object takes over ownership of the cairo_surface_t*, so no need to destroy here.
+    return adoptRef(new BitmapImage(image));
+}
+
 bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 {
     ASSERT(bmp);
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index eb7334e..15e1001 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -33,6 +33,8 @@
 #include "QTMovieWin.h"
 #include "ScrollView.h"
 #include "StringHash.h"
+#include "TimeRanges.h"
+#include "Timer.h"
 #include <wtf/HashSet.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
@@ -86,6 +88,50 @@ MediaPlayerPrivate::~MediaPlayerPrivate()
 {
 }
 
+class TaskTimer : TimerBase {
+public:
+    static void initialize();
+    
+private:
+    static void setTaskTimerDelay(double);
+    static void stopTaskTimer();
+
+    void fired();
+
+    static TaskTimer* s_timer;
+};
+
+TaskTimer* TaskTimer::s_timer = 0;
+
+void TaskTimer::initialize()
+{
+    if (s_timer)
+        return;
+
+    s_timer = new TaskTimer;
+
+    QTMovieWin::setTaskTimerFuncs(setTaskTimerDelay, stopTaskTimer);
+}
+
+void TaskTimer::setTaskTimerDelay(double delayInSeconds)
+{
+    ASSERT(s_timer);
+
+    s_timer->startOneShot(delayInSeconds);
+}
+
+void TaskTimer::stopTaskTimer()
+{
+    ASSERT(s_timer);
+
+    s_timer->stop();
+}
+
+void TaskTimer::fired()
+{
+    QTMovieWin::taskTimerFired();
+}
+
 void MediaPlayerPrivate::load(const String& url)
 {
     if (!QTMovieWin::initializeQuickTime()) {
@@ -95,6 +141,9 @@ void MediaPlayerPrivate::load(const String& url)
         return;
     }
 
+    // Initialize the task timer.
+    TaskTimer::initialize();
+
     if (m_networkState != MediaPlayer::Loading) {
         m_networkState = MediaPlayer::Loading;
         m_player->networkStateChanged();
@@ -241,6 +290,13 @@ bool MediaPlayerPrivate::hasVideo() const
     return m_qtMovie->hasVideo();
 }
 
+bool MediaPlayerPrivate::hasAudio() const
+{
+    if (!m_qtMovie)
+        return false;
+    return m_qtMovie->hasAudio();
+}
+
 void MediaPlayerPrivate::setVolume(float volume)
 {
     if (!m_qtMovie)
@@ -268,10 +324,14 @@ int MediaPlayerPrivate::dataRate() const
     return 0;
 }
 
-float MediaPlayerPrivate::maxTimeBuffered() const
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
 {
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    float loaded = maxTimeLoaded();
     // rtsp streams are not buffered
-    return m_isStreaming ? 0 : maxTimeLoaded();
+    if (!m_isStreaming && loaded > 0)
+        timeRanges->add(0, loaded);
+    return timeRanges.release();
 }
 
 float MediaPlayerPrivate::maxTimeSeekable() const
@@ -575,4 +635,3 @@ bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
 }
 
 #endif
-
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
index f584148..4a3a28e 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h
@@ -52,7 +52,8 @@ public:
     
     IntSize naturalSize() const;
     bool hasVideo() const;
-    
+    bool hasAudio() const;
+
     void load(const String& url);
     void cancelLoad();
     
@@ -76,7 +77,7 @@ public:
     MediaPlayer::NetworkState networkState() const { return m_networkState; }
     MediaPlayer::ReadyState readyState() const { return m_readyState; }
     
-    float maxTimeBuffered() const;
+    PassRefPtr<TimeRanges> buffered() const;
     float maxTimeSeekable() const;
     unsigned bytesLoaded() const;
     bool totalBytesKnown() const;
diff --git a/WebCore/platform/graphics/win/QTMovieWin.cpp b/WebCore/platform/graphics/win/QTMovieWin.cpp
index aaa61f1..56f3d0b 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.cpp
+++ b/WebCore/platform/graphics/win/QTMovieWin.cpp
@@ -62,10 +62,13 @@ static HashSet<QTMovieWinPrivate*>* gTaskList;
 static Vector<CFStringRef>* gSupportedTypes = 0;
 static SInt32 quickTimeVersion = 0;
 
+static QTMovieWin::SetTaskTimerDelayFunc gSetTaskTimerDelay = 0;
+static QTMovieWin::StopTaskTimerFunc gStopTaskTimer = 0;
+
 static void updateTaskTimer(int maxInterval = 1000)
 {
     if (!gTaskList->size()) {
-        stopSharedTimer();
+        gStopTaskTimer();
         return;    
     }
     
@@ -73,7 +76,7 @@ static void updateTaskTimer(int maxInterval = 1000)
     QTGetTimeUntilNextTask(&intervalInMS, 1000);
     if (intervalInMS > maxInterval)
         intervalInMS = maxInterval;
-    setSharedTimerFireDelay(static_cast<float>(intervalInMS) / 1000);
+    gSetTaskTimerDelay(static_cast<float>(intervalInMS) / 1000);
 }
 
 class QTMovieWinPrivate : public Noncopyable {
@@ -166,7 +169,7 @@ QTMovieWinPrivate::~QTMovieWinPrivate()
         CFRelease(m_currentURL);
 }
 
-static void taskTimerFired()
+void QTMovieWin::taskTimerFired()
 {
     // The hash content might change during task()
     Vector<QTMovieWinPrivate*> tasks;
@@ -867,6 +870,13 @@ bool QTMovieWin::hasVideo() const
     return (GetMovieIndTrackType(m_private->m_movie, 1, VisualMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
 }
 
+bool QTMovieWin::hasAudio() const
+{
+    if (!m_private->m_movie)
+        return false;
+    return (GetMovieIndTrackType(m_private->m_movie, 1, AudioMediaCharacteristic, movieTrackCharacteristic | movieTrackEnabledOnly));
+}
+
 pascal OSErr movieDrawingCompleteProc(Movie movie, long data)
 {
     UppParam param;
@@ -990,6 +1000,12 @@ void QTMovieWin::getSupportedType(unsigned index, const UChar*& str, unsigned& l
     
 }
 
+void QTMovieWin::setTaskTimerFuncs(SetTaskTimerDelayFunc setTaskTimerDelay, StopTaskTimerFunc stopTaskTimer)
+{
+    gSetTaskTimerDelay = setTaskTimerDelay;
+    gStopTaskTimer = stopTaskTimer;
+}
+
 bool QTMovieWin::initializeQuickTime() 
 {
     static bool initialized = false;
@@ -1009,7 +1025,6 @@ bool QTMovieWin::initializeQuickTime()
             return false;
         }
         EnterMovies();
-        setSharedTimerFiredFunction(taskTimerFired);
         gMovieDrawingCompleteUPP = NewMovieDrawingCompleteUPP(movieDrawingCompleteProc);
         initializationSucceeded = true;
     }
@@ -1020,7 +1035,6 @@ BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
 {
     switch (fdwReason) {
         case DLL_PROCESS_ATTACH:
-            setSharedTimerInstanceHandle(hinstDLL);
             return TRUE;
         case DLL_PROCESS_DETACH:
         case DLL_THREAD_ATTACH:
diff --git a/WebCore/platform/graphics/win/QTMovieWin.h b/WebCore/platform/graphics/win/QTMovieWin.h
index f46efd3..d178eb8 100644
--- a/WebCore/platform/graphics/win/QTMovieWin.h
+++ b/WebCore/platform/graphics/win/QTMovieWin.h
@@ -59,6 +59,11 @@ class QTMOVIEWIN_API QTMovieWin {
 public:
     static bool initializeQuickTime();
 
+    typedef void (*SetTaskTimerDelayFunc)(double);
+    typedef void (*StopTaskTimerFunc)();
+    static void setTaskTimerFuncs(SetTaskTimerDelayFunc, StopTaskTimerFunc);
+    static void taskTimerFired();
+
     QTMovieWin(QTMovieWinClient*);
     ~QTMovieWin();
 
@@ -91,6 +96,7 @@ public:
     void setDisabled(bool);
 
     bool hasVideo() const;
+    bool hasAudio() const;
 
     static unsigned countSupportedTypes();
     static void getSupportedType(unsigned index, const UChar*& str, unsigned& len);
diff --git a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 0343007..26b22af 100644
--- a/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -119,10 +119,4 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     return width * metricsMultiplier;
 }
 
-void SimpleFontData::setFont(cairo_t* cr) const
-{
-    ASSERT(cr);
-    m_platformData.setFont(cr);
-}
-
 }
diff --git a/WebCore/platform/graphics/wince/ColorWince.cpp b/WebCore/platform/graphics/wince/ColorWince.cpp
new file mode 100644
index 0000000..820b9d2
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ColorWince.cpp
@@ -0,0 +1,38 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Color.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+Color focusRingColor()
+{
+    return Color(0, 0, 0);
+}
+
+void setFocusRingColorChangeFunction(void (*)())
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp b/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
index 7c6853c..699ff25 100644
--- a/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
+++ b/WebCore/platform/graphics/wince/FontCustomPlatformData.cpp
@@ -33,6 +33,11 @@ static CustomFontCache* g_customFontCache = 0;
 
 bool renameFont(SharedBuffer* fontData, const String& fontName);
 
+void setCustomFontCache(CustomFontCache* cache)
+{
+    g_customFontCache = cache;
+}
+
 FontCustomPlatformData::~FontCustomPlatformData()
 {
     if (g_customFontCache && !m_name.isEmpty())
@@ -66,11 +71,12 @@ static String createUniqueFontName()
     return fontName.replace('/', '_');
 }
 
-FontCustomPlatformData* createFontCustomPlatformData(CachedFont* cachedFont)
+FontCustomPlatformData* createFontCustomPlatformData(const SharedBuffer* buffer)
 {
-    if (g_customFontCache && cachedFont->CachedResource::data()) {
+    if (g_customFontCache) {
         String fontName = createUniqueFontName();
-        if (renameFont(cachedFont->CachedResource::data(), fontName) && g_customFontCache->registerFont(fontName, cachedFont))
+        RefPtr<SharedBuffer> localBuffer = SharedBuffer::create(buffer->data(), buffer->size());
+        if (renameFont(localBuffer.get(), fontName) && g_customFontCache->registerFont(fontName, localBuffer.get()))
             return new FontCustomPlatformData(fontName);
     }
     return 0;
diff --git a/WebCore/platform/graphics/wince/FontCustomPlatformData.h b/WebCore/platform/graphics/wince/FontCustomPlatformData.h
index b1f64a0..89d1fdd 100644
--- a/WebCore/platform/graphics/wince/FontCustomPlatformData.h
+++ b/WebCore/platform/graphics/wince/FontCustomPlatformData.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class CustomFontCache {
     public:
-        virtual bool registerFont(const String& fontName, CachedFont*) = 0;
+        virtual bool registerFont(const String& fontName, const SharedBuffer*) = 0;
         virtual void unregisterFont(const String& fontName) = 0;
     };
 
@@ -48,8 +48,8 @@ namespace WebCore {
         String m_name;
     };
 
-    FontCustomPlatformData* createFontCustomPlatformData(CachedFont*);
-
+    FontCustomPlatformData* createFontCustomPlatformData(const SharedBuffer*);
+    void setCustomFontCache(CustomFontCache*);
 }
 
 #endif
diff --git a/WebCore/platform/graphics/wince/GradientWince.cpp b/WebCore/platform/graphics/wince/GradientWince.cpp
new file mode 100644
index 0000000..49fa970
--- /dev/null
+++ b/WebCore/platform/graphics/wince/GradientWince.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+
+#include "config.h"
+#include "Gradient.h"
+
+#include "GraphicsContext.h"
+
+namespace WebCore {
+
+void Gradient::platformDestroy()
+{
+}
+
+static inline bool compareStops(const Gradient::ColorStop& a, const Gradient::ColorStop& b)
+{
+    return a.stop < b.stop;
+}
+
+const Vector<Gradient::ColorStop>& Gradient::getStops() const
+{
+    if (!m_stopsSorted) {
+        if (m_stops.size())
+            std::stable_sort(m_stops.begin(), m_stops.end(), compareStops);
+        m_stopsSorted = true;
+    }
+    return m_stops;
+}
+
+void Gradient::fill(GraphicsContext* c, const FloatRect& r)
+{
+    c->fillRect(r, this);
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/ImageBufferData.h b/WebCore/platform/graphics/wince/ImageBufferData.h
new file mode 100644
index 0000000..01b7d06
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ImageBufferData.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef ImageBufferData_h
+#define ImageBufferData_h
+
+namespace WebCore {
+
+    class IntSize;
+    class ImageBufferData {
+    public:
+        ImageBufferData(const IntSize& size);
+        RefPtr<SharedBitmap> m_bitmap;
+    };
+
+}  // namespace WebCore
+
+#endif  // ImageBufferData_h
diff --git a/WebCore/platform/graphics/wince/ImageBufferWince.cpp b/WebCore/platform/graphics/wince/ImageBufferWince.cpp
new file mode 100644
index 0000000..3417f5f
--- /dev/null
+++ b/WebCore/platform/graphics/wince/ImageBufferWince.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ImageBuffer.h"
+
+#include "Base64.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+#include "ImageData.h"
+#include "JPEGEncoder.h"
+#include "PNGEncoder.h"
+#include "SharedBitmap.h"
+
+namespace WebCore {
+
+class BufferedImage: public Image {
+
+public:
+    BufferedImage(const ImageBufferData* data)
+        : m_data(data)
+    {
+    }
+
+    virtual IntSize size() const { return IntSize(m_data->m_bitmap->width(), m_data->m_bitmap->height()); }
+    virtual void destroyDecodedData(bool destroyAll = true) {}
+    virtual unsigned decodedSize() const { return 0; }
+    virtual void draw(GraphicsContext*, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator);
+    virtual void drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform,
+                             const FloatPoint& phase, CompositeOperator, const FloatRect& destRect);
+
+    const ImageBufferData* m_data;
+};
+
+void BufferedImage::draw(GraphicsContext* ctxt, const FloatRect& dstRect, const FloatRect& srcRect, CompositeOperator compositeOp)
+{
+    IntRect intDstRect = enclosingIntRect(dstRect);
+    IntRect intSrcRect(srcRect);
+    m_data->m_bitmap->draw(ctxt, intDstRect, intSrcRect, compositeOp);
+}
+
+void BufferedImage::drawPattern(GraphicsContext* ctxt, const FloatRect& tileRectIn, const TransformationMatrix& patternTransform,
+                             const FloatPoint& phase, CompositeOperator op, const FloatRect& destRect)
+{
+    m_data->m_bitmap->drawPattern(ctxt, tileRectIn, patternTransform, phase, op, destRect, size());
+}
+
+ImageBufferData::ImageBufferData(const IntSize& size)
+: m_bitmap(SharedBitmap::createInstance(false, size.width(), size.height(), false))
+{
+    // http://www.w3.org/TR/2009/WD-html5-20090212/the-canvas-element.html#canvaspixelarray
+    // "When the canvas is initialized it must be set to fully transparent black."
+    m_bitmap->resetPixels(true);
+    m_bitmap->setHasAlpha(true);
+}
+
+ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace colorSpace, bool& success)
+    : m_data(size)
+    , m_size(size)
+{
+    // FIXME: colorSpace is not used
+    UNUSED_PARAM(colorSpace);
+
+    m_context.set(new GraphicsContext(0));
+    m_context->setBitmap(m_data.m_bitmap);
+    success = true;
+}
+
+ImageBuffer::~ImageBuffer()
+{
+}
+
+GraphicsContext* ImageBuffer::context() const
+{
+    return m_context.get();
+}
+
+Image* ImageBuffer::image() const
+{
+    if (!m_image)
+        m_image = adoptRef(new BufferedImage(&m_data));
+
+    return m_image.get();
+}
+
+template <bool premultiplied> PassRefPtr<ImageData>
+static getImageData(const IntRect& rect, const SharedBitmap* bitmap)
+{
+    PassRefPtr<ImageData> imageData = ImageData::create(rect.width(), rect.height());
+
+    const unsigned char* src = static_cast<const unsigned char*>(bitmap->bytes());
+    if (!src)
+        return imageData;
+
+    IntRect sourceRect(0, 0, bitmap->width(), bitmap->height());
+    sourceRect.intersect(rect);
+    if (sourceRect.isEmpty())
+        return imageData;
+
+    unsigned char* dst = imageData->data()->data()->data();
+    memset(dst, 0, imageData->data()->data()->length());
+    src += (sourceRect.y() * bitmap->width() + sourceRect.x()) * 4;
+    dst += ((sourceRect.y() - rect.y()) * imageData->width() + sourceRect.x() - rect.x()) * 4;
+    int bytesToCopy = sourceRect.width() * 4;
+    int srcSkip = (bitmap->width() - sourceRect.width()) * 4;
+    int dstSkip = (imageData->width() - sourceRect.width()) * 4;
+    const unsigned char* dstEnd = dst + sourceRect.height() * imageData->width() * 4;
+    while (dst < dstEnd) {
+        const unsigned char* dstRowEnd = dst + bytesToCopy;
+        while (dst < dstRowEnd) {
+            // Convert ARGB little endian to RGBA big endian
+            int blue = *src++;
+            int green = *src++;
+            int red = *src++;
+            int alpha = *src++;
+            if (premultiplied) {
+                *dst++ = static_cast<unsigned char>((red * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>((green * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>((blue * alpha + 254) / 255);
+                *dst++ = static_cast<unsigned char>(alpha);
+            } else {
+                *dst++ = static_cast<unsigned char>(red);
+                *dst++ = static_cast<unsigned char>(green);
+                *dst++ = static_cast<unsigned char>(blue);
+                *dst++ = static_cast<unsigned char>(alpha);
+                ++src;
+            }
+        }
+        src += srcSkip;
+        dst += dstSkip;
+    }
+
+    return imageData;
+}
+
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<false>(rect, m_data.m_bitmap.get());
+}
+
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    return getImageData<true>(rect, m_data.m_bitmap.get());
+}
+
+template <bool premultiplied>
+static void putImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint, SharedBitmap* bitmap)
+{
+    unsigned char* dst = (unsigned char*)bitmap->bytes();
+    if (!dst)
+        return;
+
+    IntRect destRect(destPoint, sourceRect.size());
+    destRect.intersect(IntRect(0, 0, bitmap->width(), bitmap->height()));
+
+    if (destRect.isEmpty())
+        return;
+
+    const unsigned char* src = source->data()->data()->data();
+    dst += (destRect.y() * bitmap->width() + destRect.x()) * 4;
+    src += (sourceRect.y() * source->width() + sourceRect.x()) * 4;
+    int bytesToCopy = destRect.width() * 4;
+    int dstSkip = (bitmap->width() - destRect.width()) * 4;
+    int srcSkip = (source->width() - destRect.width()) * 4;
+    const unsigned char* dstEnd = dst + destRect.height() * bitmap->width() * 4;
+    while (dst < dstEnd) {
+        const unsigned char* dstRowEnd = dst + bytesToCopy;
+        while (dst < dstRowEnd) {
+            // Convert RGBA big endian to ARGB little endian
+            int red = *src++;
+            int green = *src++;
+            int blue = *src++;
+            int alpha = *src++;
+            if (premultiplied) {
+                *dst++ = static_cast<unsigned char>(blue * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(green * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(red * 255 / alpha);
+                *dst++ = static_cast<unsigned char>(alpha);
+            } else {
+                *dst++ = static_cast<unsigned char>(blue);
+                *dst++ = static_cast<unsigned char>(green);
+                *dst++ = static_cast<unsigned char>(red);
+                *dst++ = static_cast<unsigned char>(alpha);
+            }
+        }
+        src += srcSkip;
+        dst += dstSkip;
+    }
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<false>(source, sourceRect, destPoint, m_data.m_bitmap.get());
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    putImageData<true>(source, sourceRect, destPoint, m_data.m_bitmap.get());
+}
+
+String ImageBuffer::toDataURL(const String& mimeType) const
+{
+    if (!m_data.m_bitmap->bytes())
+        return "data:,";
+
+    Vector<char> output;
+    const char* header;
+    if (mimeType.lower() == "image/png") {
+        if (!compressBitmapToPng(m_data.m_bitmap.get(), output))
+            return "data:,";
+        header = "data:image/png;base64,";
+    } else {
+        if (!compressBitmapToJpeg(m_data.m_bitmap.get(), output))
+            return "data:,";
+        header = "data:image/jpeg;base64,";
+    }
+
+    Vector<char> base64;
+    base64Encode(output, base64);
+
+    output.clear();
+
+    Vector<char> url;
+    url.append(header, strlen(header));
+    url.append(base64);
+
+    return String(url.data(), url.size());
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h b/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h
new file mode 100644
index 0000000..2d6c358
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerPrivateWince.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MediaPlayerPrivateWince_h
+#define MediaPlayerPrivateWince_h
+
+#if ENABLE(VIDEO)
+
+#include "MediaPlayerPrivate.h"
+#include "Timer.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+    class GraphicsContext;
+    class IntSize;
+    class IntRect;
+    class String;
+
+    class MediaPlayerPrivate : public MediaPlayerPrivateInterface {
+    public:
+        static void registerMediaEngine(MediaEngineRegistrar);
+
+        ~MediaPlayerPrivate();
+
+        IntSize naturalSize() const;
+        bool hasVideo() const;
+
+        void load(const String& url);
+        void cancelLoad();
+
+        void play();
+        void pause();
+
+        bool paused() const;
+        bool seeking() const;
+
+        float duration() const;
+        float currentTime() const;
+        void seek(float time);
+        void setEndTime(float);
+
+        void setRate(float);
+        void setVolume(float);
+
+        int dataRate() const;
+
+        MediaPlayer::NetworkState networkState() const { return m_networkState; }
+        MediaPlayer::ReadyState readyState() const { return m_readyState; }
+
+        PassRefPtr<TimeRanges> buffered() const;
+        float maxTimeSeekable() const;
+        unsigned bytesLoaded() const;
+        bool totalBytesKnown() const;
+        unsigned totalBytes() const;
+
+        void setVisible(bool);
+        void setSize(const IntSize&);
+
+        void loadStateChanged();
+        void didEnd();
+
+        void paint(GraphicsContext*, const IntRect&);
+
+    private:
+        MediaPlayerPrivate(MediaPlayer*);
+
+        void updateStates();
+        void doSeek();
+        void cancelSeek();
+        void seekTimerFired(Timer<MediaPlayerPrivate>*);
+        float maxTimeLoaded() const;
+        void sawUnsupportedTracks();
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        void setMediaPlayerProxy(WebMediaPlayerProxy*);
+        void setPoster(const String& url);
+        void deliverNotification(MediaPlayerProxyNotificationType);
+#endif
+
+        // engine support
+        static MediaPlayerPrivateInterface* create(MediaPlayer*);
+        static void getSupportedTypes(HashSet<String>& types);
+        static MediaPlayer::SupportsType supportsType(const String& type, const String& codecs);
+        static bool isAvailable();
+
+        MediaPlayer* m_player;
+        float m_seekTo;
+        float m_endTime;
+        Timer<MediaPlayerPrivate> m_seekTimer;
+        MediaPlayer::NetworkState m_networkState;
+        MediaPlayer::ReadyState m_readyState;
+        unsigned m_enabledTrackCount;
+        unsigned m_totalTrackCount;
+        bool m_hasUnsupportedTracks;
+        bool m_startedPlaying;
+        bool m_isStreaming;
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        WebMediaPlayerProxy* m_proxy;
+#endif
+    };
+
+}
+
+#endif
+
+#endif
diff --git a/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp b/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp
new file mode 100644
index 0000000..9673d18
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerProxy.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#if ENABLE(VIDEO)
+
+#include "config.h"
+#include "MediaPlayerProxy.h"
+
+#include "c_class.h"
+#include "c_instance.h"
+#include "c_runtime.h"
+#include "DocumentLoader.h"
+#include "HTMLPlugInElement.h"
+#include "HTMLVideoElement.h"
+#include "JSDOMBinding.h"
+#include "JSPluginElementFunctions.h"
+#include "MediaPlayer.h"
+#include "Node.h"
+#include "npruntime_impl.h"
+#include "PlatformString.h"
+#include "PluginView.h"
+#include "RenderPartObject.h"
+#include "RenderWidget.h"
+#include "runtime.h"
+#include <runtime/Identifier.h>
+#include "Widget.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+using namespace Bindings;
+using namespace HTMLNames;
+
+WebMediaPlayerProxy::WebMediaPlayerProxy(MediaPlayer* player)
+    : m_mediaPlayer(player)
+    , m_init(false)
+    , m_hasSentResponseToPlugin(false)
+{
+    if (!m_init)
+        initEngine();
+}
+
+WebMediaPlayerProxy::~WebMediaPlayerProxy()
+{
+    m_instance.release();
+}
+
+ScriptInstance WebMediaPlayerProxy::pluginInstance()
+{
+    if (!m_instance) {
+        RenderObject* r = element()->renderer();
+        if (!r || !r->isWidget())
+            return 0;
+
+        Frame* frame = element()->document()->frame();
+
+        RenderWidget* renderWidget = static_cast<RenderWidget*>(element()->renderer());
+        if (renderWidget && renderWidget->widget())
+            m_instance = frame->script()->createScriptInstanceForWidget(renderWidget->widget());
+    }
+
+    return m_instance;
+}
+
+void WebMediaPlayerProxy::load(const String& url)
+{
+    if (!m_init)
+        initEngine();
+    if (m_init)
+        invokeMethod("play");
+}
+
+void WebMediaPlayerProxy::initEngine()
+{
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_mediaPlayer->mediaPlayerClient());
+    String url = element->initialURL();
+
+    if (url.isEmpty())
+        return;
+
+    Frame* frame = element->document()->frame();
+    Vector<String> paramNames;
+    Vector<String> paramValues;
+    String serviceType;
+
+    // add all attributes set on the embed object
+    if (NamedNodeMap* attributes = element->attributes()) {
+        for (unsigned i = 0; i < attributes->length(); ++i) {
+            Attribute* it = attributes->attributeItem(i);
+            paramNames.append(it->name().localName().string());
+            paramValues.append(it->value().string());
+        }
+    }
+    serviceType = "application/x-mplayer2";
+    frame->loader()->requestObject(static_cast<RenderPartObject*>(element->renderer()), url, nullAtom, serviceType, paramNames, paramValues);
+    m_init = true;
+
+}
+
+HTMLMediaElement* WebMediaPlayerProxy::element()
+{
+    return static_cast<HTMLMediaElement*>(m_mediaPlayer->mediaPlayerClient());
+
+}
+
+void WebMediaPlayerProxy::invokeMethod(const String& methodName)
+{
+    Frame* frame = element()->document()->frame();
+    RootObject *root = frame->script()->bindingRootObject();
+    if (!root)
+        return;
+    ExecState *exec = root->globalObject()->globalExec();
+    Instance* instance = pluginInstance().get();
+    if (!instance)
+        return;
+
+    instance->begin();
+    Class *aClass = instance->getClass();
+    Identifier iden(exec, methodName);
+    MethodList methodList = aClass->methodsNamed(iden, instance);
+    ArgList args;
+    instance->invokeMethod(exec, methodList , args);
+    instance->end();
+}
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/wince/MediaPlayerProxy.h b/WebCore/platform/graphics/wince/MediaPlayerProxy.h
new file mode 100644
index 0000000..05f9b21
--- /dev/null
+++ b/WebCore/platform/graphics/wince/MediaPlayerProxy.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Torch Mobile, Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+
+#ifndef MediaPlayerProxy_h
+#define MediaPlayerProxy_h
+
+#if ENABLE(VIDEO)
+
+#include "ScriptInstance.h"
+
+namespace WebCore {
+
+    class IntRect;
+    class IntSize;
+    class String;
+    class MediaPlayer;
+    class PluginView;
+    class HTMLMediaElement;
+
+    enum MediaPlayerProxyNotificationType {
+        MediaPlayerNotificationPlayPauseButtonPressed,
+        Idle,
+        Loading,
+        Loaded,
+        FormatError,
+        NetworkError,
+        DecodeError
+    };
+
+    class WebMediaPlayerProxy {
+    public:
+        WebMediaPlayerProxy(MediaPlayer* player);
+        ~WebMediaPlayerProxy();
+
+        MediaPlayer* mediaPlayer() {return m_mediaPlayer;}
+        void initEngine();
+        void load(const String& url);
+        HTMLMediaElement* element();
+        void invokeMethod(const String& methodName);
+        ScriptInstance pluginInstance();
+
+    private:
+        MediaPlayer* m_mediaPlayer;
+        bool m_init;
+        WebCore::PluginView* m_pluginView;
+        bool m_hasSentResponseToPlugin;
+        ScriptInstance m_instance;
+    };
+
+}
+#endif // ENABLE(VIDEO)
+
+#endif
diff --git a/WebCore/platform/graphics/wince/PathWince.cpp b/WebCore/platform/graphics/wince/PathWince.cpp
new file mode 100644
index 0000000..7589ccb
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PathWince.cpp
@@ -0,0 +1,163 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Path.h"
+
+#include "FloatRect.h"
+#include "NotImplemented.h"
+#include "PlatformPathWince.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+Path::Path()
+    : m_path(new PlatformPath())
+{
+}
+
+Path::Path(const Path& other)
+    : m_path(new PlatformPath(*other.m_path))
+{
+}
+
+Path::~Path()
+{
+    delete m_path;
+}
+
+Path& Path::operator=(const Path& other)
+{
+    if (&other != this) {
+        delete m_path;
+        m_path = new PlatformPath(*other.m_path);
+    }
+    return *this;
+}
+
+bool Path::contains(const FloatPoint& point, WindRule rule) const
+{
+    return m_path->contains(point, rule);
+}
+
+void Path::translate(const FloatSize& size)
+{
+    m_path->translate(size);
+}
+
+FloatRect Path::boundingRect() const
+{
+    return m_path->boundingRect();
+}
+
+void Path::moveTo(const FloatPoint& point)
+{
+    m_path->moveTo(point);
+}
+
+void Path::addLineTo(const FloatPoint& point)
+{
+    m_path->addLineTo(point);
+}
+
+void Path::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    m_path->addQuadCurveTo(cp, p);
+}
+
+void Path::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    m_path->addBezierCurveTo(cp1, cp2, p);
+}
+
+void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
+{
+    m_path->addArcTo(p1, p2, radius);
+}
+
+void Path::closeSubpath()
+{
+    m_path->closeSubpath();
+}
+
+void Path::addArc(const FloatPoint& p, float r, float sar, float ear, bool anticlockwise)
+{
+    m_path->addEllipse(p, r, r, sar, ear, anticlockwise);
+}
+
+void Path::addRect(const FloatRect& r)
+{
+    m_path->addRect(r);
+}
+
+void Path::addEllipse(const FloatRect& r)
+{
+    m_path->addEllipse(r);
+}
+
+void Path::clear()
+{
+    m_path->clear();
+}
+
+bool Path::isEmpty() const
+{
+    return m_path->isEmpty();
+}
+
+String Path::debugString() const
+{
+    return m_path->debugString();
+}
+
+void Path::apply(void* info, PathApplierFunction function) const
+{
+    m_path->apply(info, function);
+}
+
+void Path::transform(const TransformationMatrix& t)
+{
+    m_path->transform(t);
+}
+
+FloatRect Path::strokeBoundingRect(StrokeStyleApplier *)
+{
+    notImplemented();
+    return FloatRect();
+}
+
+bool Path::strokeContains(StrokeStyleApplier*, const FloatPoint&) const
+{
+    notImplemented();
+    return false;
+}
+
+bool Path::hasCurrentPoint() const
+{
+    // Not sure if this is correct. At the meantime, we do what other ports
+    // do.
+    // See https://bugs.webkit.org/show_bug.cgi?id=27266,
+    // https://bugs.webkit.org/show_bug.cgi?id=27187, and 
+    // http://trac.webkit.org/changeset/45873
+    return !isEmpty();
+}
+
+}
diff --git a/WebCore/platform/graphics/wince/PlatformPathWince.cpp b/WebCore/platform/graphics/wince/PlatformPathWince.cpp
new file mode 100644
index 0000000..66fad50
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PlatformPathWince.cpp
@@ -0,0 +1,810 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "PlatformPathWince.h"
+
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "Path.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include "WinceGraphicsExtras.h"
+#include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
+
+#include <windows.h>
+
+namespace WebCore {
+
+// Implemented in GraphicsContextWince.cpp
+void getEllipsePointByAngle(double angle, double a, double b, float& x, float& y);
+
+static void quadCurve(int segments, Vector<PathPoint>& pts, const PathPoint* control)
+{
+    const float step = 1.0 / segments;
+    register float tA = 0.0;
+    register float tB = 1.0;
+
+    float c1x = control[0].x();
+    float c1y = control[0].y();
+    float c2x = control[1].x();
+    float c2y = control[1].y();
+    float c3x = control[2].x();
+    float c3y = control[2].y();
+
+    const int offset = pts.size();
+    pts.resize(offset + segments);
+    PathPoint pp;
+    pp.m_x = c1x;
+    pp.m_y = c1y;
+
+    for (int i = 1; i < segments; ++i) {
+        tA += step;
+        tB -= step;
+
+        const float a = tB * tB;
+        const float b = 2.0 * tA * tB;
+        const float c = tA * tA;
+
+        pp.m_x = c1x * a + c2x * b + c3x * c;
+        pp.m_y = c1y * a + c2y * b + c3y * c;
+
+        pts[offset + i - 1] = pp;
+    }
+
+    pp.m_x = c3x;
+    pp.m_y = c3y;
+    pts[offset + segments - 1] = pp;
+}
+
+static inline void bezier(int segments, Vector<PathPoint>& pts, const PathPoint* control)
+{
+    const float step = 1.0 / segments;
+    register float tA = 0.0;
+    register float tB = 1.0;
+
+    float c1x = control[0].x();
+    float c1y = control[0].y();
+    float c2x = control[1].x();
+    float c2y = control[1].y();
+    float c3x = control[2].x();
+    float c3y = control[2].y();
+    float c4x = control[3].x();
+    float c4y = control[3].y();
+
+    const int offset = pts.size();
+    pts.resize(offset + segments);
+    PathPoint pp;
+    pp.m_x = c1x;
+    pp.m_y = c1y;
+
+    for (int i = 1; i < segments; ++i) {
+        tA += step;
+        tB -= step;
+        const float tAsq = tA * tA;
+        const float tBsq = tB * tB;
+
+        const float a = tBsq * tB;
+        const float b = 3.0 * tA * tBsq;
+        const float c = 3.0 * tB * tAsq;
+        const float d = tAsq * tA;
+
+        pp.m_x = c1x * a + c2x * b + c3x * c + c4x * d;
+        pp.m_y = c1y * a + c2y * b + c3y * c + c4y * d;
+
+        pts[offset + i - 1] = pp;
+    }
+
+    pp.m_x = c4x;
+    pp.m_y = c4y;
+    pts[offset + segments - 1] = pp;
+}
+
+static bool containsPoint(const FloatRect& r, const FloatPoint& p)
+{
+    return p.x() >= r.x() && p.y() >= r.y() && p.x() < r.right() && p.y() < r.bottom();
+}
+
+static void normalizeAngle(float& angle)
+{
+    angle = fmod(angle, 2 * piFloat);
+    if (angle < 0)
+        angle += 2 * piFloat;
+    if (angle < 0.00001f)
+        angle = 0;
+}
+
+static void transformArcPoint(float& x, float& y, const FloatPoint& c)
+{
+    x += c.x();
+    y += c.y();
+}
+
+static void inflateRectToContainPoint(FloatRect& r, float x, float y)
+{
+    if (r.isEmpty()) {
+        r.setX(x);
+        r.setY(y);
+        r.setSize(FloatSize(1, 1));
+        return;
+    }
+    if (x < r.x()) {
+        r.setWidth(r.right() - x);
+        r.setX(x);
+    } else {
+        float w = x - r.x() + 1;
+        if (w > r.width())
+            r.setWidth(w);
+    }
+    if (y < r.y()) {
+        r.setHeight(r.bottom() - y);
+        r.setY(y);
+    } else {
+        float h =  y - r.y() + 1;
+        if (h > r.height())
+            r.setHeight(h);
+    }
+}
+
+// return 0-based value: 0 - first Quadrant ( 0 - 90 degree)
+static inline int quadrant(const PathPoint& point, const PathPoint& origin)
+{
+    return point.m_x < origin.m_x ?
+        (point.m_y < origin.m_y ? 2 : 1)
+        : (point.m_y < origin.m_y ? 3 : 0);
+}
+
+static inline bool isQuadrantOnLeft(int q) { return q == 1 || q == 2; }
+static inline bool isQuadrantOnRight(int q) { return q == 0 || q == 3; }
+static inline bool isQuadrantOnTop(int q) { return q == 2 || q == 3; }
+static inline bool isQuadrantOnBottom(int q) { return q == 0 || q == 1; }
+
+static inline int nextQuadrant(int q) { return q == 3 ? 0 : q + 1; }
+static inline int quadrantDiff(int q1, int q2)
+{
+    int d = q1 - q2;
+    while (d < 0)
+        d += 4;
+    return d;
+}
+
+struct PathVector {
+    float m_x;
+    float m_y;
+
+    PathVector() : m_x(0), m_y(0) {}
+    PathVector(float x, float y) : m_x(x), m_y(y) {}
+    double angle() const { return atan2(m_y, m_x); }
+    operator double () const { return angle(); }
+    double length() const { return _hypot(m_x, m_y); }
+};
+
+PathVector operator-(const PathPoint& p1, const PathPoint& p2)
+{
+    return PathVector(p1.m_x - p2.m_x, p1.m_y - p2.m_y);
+}
+
+static void addArcPoint(PathPolygon& poly, const PathPoint& center, const PathPoint& radius, double angle)
+{
+    PathPoint p;
+    getEllipsePointByAngle(angle, radius.m_x, radius.m_y, p.m_x, p.m_y);
+    transformArcPoint(p.m_x, p.m_y, center);
+    if (poly.isEmpty() || poly.last() != p)
+        poly.append(p);
+}
+
+static void addArcPoints(PathPolygon& poly, const PlatformPathElement::ArcTo& data)
+{
+    const PathPoint& startPoint = poly.last();
+    double curAngle = startPoint - data.m_center;
+    double endAngle = data.m_end - data.m_center;
+    double angleStep = 2. / std::max(data.m_radius.m_x, data.m_radius.m_y);
+    if (data.m_clockwise) {
+        if (endAngle <= curAngle || startPoint == data.m_end)
+            endAngle += 2 * piDouble;
+    } else {
+        angleStep = -angleStep;
+        if (endAngle >= curAngle || startPoint == data.m_end)
+            endAngle -= 2 * piDouble;
+    }
+
+    for (curAngle += angleStep; data.m_clockwise ? curAngle < endAngle : curAngle > endAngle; curAngle += angleStep)
+        addArcPoint(poly, data.m_center, data.m_radius, curAngle);
+
+    if (poly.isEmpty() || poly.last() != data.m_end)
+        poly.append(data.m_end);
+}
+
+static void drawPolygons(HDC dc, const Vector<PathPolygon>& polygons, bool fill, const TransformationMatrix* transformation)
+{
+    MemoryAllocationCanFail canFail;
+    for (Vector<PathPolygon>::const_iterator i = polygons.begin(); i != polygons.end(); ++i) {
+        int npoints = i->size();
+        if (!npoints)
+            continue;
+
+        POINT* winPoints = 0;
+        if (fill) {
+            if (npoints > 2)
+                winPoints = new POINT[npoints + 1];
+        } else
+            winPoints = new POINT[npoints];
+
+        if (winPoints) {
+            if (transformation) {
+                for (int i2 = 0; i2 < npoints; ++i2) {
+                    FloatPoint trPoint = transformation->mapPoint(i->at(i2));
+                    winPoints[i2].x = stableRound(trPoint.x());
+                    winPoints[i2].y = stableRound(trPoint.y());
+                }
+            } else {
+                for (int i2 = 0; i2 < npoints; ++i2) {
+                    winPoints[i2].x = stableRound(i->at(i2).x());
+                    winPoints[i2].y = stableRound(i->at(i2).y());
+                }
+            }
+
+            if (fill && winPoints[npoints - 1] != winPoints[0]) {
+                winPoints[npoints].x = winPoints[0].x;
+                winPoints[npoints].y = winPoints[0].y;
+                ++npoints;
+            }
+
+            if (fill)
+                ::Polygon(dc, winPoints, npoints);
+            else
+                ::Polyline(dc, winPoints, npoints);
+            delete[] winPoints;
+        }
+    }
+}
+
+
+int PlatformPathElement::numControlPoints() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+    case PathLineTo:
+        return 1;
+    case PathQuadCurveTo:
+    case PathArcTo:
+        return 2;
+    case PathBezierCurveTo:
+        return 3;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return 0;
+    }
+}
+
+int PlatformPathElement::numPoints() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+    case PathLineTo:
+    case PathArcTo:
+        return 1;
+    case PathQuadCurveTo:
+        return 2;
+    case PathBezierCurveTo:
+        return 3;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return 0;
+    }
+}
+
+void PathPolygon::move(const FloatSize& offset)
+{
+    for (Vector<PathPoint>::iterator i = begin(); i < end(); ++i)
+        i->move(offset);
+}
+
+void PathPolygon::transform(const TransformationMatrix& t)
+{
+    for (Vector<PathPoint>::iterator i = begin(); i < end(); ++i)
+        *i = t.mapPoint(*i);
+}
+
+bool PathPolygon::contains(const FloatPoint& point) const
+{
+    if (size() < 3)
+        return false;
+
+    // Test intersections between the polygon and the vertical line: x = point.x()
+
+    int intersected = 0;
+    const PathPoint* point1 = &last();
+    Vector<PathPoint>::const_iterator last = end();
+    // wasNegative: -1 means unknown, 0 means false, 1 means true.
+    int wasNegative = -1;
+    for (Vector<PathPoint>::const_iterator i = begin(); i != last; ++i) {
+        const PathPoint& point2 = *i;
+        if (point1->x() != point.x()) {
+            if (point2.x() == point.x()) {
+                // We are getting on the vertical line
+                wasNegative = point1->x() < point.x() ? 1 : 0;
+            } else if (point2.x() < point.x() != point1->x() < point.x()) {
+                float y = (point2.y() - point1->y()) / (point2.x() - point1->x()) * (point.x() - point1->x()) + point1->y();
+                if (y >= point.y())
+                    ++intersected;
+            }
+        } else {
+            // We were on the vertical line
+
+            // handle special case
+            if (point1->y() == point.y())
+                return true;
+
+            if (point1->y() > point.y()) {
+                if (point2.x() == point.x()) {
+                    // see if the point is on this segment
+                    if (point2.y() <= point.y())
+                        return true;
+
+                    // We are still on the line
+                } else {
+                    // We are leaving the line now.
+                    // We have to get back to see which side we come from. If we come from
+                    // the same side we are leaving, no intersection should be counted
+                    if (wasNegative < 0) {
+                        Vector<PathPoint>::const_iterator jLast = i;
+                        Vector<PathPoint>::const_iterator j = i;
+                        do {
+                            if (j == begin())
+                                j = last;
+                            else
+                                --j;
+                            if (j->x() != point.x()) {
+                                if (j->x() > point.x())
+                                    wasNegative = 0;
+                                else
+                                    wasNegative = 1;
+                                break;
+                            }
+                        } while (j != jLast);
+
+                        if (wasNegative < 0)
+                            return false;
+                    }
+                    if (wasNegative ? point2.x() > point.x() : point2.x() < point.x())
+                        ++intersected;
+                }
+            } else if (point2.x() == point.x() && point2.y() >= point.y())
+                return true;
+        }
+        point1 = &point2;
+    }
+
+    return intersected & 1;
+}
+
+void PlatformPathElement::move(const FloatSize& offset)
+{
+    int n = numControlPoints();
+    for (int i = 0; i < n; ++i)
+        m_data.m_points[i].move(offset);
+}
+
+void PlatformPathElement::transform(const TransformationMatrix& t)
+{
+    int n = numControlPoints();
+    for (int i = 0; i < n; ++i) {
+        FloatPoint p = t.mapPoint(m_data.m_points[i]);
+        m_data.m_points[i].set(p.x(), p.y());
+    }
+}
+
+void PlatformPathElement::inflateRectToContainMe(FloatRect& r, const FloatPoint& lastPoint) const
+{
+    if (m_type == PathArcTo) {
+        const ArcTo& data = m_data.m_arcToData;
+        PathPoint startPoint;
+        startPoint = lastPoint;
+        PathPoint endPoint = data.m_end;
+        if (!data.m_clockwise)
+            std::swap(startPoint, endPoint);
+
+        int q0 = quadrant(startPoint, data.m_center);
+        int q1 = quadrant(endPoint, data.m_center);
+        bool containsExtremes[4] = { false }; // bottom, left, top, right
+        static const PathPoint extremeVectors[4] = { { 0, 1 }, { -1, 0 }, { 0, -1 }, { 1, 0 } };
+        if (q0 == q1) {
+            if (startPoint.m_x == endPoint.m_x || isQuadrantOnBottom(q0) != startPoint.m_x > endPoint.m_x) {
+                for (int i = 0; i < 4; ++i)
+                    containsExtremes[i] = true;
+            }
+        } else {
+            int extreme = q0;
+            int diff = quadrantDiff(q1, q0);
+            for (int i = 0; i < diff; ++i) {
+                containsExtremes[extreme] = true;
+                extreme = nextQuadrant(extreme);
+            }
+        }
+
+        inflateRectToContainPoint(r, startPoint.m_x, startPoint.m_y);
+        inflateRectToContainPoint(r, endPoint.m_x, endPoint.m_y);
+        for (int i = 0; i < 4; ++i) {
+            if (containsExtremes[i])
+                inflateRectToContainPoint(r, data.m_center.m_x + data.m_radius.m_x * extremeVectors[i].m_x, data.m_center.m_y + data.m_radius.m_y * extremeVectors[i].m_y);
+        }
+    } else {
+        int n = numPoints();
+        for (int i = 0; i < n; ++i)
+            inflateRectToContainPoint(r, m_data.m_points[i].m_x, m_data.m_points[i].m_y);
+    }
+}
+
+PathElementType PlatformPathElement::type() const
+{
+    switch (m_type) {
+    case PathMoveTo:
+        return PathElementMoveToPoint;
+    case PathLineTo:
+        return PathElementAddLineToPoint;
+    case PathArcTo:
+        // FIXME: there's no arcTo type for PathElement
+        return PathElementAddLineToPoint;
+        // return PathElementAddQuadCurveToPoint;
+    case PathQuadCurveTo:
+        return PathElementAddQuadCurveToPoint;
+    case PathBezierCurveTo:
+        return PathElementAddCurveToPoint;
+    default:
+        ASSERT(m_type == PathCloseSubpath);
+        return PathElementCloseSubpath;
+    }
+}
+
+PlatformPath::PlatformPath()
+    : m_penLifted(true)
+{
+    m_currentPoint.clear();
+}
+
+void PlatformPath::ensureSubpath()
+{
+    if (m_penLifted) {
+        m_penLifted = false;
+        m_subpaths.append(PathPolygon());
+        m_subpaths.last().append(m_currentPoint);
+    } else
+        ASSERT(!m_subpaths.isEmpty());
+}
+
+void PlatformPath::addToSubpath(const PlatformPathElement& e)
+{
+    if (e.platformType() == PlatformPathElement::PathMoveTo) {
+        m_penLifted = true;
+        m_currentPoint = e.pointAt(0);
+    } else if (e.platformType() == PlatformPathElement::PathCloseSubpath) {
+        m_penLifted = true;
+        if (!m_subpaths.isEmpty()) {
+            if (m_currentPoint != m_subpaths.last()[0]) {
+                // According to W3C, we have to draw a line from current point to the initial point
+                m_subpaths.last().append(m_subpaths.last()[0]);
+                m_currentPoint = m_subpaths.last()[0];
+            }
+        } else
+            m_currentPoint.clear();
+    } else {
+        ensureSubpath();
+        switch (e.platformType()) {
+        case PlatformPathElement::PathLineTo:
+            m_subpaths.last().append(e.pointAt(0));
+            break;
+        case PlatformPathElement::PathArcTo:
+            addArcPoints(m_subpaths.last(), e.arcTo());
+            break;
+        case PlatformPathElement::PathQuadCurveTo:
+            {
+                PathPoint control[] = {
+                    m_currentPoint,
+                    e.pointAt(0),
+                    e.pointAt(1),
+                };
+                // FIXME: magic number?
+                quadCurve(50, m_subpaths.last(), control);
+            }
+            break;
+        case PlatformPathElement::PathBezierCurveTo:
+            {
+                PathPoint control[] = {
+                    m_currentPoint,
+                    e.pointAt(0),
+                    e.pointAt(1),
+                    e.pointAt(2),
+                };
+                // FIXME: magic number?
+                bezier(100, m_subpaths.last(), control);
+            }
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
+        }
+        m_currentPoint = m_subpaths.last().last();
+    }
+}
+
+void PlatformPath::append(const PlatformPathElement& e)
+{
+    e.inflateRectToContainMe(m_boundingRect, lastPoint());
+    addToSubpath(e);
+    m_elements.append(e);
+}
+
+void PlatformPath::append(const PlatformPath& p)
+{
+    const PlatformPathElements& e = p.elements();
+    for (PlatformPathElements::const_iterator it(e.begin()); it != e.end(); ++it) {
+        addToSubpath(*it);
+        it->inflateRectToContainMe(m_boundingRect, lastPoint());
+        m_elements.append(*it);
+    }
+}
+
+void PlatformPath::clear()
+{
+    m_elements.clear();
+    m_boundingRect = FloatRect();
+    m_subpaths.clear();
+    m_currentPoint.clear();
+    m_penLifted = true;
+}
+
+void PlatformPath::strokePath(HDC dc, const TransformationMatrix* transformation) const
+{
+    drawPolygons(dc, m_subpaths, false, transformation);
+}
+
+void PlatformPath::fillPath(HDC dc, const TransformationMatrix* transformation) const
+{
+    HGDIOBJ oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
+    drawPolygons(dc, m_subpaths, true, transformation);
+    SelectObject(dc, oldPen);
+}
+
+void PlatformPath::translate(const FloatSize& size)
+{
+    for (PlatformPathElements::iterator it(m_elements.begin()); it != m_elements.end(); ++it)
+        it->move(size);
+
+    m_boundingRect.move(size);
+    for (Vector<PathPolygon>::iterator it = m_subpaths.begin(); it != m_subpaths.end(); ++it)
+        it->move(size);
+}
+
+void PlatformPath::transform(const TransformationMatrix& t)
+{
+    for (PlatformPathElements::iterator it(m_elements.begin()); it != m_elements.end(); ++it)
+        it->transform(t);
+
+    m_boundingRect = t.mapRect(m_boundingRect);
+    for (Vector<PathPolygon>::iterator it = m_subpaths.begin(); it != m_subpaths.end(); ++it)
+        it->transform(t);
+}
+
+bool PlatformPath::contains(const FloatPoint& point, WindRule rule) const
+{
+    // optimization: check the bounding rect first
+    if (!containsPoint(m_boundingRect, point))
+        return false;
+
+    for (Vector<PathPolygon>::const_iterator i = m_subpaths.begin(); i != m_subpaths.end(); ++i) {
+        if (i->contains(point))
+            return true;
+    }
+
+    return false;
+}
+
+void PlatformPath::moveTo(const FloatPoint& point)
+{
+    PlatformPathElement::MoveTo data = { { point.x(), point.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addLineTo(const FloatPoint& point)
+{
+    PlatformPathElement::LineTo data = { { point.x(), point.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addQuadCurveTo(const FloatPoint& cp, const FloatPoint& p)
+{
+    PlatformPathElement::QuadCurveTo data = { { cp.x(), cp.y() }, { p.x(), p.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addBezierCurveTo(const FloatPoint& cp1, const FloatPoint& cp2, const FloatPoint& p)
+{
+    PlatformPathElement::BezierCurveTo data = { { cp1.x(), cp1.y() }, { cp2.x(), cp2.y() }, { p.x(), p.y() } };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::addArcTo(const FloatPoint& fp1, const FloatPoint& fp2, float radius)
+{
+    const PathPoint& p0 = m_currentPoint;
+    PathPoint p1;
+    p1 = fp1;
+    PathPoint p2;
+    p2 = fp2;
+    if (!radius || p0 == p1 || p1 == p2) {
+        addLineTo(p1);
+        return;
+    }
+
+    PathVector v01 = p0 - p1;
+    PathVector v21 = p2 - p1;
+
+    // sin(A - B) = sin(A) * cos(B) - sin(B) * cos(A)
+    double cross = v01.m_x * v21.m_y - v01.m_y * v21.m_x;
+
+    if (fabs(cross) < 1E-10) {
+        // on one line
+        addLineTo(p1);
+        return;
+    }
+
+    double d01 = v01.length();
+    double d21 = v21.length();
+    double angle = (piDouble - abs(asin(cross / (d01 * d21)))) * 0.5;
+    double span = radius * tan(angle);
+    double rate = span / d01;
+    PathPoint startPoint;
+    startPoint.m_x = p1.m_x + v01.m_x * rate;
+    startPoint.m_y = p1.m_y + v01.m_y * rate;
+
+    addLineTo(startPoint);
+
+    PathPoint endPoint;
+    rate = span / d21;
+    endPoint.m_x = p1.m_x + v21.m_x * rate;
+    endPoint.m_y = p1.m_y + v21.m_y * rate;
+
+    PathPoint midPoint;
+    midPoint.m_x = (startPoint.m_x + endPoint.m_x) * 0.5;
+    midPoint.m_y = (startPoint.m_y + endPoint.m_y) * 0.5;
+
+    PathVector vm1 = midPoint - p1;
+    double dm1 = vm1.length();
+    double d = _hypot(radius, span);
+
+    PathPoint centerPoint;
+    rate = d / dm1;
+    centerPoint.m_x = p1.m_x + vm1.m_x * rate;
+    centerPoint.m_y = p1.m_y + vm1.m_y * rate;
+
+    PlatformPathElement::ArcTo data = {
+        endPoint,
+        centerPoint,
+        { radius, radius },
+        cross < 0
+    };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+void PlatformPath::closeSubpath()
+{
+    PlatformPathElement pe;
+    append(pe);
+}
+
+// add a circular arc centred at p with radius r from start angle sar (radians) to end angle ear
+void PlatformPath::addEllipse(const FloatPoint& p, float a, float b, float sar, float ear, bool anticlockwise)
+{
+    float startX, startY, endX, endY;
+
+    normalizeAngle(sar);
+    normalizeAngle(ear);
+
+    getEllipsePointByAngle(sar, a, b, startX, startY);
+    getEllipsePointByAngle(ear, a, b, endX, endY);
+
+    transformArcPoint(startX, startY, p);
+    transformArcPoint(endX, endY, p);
+
+    FloatPoint start(startX, startY);
+    moveTo(start);
+
+    PlatformPathElement::ArcTo data = { { endX, endY }, { p.x(), p.y() },  { a, b }, !anticlockwise };
+    PlatformPathElement pe(data);
+    append(pe);
+}
+
+
+void PlatformPath::addRect(const FloatRect& r)
+{
+    moveTo(r.location());
+
+    float right = r.right() - 1;
+    float bottom = r.bottom() - 1;
+    addLineTo(FloatPoint(right, r.y()));
+    addLineTo(FloatPoint(right, bottom));
+    addLineTo(FloatPoint(r.x(), bottom));
+    addLineTo(r.location());
+}
+
+void PlatformPath::addEllipse(const FloatRect& r)
+{
+    FloatSize radius(r.width() * 0.5, r.height() * 0.5);
+    addEllipse(r.location() + radius, radius.width(), radius.height(), 0, 0, true);
+}
+
+String PlatformPath::debugString() const
+{
+    String ret;
+    for (PlatformPathElements::const_iterator i(m_elements.begin()); i != m_elements.end(); ++i) {
+        switch (i->platformType()) {
+        case PlatformPathElement::PathMoveTo:
+        case PlatformPathElement::PathLineTo:
+            ret += String::format("M %f %f\n", i->pointAt(0).m_x, i->pointAt(0).m_y);
+            break;
+        case PlatformPathElement::PathArcTo:
+            ret += String::format("A %f %f %f %f %f %f %c\n"
+                , i->arcTo().m_end.m_x, i->arcTo().m_end.m_y
+                , i->arcTo().m_center.m_x, i->arcTo().m_center.m_y
+                , i->arcTo().m_radius.m_x, i->arcTo().m_radius.m_y
+                , i->arcTo().m_clockwise? 'Y' : 'N');
+            break;
+        case PlatformPathElement::PathQuadCurveTo:
+            ret += String::format("Q %f %f %f %f\n"
+                , i->pointAt(0).m_x, i->pointAt(0).m_y
+                , i->pointAt(1).m_x, i->pointAt(1).m_y);
+            break;
+        case PlatformPathElement::PathBezierCurveTo:
+            ret += String::format("B %f %f %f %f %f %f\n"
+                , i->pointAt(0).m_x, i->pointAt(0).m_y
+                , i->pointAt(1).m_x, i->pointAt(1).m_y
+                , i->pointAt(2).m_x, i->pointAt(2).m_y);
+            break;
+        default:
+            ASSERT(i->platformType() == PlatformPathElement::PathCloseSubpath);
+            ret += "S\n";
+            break;
+        }
+    }
+
+    return ret;
+}
+
+void PlatformPath::apply(void* info, PathApplierFunction function) const
+{
+    PathElement pelement;
+    FloatPoint points[3];
+    pelement.points = points;
+
+    for (PlatformPathElements::const_iterator it(m_elements.begin()); it != m_elements.end(); ++it) {
+        pelement.type = it->type();
+        int n = it->numPoints();
+        for (int i = 0; i < n; ++i)
+            points[i] = it->pointAt(i);
+        function(info, &pelement);
+    }
+}
+
+} // namespace Webcore
diff --git a/WebCore/platform/graphics/wince/PlatformPathWince.h b/WebCore/platform/graphics/wince/PlatformPathWince.h
new file mode 100644
index 0000000..fca00a7
--- /dev/null
+++ b/WebCore/platform/graphics/wince/PlatformPathWince.h
@@ -0,0 +1,178 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef PlatformPathWince_h
+#define PlatformPathWince_h
+
+namespace WebCore {
+
+    class GraphicsContext;
+
+    struct PathPoint {
+        float m_x;
+        float m_y;
+        const float& x() const { return m_x; }
+        const float& y() const { return m_y; }
+        void set(float x, float y)
+        {
+            m_x = x;
+            m_y = y;
+        };
+        operator FloatPoint() const { return FloatPoint(m_x, m_y); }
+        void move(const FloatSize& offset)
+        {
+            m_x += offset.width();
+            m_y += offset.height();
+        }
+        PathPoint& operator=(const FloatPoint& p)
+        {
+            m_x = p.x();
+            m_y = p.y();
+            return *this;
+        }
+        void clear() { m_x = m_y = 0; }
+    };
+
+    struct PathPolygon: public Vector<PathPoint> {
+        void move(const FloatSize& offset);
+        void transform(const TransformationMatrix& t);
+        bool contains(const FloatPoint& point) const;
+    };
+
+    class PlatformPathElement {
+    public:
+        enum PlaformPathElementType {
+            PathMoveTo,
+            PathLineTo,
+            PathArcTo,
+            PathQuadCurveTo,
+            PathBezierCurveTo,
+            PathCloseSubpath,
+        };
+
+        struct MoveTo {
+            PathPoint m_end;
+        };
+
+        struct LineTo {
+            PathPoint m_end;
+        };
+
+        struct ArcTo {
+            PathPoint m_end;
+            PathPoint m_center;
+            PathPoint m_radius;
+            bool m_clockwise;
+        };
+
+        struct QuadCurveTo {
+            PathPoint m_point0;
+            PathPoint m_point1;
+        };
+
+        struct BezierCurveTo {
+            PathPoint m_point0;
+            PathPoint m_point1;
+            PathPoint m_point2;
+        };
+
+        PlatformPathElement(): m_type(PathCloseSubpath) { m_data.m_points[0].set(0, 0);    }
+        PlatformPathElement(const MoveTo& data): m_type(PathMoveTo) { m_data.m_moveToData = data; }
+        PlatformPathElement(const LineTo& data): m_type(PathLineTo) { m_data.m_lineToData = data; }
+        PlatformPathElement(const ArcTo& data): m_type(PathArcTo) { m_data.m_arcToData = data; }
+        PlatformPathElement(const QuadCurveTo& data): m_type(PathQuadCurveTo) { m_data.m_quadCurveToData = data; }
+        PlatformPathElement(const BezierCurveTo& data): m_type(PathBezierCurveTo) { m_data.m_bezierCurveToData = data; }
+
+        const MoveTo& moveTo() const { return m_data.m_moveToData; }
+        const LineTo& lineTo() const { return m_data.m_lineToData; }
+        const ArcTo& arcTo() const { return m_data.m_arcToData; }
+        const QuadCurveTo& quadCurveTo() const { return m_data.m_quadCurveToData; }
+        const BezierCurveTo& bezierCurveTo() const { return m_data.m_bezierCurveToData; }
+        const PathPoint& lastPoint() const
+        {
+            int n = numPoints();
+            return n > 1 ? m_data.m_points[n - 1] : m_data.m_points[0];
+        }
+        const PathPoint& pointAt(int index) const { return m_data.m_points[index]; }
+        int numPoints() const;
+        int numControlPoints() const;
+        void move(const FloatSize& offset);
+        void transform(const TransformationMatrix& t);
+        PathElementType type() const;
+        PlaformPathElementType platformType() const { return m_type; }
+        void inflateRectToContainMe(FloatRect& r, const FloatPoint& lastPoint) const;
+
+    private:
+        PlaformPathElementType m_type;
+        union {
+            MoveTo m_moveToData;
+            LineTo m_lineToData;
+            ArcTo m_arcToData;
+            QuadCurveTo m_quadCurveToData;
+            BezierCurveTo m_bezierCurveToData;
+            PathPoint m_points[4];
+        } m_data;
+    };
+
+    typedef Vector<PlatformPathElement> PlatformPathElements;
+
+    class PlatformPath {
+    public:
+        PlatformPath();
+        const PlatformPathElements& elements() const { return m_elements; }
+        void append(const PlatformPathElement& e);
+        void append(const PlatformPath& p);
+        void clear();
+        bool isEmpty() const { return m_elements.isEmpty(); }
+
+        void strokePath(HDC, const TransformationMatrix* tr) const;
+        void fillPath(HDC, const TransformationMatrix* tr) const;
+        FloatPoint lastPoint() const { return m_elements.isEmpty() ? FloatPoint(0, 0) : m_elements.last().lastPoint(); }
+
+        const FloatRect& boundingRect() const { return m_boundingRect; }
+        bool contains(const FloatPoint& point, WindRule rule) const;
+        void translate(const FloatSize& size);
+        void transform(const TransformationMatrix& t);
+
+        void moveTo(const FloatPoint&);
+        void addLineTo(const FloatPoint&);
+        void addQuadCurveTo(const FloatPoint& controlPoint, const FloatPoint& point);
+        void addBezierCurveTo(const FloatPoint& controlPoint1, const FloatPoint& controlPoint2, const FloatPoint&);
+        void addArcTo(const FloatPoint&, const FloatPoint&, float radius);
+        void closeSubpath();
+        void addEllipse(const FloatPoint& p, float a, float b, float sar, float ear, bool anticlockwise);
+        void addRect(const FloatRect& r);
+        void addEllipse(const FloatRect& r);
+        String debugString() const;
+        void apply(void* info, PathApplierFunction function) const;
+
+    private:
+        void ensureSubpath();
+        void addToSubpath(const PlatformPathElement& e);
+
+        PlatformPathElements m_elements;
+        FloatRect m_boundingRect;
+        Vector<PathPolygon> m_subpaths;
+        PathPoint m_currentPoint;
+        bool m_penLifted;
+    };
+
+}
+
+#endif // PlatformPathWince_h
diff --git a/WebCore/platform/graphics/wince/WinceGraphicsExtras.h b/WebCore/platform/graphics/wince/WinceGraphicsExtras.h
new file mode 100644
index 0000000..2a6fae1
--- /dev/null
+++ b/WebCore/platform/graphics/wince/WinceGraphicsExtras.h
@@ -0,0 +1,39 @@
+/*
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WinceGraphicsExtras_h
+#define WinceGraphicsExtras_h
+
+// This file is used to contain small utilities used by WINCE graphics code.
+
+namespace WebCore {
+    // Always round to same direction. 0.5 is rounded to 1,
+    // and -0.5 (0.5 - 1) is rounded to 0 (1 - 1), so that it
+    // is consistent when transformation shifts.
+    static inline int stableRound(double d)
+    {
+        if (d > 0)
+            return static_cast<int>(d + 0.5);
+
+        int i = static_cast<int>(d);
+        return i - d > 0.5 ? i - 1 : i;
+    }
+}
+
+#endif WinceGraphicsExtras_h
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 59e388e..686fb07 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -506,4 +506,59 @@ void GraphicsContext::fillRect(const FloatRect& rect)
         return;
 }
 
+void GraphicsContext::setPlatformShadow(IntSize const&,int,Color const&) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::clearPlatformShadow() 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::beginTransparencyLayer(float) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::endTransparencyLayer() 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::clearRect(const FloatRect&) 
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::strokeRect(const FloatRect&, float)
+{ 
+    notImplemented(); 
+}
+
+void GraphicsContext::setLineCap(LineCap) 
+{
+    notImplemented(); 
+}
+
+void GraphicsContext::setLineJoin(LineJoin)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setMiterLimit(float)
+{
+    notImplemented();
+}
+
+void GraphicsContext::setAlpha(float)
+{
+    notImplemented();
+}
+
+void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/graphics/wx/IconWx.cpp b/WebCore/platform/graphics/wx/IconWx.cpp
new file mode 100644
index 0000000..e82091e
--- /dev/null
+++ b/WebCore/platform/graphics/wx/IconWx.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "Icon.h"
+
+#include "GraphicsContext.h"
+#include "PlatformString.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+Icon::~Icon()
+{
+}
+
+PassRefPtr<Icon> Icon::createIconForFile(const String& filename)
+{
+    notImplemented();
+    return 0;
+}
+
+PassRefPtr<Icon> Icon::createIconForFiles(const Vector<String>& filenames)
+{
+    notImplemented();
+    return 0;
+}
+
+void Icon::paint(GraphicsContext* ctx, const IntRect& rect)
+{
+    notImplemented();
+}
+
+}
+
diff --git a/WebCore/platform/graphics/wx/ImageBufferWx.cpp b/WebCore/platform/graphics/wx/ImageBufferWx.cpp
index e71dbde..49f3f3b 100644
--- a/WebCore/platform/graphics/wx/ImageBufferWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageBufferWx.cpp
@@ -53,13 +53,24 @@ GraphicsContext* ImageBuffer::context() const
     return 0;
 }
 
-PassRefPtr<ImageData> ImageBuffer::getImageData(const IntRect&) const
+PassRefPtr<ImageData> ImageBuffer::getUnmultipliedImageData(const IntRect& rect) const
 {
     notImplemented();
     return 0;
 }
 
-void ImageBuffer::putImageData(ImageData*, const IntRect&, const IntPoint&)
+PassRefPtr<ImageData> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
+{
+    notImplemented();
+    return 0;
+}
+
+void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
+{
+    notImplemented();
+}
+
+void ImageBuffer::putPremultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     notImplemented();
 }
diff --git a/WebCore/platform/graphics/wx/ImageSourceWx.cpp b/WebCore/platform/graphics/wx/ImageSourceWx.cpp
deleted file mode 100644
index 06c165d..0000000
--- a/WebCore/platform/graphics/wx/ImageSourceWx.cpp
+++ /dev/null
@@ -1,226 +0,0 @@
-/*
- * Copyright (C) 2006, 2007 Apple Computer, Kevin Ollivier.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "ImageSource.h"
-
-#include "BMPImageDecoder.h"
-#include "GIFImageDecoder.h"
-#include "ICOImageDecoder.h"
-#include "JPEGImageDecoder.h"
-#include "NotImplemented.h"
-#include "PNGImageDecoder.h"
-#include "SharedBuffer.h"
-#include "XBMImageDecoder.h"
-
-#include <wx/defs.h>
-#include <wx/bitmap.h>
-#if USE(WXGC)
-#include <wx/graphics.h>
-#endif
-#include <wx/image.h>
-#include <wx/rawbmp.h>
-
-namespace WebCore {
-
-ImageDecoder* createDecoder(const SharedBuffer& data)
-{
-    // We need at least 4 bytes to figure out what kind of image we're dealing with.
-    int length = data.size();
-    if (length < 4)
-        return 0;
-
-    const unsigned char* uContents = (const unsigned char*)data.data();
-    const char* contents = data.data();
-
-    // GIFs begin with GIF8(7 or 9).
-    if (strncmp(contents, "GIF8", 4) == 0)
-        return new GIFImageDecoder();
-
-    // Test for PNG.
-    if (uContents[0]==0x89 &&
-        uContents[1]==0x50 &&
-        uContents[2]==0x4E &&
-        uContents[3]==0x47)
-        return new PNGImageDecoder();
-
-    // JPEG
-    if (uContents[0]==0xFF &&
-        uContents[1]==0xD8 &&
-        uContents[2]==0xFF)
-        return new JPEGImageDecoder();
-
-    // BMP
-    if (strncmp(contents, "BM", 2) == 0)
-        return new BMPImageDecoder();
-
-    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
-    // CURs begin with 2-byte 0 followed by 2-byte 2.
-    if (!memcmp(contents, "\000\000\001\000", 4) ||
-        !memcmp(contents, "\000\000\002\000", 4))
-        return new ICOImageDecoder();
-   
-    // XBMs require 8 bytes of info.
-    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
-        return new XBMImageDecoder();
-
-    // Give up. We don't know what the heck this is.
-    return 0;
-}
-
-ImageSource::ImageSource()
-  : m_decoder(0)
-{}
-
-ImageSource::~ImageSource()
-{
-    clear(true);
-}
-
-bool ImageSource::initialized() const
-{
-    return m_decoder;
-}
-
-void ImageSource::setData(SharedBuffer* data, bool allDataReceived)
-{
-    // Make the decoder by sniffing the bytes.
-    // This method will examine the data and instantiate an instance of the appropriate decoder plugin.
-    // If insufficient bytes are available to determine the image type, no decoder plugin will be
-    // made.
-    if (m_decoder)
-        delete m_decoder;
-    m_decoder = createDecoder(*data);
-    if (!m_decoder)
-        return;
-    m_decoder->setData(data, allDataReceived);
-}
-
-bool ImageSource::isSizeAvailable()
-{
-    if (!m_decoder)
-        return false;
-
-    return m_decoder->isSizeAvailable();
-}
-
-IntSize ImageSource::size() const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->size();
-}
-
-IntSize ImageSource::frameSizeAtIndex(size_t index) const
-{
-    if (!m_decoder)
-        return IntSize();
-
-    return m_decoder->frameSizeAtIndex(index);
-}
-
-int ImageSource::repetitionCount()
-{
-    if (!m_decoder)
-        return cAnimationNone;
-
-    return m_decoder->repetitionCount();
-}
-
-String ImageSource::filenameExtension() const
-{
-    notImplemented();
-    return String();
-}
-
-size_t ImageSource::frameCount() const
-{
-    return m_decoder ? m_decoder->frameCount() : 0;
-}
-
-bool ImageSource::frameIsCompleteAtIndex(size_t index)
-{
-    // FIXME: should we be testing the RGBA32Buffer's status as well?
-    return (m_decoder && m_decoder->frameBufferAtIndex(index) != 0);
-}
-
-void ImageSource::clear(bool destroyAll, size_t clearBeforeFrame, SharedBuffer* data, bool allDataReceived)
-{
-    if (!destroyAll) {
-        if (m_decoder)
-            m_decoder->clearFrameBufferCache(clearBeforeFrame);
-        return;
-    }
-
-    delete m_decoder;
-    m_decoder = 0;
-    if (data)
-        setData(data, allDataReceived);
-}
-
-NativeImagePtr ImageSource::createFrameAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-    
-    return buffer->asNewNativeImage();
-}
-
-float ImageSource::frameDurationAtIndex(size_t index)
-{
-    if (!m_decoder)
-        return 0;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return 0;
-
-    float duration = buffer->duration() / 1000.0f;
-
-    // Follow other ports (and WinIE's) behavior to slow annoying ads that
-    // specify a 0 duration.
-    if (duration < 0.051f)
-        return 0.100f;
-    return duration;
-}
-
-bool ImageSource::frameHasAlphaAtIndex(size_t index)
-{
-    if (!m_decoder || !m_decoder->supportsAlpha())
-        return false;
-
-    RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
-    if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
-        return false;
-
-    return buffer->hasAlpha();
-}
-
-}
diff --git a/WebCore/platform/graphics/wx/ImageWx.cpp b/WebCore/platform/graphics/wx/ImageWx.cpp
index b0a993e..bd129cf 100644
--- a/WebCore/platform/graphics/wx/ImageWx.cpp
+++ b/WebCore/platform/graphics/wx/ImageWx.cpp
@@ -31,6 +31,7 @@
 #include "FloatRect.h"
 #include "GraphicsContext.h"
 #include "ImageObserver.h"
+#include "NotImplemented.h"
 #include "TransformationMatrix.h"
 
 #include <math.h>
@@ -45,9 +46,6 @@
 #include <wx/image.h>
 #include <wx/thread.h>
 
-// This function loads resources from WebKit
-Vector<char> loadResourceIntoArray(const char*);
-
 namespace WebCore {
 
 // this is in GraphicsContextWx.cpp
@@ -72,7 +70,9 @@ bool FrameData::clear(bool clearMetadata)
 
 PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
-    Vector<char> arr = loadResourceIntoArray(name);
+    // FIXME: We need to have some 'placeholder' graphics for things like missing
+    // plugins or broken images.
+    Vector<char> arr;
     RefPtr<Image> img = BitmapImage::create();
     RefPtr<SharedBuffer> buffer = SharedBuffer::create(arr.data(), arr.size());
     img->setData(buffer, true);
@@ -261,4 +261,9 @@ void BitmapImage::invalidatePlatformData()
 
 }
 
+void Image::drawPattern(GraphicsContext*, const FloatRect& srcRect, const TransformationMatrix& patternTransform, const FloatPoint& phase, CompositeOperator, const FloatRect& destRect)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/graphics/wx/IntSizeWx.cpp b/WebCore/platform/graphics/wx/IntSizeWx.cpp
new file mode 100644
index 0000000..8c82854
--- /dev/null
+++ b/WebCore/platform/graphics/wx/IntSizeWx.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Kevin Watters. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IntSize.h"
+
+#include <wx/defs.h>
+#include <wx/gdicmn.h>
+
+namespace WebCore {
+
+IntSize::IntSize(const wxSize& s)
+    : m_width(s.x)
+    , m_height(s.y)
+{
+}
+
+IntSize::operator wxSize() const
+{
+    return wxSize(m_width, m_height);
+}
+
+}
diff --git a/WebCore/platform/gtk/ClipboardGtk.cpp b/WebCore/platform/gtk/ClipboardGtk.cpp
index 8cbf590..450966e 100644
--- a/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -17,11 +17,18 @@
 #include "config.h"
 #include "ClipboardGtk.h"
 
+#include "CachedImage.h"
+#include "CString.h"
+#include "Editor.h"
+#include "Element.h"
 #include "FileList.h"
+#include "Frame.h"
+#include "markup.h"
 #include "NotImplemented.h"
+#include "RenderImage.h"
 #include "StringHash.h"
 
-#include "Editor.h"
+#include <gtk/gtk.h>
 
 namespace WebCore {
 
@@ -33,12 +40,10 @@ PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 ClipboardGtk::ClipboardGtk(ClipboardAccessPolicy policy, bool forDragging)
     : Clipboard(policy, forDragging)
 {
-    notImplemented();
 }
 
 ClipboardGtk::~ClipboardGtk()
 {
-    notImplemented();
 }
 
 void ClipboardGtk::clearData(const String&)
@@ -110,19 +115,65 @@ DragImageRef ClipboardGtk::createDragImage(IntPoint&) const
     return 0;
 }
 
-void ClipboardGtk::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
+static CachedImage* getCachedImage(Element* element)
 {
-    notImplemented();
+    // Attempt to pull CachedImage from element
+    ASSERT(element);
+    RenderObject* renderer = element->renderer();
+    if (!renderer || !renderer->isImage())
+        return 0;
+
+    RenderImage* image = static_cast<RenderImage*>(renderer);
+    if (image->cachedImage() && !image->cachedImage()->errorOccurred())
+        return image->cachedImage();
+
+    return 0;
 }
 
-void ClipboardGtk::writeURL(const KURL&, const String&, Frame*)
+void ClipboardGtk::declareAndWriteDragImage(Element* element, const KURL& url, const String& label, Frame*)
 {
-    notImplemented();
+    CachedImage* cachedImage = getCachedImage(element);
+    if (!cachedImage || !cachedImage->isLoaded())
+        return;
+
+    GdkPixbuf* pixbuf = cachedImage->image()->getGdkPixbuf();
+    if (!pixbuf)
+        return;
+
+    GtkClipboard* imageClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardImage"));
+    gtk_clipboard_clear(imageClipboard);
+
+    gtk_clipboard_set_image(imageClipboard, pixbuf);
+    g_object_unref(pixbuf);
+
+    writeURL(url, label, 0);
 }
 
-void ClipboardGtk::writeRange(Range*, Frame*)
+void ClipboardGtk::writeURL(const KURL& url, const String& label, Frame*)
 {
-    notImplemented();
+    GtkClipboard* textClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardText"));
+    GtkClipboard* urlClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardUrl"));
+    GtkClipboard* urlLabelClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardUrlLabel"));
+
+    gtk_clipboard_clear(textClipboard);
+    gtk_clipboard_clear(urlClipboard);
+    gtk_clipboard_clear(urlLabelClipboard);
+
+    gtk_clipboard_set_text(textClipboard, url.string().utf8().data(), -1);
+    gtk_clipboard_set_text(urlClipboard, url.string().utf8().data(), -1);
+    gtk_clipboard_set_text(urlLabelClipboard, label.utf8().data(), -1);
+}
+
+void ClipboardGtk::writeRange(Range* range, Frame* frame)
+{
+    GtkClipboard* textClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardText"));
+    GtkClipboard* htmlClipboard = gtk_clipboard_get(gdk_atom_intern_static_string("WebKitClipboardHtml"));
+
+    gtk_clipboard_clear(textClipboard);
+    gtk_clipboard_clear(htmlClipboard);
+
+    gtk_clipboard_set_text(textClipboard, frame->selectedText().utf8().data(), -1);
+    gtk_clipboard_set_text(htmlClipboard, createMarkup(range, 0, AnnotateForInterchange).utf8().data(), -1);
 }
 
 bool ClipboardGtk::hasData()
diff --git a/WebCore/platform/gtk/ClipboardGtk.h b/WebCore/platform/gtk/ClipboardGtk.h
index 7314ae4..bb21d92 100644
--- a/WebCore/platform/gtk/ClipboardGtk.h
+++ b/WebCore/platform/gtk/ClipboardGtk.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ClipboardGdk_h
-#define ClipboardGdk_h
+#ifndef ClipboardGtk_h
+#define ClipboardGtk_h
 
 #include "Clipboard.h"
 
diff --git a/WebCore/platform/gtk/CursorGtk.cpp b/WebCore/platform/gtk/CursorGtk.cpp
index 115760e..1c669f3 100644
--- a/WebCore/platform/gtk/CursorGtk.cpp
+++ b/WebCore/platform/gtk/CursorGtk.cpp
@@ -28,6 +28,9 @@
 #include "config.h"
 #include "CursorGtk.h"
 
+#include "Image.h"
+#include "IntPoint.h"
+
 #include <wtf/Assertions.h>
 
 #include <gdk/gdk.h>
@@ -60,15 +63,11 @@ Cursor::Cursor(const Cursor& other)
         gdk_cursor_ref(m_impl);
 }
 
-Cursor::Cursor(Image*, const IntPoint&)
+Cursor::Cursor(Image* image, const IntPoint& hotSpot)
 {
-    // FIXME: We don't support images for cursors yet.
-    // This is just a placeholder to avoid crashes.
-    Cursor other(crossCursor());
-    m_impl = other.m_impl;
-
-    if (m_impl)
-        gdk_cursor_ref(m_impl);
+    GdkPixbuf* pixbuf = image->getGdkPixbuf();
+    m_impl = gdk_cursor_new_from_pixbuf(gdk_display_get_default(), pixbuf, hotSpot.x(), hotSpot.y());
+    g_object_unref(pixbuf);
 }
 
 Cursor::~Cursor()
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.cpp b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
index fc15833..cf35346 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.cpp
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.cpp
@@ -37,11 +37,13 @@ namespace WTF {
 
 namespace WebCore {
 
-GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+GeolocationService* GeolocationServiceGtk::create(GeolocationServiceClient* client)
 {
     return new GeolocationServiceGtk(client);
 }
 
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceGtk::create;
+
 GeolocationServiceGtk::GeolocationServiceGtk(GeolocationServiceClient* client)
     : GeolocationService(client)
     , m_geoclueClient(0)
diff --git a/WebCore/platform/gtk/GeolocationServiceGtk.h b/WebCore/platform/gtk/GeolocationServiceGtk.h
index 90699ad..a198dc0 100644
--- a/WebCore/platform/gtk/GeolocationServiceGtk.h
+++ b/WebCore/platform/gtk/GeolocationServiceGtk.h
@@ -31,7 +31,7 @@
 namespace WebCore {
     class GeolocationServiceGtk : public GeolocationService {
     public:
-        GeolocationServiceGtk(GeolocationServiceClient*);
+        static GeolocationService* create(GeolocationServiceClient*);
         ~GeolocationServiceGtk();
 
         virtual bool startUpdating(PositionOptions*);
@@ -44,6 +44,8 @@ namespace WebCore {
         PositionError* lastError() const;
 
     private:
+        GeolocationServiceGtk(GeolocationServiceClient*);
+
         void updateLocationInformation();
         void setError(PositionError::ErrorCode, const char* message);
         void updatePosition();
diff --git a/WebCore/platform/gtk/KeyEventGtk.cpp b/WebCore/platform/gtk/KeyEventGtk.cpp
index 5875547..4186c2f 100644
--- a/WebCore/platform/gtk/KeyEventGtk.cpp
+++ b/WebCore/platform/gtk/KeyEventGtk.cpp
@@ -136,6 +136,8 @@ static String keyIdentifierForGdkKeyCode(guint keyCode)
             // Standard says that DEL becomes U+007F.
         case GDK_Delete:
             return "U+007F";
+        case GDK_BackSpace:
+            return "U+0008";
         case GDK_ISO_Left_Tab:
         case GDK_3270_BackTab:
         case GDK_Tab:
@@ -503,6 +505,8 @@ static String singleCharacterString(guint val)
         case GDK_KP_Enter:
         case GDK_Return:
             return String("\r");
+        case GDK_BackSpace:
+            return String("\x8");
         default:
             gunichar c = gdk_keyval_to_unicode(val);
             glong nwc;
diff --git a/WebCore/platform/gtk/LocalizedStringsGtk.cpp b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
index 2ba4fbb..85e071b 100644
--- a/WebCore/platform/gtk/LocalizedStringsGtk.cpp
+++ b/WebCore/platform/gtk/LocalizedStringsGtk.cpp
@@ -345,6 +345,9 @@ String imageTitle(const String& filename, const IntSize& size)
     return String::fromUTF8(string.get());
 }
 
+
+#if ENABLE(VIDEO)
+
 String mediaElementLoadingStateText()
 {
     return String::fromUTF8(_("Loading..."));
@@ -355,4 +358,113 @@ String mediaElementLiveBroadcastStateText()
     return String::fromUTF8(_("Live Broadcast"));
 }
 
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return String::fromUTF8(_("audio element controller"));
+    if (name == "VideoElement")
+        return String::fromUTF8(_("video element controller"));
+    if (name == "MuteButton")
+        return String::fromUTF8(_("mute"));
+    if (name == "UnMuteButton")
+        return String::fromUTF8(_("unmute"));
+    if (name == "PlayButton")
+        return String::fromUTF8(_("play"));
+    if (name == "PauseButton")
+        return String::fromUTF8(_("pause"));
+    if (name == "Slider")
+        return String::fromUTF8(_("movie time"));
+    if (name == "SliderThumb")
+        return String::fromUTF8(_("timeline slider thumb"));
+    if (name == "RewindButton")
+        return String::fromUTF8(_("back 30 seconds"));
+    if (name == "ReturnToRealtimeButton")
+        return String::fromUTF8(_("return to realtime"));
+    if (name == "CurrentTimeDisplay")
+        return String::fromUTF8(_("elapsed time"));
+    if (name == "TimeRemainingDisplay")
+        return String::fromUTF8(_("remaining time"));
+    if (name == "StatusDisplay")
+        return String::fromUTF8(_("status"));
+    if (name == "FullscreenButton")
+        return String::fromUTF8(_("fullscreen"));
+    if (name == "SeekForwardButton")
+        return String::fromUTF8(_("fast forward"));
+    if (name == "SeekBackButton")
+        return String::fromUTF8(_("fast reverse"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return String::fromUTF8(_("audio element playback controls and status display"));
+    if (name == "VideoElement")
+        return String::fromUTF8(_("video element playback controls and status display"));
+    if (name == "MuteButton")
+        return String::fromUTF8(_("mute audio tracks"));
+    if (name == "UnMuteButton")
+        return String::fromUTF8(_("unmute audio tracks"));
+    if (name == "PlayButton")
+        return String::fromUTF8(_("begin playback"));
+    if (name == "PauseButton")
+        return String::fromUTF8(_("pause playback"));
+    if (name == "Slider")
+        return String::fromUTF8(_("movie time scrubber"));
+    if (name == "SliderThumb")
+        return String::fromUTF8(_("movie time scrubber thumb"));
+    if (name == "RewindButton")
+        return String::fromUTF8(_("seek movie back 30 seconds"));
+    if (name == "ReturnToRealtimeButton")
+        return String::fromUTF8(_("return streaming movie to real time"));
+    if (name == "CurrentTimeDisplay")
+        return String::fromUTF8(_("current movie time in seconds"));
+    if (name == "TimeRemainingDisplay")
+        return String::fromUTF8(_("number of seconds of movie remaining"));
+    if (name == "StatusDisplay")
+        return String::fromUTF8(_("current movie status"));
+    if (name == "SeekBackButton")
+        return String::fromUTF8(_("seek quickly back"));
+    if (name == "SeekForwardButton")
+        return String::fromUTF8(_("seek quickly forward"));
+    if (name == "FullscreenButton")
+        return String::fromUTF8(_("Play movie in fullscreen mode"));
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return String::fromUTF8(_("indefinite time"));
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d days %d hours %d minutes %d seconds", days, hours, minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    if (hours) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d hours %d minutes %d seconds", hours, minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    if (minutes) {
+        GOwnPtr<gchar> string(g_strdup_printf("%d minutes %d seconds", minutes, seconds));
+        return String::fromUTF8(string.get());
+    }
+
+    GOwnPtr<gchar> string(g_strdup_printf("%d seconds", seconds));
+    return String::fromUTF8(string.get());
+}
+#endif  // ENABLE(VIDEO)
+
 }
diff --git a/WebCore/platform/gtk/PasteboardGtk.cpp b/WebCore/platform/gtk/PasteboardGtk.cpp
index 9f72923..0ff26f7 100644
--- a/WebCore/platform/gtk/PasteboardGtk.cpp
+++ b/WebCore/platform/gtk/PasteboardGtk.cpp
@@ -35,13 +35,6 @@
 
 namespace WebCore {
 
-/* FIXME: we must get rid of this and use the enum in webkitwebview.h someway */
-typedef enum
-{
-    WEBKIT_WEB_VIEW_TARGET_INFO_HTML = - 1,
-    WEBKIT_WEB_VIEW_TARGET_INFO_TEXT = - 2
-} WebKitWebViewTargetInfo;
-
 class PasteboardSelectionData {
 public:
     PasteboardSelectionData(gchar* text, gchar* markup)
@@ -65,11 +58,11 @@ static void clipboard_get_contents_cb(GtkClipboard *clipboard, GtkSelectionData
                                       guint info, gpointer data) {
     PasteboardSelectionData* clipboardData = reinterpret_cast<PasteboardSelectionData*>(data);
     ASSERT(clipboardData);
-    if ((gint)info == WEBKIT_WEB_VIEW_TARGET_INFO_HTML) {
+    if ((gint)info == Pasteboard::generalPasteboard()->m_helper->getWebViewTargetInfoHtml())
         gtk_selection_data_set(selection_data, selection_data->target, 8,
                                reinterpret_cast<const guchar*>(clipboardData->markup()),
                                g_utf8_strlen(clipboardData->markup(), -1));
-    } else
+    else
         gtk_selection_data_set_text(selection_data, clipboardData->text(), -1);
 }
 
@@ -115,6 +108,13 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     gtk_target_table_free(targets, n_targets);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    CString utf8 = text.utf8();
+    GtkClipboard* clipboard = gtk_clipboard_get_for_display(gdk_display_get_default(), GDK_SELECTION_CLIPBOARD);
+    gtk_clipboard_set_text(clipboard, utf8.data(), utf8.length());
+}
+
 void Pasteboard::writeURL(const KURL& url, const String&, Frame* frame)
 {
     if (url.isEmpty())
@@ -122,8 +122,9 @@ void Pasteboard::writeURL(const KURL& url, const String&, Frame* frame)
 
     GtkClipboard* clipboard = m_helper->getClipboard(frame);
     GtkClipboard* primary = m_helper->getPrimary(frame);
-    gtk_clipboard_set_text(clipboard, url.string().utf8().data(), url.string().utf8().length());
-    gtk_clipboard_set_text(primary, url.string().utf8().data(), url.string().utf8().length());
+    CString utf8 = url.string().utf8();
+    gtk_clipboard_set_text(clipboard, utf8.data(), utf8.length());
+    gtk_clipboard_set_text(primary, utf8.data(), utf8.length());
 }
 
 void Pasteboard::writeImage(Node* node, const KURL&, const String&)
diff --git a/WebCore/platform/gtk/PasteboardHelper.h b/WebCore/platform/gtk/PasteboardHelper.h
index 9943a2d..8e67127 100644
--- a/WebCore/platform/gtk/PasteboardHelper.h
+++ b/WebCore/platform/gtk/PasteboardHelper.h
@@ -43,6 +43,7 @@ public:
     virtual GtkClipboard* getPrimary(Frame*) const = 0;
     virtual GtkTargetList* getCopyTargetList(Frame*) const = 0;
     virtual GtkTargetList* getPasteTargetList(Frame*) const = 0;
+    virtual gint getWebViewTargetInfoHtml() const = 0;
 };
 
 }
diff --git a/WebCore/platform/gtk/PlatformScreenGtk.cpp b/WebCore/platform/gtk/PlatformScreenGtk.cpp
index 4ba6d43..a6ff954 100644
--- a/WebCore/platform/gtk/PlatformScreenGtk.cpp
+++ b/WebCore/platform/gtk/PlatformScreenGtk.cpp
@@ -49,7 +49,7 @@ static GdkVisual* getVisual(Widget* widget)
     if (!widget)
         return 0;
 
-    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformWindow());
+    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformPageClient());
 
     if (!container)
         return 0;
@@ -93,7 +93,7 @@ FloatRect screenRect(Widget* widget)
     if (!widget)
         return FloatRect();
 
-    GtkWidget* container = gtk_widget_get_toplevel(GTK_WIDGET(widget->root()->hostWindow()->platformWindow()));
+    GtkWidget* container = gtk_widget_get_toplevel(GTK_WIDGET(widget->root()->hostWindow()->platformPageClient()));
     if (!GTK_WIDGET_TOPLEVEL(container))
         return FloatRect();
 
@@ -114,7 +114,7 @@ FloatRect screenAvailableRect(Widget* widget)
         return FloatRect();
 
 #if PLATFORM(X11)
-    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformWindow());
+    GtkWidget* container = GTK_WIDGET(widget->root()->hostWindow()->platformPageClient());
     if (!container)
         return FloatRect();
 
diff --git a/WebCore/platform/gtk/PopupMenuGtk.cpp b/WebCore/platform/gtk/PopupMenuGtk.cpp
index 121d7b0..3f6b02a 100644
--- a/WebCore/platform/gtk/PopupMenuGtk.cpp
+++ b/WebCore/platform/gtk/PopupMenuGtk.cpp
@@ -60,7 +60,7 @@ void PopupMenu::show(const IntRect& rect, FrameView* view, int index)
         gtk_container_foreach(GTK_CONTAINER(m_popup), reinterpret_cast<GtkCallback>(menuRemoveItem), this);
 
     int x, y;
-    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformWindow())->window, &x, &y);
+    gdk_window_get_origin(GTK_WIDGET(view->hostWindow()->platformPageClient())->window, &x, &y);
     m_menuPosition = view->contentsToWindow(rect.location());
     m_menuPosition = IntPoint(m_menuPosition.x() + x, m_menuPosition.y() + y + rect.height());
     m_indexMap.clear();
@@ -137,7 +137,7 @@ void PopupMenu::menuItemActivated(GtkMenuItem* item, PopupMenu* that)
 void PopupMenu::menuUnmapped(GtkWidget*, PopupMenu* that)
 {
     ASSERT(that->client());
-    that->client()->hidePopup();
+    that->client()->popupDidHide();
 }
 
 void PopupMenu::menuPositionFunction(GtkMenu*, gint* x, gint* y, gboolean* pushIn, PopupMenu* that)
diff --git a/WebCore/platform/gtk/ScrollViewGtk.cpp b/WebCore/platform/gtk/ScrollViewGtk.cpp
index 0e811ef..a1ed8c3 100644
--- a/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -31,10 +31,14 @@
 #include "config.h"
 #include "ScrollView.h"
 
+#include "ChromeClient.h"
 #include "FloatRect.h"
+#include "Frame.h"
+#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HostWindow.h"
 #include "IntRect.h"
+#include "Page.h"
 #include "PlatformMouseEvent.h"
 #include "PlatformWheelEvent.h"
 #include "ScrollbarGtk.h"
@@ -103,7 +107,7 @@ void ScrollView::setGtkAdjustments(GtkAdjustment* hadj, GtkAdjustment* vadj)
 void ScrollView::platformAddChild(Widget* child)
 {
     if (!GTK_IS_SOCKET(child->platformWidget()))
-        gtk_container_add(GTK_CONTAINER(hostWindow()->platformWindow()), child->platformWidget());
+        gtk_container_add(GTK_CONTAINER(hostWindow()->platformPageClient()), child->platformWidget());
 }
 
 void ScrollView::platformRemoveChild(Widget* child)
@@ -113,7 +117,7 @@ void ScrollView::platformRemoveChild(Widget* child)
     // HostWindow can be NULL here. If that's the case
     // let's grab the child's parent instead.
     if (hostWindow())
-        parent = GTK_WIDGET(hostWindow()->platformWindow());
+        parent = GTK_WIDGET(hostWindow()->platformPageClient());
     else
         parent = GTK_WIDGET(child->platformWidget()->parent);
 
@@ -129,7 +133,7 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                                max(0, height() - (horizontalScrollbar() && !includeScrollbars ? horizontalScrollbar()->height() : 0))));
 
     // Main frame.
-    GtkWidget* measuredWidget = hostWindow()->platformWindow();
+    GtkWidget* measuredWidget = hostWindow()->platformPageClient();
     GtkWidget* parent = gtk_widget_get_parent(measuredWidget);
 
     // We may not be in a widget that displays scrollbars, but we may
@@ -142,4 +146,29 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
                            measuredWidget->allocation.height));
 }
 
+void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode)
+{
+    if (horizontalMode == m_horizontalScrollbarMode && verticalMode == m_verticalScrollbarMode)
+        return;
+
+    m_horizontalScrollbarMode = horizontalMode;
+    m_verticalScrollbarMode = verticalMode;
+
+    // We don't really care about reporting policy changes on frames
+    // that have no adjustments attached to them.
+    if (!m_horizontalAdjustment) {
+        updateScrollbars(scrollOffset());
+        return;
+    }
+
+    if (!isFrameView())
+        return;
+
+    // For frames that do have adjustments attached, we want to report
+    // policy changes, so that they may be applied to the widget to
+    // which the WebView has been added, for instance.
+    if (hostWindow())
+        hostWindow()->scrollbarsModeDidChange();
+}
+
 }
diff --git a/WebCore/platform/gtk/WidgetGtk.cpp b/WebCore/platform/gtk/WidgetGtk.cpp
index 007f2ee..53c10f1 100644
--- a/WebCore/platform/gtk/WidgetGtk.cpp
+++ b/WebCore/platform/gtk/WidgetGtk.cpp
@@ -55,7 +55,7 @@ Widget::~Widget()
 
 void Widget::setFocus()
 {
-    gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformWindow()));
+    gtk_widget_grab_focus(platformWidget() ? platformWidget() : GTK_WIDGET(root()->hostWindow()->platformPageClient()));
 }
 
 static GdkDrawable* gdkDrawable(PlatformWidget widget)
@@ -76,7 +76,7 @@ void Widget::setCursor(const Cursor& cursor)
     if (platformCursor == lastSetCursor)
         return;
 
-    gdk_window_set_cursor(gdkDrawable(platformWidget()) ? GDK_WINDOW(gdkDrawable(platformWidget())) : GTK_WIDGET(root()->hostWindow()->platformWindow())->window, platformCursor);
+    gdk_window_set_cursor(gdkDrawable(platformWidget()) ? GDK_WINDOW(gdkDrawable(platformWidget())) : GTK_WIDGET(root()->hostWindow()->platformPageClient())->window, platformCursor);
     lastSetCursor = platformCursor;
 }
 
diff --git a/WebCore/platform/haiku/ClipboardHaiku.cpp b/WebCore/platform/haiku/ClipboardHaiku.cpp
index 845c08c..a62c30c 100644
--- a/WebCore/platform/haiku/ClipboardHaiku.cpp
+++ b/WebCore/platform/haiku/ClipboardHaiku.cpp
@@ -27,8 +27,8 @@
 #include "config.h"
 #include "ClipboardHaiku.h"
 
-#include "IntPoint.h"
 #include "FileList.h"
+#include "IntPoint.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
 #include "StringHash.h"
@@ -42,7 +42,7 @@
 
 namespace WebCore {
 
-ClipboardHaiku::ClipboardHaiku(ClipboardAccessPolicy policy, bool forDragging) 
+ClipboardHaiku::ClipboardHaiku(ClipboardAccessPolicy policy, bool forDragging)
     : Clipboard(policy, forDragging)
 {
 }
@@ -61,7 +61,7 @@ void ClipboardHaiku::clearData(const String& type)
     }
 }
 
-void ClipboardHaiku::clearAllData() 
+void ClipboardHaiku::clearAllData()
 {
     if (be_clipboard->Lock()) {
         be_clipboard->Clear();
@@ -70,7 +70,7 @@ void ClipboardHaiku::clearAllData()
     }
 }
 
-String ClipboardHaiku::getData(const String& type, bool& success) const 
+String ClipboardHaiku::getData(const String& type, bool& success) const
 {
     BString result;
     success = false;
@@ -88,7 +88,7 @@ String ClipboardHaiku::getData(const String& type, bool& success) const
     return result;
 }
 
-bool ClipboardHaiku::setData(const String& type, const String& data) 
+bool ClipboardHaiku::setData(const String& type, const String& data)
 {
     bool result = false;
 
@@ -110,7 +110,7 @@ bool ClipboardHaiku::setData(const String& type, const String& data)
 }
 
 // Extensions beyond IE's API.
-HashSet<String> ClipboardHaiku::types() const 
+HashSet<String> ClipboardHaiku::types() const
 {
     HashSet<String> result;
 
@@ -138,27 +138,27 @@ PassRefPtr<FileList> ClipboardHaiku::files() const
     return 0;
 }
 
-IntPoint ClipboardHaiku::dragLocation() const 
-{ 
+IntPoint ClipboardHaiku::dragLocation() const
+{
     notImplemented();
     return IntPoint(0, 0);
 }
 
-CachedImage* ClipboardHaiku::dragImage() const 
+CachedImage* ClipboardHaiku::dragImage() const
 {
     notImplemented();
-    return 0; 
+    return 0;
 }
 
-void ClipboardHaiku::setDragImage(CachedImage*, const IntPoint&) 
+void ClipboardHaiku::setDragImage(CachedImage*, const IntPoint&)
 {
     notImplemented();
 }
 
-Node* ClipboardHaiku::dragImageElement() 
+Node* ClipboardHaiku::dragImageElement()
 {
     notImplemented();
-    return 0; 
+    return 0;
 }
 
 void ClipboardHaiku::setDragImageElement(Node*, const IntPoint&)
@@ -167,27 +167,27 @@ void ClipboardHaiku::setDragImageElement(Node*, const IntPoint&)
 }
 
 DragImageRef ClipboardHaiku::createDragImage(IntPoint& dragLocation) const
-{ 
+{
     notImplemented();
     return 0;
 }
 
-void ClipboardHaiku::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*) 
+void ClipboardHaiku::declareAndWriteDragImage(Element*, const KURL&, const String&, Frame*)
 {
     notImplemented();
 }
 
-void ClipboardHaiku::writeURL(const KURL&, const String&, Frame*) 
+void ClipboardHaiku::writeURL(const KURL&, const String&, Frame*)
 {
     notImplemented();
 }
 
-void ClipboardHaiku::writeRange(Range*, Frame*) 
+void ClipboardHaiku::writeRange(Range*, Frame*)
 {
     notImplemented();
 }
 
-bool ClipboardHaiku::hasData() 
+bool ClipboardHaiku::hasData()
 {
     bool result = false;
 
diff --git a/WebCore/platform/haiku/ContextMenuHaiku.cpp b/WebCore/platform/haiku/ContextMenuHaiku.cpp
index 03b8978..b978433 100644
--- a/WebCore/platform/haiku/ContextMenuHaiku.cpp
+++ b/WebCore/platform/haiku/ContextMenuHaiku.cpp
@@ -27,30 +27,27 @@
 #include "config.h"
 #include "ContextMenu.h"
 
-#include "ContextMenuItem.h"
 #include "ContextMenuController.h"
+#include "ContextMenuItem.h"
+#include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "Document.h"
-
-#include <wtf/Assertions.h>
-
 #include <Looper.h>
 #include <Menu.h>
 #include <Message.h>
+#include <wtf/Assertions.h>
 
 
 namespace WebCore {
 
 // FIXME: This class isn't used yet
-class ContextMenuReceiver : public BLooper
-{
+class ContextMenuReceiver : public BLooper {
 public:
     ContextMenuReceiver(ContextMenu* menu)
         : BLooper("context_menu_receiver")
         , m_menu(menu)
+        , m_result(-1)
     {
-        m_result = -1;
     }
 
     void HandleMessage(BMessage* msg)
@@ -80,21 +77,8 @@ private:
 
 ContextMenu::ContextMenu(const HitTestResult& result)
     : m_hitTestResult(result)
-    , m_platformDescription(NULL)
+    , m_platformDescription(new BMenu("context_menu"))
 {
-    /* Get position */
-    if (result.innerNode() && result.innerNode()->document()) {
-        BView* view = result.innerNode()->document()->frame()->view()->platformWidget();
-        int child = 0;
-        while (view->ChildAt(child)) {
-            if (view->ChildAt(child)->Name() == "scroll_view_canvas") {
-                m_point = view->ChildAt(child)->ConvertToScreen(BPoint(result.point().x(), result.point().y()));
-                break;
-            }
-            child++;
-        }
-    }
-    m_platformDescription = new BMenu("context_menu");
 }
 
 ContextMenu::~ContextMenu()
@@ -106,9 +90,9 @@ void ContextMenu::appendItem(ContextMenuItem& item)
 {
     checkOrEnableIfNeeded(item);
 
-    BMenuItem* bItem = item.releasePlatformDescription();
-    if (bItem)
-        m_platformDescription->AddItem(bItem);
+    BMenuItem* menuItem = item.releasePlatformDescription();
+    if (menuItem)
+        m_platformDescription->AddItem(menuItem);
 }
 
 unsigned ContextMenu::itemCount() const
@@ -120,9 +104,9 @@ void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
 {
     checkOrEnableIfNeeded(item);
 
-    BMenuItem* bItem = item.releasePlatformDescription();
-    if (bItem)
-        m_platformDescription->AddItem(bItem, position);
+    BMenuItem* menuItem = item.releasePlatformDescription();
+    if (menuItem)
+        m_platformDescription->AddItem(menuItem, position);
 }
 
 PlatformMenuDescription ContextMenu::platformDescription() const
diff --git a/WebCore/platform/haiku/CookieJarHaiku.cpp b/WebCore/platform/haiku/CookieJarHaiku.cpp
index 73519d7..831b379 100644
--- a/WebCore/platform/haiku/CookieJarHaiku.cpp
+++ b/WebCore/platform/haiku/CookieJarHaiku.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "StringHash.h"
@@ -41,21 +42,33 @@ namespace WebCore {
 // FIXME: Shouldn't this be saved to and restored from disk too?
 static HashMap<String, String> cookieJar;
 
-void setCookies(const KURL& url, const KURL& /*policyURL*/, const String& value)
+void setCookies(Document*, const KURL& url, const String& value)
 {
     cookieJar.set(url.string(), value);
 }
 
-String cookies(const KURL& url)
+String cookies(const Document*, const KURL& url)
 {
     return cookieJar.get(url.string());
 }
 
-bool cookiesEnabled()
+bool cookiesEnabled(const Document*)
 {
     // FIXME: This should probably be a setting
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/haiku/DragDataHaiku.cpp b/WebCore/platform/haiku/DragDataHaiku.cpp
index b42b311..4a20147 100644
--- a/WebCore/platform/haiku/DragDataHaiku.cpp
+++ b/WebCore/platform/haiku/DragDataHaiku.cpp
@@ -27,10 +27,9 @@
 #include "config.h"
 #include "DragData.h"
 
+#include "ClipboardHaiku.h"
 #include "Document.h"
 #include "DocumentFragment.h"
-#include "ClipboardHaiku.h"
-
 #include "NotImplemented.h"
 
 
@@ -79,7 +78,7 @@ Color DragData::asColor() const
 
 WTF::PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) const
 {
-    return new ClipboardHaiku(policy, true);
+    return ClipboardHaiku::create(policy, true);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -104,6 +103,6 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
     notImplemented();
     return 0;
 }
-    
+
 } // namespace WebCore
 
diff --git a/WebCore/platform/haiku/LocalizedStringsHaiku.cpp b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
new file mode 100644
index 0000000..a37ffcc
--- /dev/null
+++ b/WebCore/platform/haiku/LocalizedStringsHaiku.cpp
@@ -0,0 +1,346 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "LocalizedStrings.h"
+
+#include "PlatformString.h"
+
+
+namespace WebCore {
+String submitButtonDefaultLabel()
+{
+    return "Submit";
+}
+
+String inputElementAltText()
+{
+    return String();
+}
+
+String resetButtonDefaultLabel()
+{
+    return "Reset";
+}
+
+String defaultLanguage()
+{
+    return "en";
+}
+
+String searchableIndexIntroduction()
+{
+    return "Searchable Index";
+}
+
+String fileButtonChooseFileLabel()
+{
+    return "Choose File";
+}
+
+String fileButtonNoFileSelectedLabel()
+{
+    return "No file selected";
+}
+
+String contextMenuItemTagOpenLinkInNewWindow()
+{
+    return "Open in new tab";
+}
+
+String contextMenuItemTagDownloadLinkToDisk()
+{
+    return "Download link to disk";
+}
+
+String contextMenuItemTagCopyLinkToClipboard()
+{
+    return "Copy link to clipboard";
+}
+
+String contextMenuItemTagOpenImageInNewWindow()
+{
+    return "Open image in new window";
+}
+
+String contextMenuItemTagDownloadImageToDisk()
+{
+    return "Download image to disk";
+}
+
+String contextMenuItemTagCopyImageToClipboard()
+{
+    return "Copy image to clipboard";
+}
+
+String contextMenuItemTagOpenFrameInNewWindow()
+{
+    return "Open frame in new window";
+}
+
+String contextMenuItemTagCopy()
+{
+    return "Copy";
+}
+
+String contextMenuItemTagGoBack()
+{
+    return "Go back";
+}
+
+String contextMenuItemTagGoForward()
+{
+    return "Go forward";
+}
+
+String contextMenuItemTagStop()
+{
+    return "Stop";
+}
+
+String contextMenuItemTagReload()
+{
+    return "Reload";
+}
+
+String contextMenuItemTagCut()
+{
+    return "Cut";
+}
+
+String contextMenuItemTagPaste()
+{
+    return "Paste";
+}
+
+String contextMenuItemTagNoGuessesFound()
+{
+    return "No guesses found";
+}
+
+String contextMenuItemTagIgnoreSpelling()
+{
+    return "Ignore spelling";
+}
+
+String contextMenuItemTagLearnSpelling()
+{
+    return "Learn spelling";
+}
+
+String contextMenuItemTagSearchWeb()
+{
+    return "Search web";
+}
+
+String contextMenuItemTagLookUpInDictionary()
+{
+    return "Lookup in dictionary";
+}
+
+String contextMenuItemTagOpenLink()
+{
+    return "Open link";
+}
+
+String contextMenuItemTagIgnoreGrammar()
+{
+    return "Ignore grammar";
+}
+
+String contextMenuItemTagSpellingMenu()
+{
+    return "Spelling menu";
+}
+
+String contextMenuItemTagShowSpellingPanel(bool show)
+{
+    return "Show spelling panel";
+}
+
+String contextMenuItemTagCheckSpelling()
+{
+    return "Check spelling";
+}
+
+String contextMenuItemTagCheckSpellingWhileTyping()
+{
+    return "Check spelling while typing";
+}
+
+String contextMenuItemTagCheckGrammarWithSpelling()
+{
+    return "Check for grammar with spelling";
+}
+
+String contextMenuItemTagFontMenu()
+{
+    return "Font menu";
+}
+
+String contextMenuItemTagBold()
+{
+    return "Bold";
+}
+
+String contextMenuItemTagItalic()
+{
+    return "Italic";
+}
+
+String contextMenuItemTagUnderline()
+{
+    return "Underline";
+}
+
+String contextMenuItemTagOutline()
+{
+    return "Outline";
+}
+
+String contextMenuItemTagWritingDirectionMenu()
+{
+    return "Writing direction menu";
+}
+
+String contextMenuItemTagDefaultDirection()
+{
+    return "Default direction";
+}
+
+String contextMenuItemTagLeftToRight()
+{
+    return "Left to right";
+}
+
+String contextMenuItemTagRightToLeft()
+{
+    return "Right to left";
+}
+
+String contextMenuItemTagInspectElement()
+{
+    return "Inspect";
+}
+
+String searchMenuNoRecentSearchesText()
+{
+    return "No recent text searches";
+}
+
+String searchMenuRecentSearchesText()
+{
+    return "Recent text searches";
+}
+
+String searchMenuClearRecentSearchesText()
+{
+    return "Clear recent text searches";
+}
+
+String unknownFileSizeText()
+{
+    return "Unknown";
+}
+
+String AXWebAreaText()
+{
+    return String();
+}
+
+String AXLinkText()
+{
+    return String();
+}
+
+String AXListMarkerText()
+{
+    return String();
+}
+
+String AXImageMapText()
+{
+    return String();
+}
+
+String AXHeadingText()
+{
+    return String();
+}
+
+String imageTitle(const String& filename, const IntSize& size)
+{
+    return String(filename);
+}
+
+String contextMenuItemTagTextDirectionMenu()
+{
+    return String();
+}
+
+String AXButtonActionVerb()
+{
+    return String();
+}
+
+String AXTextFieldActionVerb()
+{
+    return String();
+}
+
+String AXRadioButtonActionVerb()
+{
+    return String();
+}
+
+String AXCheckedCheckBoxActionVerb()
+{
+    return String();
+}
+
+String AXUncheckedCheckBoxActionVerb()
+{
+    return String();
+}
+
+String AXLinkActionVerb()
+{
+    return String();
+}
+
+String AXDefinitionListTermText()
+{
+    return String();
+}
+
+String AXDefinitionListDefinitionText()
+{
+    return String();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/haiku/LoggingHaiku.cpp b/WebCore/platform/haiku/LoggingHaiku.cpp
new file mode 100644
index 0000000..f09c483
--- /dev/null
+++ b/WebCore/platform/haiku/LoggingHaiku.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "Logging.h"
+
+
+namespace WebCore {
+
+void InitializeLoggingChannelsIfNecessary()
+{
+    // FIXME: Should read the logging channels from a file.
+    static bool haveInitializedLoggingChannels = false;
+    if (haveInitializedLoggingChannels)
+        return;
+
+    haveInitializedLoggingChannels = true;
+
+    LogEvents.state = WTFLogChannelOn;
+    LogFrames.state = WTFLogChannelOn;
+    LogLoading.state = WTFLogChannelOn;
+    LogPlatformLeaks.state = WTFLogChannelOn;
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/haiku/PasteboardHaiku.cpp b/WebCore/platform/haiku/PasteboardHaiku.cpp
index 67a7f5b..8ad72ca 100644
--- a/WebCore/platform/haiku/PasteboardHaiku.cpp
+++ b/WebCore/platform/haiku/PasteboardHaiku.cpp
@@ -68,6 +68,23 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     clipboard.Unlock();
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    BClipboard clipboard("WebKit");
+    if (!clipboard.Lock())
+        return;
+
+    clipboard.Clear();
+    BMessage* data = clipboard.Data();
+    if (!data)
+        return;
+
+    data->AddString("text/plain", BString(text));
+    clipboard.Commit();
+
+    clipboard.Unlock();
+}
+
 bool Pasteboard::canSmartReplace()
 {
     notImplemented();
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.cpp b/WebCore/platform/haiku/RenderThemeHaiku.cpp
new file mode 100644
index 0000000..4327795
--- /dev/null
+++ b/WebCore/platform/haiku/RenderThemeHaiku.cpp
@@ -0,0 +1,178 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
+ *               2006 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Ryan Leavengood <leavengood@gmail.com>
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "RenderThemeHaiku.h"
+
+#include "GraphicsContext.h"
+#include "NotImplemented.h"
+#include <ControlLook.h>
+#include <View.h>
+
+
+namespace WebCore {
+
+PassRefPtr<RenderTheme> RenderThemeHaiku::create()
+{
+    return adoptRef(new RenderThemeHaiku());
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page*)
+{
+    static RenderTheme* renderTheme = RenderThemeHaiku::create().releaseRef();
+    return renderTheme;
+}
+
+RenderThemeHaiku::RenderThemeHaiku()
+{
+}
+
+RenderThemeHaiku::~RenderThemeHaiku()
+{
+}
+
+static bool supportsFocus(ControlPart appearance)
+{
+    switch (appearance) {
+    case PushButtonPart:
+    case ButtonPart:
+    case TextFieldPart:
+    case TextAreaPart:
+    case SearchFieldPart:
+    case MenulistPart:
+    case RadioPart:
+    case CheckboxPart:
+        return true;
+    default:
+        return false;
+    }
+}
+
+bool RenderThemeHaiku::supportsFocusRing(const RenderStyle* style) const
+{
+    return supportsFocus(style->appearance());
+}
+
+Color RenderThemeHaiku::platformActiveSelectionBackgroundColor() const
+{
+    return Color(ui_color(B_CONTROL_HIGHLIGHT_COLOR));
+}
+
+Color RenderThemeHaiku::platformInactiveSelectionBackgroundColor() const
+{
+    return Color(ui_color(B_CONTROL_HIGHLIGHT_COLOR));
+}
+
+Color RenderThemeHaiku::platformActiveSelectionForegroundColor() const
+{
+    return Color(ui_color(B_CONTROL_TEXT_COLOR));
+}
+
+Color RenderThemeHaiku::platformInactiveSelectionForegroundColor() const
+{
+    return Color(ui_color(B_CONTROL_TEXT_COLOR));
+}
+
+Color RenderThemeHaiku::platformTextSearchHighlightColor() const
+{
+    return Color(ui_color(B_MENU_SELECTED_BACKGROUND_COLOR));
+}
+
+void RenderThemeHaiku::systemFont(int propId, FontDescription&) const
+{
+    notImplemented();
+}
+
+bool RenderThemeHaiku::paintCheckbox(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+{
+    if (info.context->paintingDisabled())
+        return false;
+
+    rgb_color base = ui_color(B_PANEL_BACKGROUND_COLOR);
+    BRect rect = intRect;
+    BView* view = info.context->platformContext();
+
+    if (!be_control_look)
+        return false;
+
+    be_control_look->DrawCheckBox(view, rect, rect, base);
+    return true;
+}
+
+void RenderThemeHaiku::setCheckboxSize(RenderStyle* style) const
+{
+    int size = 10;
+
+    // If the width and height are both specified, then we have nothing to do.
+    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
+        return;
+
+    // FIXME: A hard-coded size of 'size' is used. This is wrong but necessary for now.
+    if (style->width().isIntrinsicOrAuto())
+        style->setWidth(Length(size, Fixed));
+
+    if (style->height().isAuto())
+        style->setHeight(Length(size, Fixed));
+}
+
+bool RenderThemeHaiku::paintRadio(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+{
+    if (info.context->paintingDisabled())
+        return false;
+
+    rgb_color base = ui_color(B_PANEL_BACKGROUND_COLOR);
+    BRect rect = intRect;
+    BView* view = info.context->platformContext();
+
+    if (!be_control_look)
+        return false;
+
+    be_control_look->DrawRadioButton(view, rect, rect, base);
+    return true;
+}
+
+void RenderThemeHaiku::setRadioSize(RenderStyle* style) const
+{
+    // This is the same as checkboxes.
+    setCheckboxSize(style);
+}
+
+void RenderThemeHaiku::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    // Leave some space for the arrow.
+    style->setPaddingRight(Length(22, Fixed));
+    const int minHeight = 20;
+    style->setMinHeight(Length(minHeight, Fixed));
+}
+
+bool RenderThemeHaiku::paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+{
+    notImplemented();
+    return false;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.h b/WebCore/platform/haiku/RenderThemeHaiku.h
new file mode 100644
index 0000000..7daebc4
--- /dev/null
+++ b/WebCore/platform/haiku/RenderThemeHaiku.h
@@ -0,0 +1,70 @@
+/*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#ifndef RenderThemeHaiku_h
+#define RenderThemeHaiku_h
+
+#include "RenderTheme.h"
+
+namespace WebCore {
+
+    class RenderThemeHaiku : public RenderTheme {
+    private:
+        RenderThemeHaiku();
+        virtual ~RenderThemeHaiku();
+
+    public:
+        static PassRefPtr<RenderTheme> create();
+
+        // A method asking if the theme's controls actually care about redrawing when hovered.
+        virtual bool supportsHover(const RenderStyle* style) const { return false; }
+
+        // A method asking if the theme is able to draw the focus ring.
+        virtual bool supportsFocusRing(const RenderStyle*) const;
+
+        // The platform selection color.
+        virtual Color platformActiveSelectionBackgroundColor() const;
+        virtual Color platformInactiveSelectionBackgroundColor() const;
+        virtual Color platformActiveSelectionForegroundColor() const;
+        virtual Color platformInactiveSelectionForegroundColor() const;
+
+        virtual Color platformTextSearchHighlightColor() const;
+
+        // System fonts.
+        virtual void systemFont(int propId, FontDescription&) const;
+
+    protected:
+        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setCheckboxSize(RenderStyle*) const;
+
+        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual void setRadioSize(RenderStyle*) const;
+
+        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    };
+
+} // namespace WebCore
+
+#endif // RenderThemeHaiku_h
diff --git a/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp b/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp
new file mode 100644
index 0000000..8adab3d
--- /dev/null
+++ b/WebCore/platform/haiku/ScrollbarThemeHaiku.cpp
@@ -0,0 +1,164 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright 2009 Maxime Simon <simon.maxime@gmail.com> All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScrollbarThemeHaiku.h"
+
+#include "GraphicsContext.h"
+#include "Scrollbar.h"
+#include <ControlLook.h>
+#include <InterfaceDefs.h>
+
+
+int buttonWidth(int scrollbarWidth, int thickness)
+{
+    return scrollbarWidth < 2 * thickness ? scrollbarWidth / 2 : thickness;
+}
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    static ScrollbarThemeHaiku theme;
+    return &theme;
+}
+
+ScrollbarThemeHaiku::ScrollbarThemeHaiku()
+{
+}
+
+ScrollbarThemeHaiku::~ScrollbarThemeHaiku()
+{
+}
+
+int ScrollbarThemeHaiku::scrollbarThickness(ScrollbarControlSize controlSize)
+{
+    // FIXME: Should we make a distinction between a Small and a Regular Scrollbar?
+    return 16;
+}
+
+bool ScrollbarThemeHaiku::hasButtons(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled();
+}
+
+bool ScrollbarThemeHaiku::hasThumb(Scrollbar* scrollbar)
+{
+    return scrollbar->enabled() && thumbLength(scrollbar) > 0;
+}
+
+IntRect ScrollbarThemeHaiku::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    if (part == BackButtonEndPart)
+        return IntRect();
+
+    int thickness = scrollbarThickness();
+    IntPoint buttonOrigin(scrollbar->x(), scrollbar->y());
+    IntSize buttonSize = scrollbar->orientation() == HorizontalScrollbar
+        ? IntSize(buttonWidth(scrollbar->width(), thickness), thickness)
+        : IntSize(thickness, buttonWidth(scrollbar->height(), thickness));
+    IntRect buttonRect(buttonOrigin, buttonSize);
+
+    return buttonRect;
+}
+
+IntRect ScrollbarThemeHaiku::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    if (part == BackButtonStartPart)
+        return IntRect();
+
+    int thickness = scrollbarThickness();
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        int width = buttonWidth(scrollbar->width(), thickness);
+        return IntRect(scrollbar->x() + scrollbar->width() - width, scrollbar->y(), width, thickness);
+    }
+
+    int height = buttonWidth(scrollbar->height(), thickness);
+    return IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - height, thickness, height);
+}
+
+IntRect ScrollbarThemeHaiku::trackRect(Scrollbar* scrollbar, bool)
+{
+    int thickness = scrollbarThickness();
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + thickness, scrollbar->y(), scrollbar->width() - 2 * thickness, thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + thickness, thickness, scrollbar->height() - 2 * thickness);
+}
+
+void ScrollbarThemeHaiku::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+{
+    if (!be_control_look)
+        return;
+
+    BRect rect = trackRect(scrollbar, false);
+    orientation scrollbarOrientation = scrollbar->orientation() == HorizontalScrollbar ? B_HORIZONTAL : B_VERTICAL;
+
+    be_control_look->DrawScrollBarBackground(context->platformContext(), rect, rect, ui_color(B_PANEL_BACKGROUND_COLOR), 0, scrollbarOrientation);
+}
+
+void ScrollbarThemeHaiku::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+{
+    if (!be_control_look)
+        return;
+
+    BRect drawRect = BRect(rect);
+    BView* view = context->platformContext();
+    rgb_color panelBgColor = ui_color(B_PANEL_BACKGROUND_COLOR);
+    rgb_color buttonBgColor = tint_color(panelBgColor, B_LIGHTEN_1_TINT);
+
+    be_control_look->DrawButtonFrame(view, drawRect, drawRect, buttonBgColor, panelBgColor);
+    be_control_look->DrawButtonBackground(view, drawRect, drawRect, buttonBgColor);
+
+    int arrowDirection;
+    if (scrollbar->orientation() == VerticalScrollbar)
+        arrowDirection = part == BackButtonStartPart ? BControlLook::B_UP_ARROW : BControlLook::B_DOWN_ARROW;
+    else
+        arrowDirection = part == BackButtonStartPart ? BControlLook::B_LEFT_ARROW : BControlLook::B_RIGHT_ARROW;
+
+    be_control_look->DrawArrowShape(view, drawRect, drawRect, ui_color(B_CONTROL_TEXT_COLOR), arrowDirection);
+}
+
+void ScrollbarThemeHaiku::paintThumb(GraphicsContext* context, Scrollbar*, const IntRect& rect)
+{
+    if (!be_control_look)
+        return;
+
+    BRect drawRect = BRect(rect);
+    BView* view = context->platformContext();
+    rgb_color panelBgColor = ui_color(B_PANEL_BACKGROUND_COLOR);
+    rgb_color buttonBgColor = tint_color(panelBgColor, B_LIGHTEN_1_TINT);
+
+    be_control_look->DrawButtonFrame(view, drawRect, drawRect, buttonBgColor, panelBgColor);
+    be_control_look->DrawButtonBackground(view, drawRect, drawRect, buttonBgColor);
+}
+
+}
+
diff --git a/WebCore/platform/haiku/ScrollbarThemeHaiku.h b/WebCore/platform/haiku/ScrollbarThemeHaiku.h
new file mode 100644
index 0000000..18e2cc0
--- /dev/null
+++ b/WebCore/platform/haiku/ScrollbarThemeHaiku.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright 2009 Maxime Simon <simon.maxime@gmail.com> All Rights Reserved
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ScrollbarThemeHaiku_h
+#define ScrollbarThemeHaiku_h
+
+#include "ScrollbarThemeComposite.h"
+
+namespace WebCore {
+    class Scrollbar;
+
+    class ScrollbarThemeHaiku : public ScrollbarThemeComposite {
+        public:
+            ScrollbarThemeHaiku();
+            virtual ~ScrollbarThemeHaiku();
+
+            virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+
+            virtual bool hasButtons(Scrollbar*);
+            virtual bool hasThumb(Scrollbar*);
+
+            virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting);
+            virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting);
+            virtual IntRect trackRect(Scrollbar*, bool painting);
+
+            virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
+            virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
+            virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    };
+
+}
+#endif
diff --git a/WebCore/platform/haiku/SharedBufferHaiku.cpp b/WebCore/platform/haiku/SharedBufferHaiku.cpp
new file mode 100644
index 0000000..113cd2e
--- /dev/null
+++ b/WebCore/platform/haiku/SharedBufferHaiku.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedBuffer.h"
+
+#include <File.h>
+#include <String.h>
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fileName)
+{
+    if (fileName.isEmpty())
+        return 0;
+
+    BFile file(BString(fileName).String(), B_READ_ONLY);
+    if (file.InitCheck() != B_OK)
+        return 0;
+
+    RefPtr<SharedBuffer> result = SharedBuffer::create();
+
+    off_t size;
+    file.GetSize(&size);
+    result->m_buffer.resize(size);
+    if (result->m_buffer.size() != size)
+        return 0;
+
+    file.Read(result->m_buffer.data(), result->m_buffer.size());
+    return result.release();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/SharedTimerHaiku.cpp b/WebCore/platform/haiku/SharedTimerHaiku.cpp
new file mode 100644
index 0000000..6265a2a
--- /dev/null
+++ b/WebCore/platform/haiku/SharedTimerHaiku.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2009 Maxime Simon <simon.maxime@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedTimer.h"
+
+#include <MessageFilter.h>
+#include <MessageRunner.h>
+#include <Looper.h>
+#include <support/Locker.h>
+#include <support/Autolock.h>
+#include <wtf/CurrentTime.h>
+
+#define FIRE_MESSAGE 'fire'
+
+
+namespace WebCore {
+
+class SharedTimerHaiku: public BMessageFilter {
+    friend void setSharedTimerFiredFunction(void (*f)());
+public:
+    static SharedTimerHaiku* instance();
+
+    void start(double);
+    void stop();
+
+protected:
+    virtual filter_result Filter(BMessage*, BHandler**);
+
+private:
+    SharedTimerHaiku();
+    ~SharedTimerHaiku();
+
+    void (*m_timerFunction)();
+    bool m_shouldRun;
+};
+
+SharedTimerHaiku::SharedTimerHaiku()
+    : BMessageFilter(FIRE_MESSAGE)
+    , m_timerFunction(0)
+    , m_shouldRun(false)
+{
+}
+
+SharedTimerHaiku::~SharedTimerHaiku()
+{
+}
+
+SharedTimerHaiku* SharedTimerHaiku::instance()
+{
+    BLooper* looper = BLooper::LooperForThread(find_thread(0));
+    static SharedTimerHaiku* timer;
+
+    if (!timer) {
+        BAutolock lock(looper);
+        timer = new SharedTimerHaiku();
+        looper->AddCommonFilter(timer);
+    }
+
+    return timer;
+}
+
+void SharedTimerHaiku::start(double fireTime)
+{
+    m_shouldRun = true;
+
+    double intervalInSeconds = fireTime - currentTime();
+    bigtime_t intervalInMicroSeconds = intervalInSeconds < 0 ? 0 : intervalInSeconds * 1000000;
+
+    BMessageRunner::StartSending(Looper(), new BMessage(FIRE_MESSAGE), intervalInMicroSeconds, 1);
+}
+
+void SharedTimerHaiku::stop()
+{
+    m_shouldRun = false;
+}
+
+filter_result SharedTimerHaiku::Filter(BMessage*, BHandler**)
+{
+    if (m_shouldRun && m_timerFunction)
+        m_timerFunction();
+
+    return B_SKIP_MESSAGE;
+}
+
+// WebCore functions
+void setSharedTimerFiredFunction(void (*f)())
+{
+    SharedTimerHaiku::instance()->m_timerFunction = f;
+}
+
+void setSharedTimerFireTime(double fireTime)
+{
+    SharedTimerHaiku::instance()->start(fireTime);
+}
+
+void stopSharedTimer()
+{
+    SharedTimerHaiku::instance()->stop();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/haiku/TemporaryLinkStubs.cpp b/WebCore/platform/haiku/TemporaryLinkStubs.cpp
index 48380fc..aa3d538 100644
--- a/WebCore/platform/haiku/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/haiku/TemporaryLinkStubs.cpp
@@ -33,40 +33,11 @@
 
 #include "config.h"
 
-#include "AXObjectCache.h"
-#include "CachedResource.h"
-#include "CookieJar.h"
-#include "Cursor.h"
-#include "DataGridColumnList.h"
-#include "FileSystem.h"
-#include "Font.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "GraphicsContext.h"
-#include "History.h"
-#include "IconLoader.h"
-#include "InspectorController.h"
-#include "IntPoint.h"
 #include "KURL.h"
-#include "Language.h"
-#include "Node.h"
 #include "NotImplemented.h"
-#include "Path.h"
-#include "PlatformMouseEvent.h"
-#include "PlatformScrollBar.h"
-#include "PluginInfoStore.h"
-#include "RenderTheme.h"
-#include "Screen.h"
-#include "Scrollbar.h"
-#include "ScrollbarTheme.h"
-#include "SharedBuffer.h"
-#include "TextBoundaries.h"
-#include "Threading.h"
-#include "Widget.h"
-#include "loader.h"
-#include <runtime/JSValue.h>
-#include <stdio.h>
-#include <stdlib.h>
+#include "PlatformString.h"
+#include "SSLKeyGenerator.h"
+#include "SystemTime.h"
 
 using namespace WebCore;
 
@@ -78,20 +49,14 @@ Vector<char> loadResourceIntoArray(const char*)
 
 namespace WebCore {
 
-bool historyContains(String const&)
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
 {
-    return false;
+    return String();
 }
 
-Vector<String> supportedKeySizes()
+void getSupportedKeySizes(Vector<String>&)
 {
     notImplemented();
-    return Vector<String>();
-}
-
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
-{
-    return String();
 }
 
 float userIdleTime()
@@ -105,22 +70,11 @@ void callOnMainThread(void (*)())
     notImplemented();
 }
 
-PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
-{
-    notImplemented();
-    return 0;
-}
-
 String KURL::fileSystemPath() const
 {
     notImplemented();
     return String();
 }
 
-void getSupportedKeySizes(Vector<String>&)
-{
-    notImplemented();
-}
-
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ImageDecoder.cpp b/WebCore/platform/image-decoders/ImageDecoder.cpp
new file mode 100644
index 0000000..a16b940
--- /dev/null
+++ b/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -0,0 +1,248 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "ImageDecoder.h"
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+#include <algorithm>
+#endif
+
+#include "BMPImageDecoder.h"
+#include "GIFImageDecoder.h"
+#include "ICOImageDecoder.h"
+#include "JPEGImageDecoder.h"
+#include "PNGImageDecoder.h"
+#include "SharedBuffer.h"
+#include "XBMImageDecoder.h"
+
+namespace WebCore {
+
+ImageDecoder* ImageDecoder::create(const SharedBuffer& data)
+{
+    // We need at least 4 bytes to figure out what kind of image we're dealing with.
+    int length = data.size();
+    if (length < 4)
+        return 0;
+
+    const unsigned char* uContents = (const unsigned char*)data.data();
+    const char* contents = data.data();
+
+    // GIFs begin with GIF8(7 or 9).
+    if (strncmp(contents, "GIF8", 4) == 0)
+        return new GIFImageDecoder();
+
+    // Test for PNG.
+    if (uContents[0]==0x89 &&
+        uContents[1]==0x50 &&
+        uContents[2]==0x4E &&
+        uContents[3]==0x47)
+        return new PNGImageDecoder();
+
+    // JPEG
+    if (uContents[0]==0xFF &&
+        uContents[1]==0xD8 &&
+        uContents[2]==0xFF)
+        return new JPEGImageDecoder();
+
+    // BMP
+    if (strncmp(contents, "BM", 2) == 0)
+        return new BMPImageDecoder();
+
+    // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
+    // CURs begin with 2-byte 0 followed by 2-byte 2.
+    if (!memcmp(contents, "\000\000\001\000", 4) ||
+        !memcmp(contents, "\000\000\002\000", 4))
+        return new ICOImageDecoder();
+
+    // XBMs require 8 bytes of info.
+    if (length >= 8 && strncmp(contents, "#define ", 8) == 0)
+        return new XBMImageDecoder();
+
+    // Give up. We don't know what the heck this is.
+    return 0;
+}
+
+#if !PLATFORM(SKIA)
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_hasAlpha(false)
+    , m_status(FrameEmpty)
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+} 
+
+void RGBA32Buffer::clear()
+{
+    m_bytes.clear();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_bytes.fill(0);
+    m_hasAlpha = true;
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_bytes = other.m_bytes;
+    m_size = other.m_size;
+    setHasAlpha(other.m_hasAlpha);
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // NOTE: This has no way to check for allocation failure if the
+    // requested size was too big...
+    m_bytes.resize(newWidth * newHeight);
+    m_size = IntSize(newWidth, newHeight);
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+#endif
+
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+namespace {
+
+enum MatchType {
+    Exact,
+    UpperBound,
+    LowerBound
+};
+
+inline void fillScaledValues(Vector<int>& scaledValues, double scaleRate, int length)
+{
+    double inflateRate = 1. / scaleRate;
+    scaledValues.reserveCapacity(static_cast<int>(length * scaleRate + 0.5));
+    for (int scaledIndex = 0;;) {
+        int index = static_cast<int>(scaledIndex * inflateRate + 0.5);
+        if (index < length) {
+            scaledValues.append(index);
+            ++scaledIndex;
+        } else
+            break;
+    }
+}
+
+template <MatchType type> int getScaledValue(const Vector<int>& scaledValues, int valueToMatch, int searchStart)
+{
+    const int* dataStart = scaledValues.data();
+    const int* dataEnd = dataStart + scaledValues.size();
+    const int* matched = std::lower_bound(dataStart + searchStart, dataEnd, valueToMatch);
+    switch (type) {
+    case Exact:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : -1;
+    case LowerBound:
+        return matched != dataEnd && *matched == valueToMatch ? matched - dataStart : matched - dataStart - 1;
+    case UpperBound:
+    default:
+        return matched != dataEnd ? matched - dataStart : -1;
+    }
+}
+
+}
+
+void ImageDecoder::prepareScaleDataIfNecessary()
+{
+    int width = m_size.width();
+    int height = m_size.height();
+    int numPixels = height * width;
+    if (m_maxNumPixels <= 0 || numPixels <= m_maxNumPixels) {
+        m_scaled = false;
+        return;
+    }
+
+    m_scaled = true;
+    double scale = sqrt(m_maxNumPixels / (double)numPixels);
+    fillScaledValues(m_scaledColumns, scale, width);
+    fillScaledValues(m_scaledRows, scale, height);
+}
+
+int ImageDecoder::upperBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<UpperBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::lowerBoundScaledX(int origX, int searchStart)
+{
+    return getScaledValue<LowerBound>(m_scaledColumns, origX, searchStart);
+}
+
+int ImageDecoder::scaledY(int origY, int searchStart)
+{
+    return getScaledValue<Exact>(m_scaledRows, origY, searchStart);
+}
+
+#endif // ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+
+}
diff --git a/WebCore/platform/image-decoders/ImageDecoder.h b/WebCore/platform/image-decoders/ImageDecoder.h
index 57f8735..37196fe 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/WebCore/platform/image-decoders/ImageDecoder.h
@@ -1,5 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -37,7 +39,8 @@
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
 // TODO(benm): ANDROID: Can we define PLATFORM(SKIA) instead of PLATFORM(SGL) before upstreaming?
 #include "NativeImageSkia.h"
-#include "SkBitmap.h"
+#elif PLATFORM(QT)
+#include <QImage>
 #endif
 
 namespace WebCore {
@@ -55,7 +58,11 @@ namespace WebCore {
             DisposeOverwriteBgcolor,   // Clear frame to transparent
             DisposeOverwritePrevious,  // Clear frame to previous framebuffer contents
         };
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #if (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(SKIA) || PLATFORM(QT)
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -132,6 +139,11 @@ namespace WebCore {
             setRGBA(getAddr(x, y), r, g, b, a);
         }
 
+#if PLATFORM(QT)
+        void setDecodedImage(const QImage& image);
+        QImage decodedImage() const { return m_image; }
+#endif
+
     private:
         RGBA32Buffer& operator=(const RGBA32Buffer& other);
 
@@ -140,13 +152,18 @@ namespace WebCore {
 
         inline PixelData* getAddr(int x, int y)
         {
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #if PLATFORM(CAIRO) || PLATFORM(WX)
             return m_bytes.data() + (y * width()) + x;
 #elif (PLATFORM(SKIA) || PLATFORM(SGL))
+=======
+#if PLATFORM(SKIA)
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
             return m_bitmap.getAddr32(x, y);
+#elif PLATFORM(QT)
+            return reinterpret_cast<QRgb*>(m_image.scanLine(y)) + x;
 #else
-            ASSERT_NOT_REACHED();
-            return 0;
+            return m_bytes.data() + (y * width()) + x;
 #endif
         }
 
@@ -166,13 +183,22 @@ namespace WebCore {
             }
         }
 
-#if PLATFORM(CAIRO) || PLATFORM(WX)
+#if PLATFORM(SKIA)
+        NativeImageSkia m_bitmap;
+#elif PLATFORM(QT)
+        mutable QImage m_image;
+        bool m_hasAlpha;
+        IntSize m_size;
+#else
         Vector<PixelData> m_bytes;
         IntSize m_size;       // The size of the buffer.  This should be the
                               // same as ImageDecoder::m_size.
         bool m_hasAlpha;      // Whether or not any of the pixels in the buffer have transparency.
+<<<<<<< HEAD:WebCore/platform/image-decoders/ImageDecoder.h
 #elif (PLATFORM(SKIA) || PLATFORM(SGL))
         NativeImageSkia m_bitmap;
+=======
+>>>>>>> webkit.org at 49305:WebCore/platform/image-decoders/ImageDecoder.h
 #endif
         IntRect m_rect;       // The rect of the original specified frame within the overall buffer.
                               // This will always just be the entire buffer except for GIF frames
@@ -188,14 +214,27 @@ namespace WebCore {
     // and the base class manages the RGBA32 frame cache.
     class ImageDecoder {
     public:
+        // ENABLE(IMAGE_DECODER_DOWN_SAMPLING) allows image decoders to write directly to
+        // scaled output buffers by down sampling. Call setMaxNumPixels() to specify the
+        // biggest size that decoded images can have. Image decoders will deflate those
+        // images that are bigger than m_maxNumPixels. (Not supported by all image decoders yet)
         ImageDecoder()
             : m_failed(false)
             , m_sizeAvailable(false)
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+            , m_maxNumPixels(-1)
+            , m_scaled(false)
+#endif
         {
         }
 
         virtual ~ImageDecoder() {}
 
+        // Factory function to create an ImageDecoder.  Ports that subclass
+        // ImageDecoder can provide their own implementation of this to avoid
+        // needing to write a dedicated setData() implementation.
+        static ImageDecoder* create(const SharedBuffer& data);
+
         // The the filename extension usually associated with an undecoded image of this type.
         virtual String filenameExtension() const = 0;
 
@@ -272,8 +311,25 @@ namespace WebCore {
         // since in practice only GIFs will ever use this.
         virtual void clearFrameBufferCache(size_t clearBeforeFrame) { }
 
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void setMaxNumPixels(int m) { m_maxNumPixels = m; }
+#endif
+
     protected:
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        void prepareScaleDataIfNecessary();
+        int upperBoundScaledX(int origX, int searchStart = 0);
+        int lowerBoundScaledX(int origX, int searchStart = 0);
+        int scaledY(int origY, int searchStart = 0);
+#endif
+
         RefPtr<SharedBuffer> m_data; // The encoded data.
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        int m_maxNumPixels;
+        Vector<int> m_scaledColumns;
+        Vector<int> m_scaledRows;
+        bool m_scaled;
+#endif
         Vector<RGBA32Buffer> m_frameBufferCache;
         bool m_failed;
 
diff --git a/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp b/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
index c53eabd..203205d 100644
--- a/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
+++ b/WebCore/platform/image-decoders/cairo/ImageDecoderCairo.cpp
@@ -30,53 +30,6 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
     return cairo_image_surface_create_for_data(
@@ -85,40 +38,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         width() * sizeof(PixelData));
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp b/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
index 3542cc2..dc120e3 100644
--- a/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
+++ b/WebCore/platform/image-decoders/haiku/ImageDecoderHaiku.cpp
@@ -28,104 +28,14 @@
 
 #include <Bitmap.h>
 
-
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
-    const void* bytes = m_bytes.data();
-
     BBitmap* bmp = new BBitmap(BRect(0, 0, width(), height()), B_RGB32);
-    bmp->SetBits(bytes, m_size.width() * m_size.height(), 0, B_RGB32);
-
+    bmp->SetBits(m_bytes.data(), m_size.width() * m_size.height(), 0, B_RGB32);
     return bmp;
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.hasAlpha());
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const
-{
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const
-{
-    return m_size.height();
-}
-
 } // namespace WebCore
 
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
index e9296ad..a0ec4f7 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp
@@ -51,12 +51,6 @@ ICOImageDecoder::ICOImageDecoder()
 {
 }
 
-ICOImageDecoder::~ICOImageDecoder()
-{
-    deleteAllValues(m_bmpReaders);
-    deleteAllValues(m_pngDecoders);
-}
-
 void ICOImageDecoder::setData(SharedBuffer* data, bool allDataReceived)
 {
     if (failed())
@@ -208,12 +202,12 @@ bool ICOImageDecoder::decodeAtIndex(size_t index)
             // We need to have already sized m_frameBufferCache before this, and
             // we must not resize it again later (see caution in frameCount()).
             ASSERT(m_frameBufferCache.size() == m_dirEntries.size());
-            m_bmpReaders[index] =
-                new BMPImageReader(this, dirEntry.m_imageOffset, 0, true);
+            m_bmpReaders[index].set(
+                new BMPImageReader(this, dirEntry.m_imageOffset, 0, true));
             m_bmpReaders[index]->setData(m_data.get());
             m_bmpReaders[index]->setBuffer(&m_frameBufferCache[index]);
         } else if (imageType == PNG) {
-            m_pngDecoders[index] = new PNGImageDecoder();
+            m_pngDecoders[index].set(new PNGImageDecoder());
             setDataForPNGDecoderAtIndex(index);
         } else {
             // Not enough data to determine image type yet.
@@ -249,18 +243,15 @@ bool ICOImageDecoder::processDirectory()
         ICON = 1,
         CURSOR = 2,
     };
-    if (((fileType != ICON) && (fileType != CURSOR)) || (idCount == 0)) {
+    if (((fileType != ICON) && (fileType != CURSOR)) || (!idCount)) {
         setFailed();
         return false;
     }
 
-    // Enlarge member vectors to hold all the entries.  We must initialize the
-    // BMP and PNG decoding vectors to 0 so that all entries can be safely
-    // deleted in our destructor.  If we don't do this, they'll contain garbage
-    // values, and deleting those will corrupt memory.
+    // Enlarge member vectors to hold all the entries.
     m_dirEntries.resize(idCount);
-    m_bmpReaders.fill(0, idCount);
-    m_pngDecoders.fill(0, idCount);
+    m_bmpReaders.resize(idCount);
+    m_pngDecoders.resize(idCount);
     return true;
 }
 
@@ -303,10 +294,10 @@ ICOImageDecoder::IconDirectoryEntry ICOImageDecoder::readDirectoryEntry()
     // matching uint8_ts) is so we can record dimensions of size 256 (which is
     // what a zero byte really means).
     int width = static_cast<uint8_t>(m_data->data()[m_decodedOffset]);
-    if (width == 0)
+    if (!width)
         width = 256;
     int height = static_cast<uint8_t>(m_data->data()[m_decodedOffset + 1]);
-    if (height == 0)
+    if (!height)
         height = 256;
     IconDirectoryEntry entry;
     entry.m_size = IntSize(width, height);
@@ -318,11 +309,12 @@ ICOImageDecoder::IconDirectoryEntry ICOImageDecoder::readDirectoryEntry()
     // this isn't quite what the bitmap info header says later, as we only use
     // this value to determine which icon entry is best.
     if (!entry.m_bitCount) {
-        uint8_t colorCount = m_data->data()[m_decodedOffset + 2];
-        if (colorCount) {
-            for (--colorCount; colorCount; colorCount >>= 1)
-                ++entry.m_bitCount;
-        }
+        int colorCount =
+            static_cast<uint8_t>(m_data->data()[m_decodedOffset + 2]);
+        if (!colorCount)
+            colorCount = 256;  // Vague in the spec, needed by real-world icons.
+        for (--colorCount; colorCount; colorCount >>= 1)
+            ++entry.m_bitCount;
     }
 
     m_decodedOffset += sizeOfDirEntry;
diff --git a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
index f8bddf9..6117e06 100644
--- a/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
+++ b/WebCore/platform/image-decoders/ico/ICOImageDecoder.h
@@ -41,7 +41,6 @@ namespace WebCore {
     class ICOImageDecoder : public ImageDecoder {
     public:
         ICOImageDecoder();
-        virtual ~ICOImageDecoder();
 
         // ImageDecoder
         virtual String filenameExtension() const { return "ico"; }
@@ -134,9 +133,9 @@ namespace WebCore {
         IconDirectoryEntries m_dirEntries;
 
         // The image decoders for the various frames.
-        typedef Vector<BMPImageReader*> BMPReaders;
+        typedef Vector<OwnPtr<BMPImageReader> > BMPReaders;
         BMPReaders m_bmpReaders;
-        typedef Vector<PNGImageDecoder*> PNGDecoders;
+        typedef Vector<OwnPtr<PNGImageDecoder> > PNGDecoders;
         PNGDecoders m_pngDecoders;
 
         // Valid only while a BMPImageReader is decoding, this holds the size
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index ae09586..410ef60 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -461,11 +461,27 @@ void JPEGImageDecoder::decode(bool sizeOnly)
     }
 }
 
-static void convertCMYKToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_struct* info)
+static void convertCMYKToRGBA(RGBA32Buffer& dest, int destY, JSAMPROW src, JDIMENSION srcWidth
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+                              , bool scaled, const Vector<int>& scaledColumns
+#endif
+                              )
 {
-    ASSERT(info->out_color_space == JCS_CMYK);
-
-    for (unsigned x = 0; x < info->output_width; ++x) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (scaled) {
+        int numColumns = scaledColumns.size();
+        for (int x = 0; x < numColumns; ++x) {
+            JSAMPLE* jsample = src + scaledColumns[x] * 3;
+            unsigned c = jsample[0];
+            unsigned m = jsample[1];
+            unsigned y = jsample[2];
+            unsigned k = jsample[3];
+            dest.setRGBA(x, destY, c * k / 255, m * k / 255, y * k / 255, 0xFF);
+        }
+        return;
+    }
+#endif
+    for (JDIMENSION x = 0; x < srcWidth; ++x) {
         unsigned c = *src++;
         unsigned m = *src++;
         unsigned y = *src++;
@@ -489,23 +505,31 @@ static void convertCMYKToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_
         // G = 1 - M => 1 - (1 - iM*iK) => iM*iK
         // B = 1 - Y => 1 - (1 - iY*iK) => iY*iK
 
-        // read_scanlines has increased the scanline counter, so we
-        // actually mean the previous one.
-        dest.setRGBA(x, info->output_scanline - 1, c * k / 255, m * k / 255, y * k / 255, 0xFF);
+        dest.setRGBA(x, destY, c * k / 255, m * k / 255, y * k / 255, 0xFF);
     }
 }
 
-static void convertRGBToRGBA(RGBA32Buffer& dest, JSAMPROW src, jpeg_decompress_struct* info)
+static void convertRGBToRGBA(RGBA32Buffer& dest, int destY, JSAMPROW src, JDIMENSION srcWidth
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+                              , bool scaled, const Vector<int>& scaledColumns
+#endif
+                              )
 {
-    ASSERT(info->out_color_space == JCS_RGB);
-
-    for (unsigned x = 0; x < info->output_width; ++x) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (scaled) {
+        int numColumns = scaledColumns.size();
+        for (int x = 0; x < numColumns; ++x) {
+            JSAMPLE* jsample = src + scaledColumns[x] * 3;
+            dest.setRGBA(x, destY, jsample[0], jsample[1], jsample[2], 0xFF);
+        }
+        return;
+    }
+#endif
+    for (JDIMENSION x = 0; x < srcWidth; ++x) {
         unsigned r = *src++;
         unsigned g = *src++;
         unsigned b = *src++;
-        // read_scanlines has increased the scanline counter, so we
-        // actually mean the previous one.
-        dest.setRGBA(x, info->output_scanline - 1, r, g, b, 0xFF);
+        dest.setRGBA(x, destY, r, g, b, 0xFF);
     }
 }
 
@@ -517,7 +541,17 @@ bool JPEGImageDecoder::outputScanlines()
     // Initialize the framebuffer if needed.
     RGBA32Buffer& buffer = m_frameBufferCache[0];
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
-        if (!buffer.setSize(size().width(), size().height())) {
+        int bufferWidth = size().width();
+        int bufferHeight = size().height();
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        // Let's resize our buffer now to the correct width/height.
+        if (m_scaled) {
+            bufferWidth = m_scaledColumns.size();
+            bufferHeight = m_scaledRows.size();
+        }
+#endif
+
+        if (!buffer.setSize(bufferWidth, bufferHeight)) {
             m_failed = true;
             return false;
         }
@@ -532,16 +566,34 @@ bool JPEGImageDecoder::outputScanlines()
     JSAMPARRAY samples = m_reader->samples();
 
     while (info->output_scanline < info->output_height) {
+        // jpeg_read_scanlines will increase the scanline counter, so we
+        // save the scanline before calling it.
+        int sourceY = info->output_scanline;
         /* Request one scanline.  Returns 0 or 1 scanlines. */
         if (jpeg_read_scanlines(info, samples, 1) != 1)
             return false;
 
+        int destY = sourceY;
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        if (m_scaled) {
+            destY = scaledY(sourceY);
+            if (destY < 0)
+                continue;
+        }
         if (info->out_color_space == JCS_RGB)
-            convertRGBToRGBA(buffer, *samples, info);
+            convertRGBToRGBA(buffer, destY, *samples, info->output_width, m_scaled, m_scaledColumns);
         else if (info->out_color_space == JCS_CMYK)
-            convertCMYKToRGBA(buffer, *samples, info);
+            convertCMYKToRGBA(buffer, destY, *samples, info->output_width, m_scaled, m_scaledColumns);
         else
             return false;
+#else
+        if (info->out_color_space == JCS_RGB)
+            convertRGBToRGBA(buffer, destY, *samples, info->output_width);
+        else if (info->out_color_space == JCS_CMYK)
+            convertCMYKToRGBA(buffer, destY, *samples, info->output_width);
+        else
+            return false;
+#endif
     }
 
     return true;
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
index 56e007d..4a822d7 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008-2009 Torch Mobile, Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,6 +58,16 @@ namespace WebCore {
         bool outputScanlines();
         void jpegComplete();
 
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        bool setSize(int width, int height)
+        {
+            if (!ImageDecoder::setSize(width, height))
+                return false;
+            prepareScaleDataIfNecessary();
+            return true;
+        }
+#endif
+
     private:
         JPEGImageReader* m_reader;
     };
diff --git a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index d14333f..ad79fc8 100644
--- a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
  *
  * Portions are Copyright (C) 2001 mozilla.org
  *
@@ -242,6 +243,9 @@ void PNGImageDecoder::headerAvailable()
             longjmp(png->jmpbuf, 1);
             return;
         }
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        prepareScaleDataIfNecessary();
+#endif
     }
 
     int bitDepth, colorType, interlaceType, compressionType, filterType, channels;
@@ -313,7 +317,14 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     // Initialize the framebuffer if needed.
     RGBA32Buffer& buffer = m_frameBufferCache[0];
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
-        if (!buffer.setSize(size().width(), size().height())) {
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+        int width = m_scaled ? m_scaledColumns.size() : size().width();
+        int height = m_scaled ? m_scaledRows.size() : size().height();
+#else
+        int width = size().width();
+        int height = size().height();
+#endif
+        if (!buffer.setSize(width, height)) {
             static_cast<PNGImageDecoder*>(png_get_progressive_ptr(reader()->pngPtr()))->decodingFailed();
             longjmp(reader()->pngPtr()->jmpbuf, 1);
             return;
@@ -358,7 +369,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     * to pass the current row, and the function will combine the
     * old row and the new row.
     */
-    
+
     png_structp png = reader()->pngPtr();
     bool hasAlpha = reader()->hasAlpha();
     unsigned colorChannels = hasAlpha ? 4 : 3;
@@ -372,8 +383,27 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
         row = rowBuffer;
 
     // Copy the data into our buffer.
+#if ENABLE(IMAGE_DECODER_DOWN_SAMPLING)
+    if (m_scaled) {
+        int destY = scaledY(rowIndex);
+        if (destY < 0)
+            return;
+        int columns = m_scaledColumns.size();
+        bool sawAlpha = buffer.hasAlpha();
+        for (int x = 0; x < columns; ++x) {
+            png_bytep pixel = row + m_scaledColumns[x] * 4;
+            unsigned alpha = pixel[3];
+            buffer.setRGBA(x, destY, pixel[0], pixel[1], pixel[2], alpha);
+            if (!sawAlpha && alpha < 255) {
+                sawAlpha = true;
+                buffer.setHasAlpha(true);
+            }
+        }
+        return;
+    }
+#endif
     int width = size().width();
-    bool sawAlpha = false;
+    bool sawAlpha = buffer.hasAlpha();
     for (int x = 0; x < width; x++) {
         unsigned red = *row++;
         unsigned green = *row++;
diff --git a/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
new file mode 100644
index 0000000..da6ab38
--- /dev/null
+++ b/WebCore/platform/image-decoders/qt/RGBA32BufferQt.cpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008, 2009 Google, Inc.
+ * Copyright (C) 2009 Holger Hans Peter Freyther
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ImageDecoder.h"
+
+#include <QPixmap>
+#include <stdio.h>
+
+namespace WebCore {
+
+RGBA32Buffer::RGBA32Buffer()
+    : m_status(FrameEmpty)
+    , m_hasAlpha(false)
+    , m_size()
+    , m_duration(0)
+    , m_disposalMethod(DisposeNotSpecified)
+{
+}
+
+// The image must not have format 8888 pre multiplied...
+void RGBA32Buffer::setDecodedImage(const QImage& image)
+{
+    m_image = image;
+    m_size = image.size();
+    m_hasAlpha = image.hasAlphaChannel();
+}
+
+void RGBA32Buffer::clear()
+{
+    m_image = QImage();
+    m_status = FrameEmpty;
+    // NOTE: Do not reset other members here; clearFrameBufferCache()
+    // calls this to free the bitmap data, but other functions like
+    // initFrameBuffer() and frameComplete() may still need to read
+    // other metadata out of this frame later.
+}
+
+void RGBA32Buffer::zeroFill()
+{
+    m_image.fill(0);
+}
+
+void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return;
+
+    m_image = other.m_image;
+    m_size = other.m_size;
+    m_hasAlpha = other.m_hasAlpha;
+}
+
+bool RGBA32Buffer::setSize(int newWidth, int newHeight)
+{
+    // This function should only be called once, it will leak memory
+    // otherwise.
+    ASSERT(width() == 0 && height() == 0);
+
+    m_size = IntSize(newWidth, newHeight);
+    m_image = QImage(newWidth, newHeight, QImage::Format_ARGB32_Premultiplied);
+    if (m_image.isNull()) {
+        // Allocation failure, maybe the bitmap was too big.
+        setStatus(FrameComplete);
+        return false;
+    }
+
+    // Zero the image.
+    zeroFill();
+
+    return true;
+}
+
+QPixmap* RGBA32Buffer::asNewNativeImage() const
+{
+    QPixmap pix = QPixmap::fromImage(m_image);
+    m_image = QImage();
+
+    return new QPixmap(pix);
+}
+
+bool RGBA32Buffer::hasAlpha() const
+{
+    return m_hasAlpha;
+}
+
+void RGBA32Buffer::setHasAlpha(bool alpha)
+{
+    m_hasAlpha = alpha;
+}
+
+void RGBA32Buffer::setStatus(FrameStatus status)
+{
+    m_status = status;
+}
+
+RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
+{
+    if (this == &other)
+        return *this;
+
+    copyBitmapData(other);
+    setRect(other.rect());
+    setStatus(other.status());
+    setDuration(other.duration());
+    setDisposalMethod(other.disposalMethod());
+    return *this;
+}
+
+int RGBA32Buffer::width() const
+{
+    return m_size.width();
+}
+
+int RGBA32Buffer::height() const
+{
+    return m_size.height();
+}
+
+}
diff --git a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
index 8e8809e..3cadf1c 100644
--- a/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
+++ b/WebCore/platform/image-decoders/wx/ImageDecoderWx.cpp
@@ -37,73 +37,21 @@
 
 namespace WebCore {
 
-RGBA32Buffer::RGBA32Buffer()
-    : m_hasAlpha(false)
-    , m_status(FrameEmpty)
-    , m_duration(0)
-    , m_disposalMethod(DisposeNotSpecified)
-{
-} 
-
-void RGBA32Buffer::clear()
-{
-    m_bytes.clear();
-    m_status = FrameEmpty;
-    // NOTE: Do not reset other members here; clearFrameBufferCache()
-    // calls this to free the bitmap data, but other functions like
-    // initFrameBuffer() and frameComplete() may still need to read
-    // other metadata out of this frame later.
-}
-
-void RGBA32Buffer::zeroFill()
-{
-    m_bytes.fill(0);
-    m_hasAlpha = true;
-}
-
-void RGBA32Buffer::copyBitmapData(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return;
-
-    m_bytes = other.m_bytes;
-    m_size = other.m_size;
-    setHasAlpha(other.m_hasAlpha);
-}
-
-bool RGBA32Buffer::setSize(int newWidth, int newHeight)
-{
-    // NOTE: This has no way to check for allocation failure if the
-    // requested size was too big...
-    m_bytes.resize(newWidth * newHeight);
-    m_size = IntSize(newWidth, newHeight);
-
-    // Zero the image.
-    zeroFill();
-
-    return true;
-}
-
 NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 {
-    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
-    
-    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
-
     wxBitmap* bmp = new wxBitmap(width(), height(), 32);
+    typedef wxPixelData<wxBitmap, wxAlphaPixelFormat> WxPixelData;
     WxPixelData data(*bmp);
     
+    // NB: It appears that the data is in BGRA format instead of RGBA format.
+    // This code works properly on both ppc and intel, meaning the issue is
+    // likely not an issue of byte order getting mixed up on different archs. 
+    const unsigned char* bytes = (const unsigned char*)m_bytes.data();
     int rowCounter = 0;
     long pixelCounter = 0;
-    
     WxPixelData::Iterator p(data);
-    
     WxPixelData::Iterator rowStart = p; 
-    
-    // NB: It appears that the data is in BGRA format instead of RGBA format.
-    // This code works properly on both ppc and intel, meaning the issue is
-    // likely not an issue of byte order getting mixed up on different archs. 
-    for (long i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
+    for (size_t i = 0; i < m_bytes.size() * sizeof(PixelData); i += sizeof(PixelData)) {
         p.Red() = bytes[i+2];
         p.Green() = bytes[i+1];
         p.Blue() = bytes[i+0];
@@ -112,12 +60,11 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
         p++;
 
         pixelCounter++;
-        if ( (pixelCounter % width() ) == 0 ) {
+        if ((pixelCounter % width()) == 0) {
             rowCounter++;
             p = rowStart;
             p.MoveTo(data, 0, rowCounter);
         }
-
     }
 #if !wxCHECK_VERSION(2,9,0)
     bmp->UseAlpha();
@@ -125,7 +72,7 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
     ASSERT(bmp->IsOk());
 
 #if USE(WXGC)
-    wxGraphicsBitmap* bitmap =  new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
+    wxGraphicsBitmap* bitmap = new wxGraphicsBitmap(wxGraphicsRenderer::GetDefaultRenderer()->CreateBitmap(*bmp));
     delete bmp;
     return bitmap;
 #else
@@ -133,40 +80,4 @@ NativeImagePtr RGBA32Buffer::asNewNativeImage() const
 #endif
 }
 
-bool RGBA32Buffer::hasAlpha() const
-{
-    return m_hasAlpha;
-}
-
-void RGBA32Buffer::setHasAlpha(bool alpha)
-{
-    m_hasAlpha = alpha;
-}
-
-void RGBA32Buffer::setStatus(FrameStatus status)
-{
-    m_status = status;
-}
-
-RGBA32Buffer& RGBA32Buffer::operator=(const RGBA32Buffer& other)
-{
-    if (this == &other)
-        return *this;
-
-    copyBitmapData(other);
-    setRect(other.rect());
-    setStatus(other.status());
-    setDuration(other.duration());
-    setDisposalMethod(other.disposalMethod());
-    return *this;
-}
-
-int RGBA32Buffer::width() const {
-    return m_size.width();
-}
-
-int RGBA32Buffer::height() const {
-    return m_size.height();
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/mac/ClipboardMac.h b/WebCore/platform/mac/ClipboardMac.h
index 9bdd276..3d3c78e 100644
--- a/WebCore/platform/mac/ClipboardMac.h
+++ b/WebCore/platform/mac/ClipboardMac.h
@@ -67,7 +67,9 @@ public:
     void setDragImageElement(Node *, const IntPoint&);
     
     virtual DragImageRef createDragImage(IntPoint& dragLoc) const;
+#if ENABLE(DRAG_SUPPORT)
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
+#endif
     virtual void writeRange(Range*, Frame* frame);
     virtual void writeURL(const KURL&, const String&, Frame* frame);
     
diff --git a/WebCore/platform/mac/ClipboardMac.mm b/WebCore/platform/mac/ClipboardMac.mm
index 52bc952..78fb659 100644
--- a/WebCore/platform/mac/ClipboardMac.mm
+++ b/WebCore/platform/mac/ClipboardMac.mm
@@ -63,7 +63,7 @@ bool ClipboardMac::hasData()
     return m_pasteboard && [m_pasteboard.get() types] && [[m_pasteboard.get() types] count] > 0;
 }
     
-static NSString *cocoaTypeFromMIMEType(const String& type)
+static NSString *cocoaTypeFromHTMLClipboardType(const String& type)
 {
     String qType = type.stripWhiteSpace();
 
@@ -82,10 +82,9 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     
     // Try UTI now
     NSString *mimeType = qType;
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL);
-    if (UTIType) {
-        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassNSPboardType);
-        CFRelease(UTIType);
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassMIMEType, (CFStringRef)mimeType, NULL));
+    if (utiType) {
+        CFStringRef pbType = UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassNSPboardType);
         if (pbType)
             return HardAutorelease(pbType);
     }
@@ -94,28 +93,41 @@ static NSString *cocoaTypeFromMIMEType(const String& type)
     return qType;
 }
 
-static String MIMETypeFromCocoaType(NSString *type)
+static String utiTypeFromCocoaType(NSString *type)
+{
+    RetainPtr<CFStringRef> utiType(AdoptCF, UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL));
+    if (utiType) {
+        RetainPtr<CFStringRef> mimeType(AdoptCF, UTTypeCopyPreferredTagWithClass(utiType.get(), kUTTagClassMIMEType));
+        if (mimeType)
+            return String(mimeType.get());
+    }
+    return String();
+}
+
+static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, NSString *cocoaType, NSPasteboard *pasteboard)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
-    if ([type isEqualToString:NSStringPboardType])
-        return "text/plain";
-    if ([type isEqualToString:NSURLPboardType] || [type isEqualToString:NSFilenamesPboardType])
-        return "text/uri-list";
-    
-    // Now try the general UTI mechanism
-    CFStringRef UTIType = UTTypeCreatePreferredIdentifierForTag(kUTTagClassNSPboardType, (CFStringRef)type, NULL);
-    if (UTIType) {
-        CFStringRef mimeType = UTTypeCopyPreferredTagWithClass(UTIType, kUTTagClassMIMEType);
-        CFRelease(UTIType);
-        if (mimeType) {
-            String result = mimeType;
-            CFRelease(mimeType);
-            return result;
+    if ([cocoaType isEqualToString:NSStringPboardType])
+        resultTypes.add("text/plain");
+    else if ([cocoaType isEqualToString:NSURLPboardType])
+        resultTypes.add("text/uri-list");
+    else if ([cocoaType isEqualToString:NSFilenamesPboardType]) {
+        // If file list is empty, add nothing.
+        // Note that there is a chance that the file list count could have changed since we grabbed the types array.
+        // However, this is not really an issue for us doing a sanity check here.
+        NSArray *fileList = [pasteboard propertyListForType:NSFilenamesPboardType];
+        if ([fileList count]) {
+            // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
+            // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
+            resultTypes.add("text/uri-list");
+            resultTypes.add("Files");
         }
+    } else if (String utiType = utiTypeFromCocoaType(cocoaType))
+        resultTypes.add(utiType);
+    else {
+        // No mapping, just pass the whole string though
+        resultTypes.add(cocoaType);
     }
-
-    // No mapping, just pass the whole string though
-    return type;
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -125,7 +137,7 @@ void ClipboardMac::clearData(const String& type)
 
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     if (cocoaType)
         [m_pasteboard.get() setString:@"" forType:cocoaType];
 }
@@ -192,12 +204,12 @@ String ClipboardMac::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable)
         return String();
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaValue = nil;
 
     // Grab the value off the pasteboard corresponding to the cocoaType
     if ([cocoaType isEqualToString:NSURLPboardType]) {
-        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromMIMEType(), "URL" only wants the first URL
+        // "URL" and "text/url-list" both map to NSURLPboardType in cocoaTypeFromHTMLClipboardType(), "URL" only wants the first URL
         bool onlyFirstURL = (type == "URL");
         NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get(), onlyFirstURL);
         cocoaValue = [absoluteURLs componentsJoinedByString:@"\n"];
@@ -222,7 +234,7 @@ bool ClipboardMac::setData(const String &type, const String &data)
         return false;
     // note NSPasteboard enforces changeCount itself on writing - can't write if not the owner
 
-    NSString *cocoaType = cocoaTypeFromMIMEType(type);
+    NSString *cocoaType = cocoaTypeFromHTMLClipboardType(type);
     NSString *cocoaData = data;
 
     if ([cocoaType isEqualToString:NSURLPboardType]) {
@@ -263,15 +275,16 @@ HashSet<String> ClipboardMac::types() const
 
     HashSet<String> result;
     NSUInteger count = [types count];
+    // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
+    // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
     for (NSUInteger i = 0; i < count; i++) {
         NSString *pbType = [types objectAtIndex:i];
         if ([pbType isEqualToString:@"NeXT plain ascii pasteboard type"])
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        String str = MIMETypeFromCocoaType(pbType);
-        if (!result.contains(str))
-            result.add(str);
+        addHTMLClipboardTypesForCocoaType(result, pbType, m_pasteboard.get());
     }
+
     return result;
 }
 
@@ -283,7 +296,7 @@ PassRefPtr<FileList> ClipboardMac::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    NSArray *absoluteURLs = absoluteURLsFromPasteboard(m_pasteboard.get());
+    NSArray *absoluteURLs = absoluteURLsFromPasteboardFilenames(m_pasteboard.get());
     NSUInteger count = [absoluteURLs count];
 
     RefPtr<FileList> fileList = FileList::create();
@@ -355,12 +368,14 @@ void ClipboardMac::writeURL(const KURL& url, const String& title, Frame* frame)
     Pasteboard::writeURL(m_pasteboard.get(), nil, url, title, frame);
 }
     
+#if ENABLE(DRAG_SUPPORT)
 void ClipboardMac::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
     if (Page* page = frame->page())
         page->dragController()->client()->declareAndWriteDragImage(m_pasteboard.get(), kit(element), url, title, frame);
 }
+#endif // ENABLE(DRAG_SUPPORT)
     
 DragImageRef ClipboardMac::createDragImage(IntPoint& loc) const
 {
diff --git a/WebCore/platform/mac/ContextMenuItemMac.mm b/WebCore/platform/mac/ContextMenuItemMac.mm
index c5e2942..48da786 100644
--- a/WebCore/platform/mac/ContextMenuItemMac.mm
+++ b/WebCore/platform/mac/ContextMenuItemMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenuItem.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenu.h"
 
 namespace WebCore {
@@ -152,4 +154,6 @@ bool ContextMenuItem::enabled() const
     return [m_platformDescription.get() isEnabled];
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/mac/ContextMenuMac.mm b/WebCore/platform/mac/ContextMenuMac.mm
index b56d0b9..8ced8cb 100644
--- a/WebCore/platform/mac/ContextMenuMac.mm
+++ b/WebCore/platform/mac/ContextMenuMac.mm
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "ContextMenu.h"
 
+#if ENABLE(CONTEXT_MENUS)
+
 #include "ContextMenuController.h"
 
 @interface WebCoreMenuTarget : NSObject {
@@ -151,4 +153,6 @@ NSMutableArray* ContextMenu::releasePlatformDescription()
     return m_platformDescription.releaseRef();
 }
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(CONTEXT_MENUS)
diff --git a/WebCore/platform/mac/CookieJar.mm b/WebCore/platform/mac/CookieJar.mm
index d8df601..e1d3e5a 100644
--- a/WebCore/platform/mac/CookieJar.mm
+++ b/WebCore/platform/mac/CookieJar.mm
@@ -27,6 +27,7 @@
 #import "CookieJar.h"
 
 #import "BlockExceptions.h"
+#import "Cookie.h"
 #import "Document.h"
 #import "KURL.h"
 #import <wtf/RetainPtr.h>
@@ -116,4 +117,52 @@ bool cookiesEnabled(const Document*)
     return false;
 }
 
+bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    rawCookies.clear();
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSArray *cookies = [[NSHTTPCookieStorage sharedHTTPCookieStorage] cookiesForURL:cookieURL];
+
+    NSUInteger count = [cookies count];
+    rawCookies.reserveCapacity(count);
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        NSString *name = [cookie name];
+        NSString *value = [cookie value];
+        NSString *domain = [cookie domain];
+        NSString *path = [cookie path];
+        NSTimeInterval expires = [[cookie expiresDate] timeIntervalSince1970] * 1000;
+        bool httpOnly = [cookie isHTTPOnly];
+        bool secure = [cookie isSecure];
+        bool session = [cookie isSessionOnly];
+        rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return true;
+}
+
+void deleteCookie(const Document*, const KURL& url, const String& cookieName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+
+    NSURL *cookieURL = url;
+    NSHTTPCookieStorage *cookieStorage = [NSHTTPCookieStorage sharedHTTPCookieStorage];
+    NSArray *cookies = [cookieStorage cookiesForURL:cookieURL];
+    NSString *cookieNameString = (NSString *) cookieName;
+
+    NSUInteger count = [cookies count];
+    for (NSUInteger i = 0; i < count; ++i) {
+        NSHTTPCookie *cookie = (NSHTTPCookie *)[cookies objectAtIndex:i];
+        if ([[cookie name] isEqualToString:cookieNameString]) {
+            [cookieStorage deleteCookie:cookie];
+            break;
+        }
+    }
+
+    END_BLOCK_OBJC_EXCEPTIONS;
+}
+
 }
diff --git a/WebCore/platform/mac/DragDataMac.mm b/WebCore/platform/mac/DragDataMac.mm
index a7b751c..02a6af7 100644
--- a/WebCore/platform/mac/DragDataMac.mm
+++ b/WebCore/platform/mac/DragDataMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragData.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "ClipboardMac.h"
 #import "ClipboardAccessPolicy.h"
 #import "Document.h"
@@ -127,5 +128,6 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
     return core(m_pasteboardHelper->fragmentFromPasteboard([m_platformDragData draggingPasteboard]));
 }
     
-}
+} // namespace WebCore
 
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/mac/DragImageMac.mm b/WebCore/platform/mac/DragImageMac.mm
index 842e6d4..7b51018 100644
--- a/WebCore/platform/mac/DragImageMac.mm
+++ b/WebCore/platform/mac/DragImageMac.mm
@@ -26,6 +26,7 @@
 #import "config.h"
 #import "DragImage.h"
 
+#if ENABLE(DRAG_SUPPORT)
 #import "CachedImage.h"
 #import "Image.h"
 #import "KURL.h"
@@ -98,4 +99,6 @@ RetainPtr<NSImage> createDragImageIconForCachedImage(CachedImage* image)
     return [[NSWorkspace sharedWorkspace] iconForFileType:extension];
 }
     
-}
+} // namespace WebCore
+
+#endif // ENABLE(DRAG_SUPPORT)
diff --git a/WebCore/platform/mac/GeolocationServiceMac.h b/WebCore/platform/mac/GeolocationServiceMac.h
index d0342e7..4beefca 100644
--- a/WebCore/platform/mac/GeolocationServiceMac.h
+++ b/WebCore/platform/mac/GeolocationServiceMac.h
@@ -45,7 +45,7 @@ namespace WebCore {
 
 class GeolocationServiceMac : public GeolocationService {
 public:
-    GeolocationServiceMac(GeolocationServiceClient*);
+    static GeolocationService* create(GeolocationServiceClient*);
     virtual ~GeolocationServiceMac();
     
     virtual bool startUpdating(PositionOptions*);
@@ -61,6 +61,8 @@ public:
     void errorOccurred(PassRefPtr<PositionError>);
 
 private:
+    GeolocationServiceMac(GeolocationServiceClient*);
+
     RetainPtr<CLLocationManager> m_locationManager;
     RetainPtr<WebCoreCoreLocationObserver> m_objcObserver;
     
diff --git a/WebCore/platform/mac/GeolocationServiceMac.mm b/WebCore/platform/mac/GeolocationServiceMac.mm
index 01eca4a..1093e69 100644
--- a/WebCore/platform/mac/GeolocationServiceMac.mm
+++ b/WebCore/platform/mac/GeolocationServiceMac.mm
@@ -65,11 +65,13 @@ using namespace WebCore;
 
 namespace WebCore {
 
-GeolocationService* GeolocationService::create(GeolocationServiceClient* client)
+GeolocationService* GeolocationServiceMac::create(GeolocationServiceClient* client)
 {
     return new GeolocationServiceMac(client);
 }
 
+GeolocationService::FactoryFunction* GeolocationService::s_factoryFunction = &GeolocationServiceMac::create;
+
 GeolocationServiceMac::GeolocationServiceMac(GeolocationServiceClient* client)
     : GeolocationService(client)
     , m_objcObserver(AdoptNS, [[WebCoreCoreLocationObserver alloc] initWithCallback:this])
diff --git a/WebCore/platform/mac/LocalizedStringsMac.mm b/WebCore/platform/mac/LocalizedStringsMac.mm
index fdd7df5..261347f 100644
--- a/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/WebCore/platform/mac/LocalizedStringsMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2009 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -89,6 +89,7 @@ String copyImageUnknownFileLabel()
     return String();
 }
 
+#if ENABLE(CONTEXT_MENUS)
 String contextMenuItemTagOpenLinkInNewWindow()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -544,6 +545,7 @@ String contextMenuItemTagInspectElement()
     END_BLOCK_OBJC_EXCEPTIONS;
     return String();
 }
+#endif // ENABLE(CONTEXT_MENUS)
 
 String searchMenuNoRecentSearchesText()
 {
@@ -625,6 +627,14 @@ String AXDefinitionListDefinitionText()
     return String();
 }
     
+String AXARIAContentGroupText(const String& ariaType)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] AXARIAContentGroupText:ariaType];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();        
+}
+    
 String AXButtonActionVerb()
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
@@ -713,4 +723,29 @@ String mediaElementLiveBroadcastStateText()
     return String();
 }
 
+String localizedMediaControlElementString(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementString:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& controlName)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaControlElementHelpText:controlName];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    BEGIN_BLOCK_OBJC_EXCEPTIONS;
+    return [[WebCoreViewFactory sharedFactory] localizedMediaTimeDescription:time];
+    END_BLOCK_OBJC_EXCEPTIONS;
+    return String();
+}
+
+
 }
diff --git a/WebCore/platform/mac/PasteboardMac.mm b/WebCore/platform/mac/PasteboardMac.mm
index e21f549..f048791 100644
--- a/WebCore/platform/mac/PasteboardMac.mm
+++ b/WebCore/platform/mac/PasteboardMac.mm
@@ -135,8 +135,8 @@ static NSAttributedString *stripAttachmentCharacters(NSAttributedString *string)
 
 void Pasteboard::writeSelection(NSPasteboard* pasteboard, Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
     ASSERT(selectedRange);
     
     NSAttributedString *attributedString = [[[NSAttributedString alloc] _initWithDOMRange:kit(selectedRange)] autorelease];
@@ -203,12 +203,24 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     Pasteboard::writeSelection(m_pasteboard.get(), selectedRange, canSmartCopyOrDelete, frame);
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
+
+    NSArray *types = [NSArray arrayWithObject:NSStringPboardType];
+    NSPasteboard *pasteboard = m_pasteboard.get();
+    [pasteboard declareTypes:types owner:nil];
+
+    [pasteboard setString:text forType:NSStringPboardType];
+}
+
 void Pasteboard::writeURL(NSPasteboard* pasteboard, NSArray* types, const KURL& url, const String& titleStr, Frame* frame)
 {
-    if (WebArchivePboardType == nil)
-        Pasteboard::generalPasteboard(); //Initialises pasteboard types
+    if (!WebArchivePboardType)
+        Pasteboard::generalPasteboard(); // Initialises pasteboard types
    
-    if (types == nil) {
+    if (!types) {
         types = writableTypesForURL();
         [pasteboard declareTypes:types owner:nil];
     }
diff --git a/WebCore/platform/mac/PopupMenuMac.mm b/WebCore/platform/mac/PopupMenuMac.mm
index b98235d..dfb0fff 100644
--- a/WebCore/platform/mac/PopupMenuMac.mm
+++ b/WebCore/platform/mac/PopupMenuMac.mm
@@ -105,7 +105,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
     int numItems = [m_popup.get() numberOfItems];
     if (numItems <= 0) {
         if (client())
-            client()->hidePopup();
+            client()->popupDidHide();
         return;
     }
     ASSERT(numItems > index);
@@ -162,7 +162,7 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 
     if (client()) {
         int newIndex = [m_popup.get() indexOfSelectedItem];
-        client()->hidePopup();
+        client()->popupDidHide();
 
         // Adjust newIndex for hidden first item.
         if (!client()->shouldPopOver())
diff --git a/WebCore/platform/mac/ScrollViewMac.mm b/WebCore/platform/mac/ScrollViewMac.mm
index 5ff0ff5..202d49e 100644
--- a/WebCore/platform/mac/ScrollViewMac.mm
+++ b/WebCore/platform/mac/ScrollViewMac.mm
@@ -163,26 +163,12 @@ bool ScrollView::platformScroll(ScrollDirection, ScrollGranularity)
 void ScrollView::platformRepaintContentRectangle(const IntRect& rect, bool now)
 {
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-
     NSView *view = documentView();
-    NSRect visibleRect = visibleContentRect();
-
-    // FIXME: I don't think this intersection is necessary any more now that
-    // selection doesn't call this method directly (but has to go through FrameView's
-    // repaintContentRectangle, which does the intersection test also).  Leaving it in
-    // for now until I'm sure.
-    // Checking for rect visibility is an important optimization for the case of
-    // Select All of a large document. AppKit does not do this check, and so ends
-    // up building a large complicated NSRegion if we don't perform the check.
-    NSRect dirtyRect = NSIntersectionRect(rect, visibleRect);
-    if (!NSIsEmptyRect(dirtyRect)) {
-        [view setNeedsDisplayInRect:dirtyRect];
-        if (now) {
-            [[view window] displayIfNeeded];
-            [[view window] flushWindowIfNeeded];
-        }
+    [view setNeedsDisplayInRect:rect];
+    if (now) {
+        [[view window] displayIfNeeded];
+        [[view window] flushWindowIfNeeded];
     }
-
     END_BLOCK_OBJC_EXCEPTIONS;
 }
 
diff --git a/WebCore/platform/mac/ThemeMac.mm b/WebCore/platform/mac/ThemeMac.mm
index e7e12ac..fd2f944 100644
--- a/WebCore/platform/mac/ThemeMac.mm
+++ b/WebCore/platform/mac/ThemeMac.mm
@@ -311,6 +311,14 @@ static const IntSize* buttonSizes()
     return sizes;
 }
 
+#if ENABLE(DATALIST)
+static const IntSize* listButtonSizes()
+{
+    static const IntSize sizes[3] = { IntSize(21, 21), IntSize(19, 18), IntSize(17, 16) };
+    return sizes;
+}
+#endif
+
 static const int* buttonMargins(NSControlSize controlSize)
 {
     static const int margins[3][4] =
@@ -333,6 +341,13 @@ static NSButtonCell* button(ControlPart part, ControlStates states, const IntRec
     }
 
     // Set the control size based off the rectangle we're painting into.
+    const IntSize* sizes = buttonSizes();
+#if ENABLE(DATALIST)
+    if (part == ListButtonPart) {
+        [buttonCell setBezelStyle:NSRoundedDisclosureBezelStyle];
+        sizes = listButtonSizes();
+    } else
+#endif
     if (part == SquareButtonPart || zoomedRect.height() > buttonSizes()[NSRegularControlSize].height() * zoomFactor) {
         // Use the square button
         if ([buttonCell bezelStyle] != NSShadowlessSquareBezelStyle)
@@ -362,7 +377,11 @@ static void paintButton(ControlPart part, ControlStates states, GraphicsContext*
     LocalCurrentGraphicsContext localContext(context);
 
     NSControlSize controlSize = [buttonCell controlSize];
+#if ENABLE(DATALIST)
+    IntSize zoomedSize = (part == ListButtonPart ? listButtonSizes() : buttonSizes())[controlSize];
+#else
     IntSize zoomedSize = buttonSizes()[controlSize];
+#endif
     zoomedSize.setWidth(zoomedRect.width()); // Buttons don't ever constrain width, so the zoomed width can just be honored.
     zoomedSize.setHeight(zoomedSize.height() * zoomFactor);
     IntRect inflatedRect = zoomedRect;
@@ -442,6 +461,10 @@ LengthSize ThemeMac::controlSize(ControlPart part, const Font& font, const Lengt
         case PushButtonPart:
             // Height is reset to auto so that specified heights can be ignored.
             return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, buttonSizes());
+#if ENABLE(DATALIST)
+        case ListButtonPart:
+            return sizeFromFont(font, LengthSize(zoomedSize.width(), Length()), zoomFactor, listButtonSizes());
+#endif
         default:
             return zoomedSize;
     }
@@ -453,6 +476,7 @@ LengthSize ThemeMac::minimumControlSize(ControlPart part, const Font& font, floa
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthSize(Length(0, Fixed), Length(static_cast<int>(15 * zoomFactor), Fixed));
         default:
             return Theme::minimumControlSize(part, font, zoomFactor);
@@ -465,6 +489,7 @@ LengthBox ThemeMac::controlBorder(ControlPart part, const Font& font, const Leng
         case SquareButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
+        case ListButtonPart:
             return LengthBox(0, zoomedBox.right().value(), 0, zoomedBox.left().value());
         default:
             return Theme::controlBorder(part, font, zoomedBox, zoomFactor);
@@ -548,6 +573,7 @@ void ThemeMac::paint(ControlPart part, ControlStates states, GraphicsContext* co
         case DefaultButtonPart:
         case ButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
             paintButton(part, states, context, zoomedRect, zoomFactor, scrollView);
             break;
         default:
diff --git a/WebCore/platform/mac/WebCoreNSStringExtras.mm b/WebCore/platform/mac/WebCoreNSStringExtras.mm
index b7087f1..d6c3f0c 100644
--- a/WebCore/platform/mac/WebCoreNSStringExtras.mm
+++ b/WebCore/platform/mac/WebCoreNSStringExtras.mm
@@ -29,6 +29,8 @@
 #import "config.h"
 #import "WebCoreNSStringExtras.h"
 
+#import <wtf/RetainPtr.h>
+
 BOOL stringIsCaseInsensitiveEqualToString(NSString *first, NSString *second)
 {
     return [first compare:second options:(NSCaseInsensitiveSearch|NSLiteralSearch)] == NSOrderedSame;
@@ -69,50 +71,41 @@ NSString *filenameByFixingIllegalCharacters(NSString *string)
 CFStringEncoding stringEncodingForResource(Handle resource)
 {
     short resRef = HomeResFile(resource);
-    if (ResError() != noErr) {
+    if (ResError() != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     // Get the FSRef for the current resource file
     FSRef fref;
     OSStatus error = FSGetForkCBInfo(resRef, 0, NULL, NULL, NULL, &fref, NULL);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
-    CFURLRef URL = CFURLCreateFromFSRef(NULL, &fref);
-    if (URL == NULL) {
+    RetainPtr<CFURLRef> url(AdoptCF, CFURLCreateFromFSRef(NULL, &fref));
+    if (!url)
         return NSMacOSRomanStringEncoding;
-    }
-    
-    NSString *path = [(NSURL *)URL path];
-    CFRelease(URL);
-    
+
+    NSString *path = [(NSURL *)url.get() path];
+
     // Get the lproj directory name
     path = [path stringByDeletingLastPathComponent];
-    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj")) {
+    if (!stringIsCaseInsensitiveEqualToString([path pathExtension], @"lproj"))
         return NSMacOSRomanStringEncoding;
-    }
     
     NSString *directoryName = [[path stringByDeletingPathExtension] lastPathComponent];
-    CFStringRef locale = CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName);
-    if (locale == NULL) {
+    RetainPtr<CFStringRef> locale(AdoptCF, CFLocaleCreateCanonicalLocaleIdentifierFromString(NULL, (CFStringRef)directoryName));
+    if (!locale)
         return NSMacOSRomanStringEncoding;
-    }
-            
+
     LangCode lang;
     RegionCode region;
-    error = LocaleStringToLangAndRegionCodes([(NSString *)locale UTF8String], &lang, &region);
-    CFRelease(locale);
-    if (error != noErr) {
+    error = LocaleStringToLangAndRegionCodes([(NSString *)locale.get() UTF8String], &lang, &region);
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
-    
+
     TextEncoding encoding;
     error = UpgradeScriptInfoToTextEncoding(kTextScriptDontCare, lang, region, NULL, &encoding);
-    if (error != noErr) {
+    if (error != noErr)
         return NSMacOSRomanStringEncoding;
-    }
     
     return encoding;
 }
diff --git a/WebCore/platform/network/Credential.cpp b/WebCore/platform/network/Credential.cpp
index 4743959..caca785 100644
--- a/WebCore/platform/network/Credential.cpp
+++ b/WebCore/platform/network/Credential.cpp
@@ -43,6 +43,11 @@ Credential::Credential(const String& user, const String& password, CredentialPer
     , m_persistence(persistence)
 {
 }
+
+bool Credential::isEmpty()
+{
+    return m_user.isEmpty() && m_password.isEmpty();
+}
     
 const String& Credential::user() const
 { 
diff --git a/WebCore/platform/network/Credential.h b/WebCore/platform/network/Credential.h
index 4d80490..ca4a45a 100644
--- a/WebCore/platform/network/Credential.h
+++ b/WebCore/platform/network/Credential.h
@@ -41,6 +41,8 @@ public:
     Credential();
     Credential(const String& user, const String& password, CredentialPersistence);
     
+    bool isEmpty();
+    
     const String& user() const;
     const String& password() const;
     bool hasPassword() const;
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
new file mode 100644
index 0000000..407ed5b
--- /dev/null
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "CredentialStorage.h"
+
+#include "CString.h"
+#include "Credential.h"
+#include "KURL.h"
+#include "ProtectionSpaceHash.h"
+#include "StringHash.h"
+
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<ProtectionSpace, Credential> ProtectionSpaceToCredentialMap;
+static ProtectionSpaceToCredentialMap& protectionSpaceToCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(ProtectionSpaceToCredentialMap, map, ());
+    return map;
+}
+
+typedef HashMap<String, HashMap<String, Credential> > OriginToDefaultBasicCredentialMap;
+static OriginToDefaultBasicCredentialMap& originToDefaultBasicCredentialMap()
+{
+    DEFINE_STATIC_LOCAL(OriginToDefaultBasicCredentialMap, map, ());
+    return map;
+}
+    
+static String originStringFromURL(const KURL& url)
+{
+    if (url.port())
+        return url.protocol() + "://" + url.host() + String::format(":%i/", url.port());
+    
+    return url.protocol() + "://" + url.host() + "/";
+}
+
+void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.isValid());
+
+    protectionSpaceToCredentialMap().set(protectionSpace, credential);
+    
+    ProtectionSpaceAuthenticationScheme scheme = protectionSpace.authenticationScheme();
+    if (url.protocolInHTTPFamily() && (scheme == ProtectionSpaceAuthenticationSchemeHTTPBasic || scheme == ProtectionSpaceAuthenticationSchemeDefault)) {
+        String origin = originStringFromURL(url);
+        
+        HashMap<String, Credential> pathToCredentialMap;
+        pair<HashMap<String, HashMap<String, Credential> >::iterator, bool> result = originToDefaultBasicCredentialMap().add(origin, pathToCredentialMap);
+        
+        // Remove the last path component that is not a directory to determine the subpath for which this credential applies.
+        // We keep a leading slash, but remove a trailing one.
+        String path = url.path();
+        ASSERT(path.length() > 0);
+        ASSERT(path[0] == '/');
+        if (path.length() > 1) {
+            int index = path.reverseFind('/');
+            path = path.substring(0, index ? index : 1);
+        }
+        ASSERT(path.length() == 1 || path[path.length() - 1] != '/');
+        
+        result.first->second.set(path, credential);
+    }
+}
+
+Credential CredentialStorage::get(const ProtectionSpace& protectionSpace)
+{
+    return protectionSpaceToCredentialMap().get(protectionSpace);
+}
+
+Credential CredentialStorage::getDefaultAuthenticationCredential(const KURL& url)
+{
+    ASSERT(url.protocolInHTTPFamily());
+    String origin = originStringFromURL(url);
+    const HashMap<String, Credential>& pathToCredentialMap(originToDefaultBasicCredentialMap().get(origin));
+    if (pathToCredentialMap.isEmpty())
+        return Credential();
+    
+    // Check to see if there is a stored credential for the subpath ancestry of this url.
+    String path = url.path();
+    Credential credential = pathToCredentialMap.get(path);
+    while (credential.isEmpty() && !path.isNull()) {
+        int index = path.reverseFind('/');
+        if (index == 0) {
+            credential = pathToCredentialMap.get("/");
+            break;
+        } else if (index == -1) {
+            // This case should never happen, as all HTTP URL paths should start with a leading /
+            ASSERT_NOT_REACHED();
+            credential = pathToCredentialMap.get(path);
+            break;
+        } else {
+            path = path.substring(0, index);
+            credential = pathToCredentialMap.get(path);
+        }
+    }
+    return credential;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/CredentialStorage.h b/WebCore/platform/network/CredentialStorage.h
new file mode 100644
index 0000000..737efa6
--- /dev/null
+++ b/WebCore/platform/network/CredentialStorage.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef SessionCredentialStorage_h
+#define SessionCredentialStorage_h
+
+namespace WebCore {
+
+class Credential;
+class KURL;
+class ProtectionSpace;
+
+class CredentialStorage {
+public:
+    static void set(const Credential&, const ProtectionSpace&, const KURL&);
+    static Credential get(const ProtectionSpace&);
+    static Credential getDefaultAuthenticationCredential(const KURL&);
+};
+
+} // namespace WebCore
+
+#endif // SessionCredentialStorage_h
diff --git a/WebCore/platform/network/HTTPHeaderMap.cpp b/WebCore/platform/network/HTTPHeaderMap.cpp
index ff470a0..07c66e8 100644
--- a/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -45,7 +45,7 @@ auto_ptr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 
     HTTPHeaderMap::const_iterator end_it = end();
     for (HTTPHeaderMap::const_iterator it = begin(); it != end_it; ++it) {
-        data->append(make_pair(it->first.string().copy(), it->second.copy()));
+        data->append(make_pair(it->first.string().crossThreadString(), it->second.crossThreadString()));
     }
     return data;
 }
diff --git a/WebCore/platform/network/ProtectionSpace.cpp b/WebCore/platform/network/ProtectionSpace.cpp
index bd73558..d04bcbe 100644
--- a/WebCore/platform/network/ProtectionSpace.cpp
+++ b/WebCore/platform/network/ProtectionSpace.cpp
@@ -37,7 +37,11 @@ namespace WebCore {
 // combined with the semantics of the String(NSString*) constructor
 ProtectionSpace::ProtectionSpace()
     : m_host("")
+    , m_port(0)
+    , m_serverType(ProtectionSpaceServerHTTP)
     , m_realm("")
+    , m_authenticationScheme(ProtectionSpaceAuthenticationSchemeDefault)
+    , m_isHashTableDeletedValue(false)
 {
 }
  
@@ -49,6 +53,7 @@ ProtectionSpace::ProtectionSpace(const String& host, int port, ProtectionSpaceSe
     , m_serverType(serverType)
     , m_realm(realm.length() ? realm : "")
     , m_authenticationScheme(authenticationScheme)
+    , m_isHashTableDeletedValue(false)
 {    
 }
     
diff --git a/WebCore/platform/network/ProtectionSpace.h b/WebCore/platform/network/ProtectionSpace.h
index 9a73cff..126b499 100644
--- a/WebCore/platform/network/ProtectionSpace.h
+++ b/WebCore/platform/network/ProtectionSpace.h
@@ -54,6 +54,10 @@ class ProtectionSpace {
 public:
     ProtectionSpace();
     ProtectionSpace(const String& host, int port, ProtectionSpaceServerType, const String& realm, ProtectionSpaceAuthenticationScheme);
+
+    // Hash table deleted values, which are only constructed and never copied or destroyed.
+    ProtectionSpace(WTF::HashTableDeletedValueType) : m_isHashTableDeletedValue(true) { }
+    bool isHashTableDeletedValue() const { return m_isHashTableDeletedValue; }
     
     const String& host() const;
     int port() const;
@@ -70,10 +74,12 @@ private:
     ProtectionSpaceServerType m_serverType;
     String m_realm;
     ProtectionSpaceAuthenticationScheme m_authenticationScheme;
+    bool m_isHashTableDeletedValue;
 };
 
 bool operator==(const ProtectionSpace& a, const ProtectionSpace& b);
 inline bool operator!=(const ProtectionSpace& a, const ProtectionSpace& b) { return !(a == b); }
     
-}
-#endif
+} // namespace WebCore
+
+#endif // ProtectionSpace_h
diff --git a/WebCore/platform/network/ProtectionSpaceHash.h b/WebCore/platform/network/ProtectionSpaceHash.h
new file mode 100644
index 0000000..6f68b5b
--- /dev/null
+++ b/WebCore/platform/network/ProtectionSpaceHash.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ProtectionSpaceHash_h
+#define ProtectionSpaceHash_h
+
+#include "ProtectionSpace.h"
+
+namespace WebCore {
+
+struct ProtectionSpaceHash {
+    static unsigned hash(const ProtectionSpace& protectionSpace)
+    { 
+        unsigned hashCodes[5] = {
+            protectionSpace.host().impl() ? protectionSpace.host().impl()->hash() : 0, 
+            protectionSpace.port(), 
+            protectionSpace.serverType(),
+            protectionSpace.realm().impl() ? protectionSpace.realm().impl()->hash() : 0,
+            protectionSpace.authenticationScheme()
+        };
+
+        return StringImpl::computeHash(reinterpret_cast<UChar*>(hashCodes), sizeof(hashCodes) / sizeof(UChar));    
+    }
+    
+    static bool equal(const ProtectionSpace& a, const ProtectionSpace& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = false;
+};
+
+} // namespace WebCore
+
+namespace WTF {
+
+    // WebCore::ProtectionSpaceHash is the default hash for ProtectionSpace
+    template<> struct HashTraits<WebCore::ProtectionSpace> : GenericHashTraits<WebCore::ProtectionSpace> {
+        static const bool emptyValueIsZero = true;
+        static void constructDeletedValue(WebCore::ProtectionSpace& slot) { new (&slot) WebCore::ProtectionSpace(HashTableDeletedValue); }
+        static bool isDeletedValue(const WebCore::ProtectionSpace& slot) { return slot.isHashTableDeletedValue(); }
+    };
+
+    template<typename T> struct DefaultHash;
+    template<> struct DefaultHash<WebCore::ProtectionSpace> {
+        typedef WebCore::ProtectionSpaceHash Hash;
+    };
+
+} // namespace WTF
+
+
+#endif // ProtectionSpaceHash_h
diff --git a/WebCore/platform/network/ResourceErrorBase.cpp b/WebCore/platform/network/ResourceErrorBase.cpp
index 370650f..97435ba 100644
--- a/WebCore/platform/network/ResourceErrorBase.cpp
+++ b/WebCore/platform/network/ResourceErrorBase.cpp
@@ -34,10 +34,10 @@ ResourceError ResourceErrorBase::copy() const
     lazyInit();
 
     ResourceError errorCopy;
-    errorCopy.m_domain = m_domain.copy();
+    errorCopy.m_domain = m_domain.crossThreadString();
     errorCopy.m_errorCode = m_errorCode;
-    errorCopy.m_failingURL = m_failingURL.copy();
-    errorCopy.m_localizedDescription = m_localizedDescription.copy();
+    errorCopy.m_failingURL = m_failingURL.crossThreadString();
+    errorCopy.m_localizedDescription = m_localizedDescription.crossThreadString();
     errorCopy.m_isNull = m_isNull;
     errorCopy.m_isCancellation = m_isCancellation;
     return errorCopy;
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index 7951109..31d740a 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -159,6 +159,8 @@ namespace WebCore {
         String m_user;
         String m_pass;
         
+        Credential m_initialCredential;
+        
         int status;
 
         bool m_defersLoading;
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index f9ecb6b..a568cc7 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -62,7 +62,7 @@ auto_ptr<ResourceRequest> ResourceRequestBase::adopt(auto_ptr<CrossThreadResourc
         request->setResponseContentDispositionEncodingFallbackArray(encoding1, encoding2, encoding3);
     }
     request->setHTTPBody(data->m_httpBody);
-    request->setAllowHTTPCookies(data->m_allowHTTPCookies);
+    request->setAllowCookies(data->m_allowCookies);
     return request;
 }
 
@@ -73,17 +73,17 @@ auto_ptr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     data->m_cachePolicy = cachePolicy();
     data->m_timeoutInterval = timeoutInterval();
     data->m_firstPartyForCookies = firstPartyForCookies().copy();
-    data->m_httpMethod = httpMethod().copy();
+    data->m_httpMethod = httpMethod().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
 
     data->m_responseContentDispositionEncodingFallbackArray.reserveInitialCapacity(m_responseContentDispositionEncodingFallbackArray.size());
     size_t encodingArraySize = m_responseContentDispositionEncodingFallbackArray.size();
     for (size_t index = 0; index < encodingArraySize; ++index) {
-        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].copy());
+        data->m_responseContentDispositionEncodingFallbackArray.append(m_responseContentDispositionEncodingFallbackArray[index].crossThreadString());
     }
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
-    data->m_allowHTTPCookies = m_allowHTTPCookies;
+    data->m_allowCookies = m_allowCookies;
     return data;
 }
 
@@ -251,18 +251,18 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
         m_platformRequestUpdated = false;
 } 
 
-bool ResourceRequestBase::allowHTTPCookies() const 
+bool ResourceRequestBase::allowCookies() const
 {
     updateResourceRequest(); 
     
-    return m_allowHTTPCookies; 
+    return m_allowCookies;
 }
 
-void ResourceRequestBase::setAllowHTTPCookies(bool allowHTTPCookies)
+void ResourceRequestBase::setAllowCookies(bool allowCookies)
 {
     updateResourceRequest(); 
     
-    m_allowHTTPCookies = allowHTTPCookies; 
+    m_allowCookies = allowCookies;
     
     if (url().protocolInHTTPFamily())
         m_platformRequestUpdated = false;
@@ -274,6 +274,9 @@ void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const Str
     pair<HTTPHeaderMap::iterator, bool> result = m_httpHeaderFields.add(name, value); 
     if (!result.second)
         result.first->second += "," + value;
+
+    if (url().protocolInHTTPFamily())
+        m_platformRequestUpdated = false;
 }
 
 void ResourceRequestBase::addHTTPHeaderFields(const HTTPHeaderMap& headerFields)
@@ -300,7 +303,7 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     if (a.httpMethod() != b.httpMethod())
         return false;
     
-    if (a.allowHTTPCookies() != b.allowHTTPCookies())
+    if (a.allowCookies() != b.allowCookies())
         return false;
     
     FormData* formDataA = a.httpBody();
@@ -355,7 +358,11 @@ void ResourceRequestBase::updateResourceRequest() const
     m_resourceRequestUpdated = true;
 }
 
+<<<<<<< HEAD:WebCore/platform/network/ResourceRequestBase.cpp
 #if !PLATFORM(MAC) && !USE(CFNETWORK) && !PLATFORM(ANDROID)
+=======
+#if !PLATFORM(MAC) && !USE(CFNETWORK) && !USE(SOUP)
+>>>>>>> webkit.org at 49305:WebCore/platform/network/ResourceRequestBase.cpp
 unsigned initializeMaximumHTTPConnectionCountPerHost()
 {
     // This is used by the loader to control the number of issued parallel load requests. 
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 2d87d6e..348e6b3 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -105,8 +105,8 @@ namespace WebCore {
         FormData* httpBody() const;
         void setHTTPBody(PassRefPtr<FormData> httpBody);
         
-        bool allowHTTPCookies() const;
-        void setAllowHTTPCookies(bool allowHTTPCookies);
+        bool allowCookies() const;
+        void setAllowCookies(bool allowCookies);
 
         bool isConditional() const;
 
@@ -129,7 +129,7 @@ namespace WebCore {
             , m_cachePolicy(policy)
             , m_timeoutInterval(unspecifiedTimeoutInterval)
             , m_httpMethod("GET")
-            , m_allowHTTPCookies(true)
+            , m_allowCookies(true)
             , m_resourceRequestUpdated(true)
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
@@ -148,7 +148,7 @@ namespace WebCore {
         HTTPHeaderMap m_httpHeaderFields;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
         mutable bool m_resourceRequestUpdated;
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
@@ -173,7 +173,7 @@ namespace WebCore {
         OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
         Vector<String> m_responseContentDispositionEncodingFallbackArray;
         RefPtr<FormData> m_httpBody;
-        bool m_allowHTTPCookies;
+        bool m_allowCookies;
     };
     
     unsigned initializeMaximumHTTPConnectionCountPerHost();
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index 7f8a4e2..fd44225 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -108,12 +108,12 @@ auto_ptr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() const
 {
     auto_ptr<CrossThreadResourceResponseData> data(new CrossThreadResourceResponseData());
     data->m_url = url().copy();
-    data->m_mimeType = mimeType().copy();
+    data->m_mimeType = mimeType().crossThreadString();
     data->m_expectedContentLength = expectedContentLength();
-    data->m_textEncodingName = textEncodingName().copy();
-    data->m_suggestedFilename = suggestedFilename().copy();
+    data->m_textEncodingName = textEncodingName().crossThreadString();
+    data->m_suggestedFilename = suggestedFilename().crossThreadString();
     data->m_httpStatusCode = httpStatusCode();
-    data->m_httpStatusText = httpStatusText().copy();
+    data->m_httpStatusText = httpStatusText().crossThreadString();
     data->m_httpHeaders.adopt(httpHeaderFields().copyData());
     data->m_lastModifiedDate = lastModifiedDate();
     return data;
diff --git a/WebCore/platform/network/SocketStreamErrorBase.cpp b/WebCore/platform/network/SocketStreamErrorBase.cpp
new file mode 100644
index 0000000..72fb44c
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamErrorBase.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamError.h"
+
+namespace WebCore {
+
+SocketStreamError SocketStreamErrorBase::copy() const
+{
+    SocketStreamError errorCopy;
+    errorCopy.m_errorCode = m_errorCode;
+    return errorCopy;
+}
+
+bool SocketStreamErrorBase::compare(const SocketStreamError& a, const SocketStreamError& b)
+{
+    return a.errorCode() == b.errorCode();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/bindings/v8/V8ObjectEventListener.h b/WebCore/platform/network/SocketStreamErrorBase.h
index 3c5ae10..b7ca35b 100644
--- a/WebCore/bindings/v8/V8ObjectEventListener.h
+++ b/WebCore/platform/network/SocketStreamErrorBase.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,32 +29,44 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8ObjectEventListener_h
-#define V8ObjectEventListener_h
-
-#include "V8CustomEventListener.h"
-#include <v8.h>
-#include <wtf/PassRefPtr.h>
+#ifndef SocketStreamErrorBase_h
+#define SocketStreamErrorBase_h
 
 namespace WebCore {
 
-    class Frame;
+    class SocketStreamError;
 
-    // V8ObjectEventListener is a special listener wrapper for objects not in the DOM.  It keeps the JS listener as a weak pointer.
-    class V8ObjectEventListener : public V8EventListener {
+    class SocketStreamErrorBase {
     public:
-        static PassRefPtr<V8ObjectEventListener> create(Frame* frame, v8::Local<v8::Object> listener, bool isInline)
+        // Makes a deep copy.  Useful for when you need to use a SocketStreamError on another thread.
+        SocketStreamError copy() const;
+
+        bool isNull() const { return m_isNull; }
+
+        int errorCode() const { return m_errorCode; }
+
+        static bool compare(const SocketStreamError&, const SocketStreamError&);
+
+    protected:
+        SocketStreamErrorBase()
+            : m_errorCode(0)
+            , m_isNull(true)
         {
-            return adoptRef(new V8ObjectEventListener(frame, listener, isInline));
         }
 
-        virtual bool isObjectListener() const { return true; }
+        explicit SocketStreamErrorBase(int errorCode)
+            : m_errorCode(errorCode)
+            , m_isNull(false)
+        {
+        }
 
-    private:
-        V8ObjectEventListener(Frame*, v8::Local<v8::Object> listener, bool isInline);
-        virtual ~V8ObjectEventListener();
+        int m_errorCode;
+        bool m_isNull;
     };
 
-} // namespace WebCore
+    inline bool operator==(const SocketStreamError& a, const SocketStreamError& b) { return SocketStreamErrorBase::compare(a, b); }
+    inline bool operator!=(const SocketStreamError& a, const SocketStreamError& b) { return !(a == b); }
+
+}  // namespace WebCore
 
-#endif // V8ObjectEventListener_h
+#endif  // SocketStreamErrorBase_h
diff --git a/WebCore/platform/network/SocketStreamHandleBase.cpp b/WebCore/platform/network/SocketStreamHandleBase.cpp
new file mode 100644
index 0000000..875c248
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleBase.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandleBase.h"
+
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+const unsigned int bufferSize = 100 * 1024 * 1024;
+
+SocketStreamHandleBase::SocketStreamHandleBase(const KURL& url, SocketStreamHandleClient* client)
+    : m_url(url)
+    , m_client(client)
+    , m_state(Connecting)
+{
+}
+
+SocketStreamHandleBase::SocketStreamState SocketStreamHandleBase::state() const
+{
+    return m_state;
+}
+
+bool SocketStreamHandleBase::send(const char* data, int length)
+{
+    if (m_state == Connecting)
+        return false;
+    if (!m_buffer.isEmpty()) {
+        if (m_buffer.size() + length > bufferSize) {
+            // FIXME: report error to indicate that buffer has no more space.
+            return false;
+        }
+        m_buffer.append(data, length);
+        return true;
+    }
+    int bytesWritten = 0;
+    if (m_state == Open)
+        bytesWritten = platformSend(data, length);
+    if (bytesWritten <= 0)
+        return false;
+    if (m_buffer.size() + length - bytesWritten > bufferSize) {
+        // FIXME: report error to indicate that buffer has no more space.
+        return false;
+    }
+    if (bytesWritten < length)
+        m_buffer.append(data + bytesWritten, length - bytesWritten);
+    return true;
+}
+
+void SocketStreamHandleBase::close()
+{
+    platformClose();
+    m_state = Closed;
+}
+
+void SocketStreamHandleBase::setClient(SocketStreamHandleClient* client)
+{
+    ASSERT(!client || (!m_client && m_state == Connecting));
+    m_client = client;
+}
+
+bool SocketStreamHandleBase::sendPendingData()
+{
+    if (m_state != Open)
+        return false;
+    if (m_buffer.isEmpty())
+        return false;
+    int bytesWritten = platformSend(m_buffer.data(), m_buffer.size());
+    if (bytesWritten <= 0)
+        return false;
+    Vector<char> remainingData;
+    ASSERT(m_buffer.size() - bytesWritten <= bufferSize);
+    remainingData.append(m_buffer.data() + bytesWritten, m_buffer.size() - bytesWritten);
+    m_buffer.swap(remainingData);
+    return true;
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/SocketStreamHandleBase.h b/WebCore/platform/network/SocketStreamHandleBase.h
new file mode 100644
index 0000000..fc011dd
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleBase.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleBase_h
+#define SocketStreamHandleBase_h
+
+#include "KURL.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class SocketStreamHandle;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandleBase {
+    public:
+        enum SocketStreamState { Connecting, Open, Closed };
+        virtual ~SocketStreamHandleBase() { }
+        SocketStreamState state() const;
+
+        bool send(const char* data, int length);
+        void close();
+        int bufferedAmount() const { return m_buffer.size(); }
+
+        SocketStreamHandleClient* client() const { return m_client; }
+        void setClient(SocketStreamHandleClient*);
+
+    protected:
+        SocketStreamHandleBase(const KURL&, SocketStreamHandleClient*);
+
+        bool sendPendingData();
+        virtual int platformSend(const char* data, int length) = 0;
+        virtual void platformClose() = 0;
+
+        KURL m_url;
+        SocketStreamHandleClient* m_client;
+        Vector<char> m_buffer;
+        SocketStreamState m_state;
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleBase_h
diff --git a/WebCore/platform/network/SocketStreamHandleClient.h b/WebCore/platform/network/SocketStreamHandleClient.h
new file mode 100644
index 0000000..04c744e
--- /dev/null
+++ b/WebCore/platform/network/SocketStreamHandleClient.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandleClient_h
+#define SocketStreamHandleClient_h
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class KURL;
+    class SocketStreamError;
+    class SocketStreamHandle;
+
+    class SocketStreamHandleClient {
+    public:
+        virtual ~SocketStreamHandleClient() { }
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&) { }
+        virtual void willSendData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didOpen(SocketStreamHandle*) { }
+        virtual void didClose(SocketStreamHandle*) { }
+        virtual void didReceiveData(SocketStreamHandle*, const char* /*data*/, int /*length*/) { }
+
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&) { }
+
+        virtual void didReceiveAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void didCancelAuthenticationChallenge(SocketStreamHandle*, const AuthenticationChallenge&) { }
+        virtual void receivedCancellation(SocketStreamHandle*, const AuthenticationChallenge&) { }
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandleClient_h
diff --git a/WebCore/platform/network/cf/AuthenticationCF.cpp b/WebCore/platform/network/cf/AuthenticationCF.cpp
index 51d60a4..bb05a39 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.cpp
+++ b/WebCore/platform/network/cf/AuthenticationCF.cpp
@@ -37,8 +37,6 @@
 
 namespace WebCore {
 
-CFMutableDictionaryRef WebCoreCredentialStorage::m_storage;
-
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/cf/AuthenticationCF.h b/WebCore/platform/network/cf/AuthenticationCF.h
index d3fc014..55f3e5f 100644
--- a/WebCore/platform/network/cf/AuthenticationCF.h
+++ b/WebCore/platform/network/cf/AuthenticationCF.h
@@ -43,26 +43,6 @@ CFURLProtectionSpaceRef createCF(const ProtectionSpace&);
 Credential core(CFURLCredentialRef);
 ProtectionSpace core(CFURLProtectionSpaceRef);
 
-class WebCoreCredentialStorage {
-public:
-    static void set(CFURLProtectionSpaceRef protectionSpace, CFURLCredentialRef credential)
-    {
-        if (!m_storage)
-            m_storage = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
-        CFDictionarySetValue(m_storage, protectionSpace, credential);
-    }
-
-    static CFURLCredentialRef get(CFURLProtectionSpaceRef protectionSpace)
-    {
-        if (!m_storage)
-            return 0;
-        return (CFURLCredentialRef)CFDictionaryGetValue(m_storage, protectionSpace);
-    }
-
-private:
-    static CFMutableDictionaryRef m_storage;
-};
-
 }
 
 #endif
diff --git a/WebCore/platform/network/cf/DNSCFNet.cpp b/WebCore/platform/network/cf/DNSCFNet.cpp
index bf21ab1..381dff2 100644
--- a/WebCore/platform/network/cf/DNSCFNet.cpp
+++ b/WebCore/platform/network/cf/DNSCFNet.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Collin Jackson  <collinj@webkit.org>
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,13 +27,128 @@
 #include "config.h"
 #include "DNS.h"
 
-#include "NotImplemented.h"
+#include "StringHash.h"
+#include "Timer.h"
+#include <wtf/RetainPtr.h>
+#include <wtf/StdLibExtras.h>
+
+#if PLATFORM(WIN)
+#include "ResourceHandle.h" // for loaderRunLoop()
+#endif
+
+#ifdef BUILDING_ON_TIGER
+// This function is available on Tiger, but not declared in the CFRunLoop.h header on Tiger.
+extern "C" CFRunLoopRef CFRunLoopGetMain();
+#endif
 
 namespace WebCore {
 
-void prefetchDNS(const String&)
+// When resolve queue is empty, we fire async resolution requests immediately (which is important if the prefetch is triggered by hovering).
+// But during page parsing, we should coalesce identical requests to avoid stressing out CFHost.
+const int namesToResolveImmediately = 4;
+
+// Coalesce prefetch requests for this long before sending them out.
+const double coalesceDelay = 1.0;
+
+// For a page has links to many outside sites, it is likely that the system DNS resolver won't be able to cache them all anyway, and we don't want
+// to negatively affect other appications' performance, by pushing their cached entries out, too.
+// If we end up with lots of names to prefetch, some will be dropped.
+const int maxRequestsToSend = 64;
+
+class DNSResolveQueue : public TimerBase {
+public:
+    static DNSResolveQueue& shared();
+    void add(const String&);
+    void decrementRequestCount();
+
+private:
+    DNSResolveQueue();
+
+    void resolve(const String&);
+    virtual void fired();
+    HashSet<String> m_names;
+    int m_requestsInFlight;
+};
+
+DNSResolveQueue::DNSResolveQueue()
+    : m_requestsInFlight(0)
+{
+}
+
+DNSResolveQueue& DNSResolveQueue::shared()
+{
+    DEFINE_STATIC_LOCAL(DNSResolveQueue, names, ());
+    return names;
+}
+
+void DNSResolveQueue::add(const String& name)
+{
+    // If there are no names queued, and few enough are in flight, resolve immediately (the mouse may be over a link).
+    if (!m_names.size()) {
+        if (atomicIncrement(&m_requestsInFlight) <= namesToResolveImmediately) {
+            resolve(name);
+            return;
+        }
+        atomicDecrement(&m_requestsInFlight);
+    }
+    m_names.add(name);
+    if (!isActive())
+        startOneShot(coalesceDelay);
+}
+
+void DNSResolveQueue::decrementRequestCount()
+{
+    atomicDecrement(&m_requestsInFlight);
+}
+
+void DNSResolveQueue::fired()
+{
+    int requestsAllowed = maxRequestsToSend - m_requestsInFlight;
+
+    for (HashSet<String>::iterator iter = m_names.begin(); iter != m_names.end() && requestsAllowed > 0; ++iter, --requestsAllowed) {
+        atomicIncrement(&m_requestsInFlight);
+        resolve(*iter);
+    }
+
+    // It's better to skip some names than to clog the queue.
+    m_names.clear();
+}
+
+static void clientCallback(CFHostRef theHost, CFHostInfoType, const CFStreamError*, void*)
+{
+    DNSResolveQueue::shared().decrementRequestCount(); // It's ok to call shared() from a secondary thread, the static variable has already been initialized by now.
+    CFRelease(theHost);
+}
+
+void DNSResolveQueue::resolve(const String& hostname)
+{
+    ASSERT(isMainThread());
+
+    RetainPtr<CFStringRef> hostnameCF(AdoptCF, hostname.createCFString());
+    RetainPtr<CFHostRef> host(AdoptCF, CFHostCreateWithName(0, hostnameCF.get()));
+    if (!host) {
+        atomicDecrement(&m_requestsInFlight);
+        return;
+    }
+    CFHostClientContext context = { 0, 0, 0, 0, 0 };
+    Boolean result = CFHostSetClient(host.get(), clientCallback, &context);
+    ASSERT_UNUSED(result, result);
+#if !PLATFORM(WIN)
+    CFHostScheduleWithRunLoop(host.get(), CFRunLoopGetMain(), kCFRunLoopCommonModes);
+#else
+    // On Windows, we run a separate thread with CFRunLoop, which is where clientCallback will be called.
+    CFHostScheduleWithRunLoop(host.get(), ResourceHandle::loaderRunLoop(), kCFRunLoopDefaultMode);
+#endif
+    CFHostStartInfoResolution(host.get(), kCFHostAddresses, 0);
+    host.releaseRef(); // The host will be released from clientCallback().
+}
+
+void prefetchDNS(const String& hostname)
 {
-    notImplemented();
+    ASSERT(isMainThread());
+    if (hostname.isEmpty())
+        return;
+    DNSResolveQueue::shared().add(hostname);
 }
 
 }
diff --git a/WebCore/platform/network/cf/ResourceErrorCF.cpp b/WebCore/platform/network/cf/ResourceErrorCF.cpp
index 8e82cd5..dacc68b 100644
--- a/WebCore/platform/network/cf/ResourceErrorCF.cpp
+++ b/WebCore/platform/network/cf/ResourceErrorCF.cpp
@@ -129,7 +129,7 @@ ResourceError::operator CFErrorRef() const
         if (!m_failingURL.isEmpty()) {
             RetainPtr<CFStringRef> failingURLString(AdoptCF, m_failingURL.createCFString());
             CFDictionarySetValue(userInfo.get(), failingURLStringKey, failingURLString.get());
-            RetainPtr<CFURLRef> url(AdoptCF, KURL(m_failingURL).createCFURL());
+            RetainPtr<CFURLRef> url(AdoptCF, KURL(ParsedURLString, m_failingURL).createCFURL());
             CFDictionarySetValue(userInfo.get(), failingURLKey, url.get());
         }
 
diff --git a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index e348f83..ea5fcc6 100644
--- a/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -31,9 +31,12 @@
 
 #include "AuthenticationCF.h"
 #include "AuthenticationChallenge.h"
-#include "CookieStorageWin.h"
+#include "Base64.h"
 #include "CString.h"
+#include "CookieStorageWin.h"
+#include "CredentialStorage.h"
 #include "DocLoader.h"
+#include "FormDataStreamCFNet.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "Logging.h"
@@ -79,6 +82,8 @@ private:
     RetainPtr<CFURLRef> m_url;
     RetainPtr<CFStringRef> m_user;
     RetainPtr<CFStringRef> m_pass;
+    // Store the preemptively used initial credential so that if we get an authentication challenge, we won't use the same one again.
+    Credential m_initialCredential;
     bool m_allowStoredCredentials;
     ResourceResponse& m_response;
     RetainPtr<CFMutableDataRef> m_data;
@@ -105,6 +110,16 @@ static void setDefaultMIMEType(CFURLResponseRef response)
     CFURLResponseSetMIMEType(response, defaultMIMETypeString);
 }
 
+static String encodeBasicAuthorization(const String& user, const String& password)
+{
+    CString unencodedString = (user + ":" + password).utf8();
+    Vector<char> unencoded(unencodedString.length());
+    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
+    Vector<char> encoded;
+    base64Encode(unencoded, encoded);
+    return String(encoded.data(), encoded.size());
+}
+
 CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfRequest, CFURLResponseRef cfRedirectResponse, const void* clientInfo)
 {
     ResourceHandle* handle = static_cast<ResourceHandle*>(const_cast<void*>(clientInfo));
@@ -125,6 +140,16 @@ CFURLRequestRef willSendRequest(CFURLConnectionRef conn, CFURLRequestRef cfReque
             if (CFStringCompareWithOptions(originalMethod.get(), newMethod.get(), CFRangeMake(0, CFStringGetLength(originalMethod.get())), kCFCompareCaseInsensitive)) {
                 RetainPtr<CFMutableURLRequestRef> mutableRequest(AdoptCF, CFURLRequestCreateMutableCopy(0, cfRequest));
                 CFURLRequestSetHTTPRequestMethod(mutableRequest.get(), originalMethod.get());
+
+                FormData* body = handle->request().httpBody();
+                if (!equalIgnoringCase(handle->request().httpMethod(), "GET") && body && !body->isEmpty())
+                    WebCore::setHTTPBody(mutableRequest.get(), body);
+
+                String originalContentType = handle->request().httpContentType();
+                RetainPtr<CFStringRef> originalContentTypeCF(AdoptCF, originalContentType.createCFString());
+                if (!originalContentType.isEmpty())
+                    CFURLRequestSetHTTPHeaderFieldValue(mutableRequest.get(), CFSTR("Content-Type"), originalContentTypeCF.get());
+
                 request = mutableRequest.get();
             }
         }
@@ -374,6 +399,16 @@ bool ResourceHandle::start(Frame* frame)
         d->m_request.setURL(urlWithCredentials);
     }
 
+    // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+    // try and reuse the credential preemptively, as allowed by RFC 2617.
+    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
+        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+        
+    if (!d->m_initialCredential.isEmpty()) {
+        String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
+        d->m_request.addHTTPHeaderField("Authorization", authHeader);
+    }
+
     RetainPtr<CFURLRequestRef> request(AdoptCF, makeFinalRequest(d->m_request, d->m_shouldContentSniff));
 
     CFURLConnectionClient_V3 client = { 3, this, 0, 0, 0, WebCore::willSendRequest, didReceiveResponse, didReceiveData, NULL, didFinishLoading, didFail, willCacheResponse, didReceiveChallenge, didSendBodyData, shouldUseCredentialStorageCallback, 0};
@@ -441,7 +476,12 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
         RetainPtr<CFStringRef> pass(AdoptCF, d->m_pass.createCFString());
         RetainPtr<CFURLCredentialRef> credential(AdoptCF,
             CFURLCredentialCreate(kCFAllocatorDefault, user.get(), pass.get(), 0, kCFURLCredentialPersistenceNone));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), credential.get());
+        
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(core(credential.get()), challenge.protectionSpace(), urlToStore);
+        
         CFURLConnectionUseCredential(d->m_connection.get(), credential.get(), challenge.cfURLAuthChallengeRef());
         d->m_user = String();
         d->m_pass = String();
@@ -450,10 +490,11 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
     }
 
     if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
-        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()));
-        if (credential) {
-            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
-            CFURLConnectionUseCredential(d->m_connection.get(), credential, challenge.cfURLAuthChallengeRef());
+        Credential credential = CredentialStorage::get(challenge.protectionSpace());
+        if (!credential.isEmpty() && credential != d->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+            CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
             return;
         }
     }
@@ -478,7 +519,12 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // to ignore it for a particular request (short of removing it altogether).
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
         RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(webCredential));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge.cfURLAuthChallengeRef()), cfCredential.get());
+        
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();      
+        CredentialStorage::set(webCredential, challenge.protectionSpace(), urlToStore);
+
         CFURLConnectionUseCredential(d->m_connection.get(), cfCredential.get(), challenge.cfURLAuthChallengeRef());
     } else {
         RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
@@ -659,19 +705,28 @@ void WebCoreSynchronousLoader::didReceiveChallenge(CFURLConnectionRef conn, CFUR
     WebCoreSynchronousLoader* loader = static_cast<WebCoreSynchronousLoader*>(const_cast<void*>(clientInfo));
 
     if (loader->m_user && loader->m_pass) {
-        RetainPtr<CFURLCredentialRef> credential(AdoptCF,
-            CFURLCredentialCreate(kCFAllocatorDefault, loader->m_user.get(), loader->m_pass.get(), 0, kCFURLCredentialPersistenceNone));
-        WebCoreCredentialStorage::set(CFURLAuthChallengeGetProtectionSpace(challenge), credential.get());
-        CFURLConnectionUseCredential(conn, credential.get(), challenge);
+        Credential credential(loader->m_user.get(), loader->m_pass.get(), CredentialPersistenceNone);
+        RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+        
+        CFURLResponseRef urlResponse = (CFURLResponseRef)CFURLAuthChallengeGetFailureResponse(challenge);
+        CFHTTPMessageRef httpResponse = urlResponse ? CFURLResponseGetHTTPResponse(urlResponse) : 0;
+        KURL urlToStore;
+        if (httpResponse && CFHTTPMessageGetResponseStatusCode(httpResponse) == 401)
+            urlToStore = loader->m_url.get();
+            
+        CredentialStorage::set(credential, core(CFURLAuthChallengeGetProtectionSpace(challenge)), urlToStore);
+        
+        CFURLConnectionUseCredential(conn, cfCredential.get(), challenge);
         loader->m_user = 0;
         loader->m_pass = 0;
         return;
     }
     if (!CFURLAuthChallengeGetPreviousFailureCount(challenge) && loader->m_allowStoredCredentials) {
-        CFURLCredentialRef credential = WebCoreCredentialStorage::get(CFURLAuthChallengeGetProtectionSpace(challenge));
-        if (credential) {
-            ASSERT(CFURLCredentialGetPersistence(credential) == kCFURLCredentialPersistenceNone);
-            CFURLConnectionUseCredential(conn, credential, challenge);
+        Credential credential = CredentialStorage::get(core(CFURLAuthChallengeGetProtectionSpace(challenge)));
+        if (!credential.isEmpty() && credential != loader->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            RetainPtr<CFURLCredentialRef> cfCredential(AdoptCF, createCF(credential));
+            CFURLConnectionUseCredential(conn, cfCredential.get(), challenge);
             return;
         }
     }
@@ -696,8 +751,10 @@ RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& reque
 
     KURL url = request.url();
 
-    loader.m_user.adoptCF(url.user().createCFString());
-    loader.m_pass.adoptCF(url.pass().createCFString());
+    if (url.user().length())
+        loader.m_user.adoptCF(url.user().createCFString());
+    if (url.pass().length())
+        loader.m_pass.adoptCF(url.pass().createCFString());
     loader.m_allowStoredCredentials = (storedCredentials == AllowStoredCredentials);
 
     // Take user/pass out of the URL.
@@ -707,8 +764,20 @@ RetainPtr<CFDataRef> WebCoreSynchronousLoader::load(const ResourceRequest& reque
         ResourceRequest requestWithoutCredentials(request);
         requestWithoutCredentials.removeCredentials();
         cfRequest.adoptCF(makeFinalRequest(requestWithoutCredentials, ResourceHandle::shouldContentSniffURL(requestWithoutCredentials.url())));
-    } else
-        cfRequest.adoptCF(makeFinalRequest(request, ResourceHandle::shouldContentSniffURL(request.url())));
+    } else {
+        // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+        // try and reuse the credential preemptively, as allowed by RFC 2617.
+        ResourceRequest requestWithInitialCredential(request);
+        if (loader.m_allowStoredCredentials && url.protocolInHTTPFamily())
+            loader.m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+
+        if (!loader.m_initialCredential.isEmpty()) {
+            String authHeader = "Basic " + encodeBasicAuthorization(loader.m_initialCredential.user(), loader.m_initialCredential.password());
+            requestWithInitialCredential.addHTTPHeaderField("Authorization", authHeader);
+        }
+
+        cfRequest.adoptCF(makeFinalRequest(requestWithInitialCredential, ResourceHandle::shouldContentSniffURL(requestWithInitialCredential.url())));
+    }
 
     CFURLConnectionClient_V3 client = { 3, &loader, 0, 0, 0, willSendRequest, didReceiveResponse, didReceiveData, 0, didFinishLoading, didFail, 0, didReceiveChallenge, 0, shouldUseCredentialStorage, 0 };
     RetainPtr<CFURLConnectionRef> connection(AdoptCF, CFURLConnectionCreate(kCFAllocatorDefault, cfRequest.get(), reinterpret_cast<CFURLConnectionClient*>(&client)));
diff --git a/WebCore/platform/network/cf/ResourceRequest.h b/WebCore/platform/network/cf/ResourceRequest.h
index a4e9749..8ead412 100644
--- a/WebCore/platform/network/cf/ResourceRequest.h
+++ b/WebCore/platform/network/cf/ResourceRequest.h
@@ -37,7 +37,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
index 7355401..bba3d3e 100644
--- a/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
+++ b/WebCore/platform/network/cf/ResourceRequestCFNet.cpp
@@ -112,7 +112,7 @@ void ResourceRequest::doUpdatePlatformRequest()
 
     addHeadersFromHashMap(cfRequest, httpHeaderFields());
     WebCore::setHTTPBody(cfRequest, httpBody());
-    CFURLRequestSetShouldHandleHTTPCookies(cfRequest, allowHTTPCookies());
+    CFURLRequestSetShouldHandleHTTPCookies(cfRequest, allowCookies());
 
     unsigned fallbackCount = m_responseContentDispositionEncodingFallbackArray.size();
     RetainPtr<CFMutableArrayRef> encodingFallbacks(AdoptCF, CFArrayCreateMutable(kCFAllocatorDefault, fallbackCount, 0));
@@ -146,7 +146,7 @@ void ResourceRequest::doUpdateResourceRequest()
         m_httpMethod = method;
         CFRelease(method);
     }
-    m_allowHTTPCookies = CFURLRequestShouldHandleHTTPCookies(m_cfRequest.get());
+    m_allowCookies = CFURLRequestShouldHandleHTTPCookies(m_cfRequest.get());
 
     if (CFDictionaryRef headers = CFURLRequestCopyAllHTTPHeaderFields(m_cfRequest.get())) {
         CFIndex headerCount = CFDictionaryGetCount(headers);
diff --git a/WebCore/platform/network/cf/SocketStreamError.h b/WebCore/platform/network/cf/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/cf/SocketStreamHandle.h b/WebCore/platform/network/cf/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/chromium/CookieJarChromium.cpp b/WebCore/platform/network/chromium/CookieJarChromium.cpp
index 65be451..7862cc3 100644
--- a/WebCore/platform/network/chromium/CookieJarChromium.cpp
+++ b/WebCore/platform/network/chromium/CookieJarChromium.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "ChromiumBridge.h"
 #include "Document.h"
 
@@ -52,4 +53,16 @@ bool cookiesEnabled(const Document*)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index aa76de4..48ff1e7 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -46,10 +46,10 @@ namespace WebCore {
         };
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -58,7 +58,7 @@ namespace WebCore {
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
             , m_securityInfo(securityInfo)
         {
@@ -68,7 +68,7 @@ namespace WebCore {
             : ResourceRequestBase(url, UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -77,7 +77,7 @@ namespace WebCore {
             : ResourceRequestBase(url, policy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
             setHTTPReferrer(referrer);
@@ -87,7 +87,7 @@ namespace WebCore {
             : ResourceRequestBase(KURL(), UseProtocolCachePolicy)
             , m_requestorID(0)
             , m_requestorProcessID(0)
-            , m_appCacheContextID(0)
+            , m_appCacheHostID(0)
             , m_targetType(TargetIsSubResource)
         {
         }
@@ -107,9 +107,9 @@ namespace WebCore {
         int requestorProcessID() const { return m_requestorProcessID; }
         void setRequestorProcessID(int requestorProcessID) { m_requestorProcessID = requestorProcessID; }
 
-        // Allows the request to be matched up with its app cache context.
-        int appCacheContextID() const { return m_appCacheContextID; }
-        void setAppCacheContextID(int id) { m_appCacheContextID = id; }
+        // Allows the request to be matched up with its app cache host.
+        int appCacheHostID() const { return m_appCacheHostID; }
+        void setAppCacheHostID(int id) { m_appCacheHostID = id; }
 
         // Opaque buffer that describes the security state (including SSL
         // connection state) for the resource that should be reported when the
@@ -128,7 +128,7 @@ namespace WebCore {
 
         int m_requestorID;
         int m_requestorProcessID;
-        int m_appCacheContextID;
+        int m_appCacheHostID;
         TargetType m_targetType;
         CString m_securityInfo;
     };
diff --git a/WebCore/platform/network/chromium/ResourceResponse.h b/WebCore/platform/network/chromium/ResourceResponse.h
index 6c928c0..0c2b5d9 100644
--- a/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/WebCore/platform/network/chromium/ResourceResponse.h
@@ -60,12 +60,18 @@ namespace WebCore {
             m_isContentFiltered = isContentFiltered;
         }
 
-        long long getAppCacheID() const { return m_appCacheID; }
+        long long appCacheID() const { return m_appCacheID; }
         void setAppCacheID(long long id)
         {
             m_appCacheID = id;
         }
 
+        const KURL& appCacheManifestURL() const { return m_appCacheManifestURL; }
+        void setAppCacheManifestURL(const KURL& url)
+        {
+            m_appCacheManifestURL = url;
+        }
+
     private:
         friend class ResourceResponseBase;
 
@@ -86,6 +92,10 @@ namespace WebCore {
         // The id of the appcache this response was retrieved from, or zero if
         // the response was not retrieved from an appcache.
         long long m_appCacheID;
+
+        // The manifest url of the appcache this response was retrieved from, if any.
+        // Note: only valid for main resource responses.
+        KURL m_appCacheManifestURL;
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/SocketStreamError.h b/WebCore/platform/network/chromium/SocketStreamError.h
new file mode 100644
index 0000000..540496b
--- /dev/null
+++ b/WebCore/platform/network/chromium/SocketStreamError.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+class SocketStreamError : public SocketStreamErrorBase {
+public:
+    SocketStreamError() { }
+    explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode) { }
+};
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/chromium/SocketStreamHandle.h b/WebCore/platform/network/chromium/SocketStreamHandle.h
new file mode 100644
index 0000000..5a905cb
--- /dev/null
+++ b/WebCore/platform/network/chromium/SocketStreamHandle.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+    class SocketStreamHandleInternal;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+
+        friend class SocketStreamHandleInternal;
+        OwnPtr<SocketStreamHandleInternal> m_internal;
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/curl/CookieJarCurl.cpp b/WebCore/platform/network/curl/CookieJarCurl.cpp
index 5ac0f9c..3bad4e4 100644
--- a/WebCore/platform/network/curl/CookieJarCurl.cpp
+++ b/WebCore/platform/network/curl/CookieJarCurl.cpp
@@ -17,6 +17,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -43,4 +44,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index a6f5dca..5469ec9 100644
--- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -103,7 +103,13 @@ ResourceHandle::~ResourceHandle()
 
 bool ResourceHandle::start(Frame* frame)
 {
-    ASSERT(frame);
+    // The frame could be null if the ResourceHandle is not associated to any
+    // Frame, e.g. if we are downloading a file.
+    // If the frame is not null but the page is null this must be an attempted
+    // load from an onUnload handler, so let's just block it.
+    if (frame && !frame->page())
+        return false;
+
     ResourceHandleManager::sharedInstance()->add(this);
     return true;
 }
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index 2aa286a..14c6f31 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -5,6 +5,8 @@
  * Copyright (C) 2007 Holger Hans Peter Freyther
  * Copyright (C) 2008 Collabora Ltd.
  * Copyright (C) 2008 Nuanti Ltd.
+ * Copyright (C) 2009 Appcelerator Inc.
+ * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -44,6 +46,7 @@
 
 #include <errno.h>
 #include <stdio.h>
+#include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -54,16 +57,72 @@ const int maxRunningJobs = 5;
 
 static const bool ignoreSSLErrors = getenv("WEBKIT_IGNORE_SSL_ERRORS");
 
+static CString certificatePath()
+{
+#if PLATFORM(CF)
+    CFBundleRef webKitBundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebKit"));
+    if (webKitBundle) {
+        RetainPtr<CFURLRef> certURLRef(AdoptCF, CFBundleCopyResourceURL(webKitBundle, CFSTR("cacert"), CFSTR("pem"), CFSTR("certificates")));
+        if (certURLRef) {
+            char path[MAX_PATH];
+            CFURLGetFileSystemRepresentation(certURLRef.get(), false, reinterpret_cast<UInt8*>(path), MAX_PATH);
+            return path;
+        }
+    }
+#endif
+    char* envPath = getenv("CURL_CA_BUNDLE_PATH");
+    if (envPath)
+       return envPath;
+
+    return CString();
+}
+
+static Mutex* sharedResourceMutex(curl_lock_data data) {
+    DEFINE_STATIC_LOCAL(Mutex, cookieMutex, ());
+    DEFINE_STATIC_LOCAL(Mutex, dnsMutex, ());
+    DEFINE_STATIC_LOCAL(Mutex, shareMutex, ());
+
+    switch (data) {
+        case CURL_LOCK_DATA_COOKIE:
+            return &cookieMutex;
+        case CURL_LOCK_DATA_DNS:
+            return &dnsMutex;
+        case CURL_LOCK_DATA_SHARE:
+            return &shareMutex;
+        default:
+            ASSERT_NOT_REACHED();
+            return NULL;
+    }
+}
+
+// libcurl does not implement its own thread synchronization primitives.
+// these two functions provide mutexes for cookies, and for the global DNS
+// cache.
+static void curl_lock_callback(CURL* handle, curl_lock_data data, curl_lock_access access, void* userPtr)
+{
+    if (Mutex* mutex = sharedResourceMutex(data))
+        mutex->lock();
+}
+
+static void curl_unlock_callback(CURL* handle, curl_lock_data data, void* userPtr)
+{
+    if (Mutex* mutex = sharedResourceMutex(data))
+        mutex->unlock();
+}
+
 ResourceHandleManager::ResourceHandleManager()
     : m_downloadTimer(this, &ResourceHandleManager::downloadTimerCallback)
     , m_cookieJarFileName(0)
     , m_runningJobs(0)
+    , m_certificatePath (certificatePath())
 {
     curl_global_init(CURL_GLOBAL_ALL);
     m_curlMultiHandle = curl_multi_init();
     m_curlShareHandle = curl_share_init();
     curl_share_setopt(m_curlShareHandle, CURLSHOPT_SHARE, CURL_LOCK_DATA_COOKIE);
     curl_share_setopt(m_curlShareHandle, CURLSHOPT_SHARE, CURL_LOCK_DATA_DNS);
+    curl_share_setopt(m_curlShareHandle, CURLSHOPT_LOCKFUNC, curl_lock_callback);
+    curl_share_setopt(m_curlShareHandle, CURLSHOPT_UNLOCKFUNC, curl_unlock_callback);
 }
 
 ResourceHandleManager::~ResourceHandleManager()
@@ -88,6 +147,23 @@ ResourceHandleManager* ResourceHandleManager::sharedInstance()
     return sharedInstance;
 }
 
+static void handleLocalReceiveResponse (CURL* handle, ResourceHandle* job, ResourceHandleInternal* d)
+{
+    // since the code in headerCallback will not have run for local files
+    // the code to set the URL and fire didReceiveResponse is never run,
+    // which means the ResourceLoader's response does not contain the URL.
+    // Run the code here for local files to resolve the issue.
+    // TODO: See if there is a better approach for handling this.
+     const char* hdr;
+     CURLcode err = curl_easy_getinfo(handle, CURLINFO_EFFECTIVE_URL, &hdr);
+     ASSERT(CURLE_OK == err);
+     d->m_response.setURL(KURL(ParsedURLString, hdr));
+     if (d->client())
+         d->client()->didReceiveResponse(job, d->m_response);
+     d->m_response.setResponseFired(true);
+}
+
+
 // called with data after all headers have been processed via headerCallback
 static size_t writeCallback(void* ptr, size_t size, size_t nmemb, void* data)
 {
@@ -112,18 +188,10 @@ static size_t writeCallback(void* ptr, size_t size, size_t nmemb, void* data)
     if (CURLE_OK == err && httpCode >= 300 && httpCode < 400)
         return totalSize;
 
-    // since the code in headerCallback will not have run for local files
-    // the code to set the URL and fire didReceiveResponse is never run,
-    // which means the ResourceLoader's response does not contain the URL.
-    // Run the code here for local files to resolve the issue.
-    // TODO: See if there is a better approach for handling this.
     if (!d->m_response.responseFired()) {
-        const char* hdr;
-        err = curl_easy_getinfo(h, CURLINFO_EFFECTIVE_URL, &hdr);
-        d->m_response.setURL(KURL(hdr));
-        if (d->client())
-            d->client()->didReceiveResponse(job, d->m_response);
-        d->m_response.setResponseFired(true);
+        handleLocalReceiveResponse(h, job, d);
+        if (d->m_cancelled)
+            return 0;
     }
 
     if (d->client())
@@ -174,7 +242,7 @@ static size_t headerCallback(char* ptr, size_t size, size_t nmemb, void* data)
 
         const char* hdr;
         err = curl_easy_getinfo(h, CURLINFO_EFFECTIVE_URL, &hdr);
-        d->m_response.setURL(KURL(hdr));
+        d->m_response.setURL(KURL(ParsedURLString, hdr));
 
         long httpCode = 0;
         err = curl_easy_getinfo(h, CURLINFO_RESPONSE_CODE, &httpCode);
@@ -222,6 +290,7 @@ size_t readCallback(void* ptr, size_t size, size_t nmemb, void* data)
 {
     ResourceHandle* job = static_cast<ResourceHandle*>(data);
     ResourceHandleInternal* d = job->getInternal();
+
     if (d->m_cancelled)
         return 0;
 
@@ -311,6 +380,14 @@ void ResourceHandleManager::downloadTimerCallback(Timer<ResourceHandleManager>*
             continue;
 
         if (CURLE_OK == msg->data.result) {
+            if (!d->m_response.responseFired()) {
+                handleLocalReceiveResponse(d->m_handle, job, d);
+                if (d->m_cancelled) {
+                    removeFromCurl(job);
+                    continue;
+                }
+            }
+
             if (d->client())
                 d->client()->didFinishLoading(job);
         } else {
@@ -629,6 +706,10 @@ void ResourceHandleManager::initializeHandle(ResourceHandle* job)
     // and/or reporting SSL errors to the user.
     if (ignoreSSLErrors)
         curl_easy_setopt(d->m_handle, CURLOPT_SSL_VERIFYPEER, false);
+
+    if (!m_certificatePath.isNull())
+       curl_easy_setopt(d->m_handle, CURLOPT_CAINFO, m_certificatePath.data());
+
     // enable gzip and deflate through Accept-Encoding:
     curl_easy_setopt(d->m_handle, CURLOPT_ENCODING, "");
 
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.h b/WebCore/platform/network/curl/ResourceHandleManager.h
index d38e577..89b27d7 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.h
+++ b/WebCore/platform/network/curl/ResourceHandleManager.h
@@ -29,6 +29,7 @@
 #define ResourceHandleManager_h
 
 #include "Frame.h"
+#include "CString.h"
 #include "Timer.h"
 #include "ResourceHandleClient.h"
 
@@ -71,6 +72,7 @@ private:
     char* m_cookieJarFileName;
     char m_curlErrorBuffer[CURL_ERROR_SIZE];
     Vector<ResourceHandle*> m_resourceHandleList;
+    const CString m_certificatePath;
     int m_runningJobs;
 };
 
diff --git a/WebCore/platform/network/curl/ResourceRequest.h b/WebCore/platform/network/curl/ResourceRequest.h
index b3032aa..3fa2795 100644
--- a/WebCore/platform/network/curl/ResourceRequest.h
+++ b/WebCore/platform/network/curl/ResourceRequest.h
@@ -36,7 +36,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url)
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/curl/SocketStreamError.h b/WebCore/platform/network/curl/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/curl/SocketStreamHandle.h b/WebCore/platform/network/curl/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp b/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp
new file mode 100644
index 0000000..891e96e
--- /dev/null
+++ b/WebCore/platform/network/curl/SocketStreamHandleCurl.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2009 Brent Fulgham.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/mac/AuthenticationMac.h b/WebCore/platform/network/mac/AuthenticationMac.h
index 7fb6bee..f55ac24 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.h
+++ b/WebCore/platform/network/mac/AuthenticationMac.h
@@ -45,24 +45,6 @@ AuthenticationChallenge core(NSURLAuthenticationChallenge *);
 ProtectionSpace core(NSURLProtectionSpace *);
 Credential core(NSURLCredential *);
 
-class WebCoreCredentialStorage {
-public:
-    static void set(NSURLCredential *credential, NSURLProtectionSpace *protectionSpace)
-    {
-        if (!m_storage)
-            m_storage = [[NSMutableDictionary alloc] init];
-        [m_storage setObject:credential forKey:protectionSpace];
-    }
-
-    static NSURLCredential *get(NSURLProtectionSpace *protectionSpace)
-    {
-        return static_cast<NSURLCredential *>([m_storage objectForKey:protectionSpace]);
-    }
-
-private:
-    static NSMutableDictionary* m_storage;
-};
-
 }
 #endif
 
diff --git a/WebCore/platform/network/mac/AuthenticationMac.mm b/WebCore/platform/network/mac/AuthenticationMac.mm
index 961a79d..355931d 100644
--- a/WebCore/platform/network/mac/AuthenticationMac.mm
+++ b/WebCore/platform/network/mac/AuthenticationMac.mm
@@ -36,9 +36,6 @@
 
 namespace WebCore {
 
-
-NSMutableDictionary* WebCoreCredentialStorage::m_storage;
-
 AuthenticationChallenge::AuthenticationChallenge(const ProtectionSpace& protectionSpace,
                                                  const Credential& proposedCredential,
                                                  unsigned previousFailureCount,
diff --git a/WebCore/platform/network/mac/FormDataStreamMac.mm b/WebCore/platform/network/mac/FormDataStreamMac.mm
index a8d6887..8aa9a6d 100644
--- a/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -161,11 +161,9 @@ static void advanceCurrentStream(FormStreamFields *form)
         form->currentData = data;
     } else {
         const String& path = nextInput.m_shouldGenerateFile ? nextInput.m_generatedFilename : nextInput.m_filename;
-        CFStringRef filename = path.createCFString();
-        CFURLRef fileURL = CFURLCreateWithFileSystemPath(0, filename, kCFURLPOSIXPathStyle, FALSE);
-        CFRelease(filename);
-        form->currentStream = CFReadStreamCreateWithFile(0, fileURL);
-        CFRelease(fileURL);
+        RetainPtr<CFStringRef> filename(AdoptCF, path.createCFString());
+        RetainPtr<CFURLRef> fileURL(AdoptCF, CFURLCreateWithFileSystemPath(0, filename.get(), kCFURLPOSIXPathStyle, FALSE));
+        form->currentStream = CFReadStreamCreateWithFile(0, fileURL.get());
     }
     form->remainingElements.removeLast();
 
@@ -375,11 +373,10 @@ void setHTTPBody(NSMutableURLRequest *request, PassRefPtr<FormData> formData)
     // Pass the length along with the formData so it does not have to be recomputed.
     FormContext formContext = { formData.releaseRef(), length };
 
-    CFReadStreamRef stream = wkCreateCustomCFReadStream(formCreate, formFinalize,
+    RetainPtr<CFReadStreamRef> stream(AdoptCF, wkCreateCustomCFReadStream(formCreate, formFinalize,
         formOpen, formRead, formCanRead, formClose, formSchedule, formUnschedule,
-        &formContext);
-    [request setHTTPBodyStream:(NSInputStream *)stream];
-    CFRelease(stream);
+        &formContext));
+    [request setHTTPBodyStream:(NSInputStream *)stream.get()];
 }
 
 FormData* httpBodyFromStream(NSInputStream* stream)
diff --git a/WebCore/platform/network/mac/ResourceErrorMac.mm b/WebCore/platform/network/mac/ResourceErrorMac.mm
index 94c2124..efd738f 100644
--- a/WebCore/platform/network/mac/ResourceErrorMac.mm
+++ b/WebCore/platform/network/mac/ResourceErrorMac.mm
@@ -76,7 +76,7 @@ ResourceError::operator NSError*() const
             [userInfo.get() setValue:m_localizedDescription forKey:NSLocalizedDescriptionKey];
 
         if (!m_failingURL.isEmpty()) {
-            NSURL *cocoaURL = KURL(m_failingURL);
+            NSURL *cocoaURL = KURL(ParsedURLString, m_failingURL);
             [userInfo.get() setValue:m_failingURL forKey:@"NSErrorFailingURLStringKey"];
             [userInfo.get() setValue:cocoaURL forKey:@"NSErrorFailingURLKey"];
         }
diff --git a/WebCore/platform/network/mac/ResourceHandleMac.mm b/WebCore/platform/network/mac/ResourceHandleMac.mm
index db76d1a..ec60079 100644
--- a/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2006-2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,7 +28,10 @@
 
 #import "AuthenticationChallenge.h"
 #import "AuthenticationMac.h"
+#import "Base64.h"
 #import "BlockExceptions.h"
+#import "CString.h"
+#import "CredentialStorage.h"
 #import "DocLoader.h"
 #import "FormDataStreamMac.h"
 #import "Frame.h"
@@ -64,10 +67,6 @@ using namespace WebCore;
 - (NSData *)_bufferedData;
 @end
 
-@interface NSURLResponse (Details)
-- (void)_setMIMEType:(NSString *)type;
-@end
-
 @interface NSURLRequest (Details)
 - (id)_propertyForKey:(NSString *)key;
 @end
@@ -78,6 +77,8 @@ using namespace WebCore;
     NSURL *m_url;
     NSString *m_user;
     NSString *m_pass;
+    // Store the preemptively used initial credential so that if we get an authentication challenge, we won't use the same one again.
+    Credential m_initialCredential;
     BOOL m_allowStoredCredentials;
     NSURLResponse *m_response;
     NSMutableData *m_data;
@@ -118,6 +119,16 @@ public:
     }
 };
 
+static String encodeBasicAuthorization(const String& user, const String& password)
+{
+    CString unencodedString = (user + ":" + password).utf8();
+    Vector<char> unencoded(unencodedString.length());
+    std::copy(unencodedString.data(), unencodedString.data() + unencodedString.length(), unencoded.begin());
+    Vector<char> encoded;
+    base64Encode(unencoded, encoded);
+    return String(encoded.data(), encoded.size());
+}
+
 ResourceHandleInternal::~ResourceHandleInternal()
 {
 }
@@ -171,6 +182,16 @@ bool ResourceHandle::start(Frame* frame)
         urlWithCredentials.setPass(d->m_pass);
         d->m_request.setURL(urlWithCredentials);
     }
+    
+    // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+    // try and reuse the credential preemptively, as allowed by RFC 2617.
+    if (!client() || client()->shouldUseCredentialStorage(this) && d->m_request.url().protocolInHTTPFamily())
+        d->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(d->m_request.url());
+        
+    if (!d->m_initialCredential.isEmpty()) {
+        String authHeader = "Basic " + encodeBasicAuthorization(d->m_initialCredential.user(), d->m_initialCredential.password());
+        d->m_request.addHTTPHeaderField("Authorization", authHeader);
+    }
 
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         associateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream], this);
@@ -249,6 +270,10 @@ void ResourceHandle::cancel()
 {
     LOG(Network, "Handle %p cancel connection %p", this, d->m_connection.get());
 
+    // Leaks were seen on HTTP tests without this; can be removed once <rdar://problem/6886937> is fixed.
+    if (d->m_currentMacChallenge)
+        [[d->m_currentMacChallenge sender] cancelAuthenticationChallenge:d->m_currentMacChallenge];
+
     if (!ResourceHandle::didSendBodyDataDelegateExists())
         disassociateStreamWithResourceHandle([d->m_request.nsURLRequest() HTTPBodyStream]);
     [d->m_connection.get() cancel];
@@ -458,9 +483,10 @@ void ResourceHandle::didReceiveAuthenticationChallenge(const AuthenticationChall
     }
 
     if (!challenge.previousFailureCount() && (!client() || client()->shouldUseCredentialStorage(this))) {
-        NSURLCredential *credential = WebCoreCredentialStorage::get([mac(challenge) protectionSpace]);
-        if (credential) {
-            [challenge.sender() useCredential:credential forAuthenticationChallenge:mac(challenge)];
+        Credential credential = CredentialStorage::get(challenge.protectionSpace());
+        if (!credential.isEmpty() && credential != d->m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            [challenge.sender() useCredential:mac(credential) forAuthenticationChallenge:mac(challenge)];
             return;
         }
     }
@@ -495,7 +521,11 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
     if (credential.persistence() == CredentialPersistenceNone) {
         // NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use session persistence.
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceForSession);
-        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
+        
         [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
     } else
 #else
@@ -504,7 +534,10 @@ void ResourceHandle::receivedCredential(const AuthenticationChallenge& challenge
         // to ignore it for a particular request (short of removing it altogether).
         // <rdar://problem/6867598> gallery.me.com is temporarily whitelisted, so that QuickTime plug-in could see the credentials.
         Credential webCredential(credential.user(), credential.password(), CredentialPersistenceNone);
-        WebCoreCredentialStorage::set(mac(webCredential), [d->m_currentMacChallenge protectionSpace]);
+        KURL urlToStore;
+        if (challenge.failureResponse().httpStatusCode() == 401)
+            urlToStore = d->m_request.url();
+        CredentialStorage::set(webCredential, core([d->m_currentMacChallenge protectionSpace]), urlToStore);
         [[d->m_currentMacChallenge sender] useCredential:mac(webCredential) forAuthenticationChallenge:d->m_currentMacChallenge];
     } else
 #endif
@@ -572,6 +605,15 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         if (!equalIgnoringCase(originalMethod, String([newRequest HTTPMethod]))) {
             NSMutableURLRequest *mutableRequest = [newRequest mutableCopy];
             [mutableRequest setHTTPMethod:originalMethod];
+    
+            FormData* body = m_handle->request().httpBody();
+            if (!equalIgnoringCase(originalMethod, "GET") && body && !body->isEmpty())
+                WebCore::setHTTPBody(mutableRequest, body);
+
+            String originalContentType = m_handle->request().httpContentType();
+            if (!originalContentType.isEmpty())
+                [mutableRequest setValue:originalContentType forHTTPHeaderField:@"Content-Type"];
+
             newRequest = [mutableRequest autorelease];
         }
     }
@@ -635,13 +677,13 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
 {
     UNUSED_PARAM(connection);
 
-    LOG(Network, "Handle %p delegate connection:%p didReceiveResponse:%p (HTTP status %d, MIMEType '%s', reported MIMEType '%s')", m_handle, connection, r, [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0, [[r MIMEType] UTF8String], [[r _webcore_reportedMIMEType] UTF8String]);
+    LOG(Network, "Handle %p delegate connection:%p didReceiveResponse:%p (HTTP status %d, reported MIMEType '%s')", m_handle, connection, r, [r respondsToSelector:@selector(statusCode)] ? [(id)r statusCode] : 0, [[r MIMEType] UTF8String]);
 
     if (!m_handle || !m_handle->client())
         return;
     CallbackGuard guard;
 
-    swizzleMIMETypeMethodIfNecessary();
+    [r adjustMIMETypeIfNecessary];
 
     if ([m_handle->request().nsURLRequest() _propertyForKey:@"ForceHTMLMIMEType"])
         [r _setMIMEType:@"text/html"];
@@ -851,9 +893,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [super dealloc];
 }
 
-- (NSURLRequest *)connection:(NSURLConnection *)unusedConnection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
+- (NSURLRequest *)connection:(NSURLConnection *)connection willSendRequest:(NSURLRequest *)newRequest redirectResponse:(NSURLResponse *)redirectResponse
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p willSendRequest:%@ redirectResponse:%p", connection, [newRequest description], redirectResponse);
 
     // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
     if (m_url && !protocolHostAndPortAreEqual(m_url, [newRequest URL])) {
@@ -882,23 +926,31 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     return newRequest;
 }
 
-- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)unusedConnection
+- (BOOL)connectionShouldUseCredentialStorage:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connectionShouldUseCredentialStorage:%p", connection);
 
     // FIXME: We should ask FrameLoaderClient whether using credential storage is globally forbidden.
     return m_allowStoredCredentials;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
+- (void)connection:(NSURLConnection *)connection didReceiveAuthenticationChallenge:(NSURLAuthenticationChallenge *)challenge
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveAuthenticationChallenge:%p", connection, challenge);
 
     if (m_user && m_pass) {
         NSURLCredential *credential = [[NSURLCredential alloc] initWithUser:m_user
                                                                    password:m_pass
                                                                 persistence:NSURLCredentialPersistenceNone];
-        WebCoreCredentialStorage::set(credential, [challenge protectionSpace]);
+        KURL urlToStore;
+        if ([[challenge failureResponse] isKindOfClass:[NSHTTPURLResponse class]] && [(NSHTTPURLResponse*)[challenge failureResponse] statusCode] == 401)
+            urlToStore = m_url;
+        CredentialStorage::set(core(credential), core([challenge protectionSpace]), urlToStore);
+        
         [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
         [credential release];
         [m_user release];
@@ -908,10 +960,10 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
         return;
     }
     if ([challenge previousFailureCount] == 0 && m_allowStoredCredentials) {
-        NSURLCredential *credential = WebCoreCredentialStorage::get([challenge protectionSpace]);
-        ASSERT([credential persistence] == NSURLCredentialPersistenceNone);
-        if (credential) {
-            [[challenge sender] useCredential:credential forAuthenticationChallenge:challenge];
+        Credential credential = CredentialStorage::get(core([challenge protectionSpace]));
+        if (!credential.isEmpty() && credential != m_initialCredential) {
+            ASSERT(credential.persistence() == CredentialPersistenceNone);
+            [[challenge sender] useCredential:mac(credential) forAuthenticationChallenge:challenge];
             return;
         }
     }
@@ -919,9 +971,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [[challenge sender] continueWithoutCredentialForAuthenticationChallenge:challenge];
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveResponse:(NSURLResponse *)response
+- (void)connection:(NSURLConnection *)connection didReceiveResponse:(NSURLResponse *)response
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveResponse:%p (HTTP status %d, reported MIMEType '%s')", connection, response, [response respondsToSelector:@selector(statusCode)] ? [(id)response statusCode] : 0, [[response MIMEType] UTF8String]);
 
     NSURLResponse *r = [response copy];
     
@@ -929,9 +983,11 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     m_response = r;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didReceiveData:(NSData *)data
+- (void)connection:(NSURLConnection *)connection didReceiveData:(NSData *)data
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didReceiveData:%p", connection, data);
 
     if (!m_data)
         m_data = [[NSMutableData alloc] init];
@@ -939,16 +995,20 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     [m_data appendData:data];
 }
 
-- (void)connectionDidFinishLoading:(NSURLConnection *)unusedConnection
+- (void)connectionDidFinishLoading:(NSURLConnection *)connection
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connectionDidFinishLoading:%p", connection);
 
     m_isDone = YES;
 }
 
-- (void)connection:(NSURLConnection *)unusedConnection didFailWithError:(NSError *)error
+- (void)connection:(NSURLConnection *)connection didFailWithError:(NSError *)error
 {
-    UNUSED_PARAM(unusedConnection);
+    UNUSED_PARAM(connection);
+
+    LOG(Network, "WebCoreSynchronousLoader delegate connection:%p didFailWithError:%@", connection, error);
 
     ASSERT(!m_error);
     
@@ -973,23 +1033,36 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
 
 + (NSData *)loadRequest:(NSURLRequest *)request allowStoredCredentials:(BOOL)allowStoredCredentials returningResponse:(NSURLResponse **)response error:(NSError **)error
 {
+    LOG(Network, "WebCoreSynchronousLoader loadRequest:%@ allowStoredCredentials:%u", request, allowStoredCredentials);
+
     WebCoreSynchronousLoader *delegate = [[WebCoreSynchronousLoader alloc] init];
 
-    NSURL *url = [request URL];
-    delegate->m_user = [[url user] copy];
-    delegate->m_pass = [[url password] copy];
+    KURL url([request URL]);
+    delegate->m_user = [nsStringNilIfEmpty(url.user()) retain];
+    delegate->m_pass = [nsStringNilIfEmpty(url.pass()) retain];
     delegate->m_allowStoredCredentials = allowStoredCredentials;
 
     NSURLConnection *connection;
 
     // Take user/pass out of the URL.
     // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
-    if ((delegate->m_user || delegate->m_pass) && KURL(url).protocolInHTTPFamily()) {
+    if ((delegate->m_user || delegate->m_pass) && url.protocolInHTTPFamily()) {
         ResourceRequest requestWithoutCredentials = request;
         requestWithoutCredentials.removeCredentials();
         connection = [[NSURLConnection alloc] initWithRequest:requestWithoutCredentials.nsURLRequest() delegate:delegate startImmediately:NO];
-    } else
-        connection = [[NSURLConnection alloc] initWithRequest:request delegate:delegate startImmediately:NO];
+    } else {
+        // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
+        // try and reuse the credential preemptively, as allowed by RFC 2617.
+        ResourceRequest requestWithInitialCredentials = request;
+        if (allowStoredCredentials && url.protocolInHTTPFamily())
+            delegate->m_initialCredential = CredentialStorage::getDefaultAuthenticationCredential(url);
+            
+        if (!delegate->m_initialCredential.isEmpty()) {
+            String authHeader = "Basic " + encodeBasicAuthorization(delegate->m_initialCredential.user(), delegate->m_initialCredential.password());
+            requestWithInitialCredentials.addHTTPHeaderField("Authorization", authHeader);
+        }
+        connection = [[NSURLConnection alloc] initWithRequest:requestWithInitialCredentials.nsURLRequest() delegate:delegate startImmediately:NO];
+    }
 
     [connection scheduleInRunLoop:[NSRunLoop currentRunLoop] forMode:WebCoreSynchronousLoaderRunLoopMode];
     [connection start];
@@ -1005,7 +1078,9 @@ void ResourceHandle::receivedCancellation(const AuthenticationChallenge& challen
     
     [connection release];
     [delegate release];
-    
+
+    LOG(Network, "WebCoreSynchronousLoader done");
+
     return data;
 }
 
diff --git a/WebCore/platform/network/mac/ResourceRequest.h b/WebCore/platform/network/mac/ResourceRequest.h
index 5bcb33e..b09e72d 100644
--- a/WebCore/platform/network/mac/ResourceRequest.h
+++ b/WebCore/platform/network/mac/ResourceRequest.h
@@ -41,7 +41,7 @@ namespace WebCore {
     class ResourceRequest : public ResourceRequestBase {
     public:
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/mac/ResourceRequestMac.mm b/WebCore/platform/network/mac/ResourceRequestMac.mm
index 6bb36a0..c4355b2 100644
--- a/WebCore/platform/network/mac/ResourceRequestMac.mm
+++ b/WebCore/platform/network/mac/ResourceRequestMac.mm
@@ -61,7 +61,7 @@ void ResourceRequest::doUpdateResourceRequest()
     
     if (NSString* method = [m_nsRequest.get() HTTPMethod])
         m_httpMethod = method;
-    m_allowHTTPCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
+    m_allowCookies = [m_nsRequest.get() HTTPShouldHandleCookies];
     
     NSDictionary *headers = [m_nsRequest.get() allHTTPHeaderFields];
     NSEnumerator *e = [headers keyEnumerator];
@@ -113,7 +113,7 @@ void ResourceRequest::doUpdatePlatformRequest()
     [nsRequest setMainDocumentURL:firstPartyForCookies()];
     if (!httpMethod().isEmpty())
         [nsRequest setHTTPMethod:httpMethod()];
-    [nsRequest setHTTPShouldHandleCookies:allowHTTPCookies()];
+    [nsRequest setHTTPShouldHandleCookies:allowCookies()];
     
     HTTPHeaderMap::const_iterator end = httpHeaderFields().end();
     for (HTTPHeaderMap::const_iterator it = httpHeaderFields().begin(); it != end; ++it)
diff --git a/WebCore/platform/network/mac/WebCoreURLResponse.h b/WebCore/platform/network/mac/WebCoreURLResponse.h
index 0a9a7c4..8d43a21 100644
--- a/WebCore/platform/network/mac/WebCoreURLResponse.h
+++ b/WebCore/platform/network/mac/WebCoreURLResponse.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,7 +27,9 @@
  */
 
 @interface NSURLResponse (WebCoreURLResponse)
--(NSString *)_webcore_reportedMIMEType;
+-(void)adjustMIMETypeIfNecessary;
 @end
 
-void swizzleMIMETypeMethodIfNecessary();
+@interface NSURLResponse (Details)
+- (void)_setMIMEType:(NSString *)type;
+@end
diff --git a/WebCore/platform/network/mac/WebCoreURLResponse.mm b/WebCore/platform/network/mac/WebCoreURLResponse.mm
index f025769..9be4714 100644
--- a/WebCore/platform/network/mac/WebCoreURLResponse.mm
+++ b/WebCore/platform/network/mac/WebCoreURLResponse.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -327,23 +327,6 @@ static NSDictionary *createExtensionToMIMETypeMap()
     ];
 }
 
-static IMP oldNSURLResponseMIMETypeIMP = 0;
-static NSString *webNSURLResponseMIMEType(id, SEL);
-
-void swizzleMIMETypeMethodIfNecessary()
-{
-    if (!oldNSURLResponseMIMETypeIMP) {
-        Method nsURLResponseMIMETypeMethod = class_getInstanceMethod([NSURLResponse class], @selector(MIMEType));
-        ASSERT(nsURLResponseMIMETypeMethod);
-#ifdef BUILDING_ON_TIGER
-        oldNSURLResponseMIMETypeIMP = nsURLResponseMIMETypeMethod->method_imp;
-        nsURLResponseMIMETypeMethod->method_imp = (IMP)webNSURLResponseMIMEType;
-#else
-        oldNSURLResponseMIMETypeIMP = method_setImplementation(nsURLResponseMIMETypeMethod, (IMP)webNSURLResponseMIMEType);
-#endif
-    }
-}
-
 static NSString *mimeTypeFromUTITree(CFStringRef uti)
 {
     // Check if this UTI has a MIME type.
@@ -379,10 +362,12 @@ static NSString *mimeTypeFromUTITree(CFStringRef uti)
     return nil;
 }
 
-static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
+@implementation NSURLResponse (WebCoreURLResponse)
+
+-(void)adjustMIMETypeIfNecessary
 {
-    ASSERT(oldNSURLResponseMIMETypeIMP);
-    NSString *result = oldNSURLResponseMIMETypeIMP(self, _cmd);
+    NSString *result = [self MIMEType];
+    NSString *originalResult = result;
 
 #ifdef BUILDING_ON_TIGER
     // When content sniffing is disabled, Tiger's CFNetwork automatically returns application/octet-stream for certain
@@ -418,7 +403,7 @@ static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
 #ifndef BUILDING_ON_TIGER
     // <rdar://problem/5321972> Plain text document from HTTP server detected as application/octet-stream
     // Make the best guess when deciding between "generic binary" and "generic text" using a table of known binary MIME types.
-    if ([result isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self allHeaderFields] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
+    if ([result isEqualToString:@"application/octet-stream"] && [self respondsToSelector:@selector(allHeaderFields)] && [[[self performSelector:@selector(allHeaderFields)] objectForKey:@"Content-Type"] hasPrefix:@"text/plain"]) {
         static NSSet *binaryExtensions = createBinaryExtensionsSet();
         if (![binaryExtensions containsObject:[[[self suggestedFilename] pathExtension] lowercaseString]])
             result = @"text/plain";
@@ -432,15 +417,8 @@ static NSString *webNSURLResponseMIMEType(id self, SEL _cmd)
         result = @"application/xml";
 #endif
 
-    return result;
-}
-
-@implementation NSURLResponse (WebCoreURLResponse)
-
--(NSString *)_webcore_reportedMIMEType
-{
-    swizzleMIMETypeMethodIfNecessary();
-    return oldNSURLResponseMIMETypeIMP(self, @selector(_webcore_realMIMEType));
+    if (result != originalResult)
+        [self _setMIMEType:result];
 }
 
 @end
diff --git a/WebCore/platform/network/qt/DnsPrefetchHelper.cpp b/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
new file mode 100644
index 0000000..e687976
--- /dev/null
+++ b/WebCore/platform/network/qt/DnsPrefetchHelper.cpp
@@ -0,0 +1,35 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "DnsPrefetchHelper.h"
+
+#include "CString.h"
+
+namespace WebCore {
+// this is called on mouse over a href and on page loading
+void prefetchDNS(const String& hostname)
+{
+    if (QWebSettings::globalSettings()->testAttribute(QWebSettings::DnsPrefetchEnabled)) {
+        static DnsPrefetchHelper dnsPrefetchHelper;
+        dnsPrefetchHelper.lookup(QString(hostname));
+    }
+}
+
+}
diff --git a/WebCore/platform/network/qt/DnsPrefetchHelper.h b/WebCore/platform/network/qt/DnsPrefetchHelper.h
new file mode 100644
index 0000000..0d98fcb
--- /dev/null
+++ b/WebCore/platform/network/qt/DnsPrefetchHelper.h
@@ -0,0 +1,75 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+#ifndef DNSPREFETCHHELPER_H
+#define DNSPREFETCHHELPER_H
+
+#include <QObject>
+#include <QCache>
+#include <QHostInfo>
+#include <QSet>
+#include <QString>
+#include <QTime>
+#include "qwebsettings.h"
+
+namespace WebCore {
+
+    class DnsPrefetchHelper : public QObject {
+        Q_OBJECT
+    public:
+        DnsPrefetchHelper() : QObject(), currentLookups(0) {};
+
+    public slots:
+        void lookup(QString hostname)
+        {
+            if (hostname.isEmpty())
+                return; // this actually happens
+            if (currentLookups >= 10)
+                return; // do not launch more than 10 lookups at the same time
+
+            QTime* entryTime = lookupCache.object(hostname);
+            if (entryTime && entryTime->elapsed() > 300*1000) {
+                // delete knowledge about lookup if it is already 300 seconds old
+                lookupCache.remove(hostname);
+            } else if (!entryTime) {
+                // not in cache yet, can look it up
+                QTime *tmpTime = new QTime();
+                *tmpTime = QTime::currentTime();
+                lookupCache.insert(hostname, tmpTime);
+                currentLookups++;
+                QHostInfo::lookupHost(hostname, this, SLOT(lookedUp(QHostInfo)));
+            }
+        }
+
+        void lookedUp(const QHostInfo&)
+        {
+            // we do not cache the result, we throw it away.
+            // we currently rely on the OS to cache the results. If it does not do that
+            // then at least the ISP nameserver did it.
+            currentLookups--;
+        }
+
+    protected:
+        QCache<QString, QTime> lookupCache; // 100 entries
+        int currentLookups;
+    };
+
+
+}
+
+#endif // DNSPREFETCHHELPER_H
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index 898e5f4..7a3703d 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -131,10 +131,11 @@ void FormDataIODevice::slotFinished()
 
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
-    , m_resourceHandle(handle)
     , m_reply(0)
+    , m_resourceHandle(handle)
     , m_redirected(false)
     , m_responseSent(false)
+    , m_responseDataSent(false)
     , m_loadMode(loadMode)
     , m_shouldStart(true)
     , m_shouldFinish(false)
@@ -204,6 +205,19 @@ QNetworkReply* QNetworkReplyHandler::release()
     return reply;
 }
 
+static bool ignoreHttpError(QNetworkReply* reply, bool receivedData)
+{
+    int httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+    if (httpStatusCode == 401 || httpStatusCode == 407)
+        return true;
+
+    if (receivedData && (httpStatusCode >= 400 && httpStatusCode < 600))
+        return true;
+
+    return false;
+}
+
 void QNetworkReplyHandler::finish()
 {
     m_shouldFinish = (m_loadMode != LoadNormal);
@@ -220,23 +234,27 @@ void QNetworkReplyHandler::finish()
         m_reply = 0;
         return;
     }
+
     QNetworkReply* oldReply = m_reply;
+
     if (m_redirected) {
         resetState();
         start();
-    } else if (m_reply->error() != QNetworkReply::NoError
-               // a web page that returns 401/403/404 can still have content
-               && m_reply->error() != QNetworkReply::ContentOperationNotPermittedError
-               && m_reply->error() != QNetworkReply::ContentNotFoundError
-               && m_reply->error() != QNetworkReply::AuthenticationRequiredError
-               && m_reply->error() != QNetworkReply::ProxyAuthenticationRequiredError) {
-        QUrl url = m_reply->url();
-        ResourceError error(url.host(), m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt(),
-                            url.toString(), m_reply->errorString());
-        client->didFail(m_resourceHandle, error);
-    } else {
+    } else if (!m_reply->error() || ignoreHttpError(m_reply, m_responseDataSent)) {
         client->didFinishLoading(m_resourceHandle);
+    } else {
+        QUrl url = m_reply->url();
+        int httpStatusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
+
+        if (httpStatusCode) {
+            ResourceError error("HTTP", httpStatusCode, url.toString(), m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toString());
+            client->didFail(m_resourceHandle, error);
+        } else {
+            ResourceError error("QtNetwork", m_reply->error(), url.toString(), m_reply->errorString());
+            client->didFail(m_resourceHandle, error);
+        }
     }
+
     oldReply->deleteLater();
     if (oldReply == m_reply)
         m_reply = 0;
@@ -248,6 +266,9 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     if (m_shouldSendResponse)
         return;
 
+    if (m_reply->error())
+        return;
+
     if (m_responseSent || !m_resourceHandle)
         return;
     m_responseSent = true;
@@ -271,41 +292,34 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     }
 
     KURL url(m_reply->url());
-    String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
-
-    if (suggestedFilename.isEmpty())
-        suggestedFilename = url.lastPathComponent();
-
     ResourceResponse response(url, mimeType,
                               m_reply->header(QNetworkRequest::ContentLengthHeader).toLongLong(),
-                              encoding,
-                              suggestedFilename);
+                              encoding, String());
 
-    const bool isLocalFileReply = (m_reply->url().scheme() == QLatin1String("file"));
-    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
-    if (!isLocalFileReply) {
-        response.setHTTPStatusCode(statusCode);
-        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
+    if (url.isLocalFile()) {
+        client->didReceiveResponse(m_resourceHandle, response);
+        return;
     }
-    else if (m_reply->error() == QNetworkReply::ContentNotFoundError)
-        response.setHTTPStatusCode(404);
 
+    // The status code is equal to 0 for protocols not in the HTTP family.
+    int statusCode = m_reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    /* Fill in the other fields
-     * For local file requests remove the content length and the last-modified
-     * headers as required by fast/dom/xmlhttprequest-get.xhtml
-     */
-    foreach (QByteArray headerName, m_reply->rawHeaderList()) {
+    if (url.protocolInHTTPFamily()) {
+        String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromAscii(m_reply->rawHeader("Content-Disposition")));
 
-        if (isLocalFileReply
-            && (headerName == "Content-Length" || headerName == "Last-Modified"))
-            continue;
+        if (!suggestedFilename.isEmpty())
+            response.setSuggestedFilename(suggestedFilename);
+        else
+            response.setSuggestedFilename(url.lastPathComponent());
 
-        response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
-    }
+        response.setHTTPStatusCode(statusCode);
+        response.setHTTPStatusText(m_reply->attribute(QNetworkRequest::HttpReasonPhraseAttribute).toByteArray().constData());
 
-    if (isLocalFileReply)
-        response.setHTTPHeaderField(QString::fromAscii("Cache-Control"), QString::fromAscii("no-cache"));
+        // Add remaining headers.
+        foreach (const QByteArray& headerName, m_reply->rawHeaderList()) {
+            response.setHTTPHeaderField(QString::fromAscii(headerName), QString::fromAscii(m_reply->rawHeader(headerName)));
+        }
+    }
 
     QUrl redirection = m_reply->attribute(QNetworkRequest::RedirectionTargetAttribute).toUrl();
     if (redirection.isValid()) {
@@ -321,9 +335,13 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         client->willSendRequest(m_resourceHandle, newRequest, response);
         m_redirected = true;
         m_request = newRequest.toNetworkRequest();
-    } else {
-        client->didReceiveResponse(m_resourceHandle, response);
+
+        ResourceHandleInternal* d = m_resourceHandle->getInternal();
+        emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+        return;
     }
+
+    client->didReceiveResponse(m_resourceHandle, response);
 }
 
 void QNetworkReplyHandler::forwardData()
@@ -347,8 +365,10 @@ void QNetworkReplyHandler::forwardData()
     if (!client)
         return;
 
-    if (!data.isEmpty())
+    if (!data.isEmpty()) {
+        m_responseDataSent = true;
         client->didReceiveData(m_resourceHandle, data.constData(), data.length(), data.length() /*FixMe*/);
+    }
 }
 
 void QNetworkReplyHandler::start()
@@ -359,6 +379,8 @@ void QNetworkReplyHandler::start()
 
     QNetworkAccessManager* manager = d->m_frame->page()->networkAccessManager();
 
+    emit d->m_frame->page()->networkRequestStarted(d->m_frame, &m_request);
+
     const QUrl url = m_request.url();
     const QString scheme = url.scheme();
     // Post requests on files and data don't really make sense, but for
@@ -421,6 +443,7 @@ void QNetworkReplyHandler::resetState()
 {
     m_redirected = false;
     m_responseSent = false;
+    m_responseDataSent = false;
     m_shouldStart = true;
     m_shouldFinish = false;
     m_shouldSendResponse = false;
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index f88ce8a..545119e 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -73,6 +73,7 @@ private:
     ResourceHandle* m_resourceHandle;
     bool m_redirected;
     bool m_responseSent;
+    bool m_responseDataSent;
     LoadMode m_loadMode;
     QNetworkAccessManager::Operation m_method;
     QNetworkRequest m_request;
diff --git a/WebCore/platform/network/qt/ResourceRequest.h b/WebCore/platform/network/qt/ResourceRequest.h
index af76f61..93dacf3 100644
--- a/WebCore/platform/network/qt/ResourceRequest.h
+++ b/WebCore/platform/network/qt/ResourceRequest.h
@@ -38,7 +38,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url) 
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/qt/SocketStreamError.h b/WebCore/platform/network/qt/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/qt/SocketStreamHandle.h b/WebCore/platform/network/qt/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp b/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/qt/SocketStreamHandleSoup.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/soup/CookieJarSoup.cpp b/WebCore/platform/network/soup/CookieJarSoup.cpp
index 705fdf2..3eb578a 100644
--- a/WebCore/platform/network/soup/CookieJarSoup.cpp
+++ b/WebCore/platform/network/soup/CookieJarSoup.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "CookieJarSoup.h"
 
+#include "Cookie.h"
 #include "CString.h"
 #include "Document.h"
 #include "KURL.h"
@@ -86,4 +87,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return defaultCookieJar();
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 4a22d8a..2177bd2 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -118,7 +118,7 @@ void WebCoreSynchronousLoader::run()
         g_main_loop_run(m_mainLoop);
 }
 
-static void cleanupGioOperation(ResourceHandleInternal* handle);
+static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying);
 static bool startData(ResourceHandle* handle, String urlString);
 static bool startGio(ResourceHandle* handle, KURL url);
 
@@ -129,8 +129,6 @@ ResourceHandleInternal::~ResourceHandleInternal()
         m_msg = 0;
     }
 
-    cleanupGioOperation(this);
-
     if (m_idleHandler) {
         g_source_remove(m_idleHandler);
         m_idleHandler = 0;
@@ -142,6 +140,21 @@ ResourceHandle::~ResourceHandle()
     if (d->m_msg)
         g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
                                              0, 0, 0, 0, this);
+
+    cleanupGioOperation(this, true);
+}
+
+// All other kinds of redirections, except for the *304* status code
+// (SOUP_STATUS_NOT_MODIFIED) which needs to be fed into WebCore, will be
+// handled by soup directly.
+static gboolean statusWillBeHandledBySoup(guint statusCode)
+{
+    if (SOUP_STATUS_IS_TRANSPORT_ERROR(statusCode)
+        || (SOUP_STATUS_IS_REDIRECTION(statusCode) && (statusCode != SOUP_STATUS_NOT_MODIFIED))
+        || (statusCode == SOUP_STATUS_UNAUTHORIZED))
+        return true;
+
+    return false;
 }
 
 static void fillResponseFromMessage(SoupMessage* msg, ResourceResponse* response)
@@ -185,6 +198,7 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     ResourceRequest request = handle->request();
     ResourceResponse response;
     request.setURL(newURL);
+    request.setHTTPMethod(msg->method);
     fillResponseFromMessage(msg, &response);
     if (d->client())
         d->client()->willSendRequest(handle, request, response);
@@ -204,22 +218,25 @@ static void gotHeadersCallback(SoupMessage* msg, gpointer data)
     // we got, when we finish downloading.
     soup_message_body_set_accumulate(msg->response_body, FALSE);
 
-    if (msg->status_code == SOUP_STATUS_NOT_MODIFIED) {
-        RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
-        if (!handle)
-            return;
-        ResourceHandleInternal* d = handle->getInternal();
-        if (d->m_cancelled)
-            return;
-        ResourceHandleClient* client = handle->client();
-        if (!client)
-            return;
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
 
-        fillResponseFromMessage(msg, &d->m_response);
-        client->didReceiveResponse(handle.get(), d->m_response);
-    }
+    // The content-sniffed callback will handle the response if WebCore
+    // require us to sniff.
+    if(!handle || statusWillBeHandledBySoup(msg->status_code) || handle->shouldContentSniff())
+        return;
+
+    ResourceHandleInternal* d = handle->getInternal();
+    if (d->m_cancelled)
+        return;
+    ResourceHandleClient* client = handle->client();
+    if (!client)
+        return;
+
+    fillResponseFromMessage(msg, &d->m_response);
+    client->didReceiveResponse(handle.get(), d->m_response);
 }
 
+// This callback will not be called if the content sniffer is disabled in startHttp.
 static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GHashTable *params, gpointer data)
 {
     if (sniffedType) {
@@ -229,13 +246,7 @@ static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GH
             soup_message_headers_set_content_type(msg->response_headers, sniffedType, params);
     }
 
-    // The 304 status code (SOUP_STATUS_NOT_MODIFIED) needs to be fed
-    // into WebCore, as opposed to other kinds of redirections, which
-    // are handled by soup directly, so we special-case it here and in
-    // gotChunk.
-    if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)
-        || (SOUP_STATUS_IS_REDIRECTION(msg->status_code) && (msg->status_code != SOUP_STATUS_NOT_MODIFIED))
-        || (msg->status_code == SOUP_STATUS_UNAUTHORIZED))
+    if (statusWillBeHandledBySoup(msg->status_code))
         return;
 
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
@@ -254,9 +265,7 @@ static void contentSniffedCallback(SoupMessage* msg, const char* sniffedType, GH
 
 static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 {
-    if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)
-        || (SOUP_STATUS_IS_REDIRECTION(msg->status_code) && (msg->status_code != SOUP_STATUS_NOT_MODIFIED))
-        || (msg->status_code == SOUP_STATUS_UNAUTHORIZED))
+    if (statusWillBeHandledBySoup(msg->status_code))
         return;
 
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(data);
@@ -276,7 +285,7 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
 // Doesn't get called for redirects.
 static void finishedCallback(SoupSession *session, SoupMessage* msg, gpointer data)
 {
-    RefPtr<ResourceHandle>handle = adoptRef(static_cast<ResourceHandle*>(data));
+    RefPtr<ResourceHandle> handle = adoptRef(static_cast<ResourceHandle*>(data));
     // TODO: maybe we should run this code even if there's no client?
     if (!handle)
         return;
@@ -410,6 +419,13 @@ static SoupSession* createSoupSession()
     return soup_session_async_new();
 }
 
+// Values taken from http://stevesouders.com/ua/index.php following
+// the rule "Do What Every Other Modern Browser Is Doing". They seem
+// to significantly improve page loading time compared to soup's
+// default values.
+#define MAX_CONNECTIONS          60
+#define MAX_CONNECTIONS_PER_HOST 6
+
 static void ensureSessionIsInitialized(SoupSession* session)
 {
     if (g_object_get_data(G_OBJECT(session), "webkit-init"))
@@ -427,27 +443,34 @@ static void ensureSessionIsInitialized(SoupSession* session)
         g_object_unref(logger);
     }
 
+    g_object_set(session,
+                 SOUP_SESSION_MAX_CONNS, MAX_CONNECTIONS,
+                 SOUP_SESSION_MAX_CONNS_PER_HOST, MAX_CONNECTIONS_PER_HOST,
+                 NULL);
+
     g_object_set_data(G_OBJECT(session), "webkit-init", reinterpret_cast<void*>(0xdeadbeef));
 }
 
-static bool startHttp(ResourceHandle* handle, String urlString)
+static bool startHttp(ResourceHandle* handle)
 {
     ASSERT(handle);
- 
+
     SoupSession* session = handle->defaultSession();
     ensureSessionIsInitialized(session);
 
     ResourceHandleInternal* d = handle->getInternal();
 
-    d->m_msg = handle->request().toSoupMessage();
-    if (!d->m_msg) {
-        ResourceError resourceError(g_quark_to_string(SOUP_HTTP_ERROR),
-                                    SOUP_STATUS_MALFORMED,
-                                    urlString,
-                                    handle->request().httpMethod());
-        d->client()->didFail(handle, resourceError);
+    ResourceRequest request(handle->request());
+    KURL url(request.url());
+    url.removeFragmentIdentifier();
+    request.setURL(url);
+
+    d->m_msg = request.toSoupMessage();
+    if (!d->m_msg)
         return false;
-    }
+
+    if(!handle->shouldContentSniff())
+        soup_message_disable_feature(d->m_msg, SOUP_TYPE_CONTENT_SNIFFER);
 
     g_signal_connect(d->m_msg, "restarted", G_CALLBACK(restartedCallback), handle);
     g_signal_connect(d->m_msg, "got-headers", G_CALLBACK(gotHeadersCallback), handle);
@@ -491,14 +514,7 @@ static bool startHttp(ResourceHandle* handle, String urlString)
                     g_free(fileName);
 
                     if (error) {
-                        ResourceError resourceError(g_quark_to_string(SOUP_HTTP_ERROR),
-                                                    d->m_msg->status_code,
-                                                    urlString,
-                                                    String::fromUTF8(error->message));
                         g_error_free(error);
-
-                        d->client()->didFail(handle, resourceError);
-
                         g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
                                                              0, 0, 0, 0, handle);
                         g_object_unref(d->m_msg);
@@ -562,12 +578,16 @@ bool ResourceHandle::start(Frame* frame)
     if (equalIgnoringCase(protocol, "data"))
         return startData(this, urlString);
 
-    if (equalIgnoringCase(protocol, "http") || equalIgnoringCase(protocol, "https"))
-        return startHttp(this, urlString);
+    if (equalIgnoringCase(protocol, "http") || equalIgnoringCase(protocol, "https")) {
+        if (startHttp(this))
+            return true;
+    }
 
-    if (equalIgnoringCase(protocol, "file") || equalIgnoringCase(protocol, "ftp") || equalIgnoringCase(protocol, "ftps"))
+    if (equalIgnoringCase(protocol, "file") || equalIgnoringCase(protocol, "ftp") || equalIgnoringCase(protocol, "ftps")) {
         // FIXME: should we be doing any other protocols here?
-        return startGio(this, url);
+        if (startGio(this, url))
+            return true;
+    }
 
     // Error must not be reported immediately
     this->scheduleFailure(InvalidURLFailure);
@@ -625,8 +645,10 @@ void ResourceHandle::loadResourceSynchronously(const ResourceRequest& request, S
 
 // GIO-based loader
 
-static void cleanupGioOperation(ResourceHandleInternal* d)
+static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying = false)
 {
+    ResourceHandleInternal* d = handle->getInternal();
+
     if (d->m_gfile) {
         g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", 0);
         g_object_unref(d->m_gfile);
@@ -648,11 +670,14 @@ static void cleanupGioOperation(ResourceHandleInternal* d)
         g_free(d->m_buffer);
         d->m_buffer = 0;
     }
+
+    if (!isDestroying)
+        handle->deref();
 }
 
 static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -660,13 +685,12 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     g_input_stream_close_finish(d->m_inputStream, res, 0);
-    cleanupGioOperation(d);
-    client->didFinishLoading(handle);
+    cleanupGioOperation(handle.get());
+    client->didFinishLoading(handle.get());
 }
 
 static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    // didReceiveData may cancel the load, which may release the last reference.
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
@@ -675,7 +699,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -690,7 +714,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         client->didFail(handle.get(), resourceError);
         return;
     }
@@ -704,8 +728,9 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
     d->m_total += bytesRead;
     client->didReceiveData(handle.get(), d->m_buffer, bytesRead, d->m_total);
 
+    // didReceiveData may cancel the load, which may release the last reference.
     if (d->m_cancelled) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -716,7 +741,7 @@ static void readCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void openCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -724,7 +749,7 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -738,8 +763,8 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -747,7 +772,8 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
     d->m_bufferSize = 8192;
     d->m_buffer = static_cast<char*>(g_malloc(d->m_bufferSize));
     d->m_total = 0;
-    g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", handle);
+
+    g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", handle.get());
     g_input_stream_read_async(d->m_inputStream, d->m_buffer, d->m_bufferSize,
                               G_PRIORITY_DEFAULT, d->m_cancellable,
                               readCallback, 0);
@@ -755,7 +781,7 @@ static void openCallback(GObject* source, GAsyncResult* res, gpointer)
 
 static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
 {
-    ResourceHandle* handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
@@ -763,7 +789,7 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled) {
-        cleanupGioOperation(d);
+        cleanupGioOperation(handle.get());
         return;
     }
 
@@ -790,8 +816,8 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
                                     error ? String::fromUTF8(error->message) : String());
         g_free(uri);
         g_error_free(error);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -804,8 +830,8 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
                                     uri,
                                     String());
         g_free(uri);
-        cleanupGioOperation(d);
-        client->didFail(handle, resourceError);
+        cleanupGioOperation(handle.get());
+        client->didFail(handle.get(), resourceError);
         return;
     }
 
@@ -816,7 +842,12 @@ static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
     g_file_info_get_modification_time(info, &tv);
     response.setLastModifiedDate(tv.tv_sec);
 
-    client->didReceiveResponse(handle, response);
+    client->didReceiveResponse(handle.get(), response);
+
+    if (d->m_cancelled) {
+        cleanupGioOperation(handle.get());
+        return;
+    }
 
     g_file_read_async(d->m_gfile, G_PRIORITY_DEFAULT, d->m_cancellable,
                       openCallback, 0);
@@ -827,13 +858,8 @@ static bool startGio(ResourceHandle* handle, KURL url)
 
     ResourceHandleInternal* d = handle->getInternal();
 
-    if (handle->request().httpMethod() != "GET" && handle->request().httpMethod() != "POST") {
-        ResourceError error(g_quark_to_string(SOUP_HTTP_ERROR),
-                            SOUP_STATUS_METHOD_NOT_ALLOWED,
-                            url.string(), handle->request().httpMethod());
-        d->client()->didFail(handle, error);
+    if (handle->request().httpMethod() != "GET" && handle->request().httpMethod() != "POST")
         return false;
-    }
 
     // GIO doesn't know how to handle refs and queries, so remove them
     // TODO: use KURL.fileSystemPath after KURLGtk and FileSystemGtk are
@@ -852,6 +878,10 @@ static bool startGio(ResourceHandle* handle, KURL url)
 #endif
         d->m_gfile = g_file_new_for_uri(url.string().utf8().data());
     g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", handle);
+
+    // balanced by a deref() in cleanupGioOperation, which should always run
+    handle->ref();
+
     d->m_cancellable = g_cancellable_new();
     g_file_query_info_async(d->m_gfile,
                             G_FILE_ATTRIBUTE_STANDARD_TYPE ","
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index 82b4eb9..42b7baa 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -36,7 +36,7 @@ namespace WebCore {
     struct ResourceRequest : ResourceRequestBase {
 
         ResourceRequest(const String& url)
-            : ResourceRequestBase(KURL(url), UseProtocolCachePolicy)
+            : ResourceRequestBase(KURL(ParsedURLString, url), UseProtocolCachePolicy)
         {
         }
 
diff --git a/WebCore/platform/network/soup/ResourceRequestSoup.cpp b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
index f2011bb..0d4e0f9 100644
--- a/WebCore/platform/network/soup/ResourceRequestSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
@@ -66,11 +66,20 @@ void ResourceRequest::updateFromSoupMessage(SoupMessage* soupMessage)
     while (soup_message_headers_iter_next(&headersIter, &headerName, &headerValue))
         m_httpHeaderFields.set(String::fromUTF8(headerName), String::fromUTF8(headerValue));
 
-    m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
+    if (soupMessage->request_body->data)
+        m_httpBody = FormData::create(soupMessage->request_body->data, soupMessage->request_body->length);
 
-    // FIXME: m_allowHTTPCookies and m_firstPartyForCookies should
+    // FIXME: m_allowCookies and m_firstPartyForCookies should
     // probably be handled here and on doUpdatePlatformRequest
     // somehow.
 }
 
+unsigned initializeMaximumHTTPConnectionCountPerHost()
+{
+    // Soup has its own queue control; it wants to have all requests
+    // given to it, so that it is able to look ahead, and schedule
+    // them in a good way.
+    return 10000;
+}
+
 }
diff --git a/WebCore/platform/network/soup/ResourceResponse.h b/WebCore/platform/network/soup/ResourceResponse.h
index b8cb586..5fa31a0 100644
--- a/WebCore/platform/network/soup/ResourceResponse.h
+++ b/WebCore/platform/network/soup/ResourceResponse.h
@@ -28,6 +28,8 @@
 
 #include "ResourceResponseBase.h"
 
+#include <libsoup/soup.h>
+
 namespace WebCore {
 
 class ResourceResponse : public ResourceResponseBase {
@@ -42,6 +44,8 @@ public:
     {
     }
 
+    SoupMessage* toSoupMessage() const;
+
 private:
     friend class ResourceResponseBase;
 
diff --git a/WebCore/platform/network/soup/ResourceResponseSoup.cpp b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
new file mode 100644
index 0000000..293577f
--- /dev/null
+++ b/WebCore/platform/network/soup/ResourceResponseSoup.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Gustavo Noronha Silva
+ * Copyright (C) 2009 Collabora Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "ResourceResponse.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+
+using namespace std;
+
+namespace WebCore {
+
+SoupMessage* ResourceResponse::toSoupMessage() const
+{
+    // This GET here is just because SoupMessage wants it, we dn't really know.
+    SoupMessage* soupMessage = soup_message_new("GET", url().string().utf8().data());
+    if (!soupMessage)
+        return 0;
+
+    soupMessage->status_code = httpStatusCode();
+
+    HTTPHeaderMap headers = httpHeaderFields();
+    SoupMessageHeaders* soupHeaders = soupMessage->response_headers;
+    if (!headers.isEmpty()) {
+        HTTPHeaderMap::const_iterator end = headers.end();
+        for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it)
+            soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
+    }
+
+    // Body data is not in the message.
+    return soupMessage;
+}
+
+}
diff --git a/WebCore/platform/network/soup/SocketStreamError.h b/WebCore/platform/network/soup/SocketStreamError.h
new file mode 100644
index 0000000..f9641ad
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamError.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamError_h
+#define SocketStreamError_h
+
+#include "SocketStreamErrorBase.h"
+
+namespace WebCore {
+
+    class SocketStreamError : public SocketStreamErrorBase {
+    public:
+        SocketStreamError() { }
+        explicit SocketStreamError(int errorCode)
+            : SocketStreamErrorBase(errorCode)
+        {
+        }
+
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamError_h
diff --git a/WebCore/platform/network/soup/SocketStreamHandle.h b/WebCore/platform/network/soup/SocketStreamHandle.h
new file mode 100644
index 0000000..64139e5
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamHandle.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SocketStreamHandle_h
+#define SocketStreamHandle_h
+
+#include "SocketStreamHandleBase.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class AuthenticationChallenge;
+    class Credential;
+    class SocketStreamHandleClient;
+
+    class SocketStreamHandle : public RefCounted<SocketStreamHandle>, public SocketStreamHandleBase {
+    public:
+        static PassRefPtr<SocketStreamHandle> create(const KURL& url, SocketStreamHandleClient* client) { return adoptRef(new SocketStreamHandle(url, client)); }
+
+        virtual ~SocketStreamHandle();
+
+    protected:
+        virtual int platformSend(const char* data, int length);
+        virtual void platformClose();
+
+    private:
+        SocketStreamHandle(const KURL&, SocketStreamHandleClient*);
+
+        // No authentication for streams per se, but proxy may ask for credentials.
+        void didReceiveAuthenticationChallenge(const AuthenticationChallenge&);
+        void receivedCredential(const AuthenticationChallenge&, const Credential&);
+        void receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&);
+        void receivedCancellation(const AuthenticationChallenge&);
+    };
+
+}  // namespace WebCore
+
+#endif  // SocketStreamHandle_h
diff --git a/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp b/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
new file mode 100644
index 0000000..6aa33fc
--- /dev/null
+++ b/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SocketStreamHandle.h"
+
+#include "KURL.h"
+#include "Logging.h"
+#include "NotImplemented.h"
+#include "SocketStreamHandleClient.h"
+
+namespace WebCore {
+
+SocketStreamHandle::SocketStreamHandle(const KURL& url, SocketStreamHandleClient* client)
+    : SocketStreamHandleBase(url, client)
+{
+    LOG(Network, "SocketStreamHandle %p new client %p", this, m_client);
+    notImplemented();
+}
+
+SocketStreamHandle::~SocketStreamHandle()
+{
+    LOG(Network, "SocketStreamHandle %p delete", this);
+    setClient(0);
+    notImplemented();
+}
+
+int SocketStreamHandle::platformSend(const char*, int)
+{
+    LOG(Network, "SocketStreamHandle %p platformSend", this);
+    notImplemented();
+    return 0;
+}
+
+void SocketStreamHandle::platformClose()
+{
+    LOG(Network, "SocketStreamHandle %p platformClose", this);
+    notImplemented();
+}
+
+void SocketStreamHandle::didReceiveAuthenticationChallenge(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCredential(const AuthenticationChallenge&, const Credential&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedRequestToContinueWithoutCredential(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+void SocketStreamHandle::receivedCancellation(const AuthenticationChallenge&)
+{
+    notImplemented();
+}
+
+}  // namespace WebCore
diff --git a/WebCore/platform/network/win/CookieJarCFNetWin.cpp b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
index af9e3f3..33b795a 100644
--- a/WebCore/platform/network/win/CookieJarCFNetWin.cpp
+++ b/WebCore/platform/network/win/CookieJarCFNetWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "CookieStorageWin.h"
 #include "Document.h"
 #include "KURL.h"
@@ -113,4 +114,60 @@ bool cookiesEnabled(const Document* /*document*/)
     return policy == CFHTTPCookieStorageAcceptPolicyOnlyFromMainDocumentDomain || policy == CFHTTPCookieStorageAcceptPolicyAlways;
 }
 
+bool getRawCookies(const Document*, const KURL& url, Vector<Cookie>& rawCookies)
+{
+    rawCookies.clear();
+    CFHTTPCookieStorageRef cookieStorage = currentCookieStorage();
+    if (!cookieStorage)
+        return false;
+
+    RetainPtr<CFURLRef> urlCF(AdoptCF, url.createCFURL());
+
+    bool sendSecureCookies = url.protocolIs("https");
+    RetainPtr<CFArrayRef> cookiesCF(AdoptCF, CFHTTPCookieStorageCopyCookiesForURL(cookieStorage, urlCF.get(), sendSecureCookies));
+
+    CFIndex count = CFArrayGetCount(cookiesCF.get());
+    rawCookies.reserveCapacity(count);
+
+    for (CFIndex i = 0; i < count; i++) {
+       CFHTTPCookieRef cookie = (CFHTTPCookieRef)CFArrayGetValueAtIndex(cookiesCF.get(), i);
+       String name = CFHTTPCookieGetName(cookie);
+       String value = CFHTTPCookieGetValue(cookie);
+       String domain = CFHTTPCookieGetDomain(cookie);
+       String path = CFHTTPCookieGetPath(cookie);
+
+       double expires = (CFDateGetAbsoluteTime(CFHTTPCookieGetExpiratonDate(cookie)) + kCFAbsoluteTimeIntervalSince1970) * 1000;
+
+       bool httpOnly = CFHTTPCookieIsHTTPOnly(cookie);
+       bool secure = CFHTTPCookieIsSecure(cookie);
+       bool session = false;    // FIXME: Need API for if a cookie is a session cookie.
+
+       rawCookies.uncheckedAppend(Cookie(name, value, domain, path, expires, httpOnly, secure, session));
+    }
+
+    return true;
+}
+
+void deleteCookie(const Document*, const KURL& url, const String& name)
+{
+    CFHTTPCookieStorageRef cookieStorage = currentCookieStorage();
+    if (!cookieStorage)
+        return;
+
+    RetainPtr<CFURLRef> urlCF(AdoptCF, url.createCFURL());
+
+    bool sendSecureCookies = url.protocolIs("https");
+    RetainPtr<CFArrayRef> cookiesCF(AdoptCF, CFHTTPCookieStorageCopyCookiesForURL(cookieStorage, urlCF.get(), sendSecureCookies));
+
+    CFIndex count = CFArrayGetCount(cookiesCF.get());
+    for (CFIndex i = 0; i < count; i++) {
+        CFHTTPCookieRef cookie = (CFHTTPCookieRef)CFArrayGetValueAtIndex(cookiesCF.get(), i);
+        String cookieName = CFHTTPCookieGetName(cookie);
+        if (cookieName == name) {
+            CFHTTPCookieStorageDeleteCookie(cookieStorage, cookie);
+            break;
+        }
+    }
+}
+
 }
diff --git a/WebCore/platform/network/win/CookieJarWin.cpp b/WebCore/platform/network/win/CookieJarWin.cpp
index 41d12d9..6576e07 100644
--- a/WebCore/platform/network/win/CookieJarWin.cpp
+++ b/WebCore/platform/network/win/CookieJarWin.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "Document.h"
@@ -35,7 +36,6 @@
 
 namespace WebCore {
 
-
 void setCookies(Document* /*document*/, const KURL& url, const String& value)
 {
     // FIXME: Deal with document->firstPartyForCookies().
@@ -64,4 +64,16 @@ bool cookiesEnabled(const Document* /*document*/)
     return true;
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 666ad18..9d2c452 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -239,8 +239,6 @@ static CachedImage* getCachedImage(Element* element)
 void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
 {
     ASSERT(frame);
-    Q_UNUSED(url);
-    Q_UNUSED(title);
 
     //WebCore::writeURL(m_writableDataObject.get(), url, title, true, false);
     if (!m_writableData)
@@ -262,8 +260,10 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
         return;
 
     QList<QUrl> urls;
+    urls.append(url);
     urls.append(fullURL);
 
+    m_writableData->setText(title);
     m_writableData->setUrls(urls);
 #ifndef QT_NO_CLIPBOARD
     if (!isForDragging())
diff --git a/WebCore/platform/qt/ContextMenuQt.cpp b/WebCore/platform/qt/ContextMenuQt.cpp
index 063a46b..9b1a054 100644
--- a/WebCore/platform/qt/ContextMenuQt.cpp
+++ b/WebCore/platform/qt/ContextMenuQt.cpp
@@ -61,7 +61,7 @@ void ContextMenu::insertItem(unsigned position, ContextMenuItem& item)
     m_items.insert(position, item);
 }
 
-void ContextMenu::setPlatformDescription(PlatformMenuDescription menu)
+void ContextMenu::setPlatformDescription(PlatformMenuDescription)
 {
     // doesn't make sense
 }
diff --git a/WebCore/platform/qt/CookieJarQt.cpp b/WebCore/platform/qt/CookieJarQt.cpp
index 40d9309..a27a06e 100644
--- a/WebCore/platform/qt/CookieJarQt.cpp
+++ b/WebCore/platform/qt/CookieJarQt.cpp
@@ -28,6 +28,7 @@
 #include "config.h"
 #include "CookieJar.h"
 
+#include "Cookie.h"
 #include "Document.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -47,6 +48,8 @@ namespace WebCore {
 #if QT_VERSION >= 0x040400
 static QNetworkCookieJar *cookieJar(const Document *document)
 {
+    if (!document)
+        return 0;
     Frame *frame = document->frame();
     if (!frame)
         return 0;
@@ -128,6 +131,18 @@ bool cookiesEnabled(const Document* document)
 #endif
 }
 
+bool getRawCookies(const Document*, const KURL&, Vector<Cookie>& rawCookies)
+{
+    // FIXME: Not yet implemented
+    rawCookies.clear();
+    return false; // return true when implemented
+}
+
+void deleteCookie(const Document*, const KURL&, const String&)
+{
+    // FIXME: Not yet implemented
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/DragDataQt.cpp b/WebCore/platform/qt/DragDataQt.cpp
index 7b1eff8..b0611e6 100644
--- a/WebCore/platform/qt/DragDataQt.cpp
+++ b/WebCore/platform/qt/DragDataQt.cpp
@@ -119,7 +119,7 @@ bool DragData::containsURL() const
     return m_platformDragData->hasUrls();
 }
 
-String DragData::asURL(String* title) const
+String DragData::asURL(String*) const
 {
     if (!m_platformDragData)
         return String();
@@ -128,7 +128,7 @@ String DragData::asURL(String* title) const
     if (urls.isEmpty())
         return String();
 
-    return urls.first().toString();
+    return encodeWithURLEscapeSequences(urls.first().toString());
 }
 
 PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
diff --git a/WebCore/platform/qt/FileSystemQt.cpp b/WebCore/platform/qt/FileSystemQt.cpp
index 28d3ca7..4093fad 100644
--- a/WebCore/platform/qt/FileSystemQt.cpp
+++ b/WebCore/platform/qt/FileSystemQt.cpp
@@ -81,7 +81,7 @@ bool makeAllDirectories(const String& path)
 
 String pathByAppendingComponent(const String& path, const String& component)
 {
-    return QDir(path).filePath(component);
+    return QDir::toNativeSeparators(QDir(path).filePath(component));
 }
 
 String homeDirectoryPath()
@@ -117,7 +117,9 @@ Vector<String> listDirectory(const String& path, const String& filter)
 
 CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
 {
-    QFile *temp = new QTemporaryFile(QLatin1String(prefix));
+    QTemporaryFile* tempFile = new QTemporaryFile(QLatin1String(prefix));
+    tempFile->setAutoRemove(false);
+    QFile* temp = tempFile;
     if (temp->open(QIODevice::ReadWrite)) {
         handle = temp;
         return String(temp->fileName()).utf8();
diff --git a/WebCore/platform/qt/Localizations.cpp b/WebCore/platform/qt/Localizations.cpp
index d1853fc..77cac57 100644
--- a/WebCore/platform/qt/Localizations.cpp
+++ b/WebCore/platform/qt/Localizations.cpp
@@ -362,5 +362,111 @@ String mediaElementLiveBroadcastStateText()
     return QCoreApplication::translate("QWebPage", "Live Broadcast", "Media controller status message when watching a live broadcast");
 }
 
+#if ENABLE(VIDEO)
+
+String localizedMediaControlElementString(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio Element", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video Element", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute Button", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute Button", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Play Button", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause Button", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Slider", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Slider Thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind Button", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return to Real-time Button", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Elapsed Time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining Time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Status Display", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Fullscreen Button", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek Forward Button", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek Back Button", "Media controller element");
+
+    return String();
+}
+
+String localizedMediaControlElementHelpText(const String& name)
+{
+    if (name == "AudioElement")
+        return QCoreApplication::translate("QWebPage", "Audio element playback controls and status display", "Media controller element");
+    if (name == "VideoElement")
+        return QCoreApplication::translate("QWebPage", "Video element playback controls and status display", "Media controller element");
+    if (name == "MuteButton")
+        return QCoreApplication::translate("QWebPage", "Mute audio tracks", "Media controller element");
+    if (name == "UnMuteButton")
+        return QCoreApplication::translate("QWebPage", "Unmute audio tracks", "Media controller element");
+    if (name == "PlayButton")
+        return QCoreApplication::translate("QWebPage", "Begin playback", "Media controller element");
+    if (name == "PauseButton")
+        return QCoreApplication::translate("QWebPage", "Pause playback", "Media controller element");
+    if (name == "Slider")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber", "Media controller element");
+    if (name == "SliderThumb")
+        return QCoreApplication::translate("QWebPage", "Movie time scrubber thumb", "Media controller element");
+    if (name == "RewindButton")
+        return QCoreApplication::translate("QWebPage", "Rewind movie", "Media controller element");
+    if (name == "ReturnToRealtimeButton")
+        return QCoreApplication::translate("QWebPage", "Return streaming movie to real-time", "Media controller element");
+    if (name == "CurrentTimeDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie time", "Media controller element");
+    if (name == "TimeRemainingDisplay")
+        return QCoreApplication::translate("QWebPage", "Remaining movie time", "Media controller element");
+    if (name == "StatusDisplay")
+        return QCoreApplication::translate("QWebPage", "Current movie status", "Media controller element");
+    if (name == "FullscreenButton")
+        return QCoreApplication::translate("QWebPage", "Play movie in full-screen mode", "Media controller element");
+    if (name == "SeekForwardButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly back", "Media controller element");
+    if (name == "SeekBackButton")
+        return QCoreApplication::translate("QWebPage", "Seek quickly forward", "Media controller element");
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+String localizedMediaTimeDescription(float time)
+{
+    if (!isfinite(time))
+        return QCoreApplication::translate("QWebPage", "Indefinite time", "Media time description");
+
+    int seconds = (int)fabsf(time);
+    int days = seconds / (60 * 60 * 24);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+
+    if (days) {
+        return QCoreApplication::translate("QWebPage", "%1 days %2 hours %3 minutes %4 seconds", "Media time description").arg(days).arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (hours) {
+        return QCoreApplication::translate("QWebPage", "%1 hours %2 minutes %3 seconds", "Media time description").arg(hours).arg(minutes).arg(seconds);
+    }
+
+    if (minutes) {
+        return QCoreApplication::translate("QWebPage", "%1 minutes %2 seconds", "Media time description").arg(minutes).arg(seconds);
+    }
+
+    return QCoreApplication::translate("QWebPage", "%1 seconds", "Media time description").arg(seconds);
+}
+#endif  // ENABLE(VIDEO)
+
 }
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/PasteboardQt.cpp b/WebCore/platform/qt/PasteboardQt.cpp
index 969de62..209a573 100644
--- a/WebCore/platform/qt/PasteboardQt.cpp
+++ b/WebCore/platform/qt/PasteboardQt.cpp
@@ -119,6 +119,18 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
     return 0;
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+#ifndef QT_NO_CLIPBOARD
+    QMimeData* md = new QMimeData;
+    QString qtext = text;
+    qtext.replace(QChar(0xa0), QLatin1Char(' '));
+    md->setText(qtext);
+    QApplication::clipboard()->setMimeData(md, m_selectionMode ?
+            QClipboard::Selection : QClipboard::Clipboard);
+#endif
+}
+
 void Pasteboard::writeURL(const KURL& _url, const String&, Frame*)
 {
     ASSERT(!_url.isEmpty());
diff --git a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 935882a..37ea681 100644
--- a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -217,7 +217,7 @@ static int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad = false
         case Qt::Key_F9:
             return VK_F9;
         case Qt::Key_F10:
-            return VK_F11;
+            return VK_F10;
         case Qt::Key_F11:
             return VK_F11;
         case Qt::Key_F12:
diff --git a/WebCore/platform/qt/PlatformMouseEventQt.cpp b/WebCore/platform/qt/PlatformMouseEventQt.cpp
index 6c1d82d..e486e68 100644
--- a/WebCore/platform/qt/PlatformMouseEventQt.cpp
+++ b/WebCore/platform/qt/PlatformMouseEventQt.cpp
@@ -31,9 +31,46 @@
 #include <wtf/CurrentTime.h>
 
 #include <QMouseEvent>
+#include <QGraphicsSceneMouseEvent>
 
 namespace WebCore {
 
+PlatformMouseEvent::PlatformMouseEvent(QGraphicsSceneMouseEvent* event, int clickCount)
+{
+    m_timestamp = WTF::currentTime();
+
+    switch (event->type()) {
+    case QEvent::GraphicsSceneMouseDoubleClick:
+    case QEvent::GraphicsSceneMousePress:
+        m_eventType = MouseEventPressed;
+        break;
+    case QEvent::GraphicsSceneMouseRelease:
+        m_eventType = MouseEventReleased;
+        break;
+    case QEvent::GraphicsSceneMouseMove:
+    default:
+        m_eventType = MouseEventMoved;
+    }
+
+    m_position = IntPoint(event->pos().toPoint());
+    m_globalPosition = IntPoint(event->screenPos());
+
+    if (event->button() == Qt::LeftButton || (event->buttons() & Qt::LeftButton))
+        m_button = LeftButton;
+    else if (event->button() == Qt::RightButton || (event->buttons() & Qt::RightButton))
+        m_button = RightButton;
+    else if (event->button() == Qt::MidButton || (event->buttons() & Qt::MidButton))
+        m_button = MiddleButton;
+    else
+        m_button = NoButton;
+
+    m_clickCount = clickCount;
+    m_shiftKey =  (event->modifiers() & Qt::ShiftModifier) != 0;
+    m_ctrlKey = (event->modifiers() & Qt::ControlModifier) != 0;
+    m_altKey =  (event->modifiers() & Qt::AltModifier) != 0;
+    m_metaKey = (event->modifiers() & Qt::MetaModifier) != 0;
+}
+
 PlatformMouseEvent::PlatformMouseEvent(QInputEvent* event, int clickCount)
 {
     m_timestamp = WTF::currentTime();
diff --git a/WebCore/platform/qt/PlatformScreenQt.cpp b/WebCore/platform/qt/PlatformScreenQt.cpp
index 5dc0963..7ba8350 100644
--- a/WebCore/platform/qt/PlatformScreenQt.cpp
+++ b/WebCore/platform/qt/PlatformScreenQt.cpp
@@ -36,42 +36,54 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "Widget.h"
+#include "QWebPageClient.h"
 #include <QApplication>
 #include <QDesktopWidget>
 
 namespace WebCore {
 
+static int screenNumber(Widget* w)
+{
+    if (!w)
+        return 0;
+
+    QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
+    return client ? client->screenNumber() : 0;
+}
+
 int screenDepth(Widget* w)
 {
-    QDesktopWidget* d = QApplication::desktop();
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow() : 0;
-    int screenNumber = view ? d->screenNumber(view) : 0;
-    return d->screen(screenNumber)->depth();
+    return QApplication::desktop()->screen(screenNumber(w))->depth();
 }
 
 int screenDepthPerComponent(Widget* w)
 {
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow() : 0;
-    return view ? view->depth() : QApplication::desktop()->screen(0)->depth();
+    if (w) {
+        QWebPageClient* client = w->root()->hostWindow()->platformPageClient();
+
+        if (client) {
+            QWidget* view = QWidget::find(client->winId());
+            if (view)
+                return view->depth();
+        }
+    }
+    return QApplication::desktop()->screen(0)->depth();
 }
 
 bool screenIsMonochrome(Widget* w)
 {
-    QDesktopWidget* d = QApplication::desktop();
-    QWidget *view = w ? w->root()->hostWindow()->platformWindow(): 0;
-    int screenNumber = view ? d->screenNumber(view) : 0;
-    return d->screen(screenNumber)->numColors() < 2;
+    return QApplication::desktop()->screen(screenNumber(w))->numColors() < 2;
 }
 
 FloatRect screenRect(Widget* w)
 {
-    QRect r = QApplication::desktop()->screenGeometry(w ? w->root()->hostWindow()->platformWindow(): 0);
+    QRect r = QApplication::desktop()->screenGeometry(screenNumber(w));
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
 FloatRect screenAvailableRect(Widget* w)
 {
-    QRect r = QApplication::desktop()->availableGeometry(w ? w->root()->hostWindow()->platformWindow(): 0);
+    QRect r = QApplication::desktop()->availableGeometry(screenNumber(w));
     return FloatRect(r.x(), r.y(), r.width(), r.height());
 }
 
diff --git a/WebCore/platform/qt/PopupMenuQt.cpp b/WebCore/platform/qt/PopupMenuQt.cpp
index 11dfe41..b44f2ec 100644
--- a/WebCore/platform/qt/PopupMenuQt.cpp
+++ b/WebCore/platform/qt/PopupMenuQt.cpp
@@ -30,6 +30,7 @@
 #include "FrameView.h"
 #include "HostWindow.h"
 #include "PopupMenuClient.h"
+#include "QWebPageClient.h"
 #include "QWebPopup.h"
 
 #include <QAction>
@@ -59,7 +60,7 @@ void PopupMenu::clear()
     m_popup->clear();
 }
 
-void PopupMenu::populate(const IntRect& r)
+void PopupMenu::populate(const IntRect&)
 {
     clear();
     Q_ASSERT(client());
@@ -85,13 +86,13 @@ void PopupMenu::populate(const IntRect& r)
 
 void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 {
-    QWidget* window = v->hostWindow()->platformWindow();
+    QWebPageClient* client = v->hostWindow()->platformPageClient();
     populate(r);
     QRect rect = r;
     rect.moveTopLeft(v->contentsToWindow(r.topLeft()));
     rect.setHeight(m_popup->sizeHint().height());
 
-    m_popup->setParent(window);
+    m_popup->setParent(QWidget::find(client->winId()));
     m_popup->setGeometry(rect);
     m_popup->setCurrentIndex(index);
     m_popup->exec();
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
new file mode 100644
index 0000000..09f7886
--- /dev/null
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef QWebPageClient_h
+#define QWebPageClient_h
+
+#include <QRect>
+
+class QWebPageClient {
+public:
+    virtual void scroll(int dx, int dy, const QRect&) = 0;
+    virtual void update(const QRect&) = 0;
+
+    inline void resetCursor()
+    {
+#ifndef QT_NO_CURSOR
+        if (!cursor().bitmap() && cursor().shape() == m_lastCursor.shape())
+            return;
+        updateCursor(m_lastCursor);
+#endif
+    }
+
+    inline void setCursor(const QCursor& cursor)
+    {
+#ifndef QT_NO_CURSOR
+        m_lastCursor = cursor;
+        if (!cursor.bitmap() && cursor.shape() == this->cursor().shape())
+            return;
+        updateCursor(cursor);
+#endif
+    }
+
+    virtual int screenNumber() const = 0;
+    virtual WId winId() const = 0;
+
+    virtual QObject* pluginParent() const = 0;
+
+protected:
+#ifndef QT_NO_CURSOR
+    virtual QCursor cursor() const = 0;
+    virtual void updateCursor(const QCursor& cursor) = 0;
+#endif
+
+private:
+#ifndef QT_NO_CURSOR
+    QCursor m_lastCursor;
+#endif
+};
+
+#endif
diff --git a/WebCore/platform/qt/QWebPopup.cpp b/WebCore/platform/qt/QWebPopup.cpp
index f437c27..d077079 100644
--- a/WebCore/platform/qt/QWebPopup.cpp
+++ b/WebCore/platform/qt/QWebPopup.cpp
@@ -71,7 +71,7 @@ void QWebPopup::hidePopup()
         return;
 
     m_popupVisible = false;
-    m_client->hidePopup();
+    m_client->popupDidHide();
 }
 
 void QWebPopup::activeChanged(int index)
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index 3fe67b2..b61d356 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -44,6 +44,7 @@
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
+#include "UserAgentStyleSheets.h"
 #include "qwebpage.h"
 
 #include <QApplication>
@@ -172,7 +173,7 @@ bool RenderThemeQt::supportsHover(const RenderStyle*) const
     return true;
 }
 
-bool RenderThemeQt::supportsFocusRing(const RenderStyle* style) const
+bool RenderThemeQt::supportsFocusRing(const RenderStyle*) const
 {
     return true; // Qt provides this through the style
 }
@@ -274,7 +275,7 @@ Color RenderThemeQt::platformInactiveSelectionForegroundColor() const
     return pal.brush(QPalette::Inactive, QPalette::HighlightedText).color();
 }
 
-void RenderThemeQt::systemFont(int propId, FontDescription& fontDescription) const
+void RenderThemeQt::systemFont(int, FontDescription&) const
 {
     // no-op
 }
@@ -387,7 +388,7 @@ bool RenderThemeQt::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i
     return paintButton(o, i, r);
 }
 
-void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeQt::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element*) const
 {
     // Ditch the border.
     style->resetBorder();
@@ -572,7 +573,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     QStyleOptionComboBox opt;
     if (p.widget)
         opt.initFrom(p.widget);
-    ControlPart appearance = applyTheme(opt, o);
+    applyTheme(opt, o);
 
     const QPoint topLeft = r.topLeft();
     p.painter->translate(topLeft);
@@ -584,8 +585,7 @@ bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo
     return false;
 }
 
-void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style,
-                                              Element* e) const
+void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     // WORKAROUND because html.css specifies -webkit-border-radius for <select> so we override it here
     // see also http://bugs.webkit.org/show_bug.cgi?id=18399
@@ -772,13 +772,7 @@ ControlPart RenderThemeQt::applyTheme(QStyleOption& option, RenderObject* o) con
 
 String RenderThemeQt::extraMediaControlsStyleSheet()
 {
-    QFile platformStyleSheet(QLatin1String(":/webcore/css/mediaControls-extras.css"));
-    if (platformStyleSheet.open(QFile::ReadOnly)) {
-        QByteArray sheetData = platformStyleSheet.readAll();
-        return QString::fromUtf8(sheetData.constData(), sheetData.length());
-    }
-
-    return String();
+    return String(mediaControlsQtUserAgentStyleSheet, sizeof(mediaControlsQtUserAgentStyleSheet));
 }
 
 // Helper class to transform the painter's world matrix to the object's content area, scaled to 0,0,100,100
@@ -887,13 +881,13 @@ bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const RenderObject::Pa
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
diff --git a/WebCore/platform/qt/ScrollViewQt.cpp b/WebCore/platform/qt/ScrollViewQt.cpp
index 48885d3..ccbd751 100644
--- a/WebCore/platform/qt/ScrollViewQt.cpp
+++ b/WebCore/platform/qt/ScrollViewQt.cpp
@@ -53,7 +53,7 @@ void ScrollView::adjustWidgetsPreventingBlittingCount(int delta)
         parent()->adjustWidgetsPreventingBlittingCount(delta);
 }
 
-void ScrollView::platformAddChild(Widget* child)
+void ScrollView::platformAddChild(Widget*)
 {
     adjustWidgetsPreventingBlittingCount(1);
 }
diff --git a/WebCore/platform/qt/SearchPopupMenuQt.cpp b/WebCore/platform/qt/SearchPopupMenuQt.cpp
index 7822b2c..187a5de 100644
--- a/WebCore/platform/qt/SearchPopupMenuQt.cpp
+++ b/WebCore/platform/qt/SearchPopupMenuQt.cpp
@@ -29,11 +29,11 @@ SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
 {
 }
 
-void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+void SearchPopupMenu::saveRecentSearches(const AtomicString&, const Vector<String>&)
 {
 }
 
-void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+void SearchPopupMenu::loadRecentSearches(const AtomicString&, Vector<String>&)
 {
 }
 
diff --git a/WebCore/platform/qt/TemporaryLinkStubs.cpp b/WebCore/platform/qt/TemporaryLinkStubs.cpp
index 8ef598f..814f961 100644
--- a/WebCore/platform/qt/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/qt/TemporaryLinkStubs.cpp
@@ -100,7 +100,7 @@ void getSupportedKeySizes(Vector<String>&)
     notImplemented();
 }
 
-String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
+String signedPublicKeyAndChallengeString(unsigned, const String&, const KURL&)
 {
     return String();
 }
@@ -114,11 +114,6 @@ float userIdleTime()
 }
 #endif
 
-void prefetchDNS(const String& hostname)
-{
-    notImplemented();
-}
-
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/WheelEventQt.cpp b/WebCore/platform/qt/WheelEventQt.cpp
index 9534f20..66118e1 100644
--- a/WebCore/platform/qt/WheelEventQt.cpp
+++ b/WebCore/platform/qt/WheelEventQt.cpp
@@ -25,9 +25,48 @@
 
 #include <qapplication.h>
 #include <QWheelEvent>
+#include <QGraphicsSceneWheelEvent>
 
 namespace WebCore {
 
+void PlatformWheelEvent::applyDelta(int delta, Qt::Orientation orientation)
+{
+    if (orientation == Qt::Horizontal) {
+        m_deltaX = (delta / 120);
+        m_deltaY = 0;
+    } else {
+        m_deltaX = 0;
+        m_deltaY = (delta / 120);
+    }
+
+    m_wheelTicksX = m_deltaX;
+    m_wheelTicksY = m_deltaY;
+
+    // Use the same single scroll step as QTextEdit
+    // (in QTextEditPrivate::init [h,v]bar->setSingleStep)
+    static const float cDefaultQtScrollStep = 20.f;
+    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+}
+
+PlatformWheelEvent::PlatformWheelEvent(QGraphicsSceneWheelEvent* e)
+#ifdef QT_NO_WHEELEVENT
+{
+    Q_UNUSED(e);
+}
+#else
+    : m_position(e->pos().toPoint())
+    , m_globalPosition(e->screenPos())
+    , m_granularity(ScrollByPixelWheelEvent)
+    , m_isAccepted(false)
+    , m_shiftKey(e->modifiers() & Qt::ShiftModifier)
+    , m_ctrlKey(e->modifiers() & Qt::ControlModifier)
+    , m_altKey(e->modifiers() & Qt::AltModifier)
+    , m_metaKey(e->modifiers() & Qt::MetaModifier)
+{
+    applyDelta(e->delta(), e->orientation());
+}
+#endif // QT_NO_WHEELEVENT
 
 PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
 #ifdef QT_NO_WHEELEVENT
@@ -44,21 +83,7 @@ PlatformWheelEvent::PlatformWheelEvent(QWheelEvent* e)
     , m_altKey(e->modifiers() & Qt::AltModifier)
     , m_metaKey(e->modifiers() & Qt::MetaModifier)
 {
-    if (e->orientation() == Qt::Horizontal) {
-        m_deltaX = (e->delta() / 120);
-        m_deltaY = 0;
-    } else {
-        m_deltaX = 0;
-        m_deltaY = (e->delta() / 120);
-    }
-    m_wheelTicksX = m_deltaX;
-    m_wheelTicksY = m_deltaY;
-
-    // use the same single scroll step as QTextEdit (in
-    // QTextEditPrivate::init [h,v]bar->setSingleStep )
-    static const float cDefaultQtScrollStep = 20.f;
-    m_deltaX *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
-    m_deltaY *= QApplication::wheelScrollLines() * cDefaultQtScrollStep;
+    applyDelta(e->delta(), e->orientation());
 }
 #endif // QT_NO_WHEELEVENT
 
diff --git a/WebCore/platform/qt/WidgetQt.cpp b/WebCore/platform/qt/WidgetQt.cpp
index 0fb6c37..e9c99a4 100644
--- a/WebCore/platform/qt/WidgetQt.cpp
+++ b/WebCore/platform/qt/WidgetQt.cpp
@@ -30,6 +30,7 @@
  */
 
 #include "config.h"
+#include "Widget.h"
 
 #include "Cursor.h"
 #include "Font.h"
@@ -37,8 +38,8 @@
 #include "HostWindow.h"
 #include "IntRect.h"
 #include "ScrollView.h"
-#include "Widget.h"
 #include "NotImplemented.h"
+#include "QWebPageClient.h"
 
 #include "qwebframe.h"
 #include "qwebframe_p.h"
@@ -81,15 +82,10 @@ void Widget::setFocus()
 void Widget::setCursor(const Cursor& cursor)
 {
 #ifndef QT_NO_CURSOR
-    QWidget* widget = root()->hostWindow()->platformWindow();
-
-    if (!widget)
-        return;
-
-    if (!cursor.impl().bitmap() && widget->cursor().shape() == cursor.impl().shape())
-        return;
+    QWebPageClient* pageClient = root()->hostWindow()->platformPageClient();
 
-    QCoreApplication::postEvent(widget, new SetCursorEvent(cursor.impl()));
+    if (pageClient)
+        pageClient->setCursor(cursor.impl());
 #endif
 }
 
@@ -105,7 +101,7 @@ void Widget::hide()
         platformWidget()->hide();
 }
 
-void Widget::paint(GraphicsContext *, const IntRect &rect)
+void Widget::paint(GraphicsContext*, const IntRect&)
 {
 }
 
diff --git a/WebCore/platform/sql/SQLValue.cpp b/WebCore/platform/sql/SQLValue.cpp
index 7e178f9..0ad643e 100644
--- a/WebCore/platform/sql/SQLValue.cpp
+++ b/WebCore/platform/sql/SQLValue.cpp
@@ -32,10 +32,10 @@
 namespace WebCore {
 
 SQLValue::SQLValue(const SQLValue& val)
+    : m_type(val.m_type)
+    , m_number(val.m_number)
+    , m_string(val.m_string.threadsafeCopy())
 {
-    m_number = val.m_number;
-    m_string = val.m_string.copy();
-    m_type = val.m_type;
 }
 
 String SQLValue::string() const
@@ -43,7 +43,7 @@ String SQLValue::string() const
     ASSERT(m_type == StringValue);
 
     // Must return a copy since ref-shared Strings are not thread safe
-    return m_string.copy();
+    return m_string.threadsafeCopy();
 }
 
 double SQLValue::number() const
diff --git a/WebCore/platform/sql/SQLValue.h b/WebCore/platform/sql/SQLValue.h
index 7d85051..0f854fc 100644
--- a/WebCore/platform/sql/SQLValue.h
+++ b/WebCore/platform/sql/SQLValue.h
@@ -38,9 +38,9 @@ namespace WebCore {
     public:
         enum Type { NullValue, NumberValue, StringValue };
 
-        SQLValue() : m_type(NullValue) { }
+        SQLValue() : m_type(NullValue), m_number(0.0) { }
         SQLValue(double number) : m_type(NumberValue), m_number(number) { }
-        SQLValue(const String& s) : m_type(StringValue), m_string(s) { }
+        SQLValue(const String& s) : m_type(StringValue), m_number(0.0), m_string(s) { }
         SQLValue(const SQLValue&);
 
         Type type() const { return m_type; }
diff --git a/WebCore/platform/sql/SQLiteTransaction.cpp b/WebCore/platform/sql/SQLiteTransaction.cpp
index 0a236be..a4b2ac8 100644
--- a/WebCore/platform/sql/SQLiteTransaction.cpp
+++ b/WebCore/platform/sql/SQLiteTransaction.cpp
@@ -30,9 +30,10 @@
 
 namespace WebCore {
 
-SQLiteTransaction::SQLiteTransaction(SQLiteDatabase& db)
+SQLiteTransaction::SQLiteTransaction(SQLiteDatabase& db, bool readOnly)
     : m_db(db)
     , m_inProgress(false)
+    , m_readOnly(readOnly)
 {
 }
 
@@ -46,7 +47,17 @@ void SQLiteTransaction::begin()
 {
     if (!m_inProgress) {
         ASSERT(!m_db.m_transactionInProgress);
-        m_inProgress = m_db.executeCommand("BEGIN;");
+        // Call BEGIN IMMEDIATE for a write transaction to acquire
+        // a RESERVED lock on the DB file. Otherwise, another write
+        // transaction (on another connection) could make changes
+        // to the same DB file before this transaction gets to execute
+        // any statements. If that happens, this transaction will fail.
+        // http://www.sqlite.org/lang_transaction.html
+        // http://www.sqlite.org/lockingv3.html#locking
+        if (m_readOnly)
+            m_inProgress = m_db.executeCommand("BEGIN;");
+        else
+            m_inProgress = m_db.executeCommand("BEGIN IMMEDIATE;");
         m_db.m_transactionInProgress = m_inProgress;
     }
 }
diff --git a/WebCore/platform/sql/SQLiteTransaction.h b/WebCore/platform/sql/SQLiteTransaction.h
index cf5a180..557d81c 100644
--- a/WebCore/platform/sql/SQLiteTransaction.h
+++ b/WebCore/platform/sql/SQLiteTransaction.h
@@ -35,7 +35,7 @@ class SQLiteDatabase;
 class SQLiteTransaction : public Noncopyable
 {
 public:
-    SQLiteTransaction(SQLiteDatabase& db);
+    SQLiteTransaction(SQLiteDatabase& db, bool readOnly = false);
     ~SQLiteTransaction();
     
     void begin();
@@ -47,10 +47,9 @@ public:
 private:
     SQLiteDatabase& m_db;
     bool m_inProgress;
-
+    bool m_readOnly;
 };
 
 } // namespace WebCore
 
 #endif // SQLiteTransation_H
-
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
index dc79fd0..3cf961f 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromium.cpp
@@ -55,10 +55,10 @@ int SQLiteFileSystem::openDatabase(const String& fileName, sqlite3** database)
         return sqlite3_open16(path.charactersWithNullTermination(), database);
     }
 
-    // open databases using Chromium's VFS
+    // open databases using the default VFS
+    // in renderers, it should be Chromium's VFS; in the browser process it should be SQLite's default VFS
     return sqlite3_open_v2(fileName.utf8().data(), database,
-                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX,
-                           "chromium_vfs");
+                           SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE | SQLITE_OPEN_FULLMUTEX, 0);
 }
 
 String SQLiteFileSystem::getFileNameForNewDatabase(
@@ -99,9 +99,7 @@ bool SQLiteFileSystem::deleteEmptyDatabaseDirectory(const String&)
 
 bool SQLiteFileSystem::deleteDatabaseFile(const String& fileName)
 {
-    // return true if and only if the error code returned by
-    // ChromiumBridge::deleteDatabase() is 0
-    return (!ChromiumBridge::databaseDeleteFile(fileName));
+    return (ChromiumBridge::databaseDeleteFile(fileName) == SQLITE_OK);
 }
 
 long long SQLiteFileSystem::getDatabaseFileSize(const String& fileName)
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
new file mode 100644
index 0000000..2960a5f
--- /dev/null
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumPosix.cpp
@@ -0,0 +1,190 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLiteFileSystem.h"
+
+#include "ChromiumBridge.h"
+#include <sqlite3.h>
+
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+
+using namespace WebCore;
+
+// Defined in Chromium's codebase in third_party/sqlite/src/os_unix.c
+extern "C" {
+void initUnixFile(sqlite3_file* file);
+int fillInUnixFile(sqlite3_vfs* vfs, int fd, int dirfd, sqlite3_file* file, const char* fileName, int noLock);
+}
+
+// Chromium's Posix implementation of SQLite VFS
+namespace {
+
+// Opens a file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// id - the structure that will manipulate the newly opened file.
+// desiredFlags - the desired open mode flags.
+// usedFlags - the actual open mode flags that were used.
+int chromiumOpen(sqlite3_vfs* vfs, const char* fileName,
+                 sqlite3_file* id, int desiredFlags, int* usedFlags)
+{
+    initUnixFile(id);
+    int dirfd = -1;
+    int fd = ChromiumBridge::databaseOpenFile(fileName, desiredFlags, &dirfd);
+    if (fd < 0) {
+        if (desiredFlags & SQLITE_OPEN_READWRITE) {
+            int newFlags = (desiredFlags & ~(SQLITE_OPEN_READWRITE | SQLITE_OPEN_CREATE)) | SQLITE_OPEN_READONLY;
+            return chromiumOpen(vfs, fileName, id, newFlags, usedFlags);
+        } else
+            return SQLITE_CANTOPEN;
+    }
+    if (usedFlags)
+        *usedFlags = desiredFlags;
+
+    fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+    if (dirfd >= 0)
+        fcntl(dirfd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+
+    // The mask 0x00007F00 gives us the 7 bits that determine the type of the file SQLite is trying to open.
+    int fileType = desiredFlags & 0x00007F00;
+    int noLock = (fileType != SQLITE_OPEN_MAIN_DB);
+    return fillInUnixFile(vfs, fd, dirfd, id, fileName, noLock);
+}
+
+// Deletes the given file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// syncDir - determines if the directory to which this file belongs
+//           should be synched after the file is deleted.
+int chromiumDelete(sqlite3_vfs*, const char* fileName, int syncDir)
+{
+    return ChromiumBridge::databaseDeleteFile(fileName, syncDir);
+}
+
+// Check the existance and status of the given file.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the file.
+// flag - the type of test to make on this file.
+// res - the result.
+int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
+{
+    int attr = static_cast<int>(ChromiumBridge::databaseGetFileAttributes(fileName));
+    if (attr < 0) {
+        *res = 0;
+        return SQLITE_OK;
+    }
+
+    switch (flag) {
+    case SQLITE_ACCESS_EXISTS:
+        *res = 1;   // if the file doesn't exist, attr < 0
+        break;
+    case SQLITE_ACCESS_READWRITE:
+        *res = (attr & W_OK) && (attr & R_OK);
+        break;
+    case SQLITE_ACCESS_READ:
+        *res = (attr & R_OK);
+        break;
+    default:
+        return SQLITE_ERROR;
+    }
+
+    return SQLITE_OK;
+}
+
+// Turns a relative pathname into a full pathname.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// relativePath - the relative path.
+// bufSize - the size of the output buffer in bytes.
+// absolutePath - the output buffer where the absolute path will be stored.
+int chromiumFullPathname(sqlite3_vfs* vfs, const char* relativePath,
+                         int, char* absolutePath)
+{
+    // The renderer process doesn't need to know the absolute path of the file
+    sqlite3_snprintf(vfs->mxPathname, absolutePath, "%s", relativePath);
+    return SQLITE_OK;
+}
+
+#ifndef SQLITE_OMIT_LOAD_EXTENSION
+// Returns NULL, thus disallowing loading libraries in the renderer process.
+//
+// vfs - pointer to the sqlite3_vfs object.
+// fileName - the name of the shared library file.
+void* chromiumDlOpen(sqlite3_vfs*, const char*)
+{
+    return 0;
+}
+#else
+#define chromiumDlOpen 0
+#endif // SQLITE_OMIT_LOAD_EXTENSION
+
+} // namespace
+
+namespace WebCore {
+
+void SQLiteFileSystem::registerSQLiteVFS()
+{
+    // FIXME: Make sure there aren't any unintended consequences when VFS code is called in the browser process.
+    if (!ChromiumBridge::sandboxEnabled()) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    sqlite3_vfs* unix_vfs = sqlite3_vfs_find("unix");
+    static sqlite3_vfs chromium_vfs = {
+        1,
+        unix_vfs->szOsFile,
+        unix_vfs->mxPathname,
+        0,
+        "chromium_vfs",
+        unix_vfs->pAppData,
+        chromiumOpen,
+        chromiumDelete,
+        chromiumAccess,
+        chromiumFullPathname,
+        chromiumDlOpen,
+        unix_vfs->xDlError,
+        unix_vfs->xDlSym,
+        unix_vfs->xDlClose,
+        unix_vfs->xRandomness,
+        unix_vfs->xSleep,
+        unix_vfs->xCurrentTime,
+        unix_vfs->xGetLastError
+    };
+    sqlite3_vfs_register(&chromium_vfs, 1);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
index b357d4a..153793b 100644
--- a/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
+++ b/WebCore/platform/sql/chromium/SQLiteFileSystemChromiumWin.cpp
@@ -35,6 +35,8 @@
 #include <sqlite3.h>
 #include <windows.h>
 
+using namespace WebCore;
+
 // Defined in Chromium's codebase in third_party/sqlite/src/os_win.c
 extern "C" {
 int chromium_sqlite3_initialize_win_sqlite3_file(sqlite3_file* file, HANDLE handle);
@@ -53,7 +55,7 @@ namespace {
 int chromiumOpen(sqlite3_vfs*, const char* fileName,
                  sqlite3_file* id, int desiredFlags, int* usedFlags)
 {
-    HANDLE h = WebCore::ChromiumBridge::databaseOpenFile(fileName, desiredFlags);
+    HANDLE h = ChromiumBridge::databaseOpenFile(fileName, desiredFlags);
     if (h == INVALID_HANDLE_VALUE) {
         if (desiredFlags & SQLITE_OPEN_READWRITE) {
             int newFlags = (desiredFlags | SQLITE_OPEN_READONLY) & ~SQLITE_OPEN_READWRITE;
@@ -80,10 +82,7 @@ int chromiumOpen(sqlite3_vfs*, const char* fileName,
 //           should be synched after the file is deleted.
 int chromiumDelete(sqlite3_vfs*, const char* fileName, int)
 {
-    bool deleted = WebCore::ChromiumBridge::databaseDeleteFile(fileName);
-    DWORD rc = WebCore::ChromiumBridge::databaseGetFileAttributes(fileName);
-    return ((rc == INVALID_FILE_ATTRIBUTES) && deleted ?
-            SQLITE_OK : SQLITE_IOERR_DELETE);
+    return ChromiumBridge::databaseDeleteFile(fileName);
 }
 
 // Check the existance and status of the given file.
@@ -94,7 +93,7 @@ int chromiumDelete(sqlite3_vfs*, const char* fileName, int)
 // res - the result.
 int chromiumAccess(sqlite3_vfs*, const char* fileName, int flag, int* res)
 {
-    DWORD attr = WebCore::ChromiumBridge::databaseGetFileAttributes(fileName);
+    DWORD attr = ChromiumBridge::databaseGetFileAttributes(fileName);
     switch (flag) {
     case SQLITE_ACCESS_READ:
     case SQLITE_ACCESS_EXISTS:
@@ -156,7 +155,7 @@ void SQLiteFileSystem::registerSQLiteVFS()
         win32_vfs->mxPathname,
         0,
         "chromium_vfs",
-        0,
+        win32_vfs->pAppData,
         chromiumOpen,
         chromiumDelete,
         chromiumAccess,
diff --git a/WebCore/platform/text/CString.cpp b/WebCore/platform/text/CString.cpp
index 90990f8..25f5fa1 100644
--- a/WebCore/platform/text/CString.cpp
+++ b/WebCore/platform/text/CString.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/WebCore/platform/text/CString.h b/WebCore/platform/text/CString.h
index f084ddf..b9030d6 100644
--- a/WebCore/platform/text/CString.h
+++ b/WebCore/platform/text/CString.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/WebCore/platform/text/PlatformString.h b/WebCore/platform/text/PlatformString.h
index 6d5384f..8d19c17 100644
--- a/WebCore/platform/text/PlatformString.h
+++ b/WebCore/platform/text/PlatformString.h
@@ -56,6 +56,10 @@ QT_END_NAMESPACE
 class wxString;
 #endif
 
+#if PLATFORM(HAIKU)
+class BString;
+#endif
+
 namespace WebCore {
 
 class CString;
@@ -189,16 +193,13 @@ public:
 
     bool percentage(int& percentage) const;
 
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    String crossThreadString() const;
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since the underlying StringImpl objects are immutable, there's no other reason
     // to ever prefer copy() over plain old assignment.
-    String copy() const;
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, StringImpl::substring returns
-    // empty() which is not safe for another thread.)
-    String substringCopy(unsigned pos, unsigned len  = UINT_MAX) const;
+    String threadsafeCopy() const;
 
     bool isNull() const { return !m_impl; }
     bool isEmpty() const;
@@ -229,6 +230,11 @@ public:
     operator wxString() const;
 #endif
 
+#if PLATFORM(HAIKU)
+    String(const BString&);
+    operator BString() const;
+#endif
+
 #ifndef NDEBUG
     Vector<char> ascii() const;
 #endif
@@ -245,6 +251,14 @@ public:
     // Determines the writing direction using the Unicode Bidi Algorithm rules P2 and P3.
     WTF::Unicode::Direction defaultWritingDirection() const { return m_impl ? m_impl->defaultWritingDirection() : WTF::Unicode::LeftToRight; }
 
+    // Counts the number of grapheme clusters. A surrogate pair or a sequence
+    // of a non-combining character and following combining characters is
+    // counted as 1 grapheme cluster.
+    unsigned numGraphemeClusters() const;
+    // Returns the number of characters which will be less than or equal to
+    // the specified grapheme cluster length.
+    unsigned numCharactersInGraphemeClusters(unsigned) const;
+
 private:
     RefPtr<StringImpl> m_impl;
 };
diff --git a/WebCore/platform/text/RegularExpression.cpp b/WebCore/platform/text/RegularExpression.cpp
index 6329b3b..9b063c9 100644
--- a/WebCore/platform/text/RegularExpression.cpp
+++ b/WebCore/platform/text/RegularExpression.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-class RegularExpression::Private : public RefCounted<Private> {
+class RegularExpression::Private : public RefCounted<RegularExpression::Private> {
 public:
     static PassRefPtr<Private> create(const String& pattern, TextCaseSensitivity);
     ~Private();
diff --git a/WebCore/platform/text/String.cpp b/WebCore/platform/text/String.cpp
index 2730939..bef2674 100644
--- a/WebCore/platform/text/String.cpp
+++ b/WebCore/platform/text/String.cpp
@@ -25,6 +25,7 @@
 #include "CString.h"
 #include "FloatConversion.h"
 #include "StringBuffer.h"
+#include "TextBreakIterator.h"
 #include "TextEncoding.h"
 #include <wtf/dtoa.h>
 #include <limits>
@@ -262,13 +263,6 @@ String String::substring(unsigned pos, unsigned len) const
     return m_impl->substring(pos, len);
 }
 
-String String::substringCopy(unsigned pos, unsigned len) const
-{
-    if (!m_impl) 
-        return String();
-    return m_impl->substringCopy(pos, len);
-}
-
 String String::lower() const
 {
     if (!m_impl)
@@ -589,11 +583,18 @@ float String::toFloat(bool* ok) const
     return m_impl->toFloat(ok);
 }
 
-String String::copy() const
+String String::threadsafeCopy() const
+{
+    if (!m_impl)
+        return String();
+    return m_impl->threadsafeCopy();
+}
+
+String String::crossThreadString() const
 {
     if (!m_impl)
         return String();
-    return m_impl->copy();
+    return m_impl->crossThreadString();
 }
 
 bool String::isEmpty() const
@@ -921,6 +922,31 @@ PassRefPtr<SharedBuffer> utf8Buffer(const String& string)
     return SharedBuffer::adoptVector(buffer);
 }
 
+unsigned String::numGraphemeClusters() const
+{
+    TextBreakIterator* it = characterBreakIterator(characters(), length());
+    if (!it)
+        return length();
+
+    unsigned num = 0;
+    while (textBreakNext(it) != TextBreakDone)
+        ++num;
+    return num;
+}
+
+unsigned String::numCharactersInGraphemeClusters(unsigned numGraphemeClusters) const
+{
+    TextBreakIterator* it = characterBreakIterator(characters(), length());
+    if (!it)
+        return min(length(), numGraphemeClusters);
+
+    for (unsigned i = 0; i < numGraphemeClusters; ++i) {
+        if (textBreakNext(it) == TextBreakDone)
+            return length();
+    }
+    return textBreakCurrent(it);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/platform/text/StringImpl.cpp b/WebCore/platform/text/StringImpl.cpp
index 8b749c7..c3ab4be 100644
--- a/WebCore/platform/text/StringImpl.cpp
+++ b/WebCore/platform/text/StringImpl.cpp
@@ -57,7 +57,7 @@ static inline void deleteUCharVector(const UChar* p)
 }
 
 // Some of the factory methods create buffers using fastMalloc.
-// We must ensure that ll allocations of StringImpl are allocated using
+// We must ensure that all allocations of StringImpl are allocated using
 // fastMalloc so that we don't have mis-matched frees. We accomplish 
 // this by overriding the new and delete operators.
 void* StringImpl::operator new(size_t size, void* address)
@@ -79,10 +79,9 @@ void StringImpl::operator delete(void* address)
 
 // This constructor is used only to create the empty string.
 StringImpl::StringImpl()
-    : m_length(0)
-    , m_data(0)
+    : m_data(0)
+    , m_length(0)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     // Ensure that the hash is computed so that AtomicStringHash can call existingHash()
     // with impunity. The empty string is special because it is never entered into
@@ -90,52 +89,10 @@ StringImpl::StringImpl()
     hash();
 }
 
-// This is one of the most common constructors, but it's also used for the copy()
-// operation. Because of that, it's the one constructor that doesn't assert the
-// length is non-zero, since we support copying the empty string.
-inline StringImpl::StringImpl(const UChar* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    UChar* data = newUCharVector(length);
-    memcpy(data, characters, length * sizeof(UChar));
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const StringImpl& str, WithTerminatingNullCharacter)
-    : m_length(str.m_length)
-    , m_hash(str.m_hash)
-    , m_bufferIsInternal(false)
-{
-    m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
-    UChar* data = newUCharVector(str.m_length + 1);
-    memcpy(data, str.m_data, str.m_length * sizeof(UChar));
-    data[str.m_length] = 0;
-    m_data = data;
-}
-
-inline StringImpl::StringImpl(const char* characters, unsigned length)
-    : m_length(length)
-    , m_hash(0)
-    , m_bufferIsInternal(false)
-{
-    ASSERT(characters);
-    ASSERT(length);
-
-    UChar* data = newUCharVector(length);
-    for (unsigned i = 0; i != length; ++i) {
-        unsigned char c = characters[i];
-        data[i] = c;
-    }
-    m_data = data;
-}
-
 inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
-    : m_length(length)
-    , m_data(characters)
+    : m_data(characters)
+    , m_length(length)
     , m_hash(0)
-    , m_bufferIsInternal(false)
 {
     ASSERT(characters);
     ASSERT(length);
@@ -143,9 +100,9 @@ inline StringImpl::StringImpl(UChar* characters, unsigned length, AdoptBuffer)
 
 // This constructor is only for use by AtomicString.
 StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
-    : m_length(length)
+    : m_data(0)
+    , m_length(length)
     , m_hash(hash)
-    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
@@ -159,9 +116,9 @@ StringImpl::StringImpl(const UChar* characters, unsigned length, unsigned hash)
 
 // This constructor is only for use by AtomicString.
 StringImpl::StringImpl(const char* characters, unsigned length, unsigned hash)
-    : m_length(length)
+    : m_data(0)
+    , m_length(length)
     , m_hash(hash)
-    , m_bufferIsInternal(false)
 {
     ASSERT(hash);
     ASSERT(characters);
@@ -180,7 +137,7 @@ StringImpl::~StringImpl()
 {
     if (inTable())
         AtomicString::remove(this);
-    if (!m_bufferIsInternal) {
+    if (!bufferIsInternal()) {
         SharedUChar* sharedBuffer = m_sharedBufferAndFlags.get();
         if (sharedBuffer)
             sharedBuffer->deref();
@@ -218,15 +175,6 @@ PassRefPtr<StringImpl> StringImpl::substring(unsigned start, unsigned length)
     return create(m_data + start, length);
 }
 
-PassRefPtr<StringImpl> StringImpl::substringCopy(unsigned start, unsigned length)
-{
-    start = min(start, m_length);
-    length = min(length, m_length - start);
-    if (!length)
-        return adoptRef(new StringImpl);
-    return create(m_data + start, length);
-}
-
 UChar32 StringImpl::characterStartingAt(unsigned i)
 {
     if (U16_IS_SINGLE(m_data[i]))
@@ -1007,10 +955,9 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
-    char* buffer = static_cast<char*>(fastMalloc(size));
-    data = reinterpret_cast<UChar*>(buffer + sizeof(StringImpl));
-    StringImpl* string = new (buffer) StringImpl(data, length, AdoptBuffer());
-    string->m_bufferIsInternal = true;
+    StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
+    data = reinterpret_cast<UChar*>(string + 1);
+    string = new (string) StringImpl(data, length, AdoptBuffer());
     return adoptRef(string);
 }
 
@@ -1071,18 +1018,43 @@ JSC::UString StringImpl::ustring()
 
 PassRefPtr<StringImpl> StringImpl::createWithTerminatingNullCharacter(const StringImpl& string)
 {
-    return adoptRef(new StringImpl(string, WithTerminatingNullCharacter()));
+    // Use createUninitialized instead of 'new StringImpl' so that the string and its buffer
+    // get allocated in a single malloc block.
+    UChar* data;
+    int length = string.m_length;
+    RefPtr<StringImpl> terminatedString = createUninitialized(length + 1, data);
+    memcpy(data, string.m_data, length * sizeof(UChar));
+    data[length] = 0;
+    terminatedString->m_length--;
+    terminatedString->m_hash = string.m_hash;
+    terminatedString->m_sharedBufferAndFlags.setFlag(HasTerminatingNullCharacter);
+    return terminatedString.release();
 }
 
-PassRefPtr<StringImpl> StringImpl::copy()
+PassRefPtr<StringImpl> StringImpl::threadsafeCopy() const
 {
-    // Using the constructor directly to make sure that per-thread empty string instance isn't returned.
-    return adoptRef(new StringImpl(m_data, m_length));
+    // Special-case empty strings to make sure that per-thread empty string instance isn't returned.
+    if (m_length == 0)
+        return adoptRef(new StringImpl);
+    return create(m_data, m_length);
+}
+
+PassRefPtr<StringImpl> StringImpl::crossThreadString()
+{
+    SharedUChar* shared = sharedBuffer();
+    if (shared) {
+        RefPtr<StringImpl> impl = adoptRef(new StringImpl(const_cast<UChar*>(m_data), m_length, AdoptBuffer()));
+        impl->m_sharedBufferAndFlags.set(shared->crossThreadCopy().releaseRef());
+        return impl.release();
+    }
+
+    // If no shared buffer is available, create a copy.
+    return threadsafeCopy();
 }
 
 StringImpl::SharedUChar* StringImpl::sharedBuffer()
 {
-    if (m_length < minLengthToShare || m_bufferIsInternal)
+    if (m_length < minLengthToShare || bufferIsInternal())
         return 0;
 
     if (!m_sharedBufferAndFlags.get())
diff --git a/WebCore/platform/text/StringImpl.h b/WebCore/platform/text/StringImpl.h
index 8b4e82d..f3256cc 100644
--- a/WebCore/platform/text/StringImpl.h
+++ b/WebCore/platform/text/StringImpl.h
@@ -67,15 +67,10 @@ class StringImpl : public RefCounted<StringImpl> {
 private:
     friend class ThreadGlobalData;
     StringImpl();
-    StringImpl(const UChar*, unsigned length);
-    StringImpl(const char*, unsigned length);
 
     struct AdoptBuffer { };
     StringImpl(UChar*, unsigned length, AdoptBuffer);
 
-    struct WithTerminatingNullCharacter { };
-    StringImpl(const StringImpl&, WithTerminatingNullCharacter);
-
     // For AtomicString.
     StringImpl(const UChar*, unsigned length, unsigned hash);
     StringImpl(const char*, unsigned length, unsigned hash);
@@ -114,15 +109,12 @@ public:
     static unsigned computeHash(const UChar*, unsigned len);
     static unsigned computeHash(const char*);
     
-    // Makes a deep copy. Helpful only if you need to use a String on another thread.
+    // Returns a StringImpl suitable for use on another thread.
+    PassRefPtr<StringImpl> crossThreadString();
+    // Makes a deep copy. Helpful only if you need to use a String on another thread
+    // (use crossThreadString if the method call doesn't need to be threadsafe).
     // Since StringImpl objects are immutable, there's no other reason to make a copy.
-    PassRefPtr<StringImpl> copy();
-
-    // Makes a deep copy like copy() but only for a substring.
-    // (This ensures that you always get something suitable for a thread while subtring
-    // may not.  For example, in the empty string case, substring returns empty() which
-    // is not safe for another thread.)
-    PassRefPtr<StringImpl> substringCopy(unsigned pos, unsigned len  = UINT_MAX);
+    PassRefPtr<StringImpl> threadsafeCopy() const;
 
     PassRefPtr<StringImpl> substring(unsigned pos, unsigned len = UINT_MAX);
 
@@ -166,7 +158,7 @@ public:
     int reverseFind(UChar, int index);
     int reverseFind(StringImpl*, int index, bool caseSensitive = true);
     
-    bool startsWith(StringImpl* m_data, bool caseSensitive = true) { return reverseFind(m_data, 0, caseSensitive) == 0; }
+    bool startsWith(StringImpl* str, bool caseSensitive = true) { return reverseFind(str, 0, caseSensitive) == 0; }
     bool endsWith(StringImpl*, bool caseSensitive = true);
 
     PassRefPtr<StringImpl> replace(UChar, UChar);
@@ -196,21 +188,22 @@ private:
     void* operator new(size_t size, void* address);
 
     static PassRefPtr<StringImpl> createStrippingNullCharactersSlowCase(const UChar*, unsigned length);
+    
+    // The StringImpl struct and its data may be allocated within a single heap block.
+    // In this case, the m_data pointer is an "internal buffer", and does not need to be deallocated.
+    bool bufferIsInternal() { return m_data == reinterpret_cast<const UChar*>(this + 1); }
 
     enum StringImplFlags {
         HasTerminatingNullCharacter,
         InTable,
     };
 
-    unsigned m_length;
     const UChar* m_data;
+    unsigned m_length;
     mutable unsigned m_hash;
     PtrAndFlags<SharedUChar, StringImplFlags> m_sharedBufferAndFlags;
-
-    // In some cases, we allocate the StringImpl struct and its data
-    // within a single heap buffer. In this case, the m_data pointer
-    // is an "internal buffer", and does not need to be deallocated.
-    bool m_bufferIsInternal;
+    // There is a fictitious variable-length UChar array at the end, which is used
+    // as the internal buffer by the createUninitialized and create methods.
 };
 
 bool equal(StringImpl*, StringImpl*);
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index b76f739..c5c8cfd 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -264,6 +264,7 @@ const TextEncoding& UTF32LittleEndianEncoding()
 const TextEncoding& UTF8Encoding()
 {
     static TextEncoding globalUTF8Encoding("UTF-8");
+    ASSERT(globalUTF8Encoding.isValid());
     return globalUTF8Encoding;
 }
 
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index 5ab1c87..5d82511 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -48,7 +48,7 @@
 #if PLATFORM(QT)
 #include "qt/TextCodecQt.h"
 #endif
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
 #include "TextCodecWince.h"
 #endif
 
@@ -194,7 +194,7 @@ static void buildBaseTextCodecMaps()
     TextCodecICU::registerBaseCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerBaseCodecs(addToTextCodecMap);
 #endif
@@ -217,7 +217,7 @@ static void extendTextCodecMaps()
     TextCodecMac::registerCodecs(addToTextCodecMap);
 #endif
 
-#if PLATFORM(WINCE)
+#if PLATFORM(WINCE) && !PLATFORM(QT)
     TextCodecWince::registerExtendedEncodingNames(addToTextEncodingNameMap);
     TextCodecWince::registerExtendedCodecs(addToTextCodecMap);
 #endif
diff --git a/WebCore/platform/text/UnicodeRange.h b/WebCore/platform/text/UnicodeRange.h
index 7ecf03f..2278a0e 100644
--- a/WebCore/platform/text/UnicodeRange.h
+++ b/WebCore/platform/text/UnicodeRange.h
@@ -35,6 +35,10 @@
 #ifndef UnicodeRange_H
 #define UnicodeRange_H
 
+#if PLATFORM(HAIKU)
+#include "stdint.h"
+#endif
+
 #include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/text/cf/StringCF.cpp b/WebCore/platform/text/cf/StringCF.cpp
index 5e12ba9..b770d0e 100644
--- a/WebCore/platform/text/cf/StringCF.cpp
+++ b/WebCore/platform/text/cf/StringCF.cpp
@@ -45,7 +45,7 @@ String::String(CFStringRef str)
 CFStringRef String::createCFString() const
 {
     if (!m_impl)
-        return CFSTR("");
+        return static_cast<CFStringRef>(CFRetain(CFSTR("")));
 
     return m_impl->createCFString();
 }
diff --git a/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp b/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
index 2c732d6..8bb8c70 100644
--- a/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
+++ b/WebCore/platform/text/haiku/TextBreakIteratorInternalICUHaiku.cpp
@@ -26,6 +26,12 @@
 
 namespace WebCore {
 
+const char* currentSearchLocaleID()
+{
+    notImplemented();
+    return "";
+}
+
 const char* currentTextBreakLocaleID()
 {
     notImplemented();
diff --git a/WebCore/platform/text/mac/TextCodecMac.cpp b/WebCore/platform/text/mac/TextCodecMac.cpp
index 93b9da2..a1750c9 100644
--- a/WebCore/platform/text/mac/TextCodecMac.cpp
+++ b/WebCore/platform/text/mac/TextCodecMac.cpp
@@ -36,7 +36,7 @@
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Threading.h>
 
-using std::min;
+using namespace std;
 
 namespace WebCore {
 
@@ -141,7 +141,7 @@ OSStatus TextCodecMac::decode(const unsigned char* inputBuffer, int inputBufferL
         // First, fill the partial character buffer with as many bytes as are available.
         ASSERT(m_numBufferedBytes < sizeof(m_bufferedBytes));
         const int spaceInBuffer = sizeof(m_bufferedBytes) - m_numBufferedBytes;
-        const int bytesToPutInBuffer = MIN(spaceInBuffer, inputBufferLength);
+        const int bytesToPutInBuffer = min(spaceInBuffer, inputBufferLength);
         ASSERT(bytesToPutInBuffer != 0);
         memcpy(m_bufferedBytes + m_numBufferedBytes, inputBuffer, bytesToPutInBuffer);
 
@@ -283,28 +283,28 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
     // Encoding will change the yen sign back into a backslash.
     String copy(characters, length);
     copy.replace('\\', m_backslashAsCurrencySymbol);
-    CFStringRef cfs = copy.createCFString();
+    RetainPtr<CFStringRef> cfs(AdoptCF, copy.createCFString());
 
     CFIndex startPos = 0;
-    CFIndex charactersLeft = CFStringGetLength(cfs);
+    CFIndex charactersLeft = CFStringGetLength(cfs.get());
     Vector<char> result;
     size_t size = 0;
     UInt8 lossByte = handling == QuestionMarksForUnencodables ? '?' : 0;
     while (charactersLeft > 0) {
         CFRange range = CFRangeMake(startPos, charactersLeft);
         CFIndex bufferLength;
-        CFStringGetBytes(cfs, range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
+        CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, NULL, 0x7FFFFFFF, &bufferLength);
 
         result.grow(size + bufferLength);
         unsigned char* buffer = reinterpret_cast<unsigned char*>(result.data() + size);
-        CFIndex charactersConverted = CFStringGetBytes(cfs, range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
+        CFIndex charactersConverted = CFStringGetBytes(cfs.get(), range, m_encoding, lossByte, false, buffer, bufferLength, &bufferLength);
         size += bufferLength;
 
         if (charactersConverted != charactersLeft) {
-            unsigned badChar = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+            unsigned badChar = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
             ++charactersConverted;
             if ((badChar & 0xFC00) == 0xD800 && charactersConverted != charactersLeft) { // is high surrogate
-                UniChar low = CFStringGetCharacterAtIndex(cfs, startPos + charactersConverted);
+                UniChar low = CFStringGetCharacterAtIndex(cfs.get(), startPos + charactersConverted);
                 if ((low & 0xFC00) == 0xDC00) { // is low surrogate
                     badChar <<= 10;
                     badChar += low;
@@ -322,7 +322,6 @@ CString TextCodecMac::encode(const UChar* characters, size_t length, Unencodable
         startPos += charactersConverted;
         charactersLeft -= charactersConverted;
     }
-    CFRelease(cfs);
     return CString(result.data(), size);
 }
 
diff --git a/WebCore/platform/text/qt/TextCodecQt.cpp b/WebCore/platform/text/qt/TextCodecQt.cpp
index c6c02cf..b3f75cc 100644
--- a/WebCore/platform/text/qt/TextCodecQt.cpp
+++ b/WebCore/platform/text/qt/TextCodecQt.cpp
@@ -94,7 +94,26 @@ TextCodecQt::~TextCodecQt()
 
 String TextCodecQt::decode(const char* bytes, size_t length, bool flush, bool /*stopOnError*/, bool& sawError)
 {
-    QString unicode = m_codec->toUnicode(bytes, length, &m_state);
+    // We chop input buffer to smaller buffers to avoid excessive memory consumption
+    // when the input buffer is big.  This helps reduce peak memory consumption in
+    // mobile devices where system RAM is limited.
+#if PLATFORM(SYMBIAN)
+    static const int MaxInputChunkSize = 32 * 1024;
+#else
+    static const int MaxInputChunkSize = 1024 * 1024;
+#endif
+    const char* buf = bytes;
+    const char* end = buf + length;
+    String unicode(""); // a non-null string is expected
+
+    while (buf < end) {
+        int size = end - buf;
+        size = qMin(size, MaxInputChunkSize);
+        QString decoded = m_codec->toUnicode(buf, size, &m_state);
+        unicode.append(decoded);
+        buf += size;
+    }
+
     sawError = m_state.invalidChars != 0;
 
     if (flush) {
diff --git a/WebCore/platform/win/ClipboardWin.cpp b/WebCore/platform/win/ClipboardWin.cpp
index 65741e4..b2e8e3e 100644
--- a/WebCore/platform/win/ClipboardWin.cpp
+++ b/WebCore/platform/win/ClipboardWin.cpp
@@ -117,56 +117,49 @@ static inline void pathRemoveBadFSCharacters(PWSTR psz, size_t length)
 
 static String filesystemPathFromUrlOrTitle(const String& url, const String& title, TCHAR* extension, bool isLink)
 {
+    static const size_t fsPathMaxLengthExcludingNullTerminator = MAX_PATH - 1;
     bool usedURL = false;
-    WCHAR fsPathBuffer[MAX_PATH + 1];
+    WCHAR fsPathBuffer[MAX_PATH];
     fsPathBuffer[0] = 0;
     int extensionLen = extension ? lstrlen(extension) : 0;
+    int fsPathMaxLengthExcludingExtension = fsPathMaxLengthExcludingNullTerminator - extensionLen;
 
     if (!title.isEmpty()) {
-        size_t len = min<size_t>(title.length(), MAX_PATH - extensionLen);
+        size_t len = min<size_t>(title.length(), fsPathMaxLengthExcludingExtension);
         CopyMemory(fsPathBuffer, title.characters(), len * sizeof(UChar));
         fsPathBuffer[len] = 0;
         pathRemoveBadFSCharacters(fsPathBuffer, len);
     }
 
     if (!lstrlen(fsPathBuffer)) {
-        DWORD len = MAX_PATH;
-        String nullTermURL = url;
+        KURL kurl(ParsedURLString, url);
         usedURL = true;
-        if (UrlIsFileUrl((LPCWSTR)nullTermURL.charactersWithNullTermination()) 
-            && SUCCEEDED(PathCreateFromUrl((LPCWSTR)nullTermURL.charactersWithNullTermination(), fsPathBuffer, &len, 0))) {
-            // When linking to a file URL we can trivially find the file name
-            PWSTR fn = PathFindFileName(fsPathBuffer);
-            if (fn && fn != fsPathBuffer)
-                lstrcpyn(fsPathBuffer, fn, lstrlen(fn) + 1);
+        // The filename for any content based drag or file url should be the last element of 
+        // the path.  If we can't find it, or we're coming up with the name for a link
+        // we just use the entire url.
+        DWORD len = fsPathMaxLengthExcludingExtension;
+        String lastComponent = kurl.lastPathComponent();
+        if (kurl.isLocalFile() || (!isLink && !lastComponent.isEmpty())) {
+            len = min<DWORD>(fsPathMaxLengthExcludingExtension, lastComponent.length());
+            CopyMemory(fsPathBuffer, lastComponent.characters(), len * sizeof(UChar));
         } else {
-            // The filename for any content based drag should be the last element of 
-            // the path.  If we can't find it, or we're coming up with the name for a link
-            // we just use the entire url.
-            KURL kurl(url);
-            String lastComponent;
-            if (!isLink && !(lastComponent = kurl.lastPathComponent()).isEmpty()) {
-                len = min<DWORD>(MAX_PATH, lastComponent.length());
-                CopyMemory(fsPathBuffer, lastComponent.characters(), len * sizeof(UChar));
-            } else {
-                len = min<DWORD>(MAX_PATH, nullTermURL.length());
-                CopyMemory(fsPathBuffer, nullTermURL.characters(), len * sizeof(UChar));
-            }
-            fsPathBuffer[len] = 0;
-            pathRemoveBadFSCharacters(fsPathBuffer, len);
+            len = min<DWORD>(fsPathMaxLengthExcludingExtension, url.length());
+            CopyMemory(fsPathBuffer, url.characters(), len * sizeof(UChar));
         }
+        fsPathBuffer[len] = 0;
+        pathRemoveBadFSCharacters(fsPathBuffer, len);
     }
 
     if (!extension)
-        return String((UChar*)fsPathBuffer);
+        return String(static_cast<UChar*>(fsPathBuffer));
 
     if (!isLink && usedURL) {
         PathRenameExtension(fsPathBuffer, extension);
-        return String((UChar*)fsPathBuffer);
+        return String(static_cast<UChar*>(fsPathBuffer));
     }
 
-    String result((UChar*)fsPathBuffer);
-    result += String((UChar*)extension);
+    String result(static_cast<UChar*>(fsPathBuffer));
+    result += String(static_cast<UChar*>(extension));
     return result;
 }
 
@@ -522,7 +515,7 @@ bool ClipboardWin::setData(const String& type, const String& data)
     ClipboardDataType winType = clipboardTypeFromMIMEType(type);
 
     if (winType == ClipboardDataTypeURL)
-        return WebCore::writeURL(m_writableDataObject.get(), KURL(data), String(), false, true);
+        return WebCore::writeURL(m_writableDataObject.get(), KURL(ParsedURLString, data), String(), false, true);
 
     if (winType == ClipboardDataTypeText) {
         STGMEDIUM medium = {0};
diff --git a/WebCore/platform/win/CursorWin.cpp b/WebCore/platform/win/CursorWin.cpp
index 2bfe7a8..5afb1ae9 100644
--- a/WebCore/platform/win/CursorWin.cpp
+++ b/WebCore/platform/win/CursorWin.cpp
@@ -279,7 +279,7 @@ const Cursor& rowResizeCursor()
 
 const Cursor& middlePanningCursor()
 {
-    static const Cursor c = loadCursorByName("panIcon", 7, 7);
+    static const Cursor c = loadCursorByName("panIcon", 8, 8);
     return c;
 }
 
diff --git a/WebCore/platform/win/PasteboardWin.cpp b/WebCore/platform/win/PasteboardWin.cpp
index 188630f..d09769a 100644
--- a/WebCore/platform/win/PasteboardWin.cpp
+++ b/WebCore/platform/win/PasteboardWin.cpp
@@ -111,7 +111,7 @@ void Pasteboard::clear()
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
     clear();
-    
+
     // Put CF_HTML format on the pasteboard 
     if (::OpenClipboard(m_owner)) {
         ExceptionCode ec = 0;
@@ -145,6 +145,21 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     }
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    clear();
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = text;
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
 void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
 {
     ASSERT(!url.isEmpty());
diff --git a/WebCore/platform/win/PlatformScreenWin.cpp b/WebCore/platform/win/PlatformScreenWin.cpp
index 7ac4706..6e0f861 100644
--- a/WebCore/platform/win/PlatformScreenWin.cpp
+++ b/WebCore/platform/win/PlatformScreenWin.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 // Returns info for the default monitor if widget is NULL
 static MONITORINFOEX monitorInfoForWidget(Widget* widget)
 {
-    HWND window = widget ? widget->root()->hostWindow()->platformWindow() : 0;
+    HWND window = widget ? widget->root()->hostWindow()->platformPageClient() : 0;
     HMONITOR monitor = MonitorFromWindow(window, MONITOR_DEFAULTTOPRIMARY);
 
     MONITORINFOEX monitorInfo;
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index e53053f..1d9eb71 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -40,6 +40,7 @@
 #include "SimpleFontData.h"
 #include <tchar.h>
 #include <windows.h>
+#include <windowsx.h>
 #if PLATFORM(WINCE)
 #include <ResDefCE.h>
 #define MAKEPOINTS(l) (*((POINTS FAR *)&(l)))
@@ -60,8 +61,13 @@ const int optionSpacingMiddle = 1;
 const int popupWindowBorderWidth = 1;
 
 static LPCTSTR kPopupWindowClassName = _T("PopupWindowClass");
-static ATOM registerPopup();
-static LRESULT CALLBACK PopupWndProc(HWND, UINT, WPARAM, LPARAM);
+
+// This is used from within our custom message pump when we want to send a
+// message to the web view and not have our message stolen and sent to
+// the popup window.
+static const UINT WM_HOST_WINDOW_FIRST = WM_USER;
+static const UINT WM_HOST_WINDOW_CHAR = WM_USER + WM_CHAR; 
+static const UINT WM_HOST_WINDOW_MOUSEMOVE = WM_USER + WM_MOUSEMOVE;
 
 // FIXME: Remove this as soon as practical.
 static inline bool isASCIIPrintable(unsigned c)
@@ -69,6 +75,15 @@ static inline bool isASCIIPrintable(unsigned c)
     return c >= 0x20 && c <= 0x7E;
 }
 
+static void translatePoint(LPARAM& lParam, HWND from, HWND to)
+{
+    POINT pt;
+    pt.x = (short)GET_X_LPARAM(lParam);
+    pt.y = (short)GET_Y_LPARAM(lParam);    
+    ::MapWindowPoints(from, to, &pt, 1);
+    lParam = MAKELPARAM(pt.x, pt.y);
+}
+
 PopupMenu::PopupMenu(PopupMenuClient* client)
     : m_popupClient(client)
     , m_scrollbar(0)
@@ -81,6 +96,7 @@ PopupMenu::PopupMenu(PopupMenuClient* client)
     , m_wheelDelta(0)
     , m_focusedIndex(0)
     , m_scrollbarCapturingMouse(false)
+    , m_showPopup(false)
 {
 }
 
@@ -92,44 +108,46 @@ PopupMenu::~PopupMenu()
         ::DeleteDC(m_DC);
     if (m_popup)
         ::DestroyWindow(m_popup);
+    if (m_scrollbar)
+        m_scrollbar->setParent(0);
+}
+
+LPCTSTR PopupMenu::popupClassName()
+{
+    return kPopupWindowClassName;
 }
 
-void PopupMenu::show(const IntRect& r, FrameView* v, int index)
+void PopupMenu::show(const IntRect& r, FrameView* view, int index)
 {
-    calculatePositionAndSize(r, v);
+    calculatePositionAndSize(r, view);
     if (clientRect().isEmpty())
         return;
 
+    HWND hostWindow = view->hostWindow()->platformPageClient();
+
+    if (!m_scrollbar && visibleItems() < client()->listSize()) {
+        // We need a scroll bar
+        m_scrollbar = client()->createScrollbar(this, VerticalScrollbar, SmallScrollbar);
+        m_scrollbar->styleChanged();
+    }
+
     if (!m_popup) {
-        registerPopup();
+        registerClass();
 
         DWORD exStyle = WS_EX_LTRREADING;
 
-        // Even though we already know our size and location at this point, we pass (0,0,0,0) as our size/location here.
-        // We need to wait until after the call to ::SetWindowLongPtr to set our size so that in our WM_SIZE handler we can get access to the PopupMenu object
         m_popup = ::CreateWindowEx(exStyle, kPopupWindowClassName, _T("PopupMenu"),
             WS_POPUP | WS_BORDER,
-            0, 0, 0, 0,
-            v->hostWindow()->platformWindow(), 0, 0, 0);
+            m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(),
+            hostWindow, 0, Page::instanceHandle(), this);
 
         if (!m_popup)
             return;
-
-#if PLATFORM(WINCE)
-        ::SetWindowLong(m_popup, 0, (LONG)this);
-#else
-        ::SetWindowLongPtr(m_popup, 0, (LONG_PTR)this);
-#endif
+    } else {
+        // We need to reposition the popup window.
+        ::MoveWindow(m_popup, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), false);
     }
 
-    if (!m_scrollbar)
-        if (visibleItems() < client()->listSize()) {
-            // We need a scroll bar
-            m_scrollbar = client()->createScrollbar(this, VerticalScrollbar, SmallScrollbar);
-        }
-
-    ::SetWindowPos(m_popup, HWND_TOP, m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height(), 0);
-
     // Determine whether we should animate our popups
     // Note: Must use 'BOOL' and 'FALSE' instead of 'bool' and 'false' to avoid stack corruption with SystemParametersInfo
     BOOL shouldAnimate = FALSE;
@@ -138,30 +156,127 @@ void PopupMenu::show(const IntRect& r, FrameView* v, int index)
 
     if (shouldAnimate) {
         RECT viewRect = {0};
-        ::GetWindowRect(v->hostWindow()->platformWindow(), &viewRect);
+        ::GetWindowRect(hostWindow, &viewRect);
 
         if (!::IsRectEmpty(&viewRect)) {
             // Popups should slide into view away from the <select> box
             // NOTE: This may have to change for Vista
-            DWORD slideDirection = (m_windowRect.y() < viewRect.top + v->contentsToWindow(r.location()).y()) ? AW_VER_NEGATIVE : AW_VER_POSITIVE;
+            DWORD slideDirection = (m_windowRect.y() < viewRect.top + view->contentsToWindow(r.location()).y()) ? AW_VER_NEGATIVE : AW_VER_POSITIVE;
 
-            ::AnimateWindow(m_popup, defaultAnimationDuration, AW_SLIDE | slideDirection | AW_ACTIVATE);
+            ::AnimateWindow(m_popup, defaultAnimationDuration, AW_SLIDE | slideDirection);
         }
     } else
 #endif
-        ::ShowWindow(m_popup, SW_SHOWNORMAL);
-    ::SetCapture(m_popup);
+        ::ShowWindow(m_popup, SW_SHOWNOACTIVATE);
 
     if (client()) {
         int index = client()->selectedIndex();
         if (index >= 0)
             setFocusedIndex(index);
     }
+
+    m_showPopup = true;
+
+    // Protect the popup menu in case its owner is destroyed while we're running the message pump.
+    RefPtr<PopupMenu> protect(this);
+
+    ::SetCapture(hostWindow);
+
+    MSG msg;
+    HWND activeWindow;
+
+    while (::GetMessage(&msg, 0, 0, 0)) {
+        switch (msg.message) {
+            case WM_HOST_WINDOW_MOUSEMOVE:
+            case WM_HOST_WINDOW_CHAR: 
+                if (msg.hwnd == m_popup) {
+                    // This message should be sent to the host window.
+                    msg.hwnd = hostWindow;
+                    msg.message -= WM_HOST_WINDOW_FIRST;
+                }
+                break;
+
+            // Steal mouse messages.
+            case WM_NCMOUSEMOVE:
+            case WM_NCLBUTTONDOWN:
+            case WM_NCLBUTTONUP:
+            case WM_NCLBUTTONDBLCLK:
+            case WM_NCRBUTTONDOWN:
+            case WM_NCRBUTTONUP:
+            case WM_NCRBUTTONDBLCLK:
+            case WM_NCMBUTTONDOWN:
+            case WM_NCMBUTTONUP:
+            case WM_NCMBUTTONDBLCLK:
+            case WM_MOUSEWHEEL:
+                msg.hwnd = m_popup;
+                break;
+
+            // These mouse messages use client coordinates so we need to convert them.
+            case WM_MOUSEMOVE:
+            case WM_LBUTTONDOWN:
+            case WM_LBUTTONUP:
+            case WM_LBUTTONDBLCLK:
+            case WM_RBUTTONDOWN:
+            case WM_RBUTTONUP:
+            case WM_RBUTTONDBLCLK:
+            case WM_MBUTTONDOWN:
+            case WM_MBUTTONUP:
+            case WM_MBUTTONDBLCLK: {
+                // Translate the coordinate.
+                translatePoint(msg.lParam, msg.hwnd, m_popup);
+
+                msg.hwnd = m_popup;
+                break;
+            }
+
+            // Steal all keyboard messages.
+            case WM_KEYDOWN:
+            case WM_KEYUP:
+            case WM_CHAR:
+            case WM_DEADCHAR:
+            case WM_SYSKEYUP:
+            case WM_SYSCHAR:
+            case WM_SYSDEADCHAR:
+                msg.hwnd = m_popup;
+                break;
+        }
+
+        ::TranslateMessage(&msg);
+        ::DispatchMessage(&msg);
+
+        if (!m_popupClient)
+            break;
+
+        if (!m_showPopup)
+            break;
+        activeWindow = ::GetActiveWindow();
+        if (activeWindow != hostWindow && !::IsChild(activeWindow, hostWindow))
+            break;
+        if (::GetCapture() != hostWindow)
+            break;
+    }
+
+    if (::GetCapture() == hostWindow)
+        ::ReleaseCapture();
+
+    // We're done, hide the popup if necessary.
+    hide();
 }
 
 void PopupMenu::hide()
 {
+    if (!m_showPopup)
+        return;
+
+    m_showPopup = false;
+
     ::ShowWindow(m_popup, SW_HIDE);
+
+    if (client())
+        client()->popupDidHide();
+
+    // Post a WM_NULL message to wake up the message pump if necessary.
+    ::PostMessage(m_popup, WM_NULL, 0, 0);
 }
 
 const int endOfLinePadding = 2;
@@ -174,7 +289,7 @@ void PopupMenu::calculatePositionAndSize(const IntRect& r, FrameView* v)
 
     // Then, translate to screen coordinates
     POINT location(rScreenCoords.location());
-    if (!::ClientToScreen(v->hostWindow()->platformWindow(), &location))
+    if (!::ClientToScreen(v->hostWindow()->platformPageClient(), &location))
         return;
 
     rScreenCoords.setLocation(location);
@@ -591,12 +706,12 @@ void PopupMenu::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rec
     ::InvalidateRect(m_popup, &r, false);
 }
 
-static ATOM registerPopup()
+void PopupMenu::registerClass()
 {
     static bool haveRegisteredWindowClass = false;
 
     if (haveRegisteredWindowClass)
-        return true;
+        return;
 
 #if PLATFORM(WINCE)
     WNDCLASS wcex;
@@ -607,7 +722,7 @@ static ATOM registerPopup()
     wcex.style          = CS_DROPSHADOW;
 #endif
 
-    wcex.lpfnWndProc    = PopupWndProc;
+    wcex.lpfnWndProc    = PopupMenuWndProc;
     wcex.cbClsExtra     = 0;
     wcex.cbWndExtra     = sizeof(PopupMenu*); // For the PopupMenu pointer
     wcex.hInstance      = Page::instanceHandle();
@@ -620,228 +735,262 @@ static ATOM registerPopup()
     haveRegisteredWindowClass = true;
 
 #if PLATFORM(WINCE)
-    return ::RegisterClass(&wcex);
+    RegisterClass(&wcex);
 #else
-    return ::RegisterClassEx(&wcex);
+    RegisterClassEx(&wcex);
 #endif
 }
 
-const int smoothScrollAnimationDuration = 5000;
-static LRESULT CALLBACK PopupWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+
+LRESULT CALLBACK PopupMenu::PopupMenuWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
-    LRESULT lResult = 0;
 #if PLATFORM(WINCE)
     LONG longPtr = GetWindowLong(hWnd, 0);
 #else
     LONG_PTR longPtr = GetWindowLongPtr(hWnd, 0);
 #endif
-    PopupMenu* popup = reinterpret_cast<PopupMenu*>(longPtr);
+    
+    if (PopupMenu* popup = reinterpret_cast<PopupMenu*>(longPtr))
+        return popup->wndProc(hWnd, message, wParam, lParam);
+    
+    if (message == WM_CREATE) {
+        LPCREATESTRUCT createStruct = reinterpret_cast<LPCREATESTRUCT>(lParam);
+
+        // Associate the PopupMenu with the window.
+#if PLATFORM(WINCE)
+        ::SetWindowLong(hWnd, 0, (LONG)createStruct->lpCreateParams);
+#else
+        ::SetWindowLongPtr(hWnd, 0, (LONG_PTR)createStruct->lpCreateParams);
+#endif
+        return 0;
+    }
+
+    return ::DefWindowProc(hWnd, message, wParam, lParam);
+}
+
+const int smoothScrollAnimationDuration = 5000;
+
+LRESULT PopupMenu::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    LRESULT lResult = 0;
 
     switch (message) {
-        case WM_SIZE:
-            if (popup && popup->scrollbar()) {
-                IntSize size(LOWORD(lParam), HIWORD(lParam));
-                popup->scrollbar()->setFrameRect(IntRect(size.width() - popup->scrollbar()->width(), 0, popup->scrollbar()->width(), size.height()));
-
-                int visibleItems = popup->visibleItems();
-                popup->scrollbar()->setEnabled(visibleItems < popup->client()->listSize());
-                popup->scrollbar()->setSteps(1, max(1, visibleItems - 1));
-                popup->scrollbar()->setProportion(visibleItems, popup->client()->listSize());
-            }
-            break;
-        case WM_ACTIVATE:
-            if (popup && popup->client() && wParam == WA_INACTIVE)
-                popup->client()->hidePopup();
-            break;
-        case WM_KILLFOCUS:
-            if (popup && popup->client() && (HWND)wParam != popup->popupHandle())
-                // Focus is going elsewhere, so hide
-                popup->client()->hidePopup();
+        case WM_MOUSEACTIVATE:
+            return MA_NOACTIVATE;
+
+        case WM_SIZE: {
+            if (!scrollbar())
+                break;
+
+            IntSize size(LOWORD(lParam), HIWORD(lParam));
+            scrollbar()->setFrameRect(IntRect(size.width() - scrollbar()->width(), 0, scrollbar()->width(), size.height()));
+
+            int visibleItems = this->visibleItems();
+            scrollbar()->setEnabled(visibleItems < client()->listSize());
+            scrollbar()->setSteps(1, max(1, visibleItems - 1));
+            scrollbar()->setProportion(visibleItems, client()->listSize());
+
             break;
+        }
         case WM_KEYDOWN:
-            if (popup && popup->client()) {
-                lResult = 0;
-                switch (LOWORD(wParam)) {
-                    case VK_DOWN:
-                    case VK_RIGHT:
-                        popup->down();
-                        break;
-                    case VK_UP:
-                    case VK_LEFT:
-                        popup->up();
-                        break;
-                    case VK_HOME:
-                        popup->focusFirst();
-                        break;
-                    case VK_END:
-                        popup->focusLast();
-                        break;
-                    case VK_PRIOR:
-                        if (popup->focusedIndex() != popup->scrollOffset()) {
-                            // Set the selection to the first visible item
-                            int firstVisibleItem = popup->scrollOffset();
-                            popup->up(popup->focusedIndex() - firstVisibleItem);
-                        } else
-                            // The first visible item is selected, so move the selection back one page
-                            popup->up(popup->visibleItems());
-                        break;
-                    case VK_NEXT:
-                        if (popup) {
-                            int lastVisibleItem = popup->scrollOffset() + popup->visibleItems() - 1;
-                            if (popup->focusedIndex() != lastVisibleItem) {
-                                // Set the selection to the last visible item
-                                popup->down(lastVisibleItem - popup->focusedIndex());
-                            } else
-                                // The last visible item is selected, so move the selection forward one page
-                                popup->down(popup->visibleItems());
-                        }
-                        break;
-                    case VK_TAB:
-                        ::SendMessage(popup->client()->hostWindow()->platformWindow(), message, wParam, lParam);
-                        popup->client()->hidePopup();
-                        break;
-                    case VK_ESCAPE:
-                        popup->client()->hidePopup();
-                        break;
-                    default:
-                        if (isASCIIPrintable(wParam))
-                            // Send the keydown to the WebView so it can be used for type-to-select.
-                            ::PostMessage(popup->client()->hostWindow()->platformWindow(), message, wParam, lParam);
-                        else
-                            lResult = 1;
-                        break;
+            if (!client())
+                break;
+
+            lResult = 0;
+            switch (LOWORD(wParam)) {
+                case VK_DOWN:
+                case VK_RIGHT:
+                    down();
+                    break;
+                case VK_UP:
+                case VK_LEFT:
+                    up();
+                    break;
+                case VK_HOME:
+                    focusFirst();
+                    break;
+                case VK_END:
+                    focusLast();
+                    break;
+                case VK_PRIOR:
+                    if (focusedIndex() != scrollOffset()) {
+                        // Set the selection to the first visible item
+                        int firstVisibleItem = scrollOffset();
+                        up(focusedIndex() - firstVisibleItem);
+                    } else {
+                        // The first visible item is selected, so move the selection back one page
+                        up(visibleItems());
+                    }
+                    break;
+                case VK_NEXT: {
+                    int lastVisibleItem = scrollOffset() + visibleItems() - 1;
+                    if (focusedIndex() != lastVisibleItem) {
+                        // Set the selection to the last visible item
+                        down(lastVisibleItem - focusedIndex());
+                    } else {
+                        // The last visible item is selected, so move the selection forward one page
+                        down(visibleItems());
+                    }
+                    break;
                 }
+                case VK_TAB:
+                    ::SendMessage(client()->hostWindow()->platformPageClient(), message, wParam, lParam);
+                    hide();
+                    break;
+                case VK_ESCAPE:
+                    hide();
+                    break;
+                default:
+                    if (isASCIIPrintable(wParam))
+                        // Send the keydown to the WebView so it can be used for type-to-select.
+                        // Since we know that the virtual key is ASCII printable, it's OK to convert this to
+                        // a WM_CHAR message. (We don't want to call TranslateMessage because that will post a
+                        // WM_CHAR message that will be stolen and redirected to the popup HWND.
+                        ::PostMessage(m_popup, WM_HOST_WINDOW_CHAR, wParam, lParam);
+                    else
+                        lResult = 1;
+                    break;
             }
             break;
-        case WM_CHAR:
-            if (popup && popup->client()) {
-                lResult = 0;
-                int index;
-                switch (wParam) {
-                    case 0x0D:   // Enter/Return
-                        popup->client()->hidePopup();
-                        index = popup->focusedIndex();
-                        ASSERT(index >= 0);
-                        popup->client()->valueChanged(index);
-                        break;
-                    case 0x1B:   // Escape
-                        popup->client()->hidePopup();
-                        break;
-                    case 0x09:   // TAB
-                    case 0x08:   // Backspace
-                    case 0x0A:   // Linefeed
-                    default:     // Character
-                        lResult = 1;
-                        break;
-                }
+        case WM_CHAR: {
+            if (!client())
+                break;
+
+            lResult = 0;
+            int index;
+            switch (wParam) {
+                case 0x0D:   // Enter/Return
+                    hide();
+                    index = focusedIndex();
+                    ASSERT(index >= 0);
+                    client()->valueChanged(index);
+                    break;
+                case 0x1B:   // Escape
+                    hide();
+                    break;
+                case 0x09:   // TAB
+                case 0x08:   // Backspace
+                case 0x0A:   // Linefeed
+                default:     // Character
+                    lResult = 1;
+                    break;
             }
             break;
-        case WM_MOUSEMOVE:
-            if (popup) {
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (popup->scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseMoved(event);
-                        break;
-                    }
+        }
+        case WM_MOUSEMOVE: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseMoved(event);
+                    break;
                 }
+            }
 
-                BOOL shouldHotTrack = FALSE;
+            BOOL shouldHotTrack = FALSE;
 #if !PLATFORM(WINCE)
-                ::SystemParametersInfo(SPI_GETHOTTRACKING, 0, &shouldHotTrack, 0);
+            ::SystemParametersInfo(SPI_GETHOTTRACKING, 0, &shouldHotTrack, 0);
 #endif
 
-                RECT bounds;
-                GetClientRect(popup->popupHandle(), &bounds);
-                if ((shouldHotTrack || wParam & MK_LBUTTON) && ::PtInRect(&bounds, mousePoint))
-                    popup->setFocusedIndex(popup->listIndexAtPoint(mousePoint), true);
+            RECT bounds;
+            GetClientRect(popupHandle(), &bounds);
+            if (!::PtInRect(&bounds, mousePoint) && !(wParam & MK_LBUTTON) && client()) {
+                // When the mouse is not inside the popup menu and the left button isn't down, just
+                // repost the message to the web view.
 
-                // Release capture if the left button isn't down, and the mousePoint is outside the popup window.
-                // This way, the WebView will get future mouse events in the rest of the window.
-                if (!(wParam & MK_LBUTTON) && !::PtInRect(&bounds, mousePoint)) {
-                    ::ReleaseCapture();
-                    break;
-                }
+                // Translate the coordinate.
+                translatePoint(lParam, m_popup, client()->hostWindow()->platformPageClient());
+
+                ::PostMessage(m_popup, WM_HOST_WINDOW_MOUSEMOVE, wParam, lParam);
+                break;
             }
+
+            if ((shouldHotTrack || wParam & MK_LBUTTON) && ::PtInRect(&bounds, mousePoint))
+                setFocusedIndex(listIndexAtPoint(mousePoint), true);
+
             break;
-        case WM_LBUTTONDOWN:
-            if (popup) {
-                ::SetCapture(popup->popupHandle());
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (scrollBarRect.contains(mousePoint)) {
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseDown(event);
-                        popup->setScrollbarCapturingMouse(true);
-                        break;
-                    }
+        }
+        case WM_LBUTTONDOWN: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollBarRect.contains(mousePoint)) {
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseDown(event);
+                    setScrollbarCapturingMouse(true);
+                    break;
                 }
-
-                popup->setFocusedIndex(popup->listIndexAtPoint(mousePoint), true);
             }
+
+            // If the mouse is inside the window, update the focused index. Otherwise, 
+            // hide the popup.
+            RECT bounds;
+            GetClientRect(m_popup, &bounds);
+            if (::PtInRect(&bounds, mousePoint))
+                setFocusedIndex(listIndexAtPoint(mousePoint), true);
+            else
+                hide();
             break;
-        case WM_LBUTTONUP:
-            if (popup) {
-                IntPoint mousePoint(MAKEPOINTS(lParam));
-                if (popup->scrollbar()) {
-                    ::ReleaseCapture();
-                    IntRect scrollBarRect = popup->scrollbar()->frameRect();
-                    if (popup->scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
-                        popup->setScrollbarCapturingMouse(false);
-                        // Put the point into coordinates relative to the scroll bar
-                        mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
-                        PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
-                        popup->scrollbar()->mouseUp();
-                        // FIXME: This is a hack to work around Scrollbar not invalidating correctly when it doesn't have a parent widget
-                        RECT r = scrollBarRect;
-                        ::InvalidateRect(popup->popupHandle(), &r, TRUE);
-                        break;
-                    }
-                }
-                // Only release capture and hide the popup if the mouse is inside the popup window.
-                RECT bounds;
-                GetClientRect(popup->popupHandle(), &bounds);
-                if (popup->client() && ::PtInRect(&bounds, mousePoint)) {
-                    ::ReleaseCapture();
-                    popup->client()->hidePopup();
-                    int index = popup->focusedIndex();
-                    if (index >= 0)
-                        popup->client()->valueChanged(index);
+        }
+        case WM_LBUTTONUP: {
+            IntPoint mousePoint(MAKEPOINTS(lParam));
+            if (scrollbar()) {
+                IntRect scrollBarRect = scrollbar()->frameRect();
+                if (scrollbarCapturingMouse() || scrollBarRect.contains(mousePoint)) {
+                    setScrollbarCapturingMouse(false);
+                    // Put the point into coordinates relative to the scroll bar
+                    mousePoint.move(-scrollBarRect.x(), -scrollBarRect.y());
+                    PlatformMouseEvent event(hWnd, message, wParam, MAKELPARAM(mousePoint.x(), mousePoint.y()));
+                    scrollbar()->mouseUp();
+                    // FIXME: This is a hack to work around Scrollbar not invalidating correctly when it doesn't have a parent widget
+                    RECT r = scrollBarRect;
+                    ::InvalidateRect(popupHandle(), &r, TRUE);
+                    break;
                 }
             }
+            // Only hide the popup if the mouse is inside the popup window.
+            RECT bounds;
+            GetClientRect(popupHandle(), &bounds);
+            if (client() && ::PtInRect(&bounds, mousePoint)) {
+                hide();
+                int index = focusedIndex();
+                if (index >= 0)
+                    client()->valueChanged(index);
+            }
             break;
-        case WM_MOUSEWHEEL:
-            if (popup && popup->scrollbar()) {
-                int i = 0;
-                for (popup->incrementWheelDelta(GET_WHEEL_DELTA_WPARAM(wParam)); abs(popup->wheelDelta()) >= WHEEL_DELTA; popup->reduceWheelDelta(WHEEL_DELTA))
-                    if (popup->wheelDelta() > 0)
-                        ++i;
-                    else
-                        --i;
+        }
+
+        case WM_MOUSEWHEEL: {
+            if (!scrollbar())
+                break;
 
-                popup->scrollbar()->scroll(i > 0 ? ScrollUp : ScrollDown, ScrollByLine, abs(i));
+            int i = 0;
+            for (incrementWheelDelta(GET_WHEEL_DELTA_WPARAM(wParam)); abs(wheelDelta()) >= WHEEL_DELTA; reduceWheelDelta(WHEEL_DELTA)) {
+                if (wheelDelta() > 0)
+                    ++i;
+                else
+                    --i;
             }
+            scrollbar()->scroll(i > 0 ? ScrollUp : ScrollDown, ScrollByLine, abs(i));
             break;
-        case WM_PAINT:
-            if (popup) {
-                PAINTSTRUCT paintInfo;
-                ::BeginPaint(popup->popupHandle(), &paintInfo);
-                popup->paint(paintInfo.rcPaint, paintInfo.hdc);
-                ::EndPaint(popup->popupHandle(), &paintInfo);
-                lResult = 0;
-            }
+        }
+
+        case WM_PAINT: {
+            PAINTSTRUCT paintInfo;
+            ::BeginPaint(popupHandle(), &paintInfo);
+            paint(paintInfo.rcPaint, paintInfo.hdc);
+            ::EndPaint(popupHandle(), &paintInfo);
+            lResult = 0;
             break;
+        }
 #if !PLATFORM(WINCE)
         case WM_PRINTCLIENT:
-            if (popup)
-                popup->paint(popup->clientRect(), (HDC)wParam);
+            paint(clientRect(), (HDC)wParam);
             break;
 #endif
         default:
diff --git a/WebCore/platform/win/SharedBufferWin.cpp b/WebCore/platform/win/SharedBufferWin.cpp
index ce93402..1839c99 100644
--- a/WebCore/platform/win/SharedBufferWin.cpp
+++ b/WebCore/platform/win/SharedBufferWin.cpp
@@ -38,8 +38,8 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
 
     String nullifiedPath = filePath;
     FILE* fileDescriptor = 0;
-    if (_wfopen_s(&fileDescriptor, nullifiedPath.charactersWithNullTermination(), TEXT("r+b")) || !fileDescriptor) {
-        LOG_ERROR("Failed to open file %s to create shared buffer", filePath.ascii().data());
+    if (_wfopen_s(&fileDescriptor, nullifiedPath.charactersWithNullTermination(), TEXT("rb")) || !fileDescriptor) {
+        LOG_ERROR("Failed to open file %s to create shared buffer, errno(%i)", filePath.ascii().data(), errno);
         return 0;
     }
 
diff --git a/WebCore/platform/win/SharedTimerWin.cpp b/WebCore/platform/win/SharedTimerWin.cpp
index da27a53..bc634f9 100644
--- a/WebCore/platform/win/SharedTimerWin.cpp
+++ b/WebCore/platform/win/SharedTimerWin.cpp
@@ -27,6 +27,7 @@
 #include "SharedTimer.h"
 
 #include "Page.h"
+#include "Settings.h"
 #include "Widget.h"
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
@@ -160,35 +161,38 @@ void setSharedTimerFireTime(double fireTime)
             intervalInMS = (unsigned)interval;
     }
 
-    if (interval < highResolutionThresholdMsec) {
-        if (!highResTimerActive) {
-            highResTimerActive = true;
-            timeBeginPeriod(timerResolution);
-        }
-        SetTimer(timerWindowHandle, endHighResTimerID, stopHighResTimerInMsec, 0);
-    }
-
     initializeOffScreenTimerWindow();
     bool timerSet = false;
-    DWORD queueStatus = LOWORD(GetQueueStatus(QS_PAINT | QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT));
-
-    // Win32 has a tri-level queue with application messages > user input > WM_PAINT/WM_TIMER.
-
-    // If the queue doesn't contains input events, we use a higher priorty timer event posting mechanism.
-    if (!(queueStatus & (QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT))) {
-        if (intervalInMS < USER_TIMER_MINIMUM && !processingCustomTimerMessage && !(queueStatus & QS_PAINT)) {
-            // Call PostMessage immediately if the timer is already expired, unless a paint is pending.
-            // (we prioritize paints over timers)
-            if (InterlockedIncrement(&pendingTimers) == 1)
-                PostMessage(timerWindowHandle, timerFiredMessage, 0, 0);
-            timerSet = true;
-        } else {
-            // Otherwise, delay the PostMessage via a CreateTimerQueueTimer
-            if (!timerQueue)
-                timerQueue = CreateTimerQueue();
-            if (timer)
-                DeleteTimerQueueTimer(timerQueue, timer, 0);
-            timerSet = CreateTimerQueueTimer(&timer, timerQueue, queueTimerProc, 0, intervalInMS, 0, WT_EXECUTEINTIMERTHREAD | WT_EXECUTEONLYONCE);
+
+    if (Settings::shouldUseHighResolutionTimers()) {
+        if (interval < highResolutionThresholdMsec) {
+            if (!highResTimerActive) {
+                highResTimerActive = true;
+                timeBeginPeriod(timerResolution);
+            }
+            SetTimer(timerWindowHandle, endHighResTimerID, stopHighResTimerInMsec, 0);
+        }
+
+        DWORD queueStatus = LOWORD(GetQueueStatus(QS_PAINT | QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT));
+
+        // Win32 has a tri-level queue with application messages > user input > WM_PAINT/WM_TIMER.
+
+        // If the queue doesn't contains input events, we use a higher priorty timer event posting mechanism.
+        if (!(queueStatus & (QS_MOUSEBUTTON | QS_KEY | QS_RAWINPUT))) {
+            if (intervalInMS < USER_TIMER_MINIMUM && !processingCustomTimerMessage && !(queueStatus & QS_PAINT)) {
+                // Call PostMessage immediately if the timer is already expired, unless a paint is pending.
+                // (we prioritize paints over timers)
+                if (InterlockedIncrement(&pendingTimers) == 1)
+                    PostMessage(timerWindowHandle, timerFiredMessage, 0, 0);
+                timerSet = true;
+            } else {
+                // Otherwise, delay the PostMessage via a CreateTimerQueueTimer
+                if (!timerQueue)
+                    timerQueue = CreateTimerQueue();
+                if (timer)
+                    DeleteTimerQueueTimer(timerQueue, timer, 0);
+                timerSet = CreateTimerQueueTimer(&timer, timerQueue, queueTimerProc, 0, intervalInMS, 0, WT_EXECUTEINTIMERTHREAD | WT_EXECUTEONLYONCE);
+            }
         }
     }
 
diff --git a/WebCore/platform/wince/CursorWince.cpp b/WebCore/platform/wince/CursorWince.cpp
new file mode 100644
index 0000000..e35f1f9
--- /dev/null
+++ b/WebCore/platform/wince/CursorWince.cpp
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "Cursor.h"
+
+namespace WebCore {
+
+struct AllCursors {
+    AllCursors()
+    {
+        for (int i = 0; i < NumCursorTypes; ++i)
+            m_cursors[i] = (CursorType) i;
+    }
+    Cursor m_cursors[NumCursorTypes];
+};
+
+static const Cursor& getCursor(CursorType type)
+{
+    static AllCursors allCursors;
+    return allCursors.m_cursors[type];
+}
+
+Cursor::Cursor(const Cursor& other)
+: m_impl(other.m_impl)
+{
+}
+
+Cursor::Cursor(Image* img, const IntPoint& hotspot)
+: m_impl(CursorNone)
+{
+}
+
+Cursor::~Cursor()
+{
+}
+
+Cursor& Cursor::operator=(const Cursor& other)
+{
+    m_impl = other.m_impl;
+    return *this;
+}
+
+Cursor::Cursor(PlatformCursor c)
+: m_impl(c)
+{
+}
+
+const Cursor& noneCursor() { return getCursor(CursorNone); }
+const Cursor& pointerCursor() { return getCursor(CursorPointer); }
+const Cursor& crossCursor()  { return getCursor(CursorCross); }
+const Cursor& handCursor() { return getCursor(CursorHand); }
+const Cursor& iBeamCursor() { return getCursor(CursorBeam); }
+const Cursor& waitCursor() { return getCursor(CursorWait); }
+const Cursor& helpCursor() { return getCursor(CursorHelp); }
+const Cursor& moveCursor()  { return getCursor(CursorMove); }
+const Cursor& eastResizeCursor() { return getCursor(CursorEastResize); }
+const Cursor& northResizeCursor() { return getCursor(CursorNorthResize); }
+const Cursor& northEastResizeCursor() { return getCursor(CursorNorthEastResize); }
+const Cursor& northWestResizeCursor() { return getCursor(CursorNorthWestResize); }
+const Cursor& southResizeCursor() { return getCursor(CursorSouthResize); }
+const Cursor& southEastResizeCursor() { return getCursor(CursorSouthEastResize); }
+const Cursor& southWestResizeCursor() { return getCursor(CursorSouthWestResize); }
+const Cursor& westResizeCursor() { return getCursor(CursorWestResize); }
+const Cursor& northSouthResizeCursor() { return getCursor(CursorNorthSouthResize); }
+const Cursor& eastWestResizeCursor() { return getCursor(CursorEastWestResize); }
+const Cursor& northEastSouthWestResizeCursor() { return getCursor(CursorNorthEastSouthWestResize); }
+const Cursor& northWestSouthEastResizeCursor() { return getCursor(CursorNorthWestSouthEastResize); }
+const Cursor& columnResizeCursor() { return getCursor(CursorColumnResize); }
+const Cursor& rowResizeCursor() { return getCursor(CursorRowResize); }
+const Cursor& verticalTextCursor() { return getCursor(CursorVerticalText); }
+const Cursor& cellCursor() { return getCursor(CursorCell); }
+const Cursor& contextMenuCursor() { return getCursor(CursorContextMenu); }
+const Cursor& noDropCursor() { return getCursor(CursorNoDrop); }
+const Cursor& notAllowedCursor() { return getCursor(CursorNotAllowed); }
+const Cursor& progressCursor() { return getCursor(CursorProgress); }
+const Cursor& aliasCursor() { return getCursor(CursorAlias); }
+const Cursor& zoomInCursor() { return getCursor(CursorZoomIn); }
+const Cursor& zoomOutCursor() { return getCursor(CursorZoomOut); }
+const Cursor& copyCursor() { return getCursor(CursorCopy); }
+const Cursor& middlePanningCursor() { return crossCursor(); }
+const Cursor& eastPanningCursor() { return crossCursor(); }
+const Cursor& northPanningCursor() { return crossCursor(); }
+const Cursor& northEastPanningCursor() { return crossCursor(); }
+const Cursor& northWestPanningCursor() { return crossCursor(); }
+const Cursor& southPanningCursor() { return crossCursor(); }
+const Cursor& southEastPanningCursor() { return crossCursor(); }
+const Cursor& southWestPanningCursor() { return crossCursor(); }
+const Cursor& westPanningCursor() { return crossCursor(); }
+const Cursor& grabbingCursor() { return moveCursor(); }
+const Cursor& grabCursor() { return moveCursor(); }
+
+}
diff --git a/WebCore/platform/wince/DragDataWince.cpp b/WebCore/platform/wince/DragDataWince.cpp
new file mode 100644
index 0000000..881d7d4
--- /dev/null
+++ b/WebCore/platform/wince/DragDataWince.cpp
@@ -0,0 +1,90 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "DragData.h"
+
+#include "Clipboard.h"
+#include "DocumentFragment.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) const
+{
+    return 0;
+}
+
+bool DragData::containsURL() const
+{
+    return false;
+}
+
+String DragData::asURL(String* title) const
+{
+    return String();
+}
+
+bool DragData::containsFiles() const
+{
+    return false;
+}
+
+void DragData::asFilenames(Vector<String>&) const
+{
+}
+
+bool DragData::containsPlainText() const
+{
+    return false;
+}
+
+String DragData::asPlainText() const
+{
+    return String();
+}
+
+bool DragData::containsColor() const
+{
+    return false;
+}
+
+bool DragData::canSmartReplace() const
+{
+    return false;
+}
+
+bool DragData::containsCompatibleContent() const
+{
+    return false;
+}
+
+PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
+{
+     return 0;
+}
+
+Color DragData::asColor() const
+{
+    return Color();
+}
+
+}
+
diff --git a/WebCore/platform/wince/DragImageWince.cpp b/WebCore/platform/wince/DragImageWince.cpp
new file mode 100644
index 0000000..4d60f80
--- /dev/null
+++ b/WebCore/platform/wince/DragImageWince.cpp
@@ -0,0 +1,63 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "DragImage.h"
+
+#include "CachedImage.h"
+#include "GraphicsContext.h"
+#include "Image.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+IntSize dragImageSize(DragImageRef)
+{
+    return IntSize(0, 0);
+}
+
+void deleteDragImage(DragImageRef image)
+{
+    if (image)
+        ::DeleteObject(image);
+}
+
+DragImageRef scaleDragImage(DragImageRef, FloatSize)
+{
+    return 0;
+}
+
+DragImageRef dissolveDragImageToFraction(DragImageRef image, float)
+{
+    return image;
+}
+
+DragImageRef createDragImageFromImage(Image*)
+{
+    return 0;
+}
+
+DragImageRef createDragImageIconForCachedImage(CachedImage*)
+{
+    return 0;
+}
+
+}
diff --git a/WebCore/platform/wince/EditorWince.cpp b/WebCore/platform/wince/EditorWince.cpp
new file mode 100644
index 0000000..02af780
--- /dev/null
+++ b/WebCore/platform/wince/EditorWince.cpp
@@ -0,0 +1,43 @@
+/*
+ *  Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#include "Editor.h"
+
+#include "ClipboardWince.h"
+#include "Document.h"
+#include "EditorClient.h"
+#include "Element.h"
+#include "HtmlEditing.h"
+#include "TextIterator.h"
+#include "visible_units.h"
+
+#include <windows.h>
+#define _SYS_GUID_OPERATORS_
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+{
+    return adoptRef(new ClipboardWince(policy, false));
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/FileChooserWince.cpp b/WebCore/platform/wince/FileChooserWince.cpp
new file mode 100644
index 0000000..07c99b1
--- /dev/null
+++ b/WebCore/platform/wince/FileChooserWince.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FileChooser.h"
+
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "Document.h"
+#include "Frame.h"
+#include "Icon.h"
+#include "LocalizedStrings.h"
+#include "Page.h"
+#include "StringTruncator.h"
+
+namespace WebCore {
+
+String pathGetFileName(const String& path);
+
+String FileChooser::basenameForWidth(const Font& font, int width) const
+{
+    if (width <= 0)
+        return String();
+
+    String string;
+    if (m_filenames.isEmpty())
+        string = fileButtonNoFileSelectedLabel();
+    else if (m_filenames.size() == 1) {
+        String tmpFilename = m_filenames[0];
+        string = pathGetFileName(tmpFilename);
+    } else
+        return StringTruncator::rightTruncate(String::number(m_filenames.size()) + " files", width, font, false);
+
+    return StringTruncator::centerTruncate(string, width, font, false);
+}
+
+}
diff --git a/WebCore/platform/wince/FileSystemWince.cpp b/WebCore/platform/wince/FileSystemWince.cpp
new file mode 100644
index 0000000..2bb4dd5
--- /dev/null
+++ b/WebCore/platform/wince/FileSystemWince.cpp
@@ -0,0 +1,283 @@
+/*
+ * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Collabora, Ltd. All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileSystem.h"
+
+#include "CString.h"
+#include "PlatformString.h"
+
+#include <windows.h>
+#include <wincrypt.h>
+
+namespace WebCore {
+
+static bool getFileInfo(const String& path, BY_HANDLE_FILE_INFORMATION& fileInfo)
+{
+    String filename = path;
+    HANDLE hFile = CreateFile(filename.charactersWithNullTermination(), GENERIC_READ, FILE_SHARE_READ, 0
+        , OPEN_EXISTING, FILE_FLAG_NO_BUFFERING, 0);
+
+    if (hFile == INVALID_HANDLE_VALUE)
+        return false;
+
+    bool rtn = GetFileInformationByHandle(hFile, &fileInfo) ? true : false;
+
+    CloseHandle(hFile);
+    return rtn;
+}
+
+bool getFileSize(const String& path, long long& result)
+{
+    BY_HANDLE_FILE_INFORMATION fileInformation;
+    if (!getFileInfo(path, fileInformation))
+        return false;
+
+    ULARGE_INTEGER fileSize;
+    fileSize.LowPart = fileInformation.nFileSizeLow;
+    fileSize.HighPart = fileInformation.nFileSizeHigh;
+
+    result = fileSize.QuadPart;
+
+    return true;
+}
+
+bool getFileModificationTime(const String& path, time_t& result)
+{
+    BY_HANDLE_FILE_INFORMATION fileInformation;
+    if (!getFileInfo(path, fileInformation))
+        return false;
+
+    ULARGE_INTEGER t;
+    memcpy(&t, &fileInformation.ftLastWriteTime, sizeof(t));
+    
+    result = t.QuadPart * 0.0000001 - 11644473600.0;
+
+    return true;
+}
+
+bool fileExists(const String& path) 
+{
+    String filename = path;
+    HANDLE hFile = CreateFile(filename.charactersWithNullTermination(), 0, FILE_SHARE_READ | FILE_SHARE_WRITE
+        , 0, OPEN_EXISTING, FILE_FLAG_NO_BUFFERING, 0);
+
+    CloseHandle(hFile);
+
+    return hFile != INVALID_HANDLE_VALUE;
+}
+
+bool deleteFile(const String& path)
+{
+    String filename = path;
+    return !!DeleteFileW(filename.charactersWithNullTermination());
+}
+
+
+bool deleteEmptyDirectory(const String& path)
+{
+    String filename = path;
+    return !!RemoveDirectoryW(filename.charactersWithNullTermination());
+}
+
+String pathByAppendingComponent(const String& path, const String& component)
+{
+    if (component.isEmpty())
+        return path;
+
+    Vector<UChar, MAX_PATH> buffer;
+
+    buffer.append(path.characters(), path.length());
+
+    if (buffer.last() != L'\\' && buffer.last() != L'/'
+        && component[0] != L'\\' && component[0] != L'/')
+        buffer.append(L'\\');
+
+    buffer.append(component.characters(), component.length());
+
+    return String(buffer.data(), buffer.size());
+}
+
+CString fileSystemRepresentation(const String&)
+{
+    return "";
+}
+
+bool makeAllDirectories(const String& path)
+{
+    int lastDivPos = max(path.reverseFind('/'), path.reverseFind('\\'));
+    int endPos = path.length();
+    if (lastDivPos == path.length() - 1) {
+        endPos -= 1;
+        lastDivPos = max(path.reverseFind('/', lastDivPos), path.reverseFind('\\', lastDivPos));
+    }
+
+    if (lastDivPos > 0) {
+        if (!makeAllDirectories(path.substring(0, lastDivPos)))
+            return false;
+    }
+
+    String folder(path.substring(0, endPos));
+    CreateDirectory(folder.charactersWithNullTermination(), 0);
+
+    DWORD fileAttr = GetFileAttributes(folder.charactersWithNullTermination());
+    return fileAttr != 0xFFFFFFFF && (fileAttr & FILE_ATTRIBUTE_DIRECTORY);
+}
+
+String homeDirectoryPath()
+{
+    notImplemented();
+    return "";
+}
+
+String pathGetFileName(const String& path)
+{
+    return path.substring(max(path.reverseFind('/'), path.reverseFind('\\')) + 1);
+}
+
+String directoryName(const String& path)
+{
+    notImplemented();
+    return String();
+}
+
+CString openTemporaryFile(const char*, PlatformFileHandle& handle)
+{
+    handle = INVALID_HANDLE_VALUE;
+
+    wchar_t tempPath[MAX_PATH];
+    int tempPathLength = ::GetTempPath(_countof(tempPath), tempPath);
+    if (tempPathLength <= 0 || tempPathLength > _countof(tempPath))
+        return CString();
+
+    HCRYPTPROV hCryptProv = 0;
+    if (!CryptAcquireContext(&hCryptProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
+        return CString();
+
+    String proposedPath;
+    while (1) {
+
+        wchar_t tempFile[] = L"XXXXXXXX.tmp"; // Use 8.3 style name (more characters aren't helpful due to 8.3 short file names)
+        const int randomPartLength = 8;
+        if (!CryptGenRandom(hCryptProv, randomPartLength * 2, reinterpret_cast<BYTE*>(tempFile)))
+            break;
+
+        // Limit to valid filesystem characters, also excluding others that could be problematic, like punctuation.
+        // don't include both upper and lowercase since Windows file systems are typically not case sensitive.
+        const char validChars[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+        for (int i = 0; i < randomPartLength; ++i)
+            tempFile[i] = validChars[tempFile[i] % (sizeof(validChars) - 1)];
+
+        ASSERT(wcslen(tempFile) * 2 == sizeof(tempFile) - 2);
+
+        proposedPath = pathByAppendingComponent(String(tempPath), String(tempFile));
+
+        // use CREATE_NEW to avoid overwriting an existing file with the same name
+        handle = CreateFile(proposedPath.charactersWithNullTermination(), GENERIC_READ | GENERIC_WRITE, 0, 0, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, 0);
+        if (!isHandleValid(handle) && GetLastError() == ERROR_ALREADY_EXISTS)
+            continue;
+
+        break;
+    }
+
+    CryptReleaseContext(hCryptProv, 0);
+
+    if (!isHandleValid(handle))
+        return CString();
+
+    return proposedPath.latin1();
+}
+
+void closeFile(PlatformFileHandle& handle)
+{
+    if (isHandleValid(handle)) {
+        ::CloseHandle(handle);
+        handle = invalidPlatformFileHandle;
+    }
+}
+
+int writeToFile(PlatformFileHandle handle, const char* data, int length)
+{
+    if (!isHandleValid(handle))
+        return -1;
+
+    DWORD bytesWritten;
+    bool success = WriteFile(handle, data, length, &bytesWritten, 0);
+
+    if (!success)
+        return -1;
+    return static_cast<int>(bytesWritten);
+}
+
+bool unloadModule(PlatformModule module)
+{
+    return ::FreeLibrary(module);
+}
+
+String localUserSpecificStorageDirectory()
+{
+    return String(L"\\");
+}
+
+String roamingUserSpecificStorageDirectory()
+{
+    return String(L"\\");
+}
+
+Vector<String> listDirectory(const String& path, const String& filter)
+{
+    Vector<String> entries;
+
+    Vector<UChar, 256> pattern;
+    pattern.append(path.characters(), path.length());
+    if (pattern.last() != L'/' && pattern.last() != L'\\')
+        pattern.append(L'\\');
+
+    String root(pattern.data(), pattern.size());
+    pattern.append(filter.characters(), filter.length());
+    pattern.append(0);
+
+    WIN32_FIND_DATA findData;
+    HANDLE hFind = FindFirstFile(pattern.data(), &findData);
+    if (INVALID_HANDLE_VALUE != hFind) {
+        do {
+            // FIXEME: should we also add the folders? This function
+            // is so far only called by PluginDatabase.cpp to list
+            // all plugins in a folder, where it's not supposed to list sub-folders.
+            if (!(findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY))
+                entries.append(root + findData.cFileName);
+        } while (FindNextFile(hFind, &findData));
+        FindClose(hFind);
+    }
+
+    return entries;
+}
+
+}
diff --git a/WebCore/platform/wince/KURLWince.cpp b/WebCore/platform/wince/KURLWince.cpp
new file mode 100644
index 0000000..5ca1e4b
--- /dev/null
+++ b/WebCore/platform/wince/KURLWince.cpp
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+namespace WebCore {
+
+String KURL::fileSystemPath() const
+{
+    return path();
+}
+
+}
diff --git a/WebCore/platform/wince/KeygenWince.cpp b/WebCore/platform/wince/KeygenWince.cpp
new file mode 100644
index 0000000..b0f4d63
--- /dev/null
+++ b/WebCore/platform/wince/KeygenWince.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2008-2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "Base64.h"
+#include "CString.h"
+
+#include <windows.h>
+#include <wincrypt.h>
+
+namespace WebCore {
+
+void WebCore::getSupportedKeySizes(Vector<String>& v)
+{
+    v.append("High Grade");
+    v.append("Medium Grade");
+}
+
+String WebCore::signedPublicKeyAndChallengeString(unsigned index, const String& challenge, const KURL& url)
+{
+    String keyString;
+
+    HCRYPTPROV hContext = 0;
+    HCRYPTKEY hKey = 0;
+    PCERT_PUBLIC_KEY_INFO pPubInfo = 0;
+
+    // Try to delete it if it exists already
+    CryptAcquireContext(&hContext, _T("keygen_container"), MS_ENHANCED_PROV, PROV_RSA_FULL, CRYPT_DELETEKEYSET);
+
+    do {
+        if (!CryptAcquireContext(&hContext, _T("keygen_container"), MS_ENHANCED_PROV, PROV_RSA_FULL, CRYPT_NEWKEYSET))
+            break;
+
+        DWORD dwPubInfoLength = 0;
+        if (!CryptGenKey(hContext, AT_KEYEXCHANGE, 0, &hKey) || !CryptExportPublicKeyInfo(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, 0, &dwPubInfoLength))
+            break;
+
+        // Use malloc instead of new, because malloc guarantees to return a pointer aligned for all data types.
+        pPubInfo = reinterpret_cast<PCERT_PUBLIC_KEY_INFO>(fastMalloc(dwPubInfoLength));
+
+        if (!CryptExportPublicKeyInfo(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, pPubInfo, &dwPubInfoLength))
+            break;
+
+        CERT_KEYGEN_REQUEST_INFO requestInfo = { 0 };
+        requestInfo.dwVersion = CERT_KEYGEN_REQUEST_V1;
+        requestInfo.pwszChallengeString = L"";
+        requestInfo.SubjectPublicKeyInfo = *pPubInfo;
+
+        String localChallenge = challenge;
+
+        // Windows API won't write to our buffer, although it's not declared with const.
+        requestInfo.pwszChallengeString = const_cast<wchar_t*>(localChallenge.charactersWithNullTermination());
+
+        CRYPT_ALGORITHM_IDENTIFIER signAlgo = { 0 };
+        signAlgo.pszObjId = szOID_RSA_SHA1RSA;
+
+        DWORD dwEncodedLength;
+        if (!CryptSignAndEncodeCertificate(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, X509_KEYGEN_REQUEST_TO_BE_SIGNED, &requestInfo, &signAlgo, 0, 0, &dwEncodedLength))
+            break;
+
+        Vector<char> binary(dwEncodedLength);
+        if (!CryptSignAndEncodeCertificate(hContext, AT_KEYEXCHANGE, X509_ASN_ENCODING, X509_KEYGEN_REQUEST_TO_BE_SIGNED, &requestInfo, &signAlgo, 0, reinterpret_cast<LPBYTE>(binary.data()), &dwEncodedLength))
+            break;
+
+        Vector<char> base64;
+        base64Encode(binary, base64);
+        keyString = String(base64.data(), base64.size());
+
+    } while(0);
+
+    if (pPubInfo)
+        fastFree(pPubInfo);
+       
+    if (hKey)
+        CryptDestroyKey(hKey);
+
+    if (hContext)
+        CryptReleaseContext(hContext, 0);
+
+    return keyString;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/MIMETypeRegistryWince.cpp b/WebCore/platform/wince/MIMETypeRegistryWince.cpp
new file mode 100644
index 0000000..2ecde48
--- /dev/null
+++ b/WebCore/platform/wince/MIMETypeRegistryWince.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MIMETypeRegistry.h"
+
+#include <windows.h>
+#include <winreg.h>
+
+namespace WebCore {
+
+static String mimeTypeForExtension(const String& extension)
+{
+    String ext = "." + extension;
+    WCHAR contentTypeStr[256];
+    DWORD contentTypeStrLen = sizeof(contentTypeStr);
+    DWORD valueType;
+
+    HKEY key;
+    String result;
+    if (ERROR_SUCCESS != RegOpenKeyEx(HKEY_CLASSES_ROOT, ext.charactersWithNullTermination(), 0, 0, &key))
+        return result;
+
+    if (ERROR_SUCCESS == RegQueryValueEx(key, L"Content Type", 0, &valueType, (LPBYTE)contentTypeStr, &contentTypeStrLen) && valueType == REG_SZ)
+        result = String(contentTypeStr, contentTypeStrLen / sizeof(contentTypeStr[0]) - 1);
+
+    RegCloseKey(key);
+
+    return result;
+}
+
+static HashMap<String, String> mimetypeMap;
+
+static void initMIMETypeEntensionMap()
+{
+    if (mimetypeMap.isEmpty()) {
+        //fill with initial values
+        mimetypeMap.add("txt", "text/plain");
+        mimetypeMap.add("pdf", "application/pdf");
+        mimetypeMap.add("ps", "application/postscript");
+        mimetypeMap.add("html", "text/html");
+        mimetypeMap.add("htm", "text/html");
+        mimetypeMap.add("xml", "text/xml");
+        mimetypeMap.add("xsl", "text/xsl");
+        mimetypeMap.add("js", "application/x-javascript");
+        mimetypeMap.add("xhtml", "application/xhtml+xml");
+        mimetypeMap.add("rss", "application/rss+xml");
+        mimetypeMap.add("webarchive", "application/x-webarchive");
+        mimetypeMap.add("svg", "image/svg+xml");
+        mimetypeMap.add("svgz", "image/svg+xml");
+        mimetypeMap.add("jpg", "image/jpeg");
+        mimetypeMap.add("jpeg", "image/jpeg");
+        mimetypeMap.add("png", "image/png");
+        mimetypeMap.add("tif", "image/tiff");
+        mimetypeMap.add("tiff", "image/tiff");
+        mimetypeMap.add("ico", "image/ico");
+        mimetypeMap.add("cur", "image/ico");
+        mimetypeMap.add("bmp", "image/bmp");
+        mimetypeMap.add("css", "text/css");
+        // FIXME: Custom font works only when MIME is "text/plain"
+        mimetypeMap.add("ttf", "text/plain"); // "font/ttf"
+        mimetypeMap.add("otf", "text/plain"); // "font/otf"
+#if ENABLE(WML)
+        mimetypeMap.add("wml", "text/vnd.wap.wml");
+#endif
+#if ENABLE(WBXML)
+        mimetypeMap.add("wbxml", "application/vnd.wap.wmlc");
+#endif
+    }
+}
+
+String MIMETypeRegistry::getPreferredExtensionForMIMEType(const String& type)
+{
+    if (type.isEmpty())
+        return String();
+
+    // Avoid conflicts with "ttf" and "otf"
+    if (equalIgnoringCase(type, "text/plain"))
+        return "txt";
+
+    initMIMETypeEntensionMap();
+
+    for (HashMap<String, String>::iterator i = mimetypeMap.begin(); i != mimetypeMap.end(); ++i) {
+        if (equalIgnoringCase(i->second, type))
+            return i->first;
+    }
+
+#if ENABLE(XHTMLMP)
+    if (equalIgnoringCase("application/vnd.wap.xhtml+xml", type))
+        return String("xml");
+#endif
+
+    return String();
+}
+
+String MIMETypeRegistry::getMIMETypeForExtension(const String &ext)
+{
+    if (ext.isEmpty())
+        return String();
+
+    initMIMETypeEntensionMap();
+
+    String result = mimetypeMap.get(ext.lower());
+    if (result.isEmpty()) {
+        result = mimeTypeForExtension(ext);
+        if (!result.isEmpty())
+            mimetypeMap.add(ext, result);
+    }
+    return result.isEmpty() ? "unknown/unknown" : result;
+}
+
+}
diff --git a/WebCore/platform/wince/PasteboardWince.cpp b/WebCore/platform/wince/PasteboardWince.cpp
new file mode 100644
index 0000000..16f4968
--- /dev/null
+++ b/WebCore/platform/wince/PasteboardWince.cpp
@@ -0,0 +1,330 @@
+/*
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+#include "Pasteboard.h"
+
+#include "CString.h"
+#include "ClipboardUtilitiesWin.h"
+#include "Document.h"
+#include "DocumentFragment.h"
+#include "Element.h"
+#include "Frame.h"
+#include "HitTestResult.h"
+#include "Image.h"
+#include "KURL.h"
+#include "Page.h"
+#include "Range.h"
+#include "RenderImage.h"
+#include "TextEncoding.h"
+#include "markup.h"
+
+namespace WebCore {
+
+static UINT HTMLClipboardFormat = 0;
+static UINT BookmarkClipboardFormat = 0;
+static UINT WebSmartPasteFormat = 0;
+
+extern HDC hScreenDC;
+
+static LRESULT CALLBACK PasteboardOwnerWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    LRESULT lresult = 0;
+    LONG longPtr = GetWindowLong(hWnd, 0);
+
+    switch (message) {
+    case WM_RENDERFORMAT:
+        // This message comes when SetClipboardData was sent a null data handle
+        // and now it's come time to put the data on the clipboard.
+        break;
+    case WM_RENDERALLFORMATS:
+        // This message comes when SetClipboardData was sent a null data handle
+        // and now this application is about to quit, so it must put data on
+        // the clipboard before it exits.
+        break;
+    case WM_DESTROY:
+        break;
+    default:
+        lresult = DefWindowProc(hWnd, message, wParam, lParam);
+        break;
+    }
+    return lresult;
+}
+
+Pasteboard* Pasteboard::generalPasteboard()
+{
+    static Pasteboard* pasteboard = new Pasteboard;
+    return pasteboard;
+}
+
+Pasteboard::Pasteboard()
+{
+    // make a dummy HWND to be the Windows clipboard's owner
+    WNDCLASS wc = {0};
+    memset(&wc, 0, sizeof(wc));
+    wc.lpfnWndProc    = PasteboardOwnerWndProc;
+    wc.hInstance      = Page::instanceHandle();
+    wc.lpszClassName  = L"PasteboardOwnerWindowClass";
+    ::RegisterClass(&wc);
+
+    m_owner = ::CreateWindow(L"PasteboardOwnerWindowClass", L"PasteboardOwnerWindow", 0, 0, 0, 0, 0,
+        HWND_MESSAGE, 0, 0, 0);
+
+    HTMLClipboardFormat = ::RegisterClipboardFormat(L"HTML Format");
+    BookmarkClipboardFormat = ::RegisterClipboardFormat(L"UniformResourceLocatorW");
+    WebSmartPasteFormat = ::RegisterClipboardFormat(L"WebKit Smart Paste Format");
+}
+
+void Pasteboard::clear()
+{
+    if (::OpenClipboard(m_owner)) {
+        ::EmptyClipboard();
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
+{
+    clear();
+
+    // Put CF_HTML format on the pasteboard
+    if (::OpenClipboard(m_owner)) {
+        ExceptionCode ec = 0;
+        Vector<char> data;
+        markupToCF_HTML(createMarkup(selectedRange, 0, AnnotateForInterchange), selectedRange->startContainer(ec)->document()->url(), data);
+        HGLOBAL cbData = createGlobalData(data);
+        if (!::SetClipboardData(HTMLClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = frame->selectedText();
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    replaceNBSPWithSpace(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // enable smart-replacing later on by putting dummy data on the pasteboard
+    if (canSmartCopyOrDelete) {
+        if (::OpenClipboard(m_owner)) {
+            ::SetClipboardData(WebSmartPasteFormat, 0);
+            ::CloseClipboard();
+        }
+    }
+}
+
+void Pasteboard::writePlainText(const String& text)
+{
+    clear();
+
+    // Put plain string on the pasteboard. CF_UNICODETEXT covers CF_TEXT as well
+    String str = text;
+    replaceNewlinesWithWindowsStyleNewlines(str);
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(str);
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeURL(const KURL& url, const String& titleStr, Frame* frame)
+{
+    ASSERT(!url.isEmpty());
+
+    clear();
+
+    String title(titleStr);
+    if (title.isEmpty()) {
+        title = url.lastPathComponent();
+        if (title.isEmpty())
+            title = url.host();
+    }
+
+    // write to clipboard in format com.apple.safari.bookmarkdata to be able to paste into the bookmarks view with appropriate title
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(url, title);
+        if (!::SetClipboardData(BookmarkClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // write to clipboard in format CF_HTML to be able to paste into contenteditable areas as a link
+    if (::OpenClipboard(m_owner)) {
+        Vector<char> data;
+        markupToCF_HTML(urlToMarkup(url, title), "", data);
+        HGLOBAL cbData = createGlobalData(data);
+        if (!::SetClipboardData(HTMLClipboardFormat, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+
+    // bare-bones CF_UNICODETEXT support
+    if (::OpenClipboard(m_owner)) {
+        HGLOBAL cbData = createGlobalData(url.string());
+        if (!::SetClipboardData(CF_UNICODETEXT, cbData))
+            ::GlobalFree(cbData);
+        ::CloseClipboard();
+    }
+}
+
+void Pasteboard::writeImage(Node* node, const KURL&, const String&)
+{
+    ASSERT(node && node->renderer() && node->renderer()->isImage());
+    RenderImage* renderer = static_cast<RenderImage*>(node->renderer());
+    CachedImage* cachedImage = static_cast<CachedImage*>(renderer->cachedImage());
+    ASSERT(cachedImage);
+    Image* image = cachedImage->image();
+    ASSERT(image);
+
+    clear();
+
+    RefPtr<SharedBitmap> sourceBmp = image->nativeImageForCurrentFrame();
+    if (!sourceBmp)
+        return;
+
+    IntRect rect(0, 0, sourceBmp->width(), sourceBmp->height());
+    BitmapInfo bmpInfo;
+    void* pixels;
+    HBITMAP resultBitmap = sourceBmp->clipBitmap(rect, true, bmpInfo, pixels);
+    if (!resultBitmap)
+        return;
+
+    if (::OpenClipboard(m_owner)) {
+        ::SetClipboardData(CF_BITMAP, resultBitmap);
+        ::CloseClipboard();
+    } else
+        DeleteObject(resultBitmap);
+}
+
+bool Pasteboard::canSmartReplace()
+{
+    return ::IsClipboardFormatAvailable(WebSmartPasteFormat);
+}
+
+String Pasteboard::plainText(Frame* frame)
+{
+    if (::IsClipboardFormatAvailable(CF_UNICODETEXT) && ::OpenClipboard(m_owner)) {
+        HANDLE cbData = ::GetClipboardData(CF_UNICODETEXT);
+        if (cbData) {
+            UChar* buffer = (UChar*)GlobalLock(cbData);
+            String fromClipboard(buffer);
+            GlobalUnlock(cbData);
+            CloseClipboard();
+            return fromClipboard;
+        } else
+            CloseClipboard();
+    }
+
+    if (::IsClipboardFormatAvailable(CF_TEXT) && ::OpenClipboard(m_owner)) {
+        HANDLE cbData = ::GetClipboardData(CF_TEXT);
+        if (cbData) {
+            char* buffer = (char*)GlobalLock(cbData);
+            String fromClipboard(buffer);
+            GlobalUnlock(cbData);
+            CloseClipboard();
+            return fromClipboard;
+        } else
+            CloseClipboard();
+    }
+
+    return String();
+}
+
+PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefPtr<Range> context, bool allowPlainText, bool& chosePlainText)
+{
+    chosePlainText = false;
+
+    if (::IsClipboardFormatAvailable(HTMLClipboardFormat) && ::OpenClipboard(m_owner)) {
+        // get data off of clipboard
+        HANDLE cbData = ::GetClipboardData(HTMLClipboardFormat);
+        if (cbData) {
+            SIZE_T dataSize = ::GlobalSize(cbData);
+            String cf_html(UTF8Encoding().decode((char*)GlobalLock(cbData), dataSize));
+            GlobalUnlock(cbData);
+            CloseClipboard();
+
+            PassRefPtr<DocumentFragment> fragment = fragmentFromCF_HTML(frame->document(), cf_html);
+            if (fragment)
+                return fragment;
+        } else
+            CloseClipboard();
+    }
+
+    if (allowPlainText && IsClipboardFormatAvailable(CF_UNICODETEXT)) {
+        chosePlainText = true;
+        if (OpenClipboard(m_owner)) {
+            HANDLE cbData = GetClipboardData(CF_UNICODETEXT);
+            if (cbData) {
+                UChar* buffer = (UChar*)GlobalLock(cbData);
+                String str(buffer);
+                GlobalUnlock(cbData);
+                CloseClipboard();
+                RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), str);
+                if (fragment)
+                    return fragment.release();
+            } else
+                CloseClipboard();
+        }
+    }
+
+    if (allowPlainText && ::IsClipboardFormatAvailable(CF_TEXT)) {
+        chosePlainText = true;
+        if (::OpenClipboard(m_owner)) {
+            HANDLE cbData = ::GetClipboardData(CF_TEXT);
+            if (cbData) {
+                char* buffer = (char*)GlobalLock(cbData);
+                String str(buffer);
+                GlobalUnlock(cbData);
+                CloseClipboard();
+                RefPtr<DocumentFragment> fragment = createFragmentFromText(context.get(), str);
+                if (fragment)
+                    return fragment.release();
+            } else
+                CloseClipboard();
+        }
+    }
+
+    return 0;
+}
+
+bool Pasteboard::hasData()
+{
+    return hasDataInFormat(CF_UNICODETEXT) || hasDataInFormat(CF_TEXT);
+}
+
+bool Pasteboard::hasDataInFormat(unsigned int format)
+{
+    return ::IsClipboardFormatAvailable(format);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/wince/SearchPopupMenuWince.cpp b/WebCore/platform/wince/SearchPopupMenuWince.cpp
new file mode 100644
index 0000000..ca11292
--- /dev/null
+++ b/WebCore/platform/wince/SearchPopupMenuWince.cpp
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "SearchPopupMenu.h"
+
+#include "AtomicString.h"
+
+namespace WebCore {
+
+SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
+: PopupMenu(client)
+{
+}
+
+bool SearchPopupMenu::enabled()
+{
+    return false;
+}
+
+void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+{
+    if (name.isEmpty())
+        return;
+
+    notImplemented();
+}
+
+void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+{
+    if (name.isEmpty())
+        return;
+
+    notImplemented();
+}
+
+}
diff --git a/WebCore/platform/wince/SharedTimerWince.cpp b/WebCore/platform/wince/SharedTimerWince.cpp
new file mode 100644
index 0000000..ca2f104
--- /dev/null
+++ b/WebCore/platform/wince/SharedTimerWince.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedTimer.h"
+
+#include "Page.h"
+#include "SystemTime.h"
+#include "Widget.h"
+#include <wtf/Assertions.h>
+#include <wtf/CurrentTime.h>
+#include <windows.h>
+
+namespace JSC {
+extern void* g_stackBase;
+}
+
+namespace WebCore {
+
+enum {
+    TimerIdNone = 0,
+    TimerIdAuto,
+    TimerIdManual,
+};
+static UINT timerID = TimerIdNone;
+
+static void (*sharedTimerFiredFunction)();
+
+static HWND timerWindowHandle = 0;
+const LPCWSTR kTimerWindowClassName = L"TimerWindowClass";
+
+LRESULT CALLBACK TimerWindowWndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    int dummy;
+    JSC::g_stackBase = &dummy;
+
+    if (message == WM_TIMER) {
+        if (timerID != TimerIdNone)
+            sharedTimerFiredFunction();
+    } else if (message == WM_USER)    {
+        if (timerID = TimerIdManual) {
+            sharedTimerFiredFunction();
+            PostMessage(hWnd, WM_USER, 0, 0);
+        }
+    } else {
+        JSC::g_stackBase = 0;
+        return DefWindowProc(hWnd, message, wParam, lParam);
+    }
+    JSC::g_stackBase = 0;
+    return 0;
+}
+
+static void initializeOffScreenTimerWindow()
+{
+    if (timerWindowHandle)
+        return;
+
+    WNDCLASS wcex = {0};
+    wcex.lpfnWndProc    = TimerWindowWndProc;
+    wcex.hInstance      = Page::instanceHandle();
+    wcex.lpszClassName  = kTimerWindowClassName;
+    RegisterClass(&wcex);
+
+    timerWindowHandle = CreateWindow(kTimerWindowClassName, 0, 0,
+       CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, HWND_MESSAGE, 0, Page::instanceHandle(), 0);
+}
+
+void setSharedTimerFiredFunction(void (*f)())
+{
+    sharedTimerFiredFunction = f;
+}
+
+#define USER_TIMER_MAXIMUM  0x7FFFFFFF
+#define USER_TIMER_MINIMUM  0x0000000A
+
+void setSharedTimerFireTime(double fireTime)
+{
+    ASSERT(sharedTimerFiredFunction);
+
+    double interval = (fireTime - currentTime()) * 1000.;
+    unsigned intervalInMS = interval < USER_TIMER_MINIMUM
+        ? USER_TIMER_MINIMUM
+        : interval > USER_TIMER_MAXIMUM
+        ? USER_TIMER_MAXIMUM
+        : static_cast<unsigned>(interval);
+
+    if (timerID == TimerIdAuto) {
+        KillTimer(timerWindowHandle, TimerIdAuto);
+        timerID = TimerIdNone;
+    }
+
+    initializeOffScreenTimerWindow();
+    if (SetTimer(timerWindowHandle, TimerIdAuto, intervalInMS, 0))
+        timerID = TimerIdAuto;
+    else if (timerID != TimerIdManual)
+        PostMessage(timerWindowHandle, WM_USER, 0, 0);
+}
+
+void stopSharedTimer()
+{
+    if (timerID == TimerIdAuto)
+        KillTimer(timerWindowHandle, TimerIdAuto);
+
+    timerID = TimerIdNone;
+}
+
+}
diff --git a/WebCore/platform/wince/SystemTimeWince.cpp b/WebCore/platform/wince/SystemTimeWince.cpp
new file mode 100644
index 0000000..70b705b
--- /dev/null
+++ b/WebCore/platform/wince/SystemTimeWince.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2007-2008 Torch Mobile, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SystemTime.h"
+
+#include <windows.h>
+
+namespace WebCore {
+
+float userIdleTime()
+{
+    return FLT_MAX;
+}
+
+}
diff --git a/WebCore/platform/wx/CursorWx.cpp b/WebCore/platform/wx/CursorWx.cpp
index 7175b01..ed7f86b 100644
--- a/WebCore/platform/wx/CursorWx.cpp
+++ b/WebCore/platform/wx/CursorWx.cpp
@@ -298,4 +298,10 @@ const Cursor& grabbingCursor()
     return pointerCursor();
 }
 
+const Cursor& moveCursor()
+{
+    static Cursor c = new wxCursor(wxCURSOR_SIZING);
+    return c;
+}
+
 }
diff --git a/WebCore/platform/wx/FileChooserWx.cpp b/WebCore/platform/wx/FileChooserWx.cpp
new file mode 100644
index 0000000..34065f3
--- /dev/null
+++ b/WebCore/platform/wx/FileChooserWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "FileChooser.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+String FileChooser::basenameForWidth(const Font&, int width) const
+{
+    notImplemented();
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/FileSystemWx.cpp b/WebCore/platform/wx/FileSystemWx.cpp
index 7de425e..109278f 100644
--- a/WebCore/platform/wx/FileSystemWx.cpp
+++ b/WebCore/platform/wx/FileSystemWx.cpp
@@ -40,50 +40,50 @@ namespace WebCore {
 
 bool fileExists(const String& path)
 {
-    notImplemented();
-    return true;
+    return wxFileName::FileExists(path);
 }
 
 bool deleteFile(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxRemoveFile(path);
 }
 
 bool deleteEmptyDirectory(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxFileName::Rmdir(path);
 }
 
 bool getFileSize(const String& path, long long& resultSize)
 {
-    notImplemented();
+    wxULongLong size = wxFileName::GetSize(path);
+    if (wxInvalidSize != size) {
+        // TODO: why is FileSystem::getFileSize signed?
+        resultSize = (long long)size.GetValue();
+        return true;
+    }
+
     return false;
 }
 
-bool getFileModificationTime(const String&, time_t&)
+bool getFileModificationTime(const String& path, time_t& t)
 {
-    notImplemented();
-    return false;
+    t = wxFileName(path).GetModificationTime().GetTicks();
+    return true;
 }
 
 bool makeAllDirectories(const String& path)
 {
-    notImplemented();
-    return false;
+    return wxFileName::Mkdir(path, 0777, wxPATH_MKDIR_FULL);
 }
 
 String pathByAppendingComponent(const String& path, const String& component)
 {
-    notImplemented();
-    return String();
+    return wxFileName(path, component).GetFullPath();
 }
 
 String homeDirectoryPath()
 {
-    notImplemented();
-    return String();
+    return wxFileName::GetHomeDir();
 }
 
 String pathGetFileName(const String& path)
@@ -93,8 +93,7 @@ String pathGetFileName(const String& path)
 
 String directoryName(const String& path)
 {
-    notImplemented();
-    return String();
+    return wxFileName(path).GetPath();
 }
 
 CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
diff --git a/WebCore/platform/wx/KURLWx.cpp b/WebCore/platform/wx/KURLWx.cpp
new file mode 100644
index 0000000..a2be103
--- /dev/null
+++ b/WebCore/platform/wx/KURLWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+String KURL::fileSystemPath() const
+{
+    notImplemented();
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/PasteboardWx.cpp b/WebCore/platform/wx/PasteboardWx.cpp
index 67697de..207c63c 100644
--- a/WebCore/platform/wx/PasteboardWx.cpp
+++ b/WebCore/platform/wx/PasteboardWx.cpp
@@ -52,13 +52,20 @@ Pasteboard* Pasteboard::generalPasteboard()
 
 void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete, Frame* frame)
 {
-    if (wxTheClipboard->Open())
-    {
+    if (wxTheClipboard->Open()) {
         wxTheClipboard->SetData( new wxTextDataObject(frame->selectedText()) );
         wxTheClipboard->Close();
     }
 }
 
+void Pasteboard::writePlainText(const String& text)
+{
+    if (wxTheClipboard->Open()) {
+        wxTheClipboard->SetData( new wxTextDataObject(text) );
+        wxTheClipboard->Close();
+    }
+}
+
 bool Pasteboard::canSmartReplace()
 {
     notImplemented();
@@ -92,8 +99,7 @@ PassRefPtr<DocumentFragment> Pasteboard::documentFragment(Frame* frame, PassRefP
 
 void Pasteboard::writeURL(const KURL& url, const String&, Frame*)
 {
-    if (wxTheClipboard->Open())
-    {
+    if (wxTheClipboard->Open()) {
         wxTheClipboard->SetData( new wxTextDataObject( url.string() ) );
         wxTheClipboard->Close();
     }
diff --git a/WebCore/platform/wx/PopupMenuWx.cpp b/WebCore/platform/wx/PopupMenuWx.cpp
index 660282c..9b0deba 100644
--- a/WebCore/platform/wx/PopupMenuWx.cpp
+++ b/WebCore/platform/wx/PopupMenuWx.cpp
@@ -88,7 +88,7 @@ void PopupMenu::OnMenuItemSelected(wxCommandEvent& event)
 {
     if (client()) {
         client()->valueChanged(event.GetId() - s_menuStartId);
-        client()->hidePopup();
+        client()->popupDidHide();
     }
     // TODO: Do we need to call Disconnect here? Do we have a ref to the native window still?
 }
diff --git a/WebCore/platform/wx/RenderThemeWx.cpp b/WebCore/platform/wx/RenderThemeWx.cpp
index f2ced9e..c66ff87 100644
--- a/WebCore/platform/wx/RenderThemeWx.cpp
+++ b/WebCore/platform/wx/RenderThemeWx.cpp
@@ -29,6 +29,7 @@
 #include "Document.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
+#include "HostWindow.h"
 #include "NotImplemented.h"
 #include "RenderView.h"
 
@@ -138,6 +139,15 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
     return rt;
 }
 
+wxWindow* nativeWindowForRenderObject(RenderObject* o)
+{
+    FrameView* frameView = o->view()->frameView();
+    ASSERT(frameView);
+    ASSERT(frameView->hostWindow());
+    return frameView->hostWindow()->platformPageClient();
+}
+
+
 bool RenderThemeWx::isControlStyled(const RenderStyle* style, const BorderData& border,
                                      const FillLayer& background, const Color& backgroundColor) const
 {
@@ -251,10 +261,23 @@ void RenderThemeWx::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
 
 bool RenderThemeWx::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     int flags = 0;
     
+    IntRect rect = r; 
+
+#if USE(WXGC)
+    double xtrans = 0;
+    double ytrans = 0;
+    
+    wxGCDC* gcdc = static_cast<wxGCDC*>(dc);
+    wxGraphicsContext* gc = gcdc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
+    rect.setX(r.x() + (int)xtrans);
+    rect.setY(r.y() + (int)ytrans);
+#endif
+
     if (!isEnabled(o))
         flags |= wxCONTROL_DISABLED;
 
@@ -266,20 +289,22 @@ bool RenderThemeWx::paintButton(RenderObject* o, const RenderObject::PaintInfo&
         flags |= wxCONTROL_PRESSED;
     
     if (part == PushButtonPart || part == ButtonPart)
-        wxRendererNative::Get().DrawPushButton(window, *dc, r, flags);
+        wxRendererNative::Get().DrawPushButton(window, *dc, rect, flags);
     else if(part == RadioPart) {
         if (isChecked(o))
             flags |= wxCONTROL_CHECKED;
-#if wxCHECK_VERSION(2,9,0)
-        wxRendererNative::Get().DrawRadioButton(window, *dc, r, flags);
+#if wxCHECK_VERSION(2,9,1)
+        wxRendererNative::Get().DrawRadioBitmap(window, *dc, r, flags);
+#elif wxCHECK_VERSION(2,9,0)
+        wxRendererNative::Get().DrawRadioButton(window, *dc, rect, flags);
 #else
-        wxRenderer_DrawRadioButton(window, *dc, r, flags);
+        wxRenderer_DrawRadioButton(window, *dc, rect, flags);
 #endif
     }
     else if(part == CheckboxPart) {
         if (isChecked(o))
             flags |= wxCONTROL_CHECKED;
-        wxRendererNative::Get().DrawCheckBox(window, *dc, r, flags);
+        wxRendererNative::Get().DrawCheckBox(window, *dc, rect, flags);
     }
     return false;
 }
@@ -291,7 +316,7 @@ void RenderThemeWx::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style,
 
 bool RenderThemeWx::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
 #if wxCHECK_VERSION(2,9,0)
     wxRendererNative::Get().DrawTextCtrl(window, *dc, r, 0);
@@ -313,7 +338,7 @@ void RenderThemeWx::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, E
     
 bool RenderThemeWx::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     
     int flags = 0;      
@@ -342,7 +367,7 @@ void RenderThemeWx::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, E
     
 bool RenderThemeWx::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
 {
-    wxWindow* window = o->view()->frameView()->platformWidget();
+    wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
     
     int flags = 0;      
diff --git a/WebCore/platform/wx/SSLKeyGeneratorWx.cpp b/WebCore/platform/wx/SSLKeyGeneratorWx.cpp
new file mode 100644
index 0000000..7d076e7
--- /dev/null
+++ b/WebCore/platform/wx/SSLKeyGeneratorWx.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SSLKeyGenerator.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+void getSupportedKeySizes(Vector<String>&)
+{
+    notImplemented();
+}
+
+String signedPublicKeyAndChallengeString(unsigned keySizeIndex, const String &challengeString, const KURL &url)
+{
+    return String();
+}
+
+}
+
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.cpp b/WebCore/platform/wx/ScrollbarThemeWx.cpp
new file mode 100644
index 0000000..6904f41
--- /dev/null
+++ b/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ScrollbarThemeWx.h"
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "Scrollbar.h"
+#include "ScrollbarClient.h"
+#include "scrollbar_render.h"
+#include "ScrollbarThemeComposite.h"
+#include "ScrollView.h"
+
+#include <wx/defs.h>
+#include <wx/dcgraph.h>
+#include <wx/settings.h>
+
+const int cMacButtonOverlap = 4;
+
+namespace WebCore {
+
+ScrollbarTheme* ScrollbarTheme::nativeTheme()
+{
+    static ScrollbarThemeWx theme;
+    return &theme;
+}
+
+ScrollbarThemeWx::~ScrollbarThemeWx()
+{
+}
+
+int ScrollbarThemeWx::scrollbarThickness(ScrollbarControlSize size)
+{
+    int thickness = wxSystemSettings::GetMetric(wxSYS_VSCROLL_X);
+    
+    // fallback for when a platform doesn't define this metric
+    if (thickness <= 0)
+        thickness = 20;
+    
+    return thickness;
+}
+
+bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
+{
+    // This method is just called as a paint-time optimization to see if
+    // painting the thumb can be skipped.  We don't have to be exact here.
+    return thumbLength(scrollbar) > 0;
+}
+
+IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
+{
+#ifdef __WXMAC__
+    return IntSize(20,20);
+#else
+    return IntSize(16,16);
+#endif
+}
+
+
+IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    // FIXME: Handling this case is needed when there are two sets of arrow buttons
+    // on Mac, one at the top and one at the bottom.
+    if (part == BackButtonEndPart)
+        return IntRect();
+
+    IntSize size = buttonSize(scrollbar);
+    int x = scrollbar->x();
+    int y = scrollbar->y();
+    
+#if __WXMAC__
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        x += scrollbar->width() - (size.width() * 2) + cMacButtonOverlap;
+    else
+        y += scrollbar->height() - (size.height() * 2) + cMacButtonOverlap;
+#endif
+    
+    return IntRect(x, y, size.width(), size.height());
+}
+
+IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+{
+    // FIXME: Handling this case is needed when there are two sets of arrow buttons
+    // on Mac, one at the top and one at the bottom.
+    if (part == ForwardButtonStartPart)
+        return IntRect();
+
+    IntSize size = buttonSize(scrollbar);
+    int x, y;
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        x = scrollbar->x() + scrollbar->width() - size.width();
+        y = scrollbar->y();
+    } else {
+        x = scrollbar->x();
+        y = scrollbar->y() + scrollbar->height() - size.height();
+    }
+    return IntRect(x, y, size.width(), size.height());
+}
+
+IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
+{
+    IntSize bs = buttonSize(scrollbar);
+    int trackStart = 0;
+    if (scrollbar->orientation() == HorizontalScrollbar)
+        trackStart = bs.width();
+    else
+        trackStart = bs.height();
+        
+#if __WXMAC__
+    trackStart = 0;
+#endif
+    
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + trackStart, scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + trackStart, thickness, scrollbar->height() - 2 * bs.height());
+}
+
+void ScrollbarThemeWx::paintScrollCorner(ScrollView* view, GraphicsContext* context, const IntRect& cornerRect)
+{
+    // ScrollbarThemeComposite::paintScrollCorner incorrectly assumes that the
+    // ScrollView is a FrameView (see FramelessScrollView), so we cannot let
+    // that code run.  For FrameView's this is correct since we don't do custom
+    // scrollbar corner rendering, which ScrollbarThemeComposite supports.
+    ScrollbarTheme::paintScrollCorner(view, context, cornerRect);
+}
+
+bool ScrollbarThemeWx::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& rect)
+{
+    wxOrientation orientation = (scrollbar->orientation() == HorizontalScrollbar) ? wxHORIZONTAL : wxVERTICAL;
+    int flags = 0;
+    if (scrollbar->client()->isActive())
+        flags |= wxCONTROL_FOCUSED;
+    
+    if (!scrollbar->enabled())
+        flags |= wxCONTROL_DISABLED;
+    
+    wxDC* dc = static_cast<wxDC*>(context->platformContext());
+    
+    context->save();
+    ScrollView* root = scrollbar->root();
+    ASSERT(root);
+    if (!root)
+        return false;
+    
+    wxWindow* webview = root->hostWindow()->platformPageClient(); 
+    
+    wxRenderer_DrawScrollbar(webview, *dc, scrollbar->frameRect(), orientation, scrollbar->currentPos(), static_cast<wxScrollbarPart>(scrollbar->pressedPart()),    
+                     static_cast<wxScrollbarPart>(scrollbar->hoveredPart()), scrollbar->maximum(), scrollbar->pageStep(), flags);
+
+    context->restore();
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/wx/ScrollbarThemeWx.h b/WebCore/platform/wx/ScrollbarThemeWx.h
new file mode 100644
index 0000000..2b3bff0
--- /dev/null
+++ b/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ScrollbarThemeWx_h
+#define ScrollbarThemeWx_h
+
+#include "ScrollbarTheme.h"
+#include "ScrollbarThemeComposite.h"
+
+namespace WebCore {
+
+class ScrollbarThemeWx : public ScrollbarThemeComposite {
+public:
+    virtual ~ScrollbarThemeWx();
+    virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect&);
+
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
+    
+protected:
+    virtual bool hasButtons(Scrollbar*) { return true; }
+    virtual bool hasThumb(Scrollbar*);
+
+    virtual IntSize buttonSize(Scrollbar*);
+
+    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+};
+
+}
+#endif
diff --git a/WebCore/platform/wx/SearchPopupMenuWx.cpp b/WebCore/platform/wx/SearchPopupMenuWx.cpp
new file mode 100644
index 0000000..dbbe339
--- /dev/null
+++ b/WebCore/platform/wx/SearchPopupMenuWx.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SearchPopupMenu.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+SearchPopupMenu::SearchPopupMenu(PopupMenuClient* client)
+    : PopupMenu(client)
+{
+    notImplemented();
+}
+
+void SearchPopupMenu::saveRecentSearches(const AtomicString& name, const Vector<String>& searchItems)
+{
+    notImplemented();
+}
+
+void SearchPopupMenu::loadRecentSearches(const AtomicString& name, Vector<String>& searchItems)
+{
+    notImplemented();
+}
+
+bool SearchPopupMenu::enabled()
+{
+    return true;
+}
+
+}
+
diff --git a/WebCore/platform/wx/SharedBufferWx.cpp b/WebCore/platform/wx/SharedBufferWx.cpp
new file mode 100644
index 0000000..a9203ba
--- /dev/null
+++ b/WebCore/platform/wx/SharedBufferWx.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SharedBuffer.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&)
+{
+    notImplemented();
+    return 0;
+}
+
+}
+
diff --git a/WebCore/platform/wx/SystemTimeWx.cpp b/WebCore/platform/wx/SystemTimeWx.cpp
new file mode 100644
index 0000000..f607cba
--- /dev/null
+++ b/WebCore/platform/wx/SystemTimeWx.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "SystemTime.h"
+
+#include <float.h>
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+float userIdleTime()
+{
+    notImplemented();
+    // return an arbitrarily high userIdleTime so that releasing pages from the page cache isn't postponed
+    return FLT_MAX;
+}
+
+}
+
diff --git a/WebCore/platform/wx/TemporaryLinkStubs.cpp b/WebCore/platform/wx/TemporaryLinkStubs.cpp
index 2403527..5aa6e2c 100644
--- a/WebCore/platform/wx/TemporaryLinkStubs.cpp
+++ b/WebCore/platform/wx/TemporaryLinkStubs.cpp
@@ -1,3 +1,4 @@
+<<<<<<< HEAD:WebCore/platform/wx/TemporaryLinkStubs.cpp
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora, Ltd.  All rights reserved.
@@ -178,3 +179,5 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String&) {
 void prefetchDNS(const String& hostname) { notImplemented(); }
 
 }
+=======
+>>>>>>> webkit.org at 49305:WebCore/platform/wx/TemporaryLinkStubs.cpp
diff --git a/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp b/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp
new file mode 100644
index 0000000..f840e13
--- /dev/null
+++ b/WebCore/platform/wx/TextBreakIteratorInternalICUWx.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextBreakIteratorInternalICU.h"
+
+namespace WebCore {
+
+const char* currentSearchLocaleID()
+{
+    return "";
+}
+
+const char* currentTextBreakLocaleID()
+{
+    return "en_us";
+}
+
+}
+
diff --git a/WebCore/platform/wx/WidgetWx.cpp b/WebCore/platform/wx/WidgetWx.cpp
index bb4fd2a..a384914 100644
--- a/WebCore/platform/wx/WidgetWx.cpp
+++ b/WebCore/platform/wx/WidgetWx.cpp
@@ -28,6 +28,7 @@
 #include "Cursor.h"
 #include "GraphicsContext.h"
 #include "IntRect.h"
+#include "NotImplemented.h"
 
 #include <wx/defs.h>
 #include <wx/scrolwin.h>
@@ -96,4 +97,9 @@ void Widget::paint(GraphicsContext*,const IntRect& r)
         widget->Update();
 }
 
+void Widget::setIsSelected(bool)
+{
+    notImplemented();
+}
+
 }
diff --git a/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
new file mode 100644
index 0000000..f74b076
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/gtk/scrollbar_render.cpp
@@ -0,0 +1,166 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/renderer.h>
+#include <wx/settings.h>
+#include <wx/window.h>
+
+#include <gtk/gtk.h>
+
+#if wxCHECK_VERSION(2, 9, 0)
+    #include <wx/gtk/dc.h>
+#else
+    #include "wx/gtk/win_gtk.h"
+#endif
+
+int wxStyleForPart(wxScrollbarPart part, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int flags)
+{
+    int style = 0;
+    if (flags == wxCONTROL_DISABLED)
+        style = wxCONTROL_DISABLED;
+    else if (part == focusPart)
+        style = wxCONTROL_PRESSED;
+    else if (part == hoverPart)
+        style = wxCONTROL_CURRENT;
+
+    return style;
+}
+
+GtkWidget* GetButtonWidget()
+{
+    static GtkWidget *s_button = NULL;
+    static GtkWidget *s_window = NULL;
+
+    if ( !s_button )
+    {
+        s_window = gtk_window_new( GTK_WINDOW_POPUP );
+        gtk_widget_realize( s_window );
+        s_button = gtk_button_new();
+        gtk_container_add( GTK_CONTAINER(s_window), s_button );
+        gtk_widget_realize( s_button );
+    }
+
+    return s_button;
+}
+
+
+GdkWindow* wxGetGdkWindowForDC(wxWindow* win, wxDC& dc)
+{
+    GdkWindow* gdk_window = NULL;
+#if wxCHECK_VERSION(2, 9, 0)
+    if ( dc.IsKindOf( CLASSINFO(wxGCDC) ) )
+        gdk_window = win->GTKGetDrawingWindow();
+    else
+    {
+        wxGTKDCImpl *impl = wxDynamicCast(dc.GetImpl(), wxGTKDCImpl);
+        if ( impl )
+            gdk_window = impl->GetGDKWindow();
+    }
+#else // wx < 2.9
+    // The way to get a GdkWindow* from a wxWindow is to use 
+    // GTK_PIZZA(win->m_wxwindow)->bin_window, but this approach
+    // won't work when drawing to a wxMemoryDC as it has its own
+    // GdkWindow* for its bitmap. wxWindowDC's GetGDKWindow() was
+    // designed to create a solution for all DCs, but we can't
+    // implement it with wxGCDC since it doesn't retain its wxWindow. 
+    // So, to work around this, we use GetGDKWindow whenever possible
+    // and use bin_window for wxGCDC. 
+#if wxUSE_GRAPHICS_CONTEXT
+    if ( dc.IsKindOf( CLASSINFO(wxGCDC) ) )
+        gdk_window = GTK_PIZZA(win->m_wxwindow)->bin_window;    
+    else
+#endif
+       gdk_window = dc.GetGDKWindow();
+    wxASSERT_MSG( gdk_window,
+                  wxT("cannot use wxRendererNative on wxDC of this type") );
+#endif // wx 2.9/2.8
+    
+    return gdk_window;
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, const wxRect& rect, wxOrientation orient, 
+                        int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    bool horiz = orient == wxHORIZONTAL;
+    wxColour scrollbar_colour = wxSystemSettings::GetColour(wxSYS_COLOUR_SCROLLBAR);
+    dc.SetBrush(wxBrush(scrollbar_colour));
+    dc.SetPen(wxPen(wxSystemSettings::GetColour(wxSYS_COLOUR_BTNSHADOW)));
+    dc.DrawRectangle(rect.x, rect.y, rect.width, rect.height);
+
+    wxRendererNative& renderer = wxRendererNative::Get();
+    int x = rect.x;
+    int y = rect.y;
+
+    int buttonLength = 16;
+
+    renderer.DrawPushButton(window, dc, wxRect(x,y,buttonLength,buttonLength), wxStyleForPart(wxSCROLLPART_BACKBTNSTART, focusPart, hoverPart, flags));
+
+    GtkWidget* button = GetButtonWidget();
+    GdkWindow* gdk_window = wxGetGdkWindowForDC(window, dc);
+
+    GtkArrowType arrowType = GTK_ARROW_UP;
+    if (horiz)
+        arrowType = GTK_ARROW_LEFT;
+
+    gtk_paint_arrow( button->style, gdk_window, GTK_STATE_NORMAL, GTK_SHADOW_OUT, NULL, button, "arrow", arrowType, false, x + 4, y + 4, 8, 8);
+
+    wxRect buttonRect = rect;
+    int physicalLength = horiz ? rect.width : rect.height;
+    physicalLength -= buttonLength*2;
+    int thumbStart = 0;
+    int thumbLength = 0;
+    calcThumbStartAndLength(physicalLength, max + step, current, step, &thumbStart, &thumbLength);
+
+    if (horiz) {
+        buttonRect.x = thumbStart + buttonLength;
+        buttonRect.width = thumbLength;
+    } else {
+        buttonRect.y = thumbStart + buttonLength;
+        buttonRect.height = thumbLength;
+    }
+
+    renderer.DrawPushButton(window, dc, buttonRect, wxStyleForPart(wxSCROLLPART_THUMB, focusPart, hoverPart, flags));
+
+    if (horiz)
+        x += rect.width - buttonLength;
+    else
+        y += rect.height - buttonLength;
+
+    renderer.DrawPushButton(window, dc, wxRect(x,y,buttonLength,buttonLength), wxStyleForPart(wxSCROLLPART_FWDBTNEND, focusPart, hoverPart, flags));
+    
+    if (horiz)
+        arrowType = GTK_ARROW_RIGHT;
+    else
+        arrowType = GTK_ARROW_DOWN;
+
+    gtk_paint_arrow( button->style, gdk_window, GTK_STATE_NORMAL, GTK_SHADOW_OUT, NULL, button, "arrow", arrowType, false, x + 4, y + 4, 8, 8);
+}
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index e5c60d6..c4c4d48 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -63,7 +63,7 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     CGFontRef cgFont;
 
 #ifdef wxOSX_USE_CORE_TEXT && wxOSX_USE_CORE_TEXT
-    cgFont = CTFontCopyGraphicsFont((CTFontRef)font->OSXGetCTFont(), NULL);
+    cgFont = CTFontCopyGraphicsFont((CTFontRef)wxfont->OSXGetCTFont(), NULL);
 #else
     ATSFontRef fontRef;
     
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
new file mode 100644
index 0000000..5169601
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
@@ -0,0 +1,107 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/dcgraph.h>
+#include <wx/renderer.h>
+
+#include <Carbon/Carbon.h>
+
+static int wxScrollbarPartToHIPressedState(wxScrollbarPart part)
+{
+    switch (part) {
+        case wxSCROLLPART_BACKBTNSTART:
+            return kThemeTopOutsideArrowPressed;
+        case wxSCROLLPART_BACKBTNEND:
+            return kThemeTopOutsideArrowPressed; // This does not make much sense.  For some reason the outside constant is required.
+        case wxSCROLLPART_FWDBTNSTART:
+            return kThemeTopInsideArrowPressed;
+        case wxSCROLLPART_FWDBTNEND:
+            return kThemeBottomOutsideArrowPressed;
+        case wxSCROLLPART_THUMB:
+            return kThemeThumbPressed;
+        default:
+            return 0;
+    }
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* WXUNUSED(window), wxDC& dc,
+                             const wxRect& rect, wxOrientation orient, int current,
+                             wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    const wxCoord x = rect.x;
+    const wxCoord y = rect.y;
+    const wxCoord w = rect.width;
+    const wxCoord h = rect.height;
+
+    dc.SetBrush( *wxWHITE_BRUSH );
+    dc.SetPen( *wxTRANSPARENT_PEN );
+    dc.DrawRectangle(rect);
+    
+    dc.SetBrush( *wxTRANSPARENT_BRUSH );
+
+    HIRect hiRect = CGRectMake( x, y, w, h );
+
+    CGContextRef cgContext = NULL;
+    wxGraphicsContext* gc = NULL;
+#if wxCHECK_VERSION(2,9,0)
+    wxGCDCImpl *impl = dynamic_cast<wxGCDCImpl*> (dc.GetImpl());
+    if (impl)
+        gc = impl->GetGraphicsContext();
+#else
+    gc = dc.GetGraphicsContext();
+#endif
+    if (gc)
+        cgContext = (CGContextRef) gc->GetNativeContext();
+    
+    if (cgContext)
+    {
+        HIThemeTrackDrawInfo trackInfo;
+        trackInfo.version = 0;
+        trackInfo.kind = kThemeMediumScrollBar;
+        trackInfo.bounds = hiRect;
+        trackInfo.min = 0;
+        trackInfo.max = max;
+        trackInfo.value = current;
+        trackInfo.trackInfo.scrollbar.viewsize = step;
+        trackInfo.attributes = 0;
+        if (orient == wxHORIZONTAL)
+            trackInfo.attributes |= kThemeTrackHorizontal;
+        trackInfo.enableState = (flags & wxCONTROL_FOCUSED) ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.trackInfo.scrollbar.pressState = wxScrollbarPartToHIPressedState(focusPart);
+        trackInfo.attributes |= kThemeTrackShowThumb;
+        
+        if (flags & wxCONTROL_DISABLED)
+            trackInfo.enableState = kThemeTrackDisabled;
+        
+        HIThemeDrawTrack(&trackInfo, 0, cgContext, kHIThemeOrientationNormal);
+    }
+}
diff --git a/WebCore/platform/wx/wxcode/scrollbar_render.h b/WebCore/platform/wx/wxcode/scrollbar_render.h
new file mode 100644
index 0000000..7a0ba1c
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/scrollbar_render.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef scrollbar_render_h
+#define scrollbar_render_h
+
+#include <wx/defs.h>
+#include <wx/dc.h>
+#include <wx/renderer.h>
+
+enum wxScrollbarPart {
+    wxSCROLLPART_NONE = 0,
+    wxSCROLLPART_BACKBTNSTART = 1,
+    wxSCROLLPART_FWDBTNSTART = 1 << 1,
+    wxSCROLLPART_BACKTRACK = 1 << 2,
+    wxSCROLLPART_THUMB = 1 << 3,
+    wxSCROLLPART_FWDTRACK = 1 << 4,
+    wxSCROLLPART_BACKBTNEND = 1 << 5,
+    wxSCROLLPART_FWDBTNEND = 1 << 6,
+    wxSCROLLPART_SCROLLBARBG = 1 << 7,
+    wxSCROLLPART_TRACKBG = 1 << 8,
+    wxSCROLLPART_ALL = 0xffffffff,
+};
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc, 
+                                       const wxRect& rect, 
+                                       wxOrientation orientation, 
+                                       int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, 
+                                       int max, int step, int flags=0);
+
+inline void calcThumbStartAndLength(int physicalLength, int virtualLength, int current, 
+                                int step, int *thumbStart, int *thumbLength)
+{
+        float proportion = (float)physicalLength / virtualLength;
+        float scale = (float)virtualLength / physicalLength;
+        int thumbSize = proportion * physicalLength;
+        int currentPos = current / scale;
+        
+        if (thumbStart)
+            *thumbStart = currentPos;
+        
+        if (thumbLength)
+            *thumbLength = thumbSize;
+}
+#endif
diff --git a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
index d2513d7..72fcc54 100644
--- a/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/win/non-kerned-drawing.cpp
@@ -79,13 +79,24 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
 
     // get the native HDC handle to draw using native APIs
     HDC hdc = 0;
+    float y = point.y() - font->ascent();
+    float x = point.x();
+
 #if USE(WXGC)
+    // when going from GdiPlus -> Gdi, any GdiPlus transformations are lost
+    // so we need to alter the coordinates to reflect their transformed point.
+    double xtrans = 0;
+    double ytrans = 0;
+    
     wxGraphicsContext* gc = dc->GetGraphicsContext();
+    gc->GetTransform().TransformPoint(&xtrans, &ytrans);
     Gdiplus::Graphics* g;
     if (gc) {
         g = (Gdiplus::Graphics*)gc->GetNativeContext();
         hdc = g->GetHDC();
     }
+    x += (int)xtrans;
+    y += (int)ytrans;    
 #else
     hdc = static_cast<HDC>(dc->GetHDC());
 #endif
@@ -95,9 +106,6 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     const GlyphBufferGlyph*   glyphs   = glyphBuffer.glyphs(from);
     const GlyphBufferAdvance* advances = glyphBuffer.advances(from);
 
-    float y = point.y() - font->ascent();
-    float x = point.x();
-
     int* spacing = new int[numGlyphs - from];
     for (unsigned i = 0; i < numGlyphs; ++i)
         spacing[i] = advances[i].width();
diff --git a/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
new file mode 100644
index 0000000..4d6bbc0
--- /dev/null
+++ b/WebCore/platform/wx/wxcode/win/scrollbar_render.cpp
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2009 Kevin Ollivier  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "scrollbar_render.h"
+
+#include <wx/defs.h>
+
+#include <wx/dc.h>
+#include <wx/renderer.h>
+#include <wx/window.h>
+
+#include <wx/msw/private.h>
+#include <wx/msw/uxtheme.h>
+
+// constants
+#define SP_BUTTON          1
+#define SP_THUMBHOR        2
+#define SP_THUMBVERT       3
+#define SP_TRACKENDHOR      4
+#define SP_TRACKENDVERT     7
+#define SP_GRIPPERHOR       8
+#define SP_GRIPPERVERT      9
+
+#define TS_NORMAL           1
+#define TS_HOVER            2
+#define TS_ACTIVE           3
+#define TS_DISABLED         4
+
+#define TS_UP_BUTTON       0
+#define TS_DOWN_BUTTON     4
+#define TS_LEFT_BUTTON     8
+#define TS_RIGHT_BUTTON    12
+
+#if wxUSE_GRAPHICS_CONTEXT
+// TODO remove this dependency (gdiplus needs the macros)
+// we need to undef because the macros are being defined in WebCorePrefix.h
+// but GdiPlus.h is not accepting them
+#undef max
+#define max(a,b)            (((a) > (b)) ? (a) : (b))
+
+#undef min
+#define min(a,b)            (((a) < (b)) ? (a) : (b))
+
+#include <wx/dcgraph.h>
+#include "gdiplus.h"
+using namespace Gdiplus;
+#endif // wxUSE_GRAPHICS_CONTEXT
+
+class GraphicsHDC
+{
+public:
+    GraphicsHDC(wxDC* dc)
+    {
+#if wxUSE_GRAPHICS_CONTEXT
+        m_graphics = NULL;
+        wxGCDC* gcdc = wxDynamicCast(dc, wxGCDC);
+        if (gcdc) {
+            m_graphics = (Graphics*)gcdc->GetGraphicsContext()->GetNativeContext();
+            m_hdc = m_graphics->GetHDC();
+        }
+        else
+#endif
+            m_hdc = GetHdcOf(*dc);
+    }
+
+    ~GraphicsHDC()
+    {
+#if wxUSE_GRAPHICS_CONTEXT
+        if (m_graphics)
+            m_graphics->ReleaseHDC(m_hdc);
+#endif
+    }
+
+    operator HDC() const { return m_hdc; }
+
+private:
+    HDC         m_hdc;
+#if wxUSE_GRAPHICS_CONTEXT
+    Graphics*   m_graphics;
+#endif
+};
+
+int getTSStateForPart(wxScrollbarPart part, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int flags = 0)
+{
+    int xpState = TS_NORMAL;
+    if (flags & wxCONTROL_DISABLED)
+        xpState = TS_DISABLED;
+    else if (part == focusPart)
+        xpState = TS_ACTIVE;
+    else if (part == hoverPart)
+        xpState = TS_HOVER;
+        
+    return xpState;
+}
+
+void wxRenderer_DrawScrollbar(wxWindow* window, wxDC& dc,
+                             const wxRect& rect, wxOrientation orient, int current, wxScrollbarPart focusPart, wxScrollbarPart hoverPart, int max, int step, int flags)
+{
+    wxUxThemeEngine *engine = wxUxThemeEngine::Get();
+    HTHEME hTheme = (HTHEME)engine->OpenThemeData(0, L"SCROLLBAR");
+
+    bool horiz = orient == wxHORIZONTAL;
+    int part = 0;
+    if (horiz)
+        part = SP_TRACKENDHOR;
+    else
+        part = SP_TRACKENDVERT;
+
+    int xpState = TS_NORMAL;
+    RECT r;
+    wxCopyRectToRECT(rect, r);
+
+    // Unlike Mac, on MSW you draw the scrollbar piece by piece.
+    // so we draw the track first, then the buttons
+    if (hTheme)
+    {
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &r, 0);
+
+        int buttonSize = 16;
+            
+        part = SP_BUTTON;
+        xpState = getTSStateForPart(wxSCROLLPART_BACKBTNSTART, focusPart, hoverPart, flags);
+        xpState += horiz ? TS_LEFT_BUTTON : TS_UP_BUTTON;
+        RECT buttonRect = r;
+        buttonRect.bottom = buttonRect.top + buttonSize;
+        buttonRect.right = buttonRect.left + buttonSize;
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+
+        xpState = getTSStateForPart(wxSCROLLPART_FWDBTNEND, focusPart, hoverPart, flags);
+        xpState += horiz ? TS_RIGHT_BUTTON : TS_DOWN_BUTTON;
+        buttonRect = r;
+        buttonRect.top = buttonRect.bottom - buttonSize;
+        buttonRect.left = buttonRect.right - buttonSize;
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+
+        part = horiz ? SP_THUMBHOR : SP_THUMBVERT;
+
+        int physicalLength = horiz ? rect.width : rect.height;
+        physicalLength -= buttonSize*2;
+        int thumbStart = 0;
+        int thumbLength = 0;
+        calcThumbStartAndLength(physicalLength, max + step, 
+                            current, step, &thumbStart, &thumbLength);
+        buttonRect = r;
+        if (horiz) {
+            buttonRect.left = thumbStart + buttonSize;
+            buttonRect.right = buttonRect.left + thumbLength;
+        } else {
+            buttonRect.top = thumbStart + buttonSize;
+            buttonRect.bottom = buttonRect.top + thumbLength;
+        }
+
+        xpState = getTSStateForPart(wxSCROLLPART_THUMB, focusPart, hoverPart, flags);
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+        
+        // draw the gripper
+        int thickness = ::GetSystemMetrics(SM_CXVSCROLL) / 2;
+        
+        buttonRect.left += ((buttonRect.right - buttonRect.left) - thickness) / 2;
+        buttonRect.top += ((buttonRect.bottom - buttonRect.top) - thickness) / 2;
+        buttonRect.right = buttonRect.left + thickness;
+        buttonRect.bottom = buttonRect.top + thickness;
+        
+        if (horiz)
+            part = SP_GRIPPERHOR;
+        else
+            part = SP_GRIPPERVERT;
+        
+        engine->DrawThemeBackground(hTheme, GraphicsHDC(&dc), part, xpState, &buttonRect, 0);
+    }
+}
diff --git a/WebCore/plugins/PluginDatabase.cpp b/WebCore/plugins/PluginDatabase.cpp
index 414f1ba..f7304df 100644
--- a/WebCore/plugins/PluginDatabase.cpp
+++ b/WebCore/plugins/PluginDatabase.cpp
@@ -29,6 +29,7 @@
 
 #include "Frame.h"
 #include "KURL.h"
+#include "PluginDatabaseClient.h"
 #include "PluginPackage.h"
 #include <stdlib.h>
 
@@ -41,6 +42,11 @@ namespace WebCore {
 
 typedef HashMap<String, RefPtr<PluginPackage> > PluginPackageByNameMap;
 
+PluginDatabase::PluginDatabase()
+    : m_client(0)
+{
+}
+
 PluginDatabase* PluginDatabase::installedPlugins(bool populate)
 {
     static PluginDatabase* plugins = 0;
@@ -116,9 +122,11 @@ bool PluginDatabase::refresh()
             remove(oldPackage.get());
         }
 
-        RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
-        if (package && add(package.release()))
-            pluginSetChanged = true;
+        if (!m_client || m_client->shouldLoadPluginAtPath(*it)) {
+            RefPtr<PluginPackage> package = PluginPackage::createPackage(*it, lastModified);
+            if (package && (!m_client || m_client->shouldLoadPluginPackage(package.get())) && add(package.release()))
+                pluginSetChanged = true;
+        }
     }
 
     // Cache all the paths we found with their timestamps for next time.
@@ -352,6 +360,8 @@ Vector<String> PluginDatabase::defaultPluginDirectories()
     paths.append("/usr/lib/netscape/plugins-libc6");
     paths.append("/usr/lib64/netscape/plugins");
     paths.append("/usr/lib64/mozilla/plugins");
+    paths.append("/usr/lib/nsbrowser/plugins");
+    paths.append("/usr/lib64/nsbrowser/plugins");
 
     String mozHome(getenv("MOZILLA_HOME"));
     mozHome.append("/plugins");
diff --git a/WebCore/plugins/PluginDatabase.h b/WebCore/plugins/PluginDatabase.h
index 14a6fb3..fe74682 100644
--- a/WebCore/plugins/PluginDatabase.h
+++ b/WebCore/plugins/PluginDatabase.h
@@ -46,12 +46,15 @@ namespace WebCore {
     class Frame;
     class IntSize;
     class KURL;
+    class PluginDatabaseClient;
     class PluginPackage;
 
     typedef HashSet<RefPtr<PluginPackage>, PluginPackageHash> PluginSet;
 
     class PluginDatabase {
     public:
+        PluginDatabase();
+
         // The first call to installedPlugins creates the plugin database
         // and by default populates it with the plugins installed on the system.
         // For testing purposes, it is possible to not populate the database
@@ -78,6 +81,11 @@ namespace WebCore {
             m_pluginDirectories = directories;
         }
 
+        void setClient(PluginDatabaseClient* client)
+        {
+            m_client = client;
+        }
+
         static Vector<String> defaultPluginDirectories();
         Vector<String> pluginDirectories() const { return m_pluginDirectories; }
 
@@ -103,6 +111,7 @@ namespace WebCore {
         friend class ::android::WebSettings;
 #endif
         HashMap<String, RefPtr<PluginPackage> > m_preferredPlugins;
+        PluginDatabaseClient* m_client;
     };
 
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginDatabaseClient.h b/WebCore/plugins/PluginDatabaseClient.h
new file mode 100644
index 0000000..b19ab83
--- /dev/null
+++ b/WebCore/plugins/PluginDatabaseClient.h
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2007 Marius Renn <damarvy@gmail.com> All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT
+ * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
+ * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef PluginDatabaseClient_h
+#define PluginDatabaseClient_h
+
+namespace WebCore {
+
+    class PluginPackage;
+    class String;
+
+    class PluginDatabaseClient {
+    public:
+        virtual ~PluginDatabaseClient() { }
+        virtual bool shouldLoadPluginAtPath(const String&) = 0;
+        virtual bool shouldLoadPluginPackage(const PluginPackage*) = 0;
+    };
+
+} // namespace WebCore
+
+#endif // PluginDatabaseClient_h
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index 7e8885d..258cbb7 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -189,6 +189,7 @@ void PluginPackage::determineQuirks(const String& mimeType)
 #if PLATFORM(QT)
             m_quirks.add(PluginQuirkRequiresGtkToolKit);
 #endif
+            m_quirks.add(PluginQuirkRequiresDefaultScreenDepth);
         } else {
             // Flash 9 and older requests windowless plugins if we return a mozilla user agent
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
diff --git a/WebCore/plugins/PluginQuirkSet.h b/WebCore/plugins/PluginQuirkSet.h
index b652c6e..de29baf 100644
--- a/WebCore/plugins/PluginQuirkSet.h
+++ b/WebCore/plugins/PluginQuirkSet.h
@@ -46,6 +46,7 @@ namespace WebCore {
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
+        PluginQuirkRequiresDefaultScreenDepth = 1 << 13
     };
 
     class PluginQuirkSet {
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index eeb4af4..02fcbce 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -51,6 +51,7 @@
 #include "PluginPackage.h"
 #include "ScriptController.h"
 #include "ScriptValue.h"
+#include "SecurityOrigin.h"
 #include "PluginDatabase.h"
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
@@ -143,8 +144,8 @@ void PluginView::setFrameRect(const IntRect& rect)
     // On Windows, always call plugin to change geometry.
     setNPWindowRect(rect);
 #elif XP_UNIX
-    // On Unix, only call plugin if it's full-page.
-    if (m_mode == NP_FULL)
+    // On Unix, multiple calls to setNPWindow() in windowed mode causes Flash to crash
+    if (m_mode == NP_FULL || !m_isWindowed)
         setNPWindowRect(rect);
 #endif
 }
@@ -163,10 +164,63 @@ void PluginView::handleEvent(Event* event)
         handleMouseEvent(static_cast<MouseEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
 #if defined(ANDROID_PLUGINS)
     else if (event->isTouchEvent())
         handleTouchEvent(static_cast<TouchEvent*>(event));
+=======
+#if defined(Q_WS_X11)
+    else if (event->type() == eventNames().DOMFocusOutEvent)
+        handleFocusOutEvent();
+    else if (event->type() == eventNames().DOMFocusInEvent)
+        handleFocusInEvent();
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 #endif
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
+=======
+}
+
+void PluginView::init()
+{
+    if (m_haveInitialized)
+        return;
+
+    m_haveInitialized = true;
+
+    if (!m_plugin) {
+        ASSERT(m_status == PluginStatusCanNotFindPlugin);
+        return;
+    }
+
+    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
+
+    if (!m_plugin->load()) {
+        m_plugin = 0;
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    if (!startOrAddToUnstartedList()) {
+        m_status = PluginStatusCanNotLoadPlugin;
+        return;
+    }
+
+    m_status = PluginStatusLoadedSuccessfully;
+}
+
+bool PluginView::startOrAddToUnstartedList()
+{
+    if (!m_parentFrame->page())
+        return false;
+
+    if (!m_parentFrame->page()->canStartPlugins()) {
+        m_parentFrame->page()->addUnstartedPlugin(this);
+        m_isWaitingToStart = true;
+        return true;
+    }
+
+    return start();
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 }
 
 
@@ -212,16 +266,58 @@ bool PluginView::start()
 
     m_status = PluginStatusLoadedSuccessfully;
 
-    platformStart();
+    if (!platformStart())
+        m_status = PluginStatusCanNotLoadPlugin;
+
+    if (m_status != PluginStatusLoadedSuccessfully)
+        return false;
+
+    if (parentFrame()->page())
+        parentFrame()->page()->didStartPlugin(this);
 
     return true;
 }
 
+PluginView::~PluginView()
+{
+    LOG(Plugins, "PluginView::~PluginView()");
+
+    removeFromUnstartedListIfNecessary();
+
+    stop();
+
+    deleteAllValues(m_requests);
+
+    freeStringArray(m_paramNames, m_paramCount);
+    freeStringArray(m_paramValues, m_paramCount);
+
+    platformDestroy();
+
+    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
+
+    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
+        m_plugin->unload();
+}
+
+void PluginView::removeFromUnstartedListIfNecessary()
+{
+    if (!m_isWaitingToStart)
+        return;
+
+    if (!m_parentFrame->page())
+        return;
+
+    m_parentFrame->page()->removeUnstartedPlugin(this);
+}
+
 void PluginView::stop()
 {
     if (!m_isStarted)
         return;
 
+    if (parentFrame()->page())
+        parentFrame()->page()->didStopPlugin(this);
+
     LOG(Plugins, "PluginView::stop(): Stopping plug-in '%s'", m_plugin->name().utf8().data());
 
     HashSet<RefPtr<PluginStream> > streams = m_streams;
@@ -236,7 +332,13 @@ void PluginView::stop()
     m_isStarted = false;
 #if USE(JSC)
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
+<<<<<<< HEAD:WebCore/plugins/PluginView.cpp
 #endif
+=======
+
+#if ENABLE(NETSCAPE_PLUGIN_API)
+#if !PLATFORM(WX) // FIXME: Revisit this when implementing plugins for wx
+>>>>>>> webkit.org at 49305:WebCore/plugins/PluginView.cpp
 #ifdef XP_WIN
     // Unsubclass the window
     if (m_isWindowed) {
@@ -253,6 +355,8 @@ void PluginView::stop()
 #endif
     }
 #endif // XP_WIN
+#endif // !PLATFORM(WX)
+#endif // ENABLE(NETSCAPE_PLUGIN_API)
 
 #if !defined(XP_MACOSX)
     // Clear the window
@@ -332,33 +436,11 @@ static bool getString(ScriptController* proxy, JSValue result, String& string)
 }
 #endif
 
-bool PluginView::startOrAddToUnstartedList()
-{
-    if (!m_parentFrame->page())
-        return false;
-
-    if (!m_parentFrame->page()->canStartPlugins()) {
-        m_parentFrame->page()->addUnstartedPlugin(this);
-        m_isWaitingToStart = true;
-        return true;
-    }
-
-    return start();
-}
-
-void PluginView::removeFromUnstartedListIfNecessary()
+void PluginView::performRequest(PluginRequest* request)
 {
-    if (!m_isWaitingToStart)
-        return;
-
-    if (!m_parentFrame->page())
+    if (!m_isStarted)
         return;
 
-    m_parentFrame->page()->removeUnstartedPlugin(this);
-}
-
-void PluginView::performRequest(PluginRequest* request)
-{
     // don't let a plugin start any loads if it is no longer part of a document that is being 
     // displayed unless the loads are in the same frame as the plugin.
     const String& targetFrameName = request->frameLoadRequest().frameName();
@@ -473,9 +555,8 @@ NPError PluginView::load(const FrameLoadRequest& frameLoadRequest, bool sendNoti
         // For security reasons, only allow JS requests to be made on the frame that contains the plug-in.
         if (!targetFrameName.isNull() && m_parentFrame->tree()->find(targetFrameName) != m_parentFrame)
             return NPERR_INVALID_PARAM;
-    } else if (!FrameLoader::canLoad(url, String(), m_parentFrame->document())) {
+    } else if (!SecurityOrigin::canLoad(url, String(), m_parentFrame->document()))
             return NPERR_GENERIC_ERROR;
-    }
 
     PluginRequest* request = new PluginRequest(frameLoadRequest, sendNotification, notifyData, arePopupsAllowed());
     scheduleRequest(request);
@@ -794,7 +875,7 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_isTransparent(false)
     , m_haveInitialized(false)
     , m_isWaitingToStart(false)
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
     , m_needsXEmbed(false)
 #endif
 #if PLATFORM(WIN_OS) && !PLATFORM(WX) && ENABLE(NETSCAPE_PLUGIN_API)
@@ -811,6 +892,13 @@ PluginView::PluginView(Frame* parentFrame, const IntSize& size, PluginPackage* p
     , m_drawingModel(NPDrawingModel(-1))
     , m_eventModel(NPEventModel(-1))
 #endif
+#if defined(Q_WS_X11)
+    , m_hasPendingGeometryChange(false)
+    , m_drawable(0)
+    , m_visual(0)
+    , m_colormap(0)
+    , m_pluginDisplay(0)
+#endif
     , m_loadManually(loadManually)
     , m_manualStream(0)
     , m_isJavaScriptPaused(false)
@@ -1211,7 +1299,12 @@ static const char* MozillaUserAgent = "Mozilla/5.0 ("
 #elif defined(XP_WIN)
         "Windows; U; Windows NT 5.1;"
 #elif defined(XP_UNIX)
-        "X11; U; Linux i686;"
+// The Gtk port uses X11 plugins in Mac.
+#if PLATFORM(DARWIN) && PLATFORM(GTK)
+    "X11; U; Intel Mac OS X;"
+#else
+    "X11; U; Linux i686;"
+#endif
 #endif
         " en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0";
 
@@ -1233,4 +1326,10 @@ const char* PluginView::userAgentStatic()
 }
 #endif
 
+
+Node* PluginView::node() const
+{
+    return m_element;
+}
+
 } // namespace WebCore
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index f88bfdf..0fd0d4f 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -30,6 +30,7 @@
 
 #include "CString.h"
 #include "FrameLoadRequest.h"
+#include "HaltablePlugin.h"
 #include "IntRect.h"
 #include "KURL.h"
 #include "PlatformString.h"
@@ -120,7 +121,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader {
+    class PluginView : public Widget, private PluginStreamClient, public PluginManualLoader, private HaltablePlugin {
     public:
         static PassRefPtr<PluginView> create(Frame* parentFrame, const IntSize&, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
         virtual ~PluginView();
@@ -216,6 +217,11 @@ namespace WebCore {
         void didFinishLoading();
         void didFail(const ResourceError&);
 
+        // HaltablePlugin
+        virtual void halt();
+        virtual void restart();
+        virtual Node* node() const;
+
         static bool isCallingPlugin();
 
 #ifdef ANDROID_PLUGINS
@@ -232,8 +238,9 @@ namespace WebCore {
         bool startOrAddToUnstartedList();
         void removeFromUnstartedListIfNecessary();
         void init();
-        void platformStart();
+        bool platformStart();
         void stop();
+        void platformDestroy();
         static void setCurrentPluginView(PluginView*);
         NPError load(const FrameLoadRequest&, bool sendNotification, void* notifyData);
         NPError handlePost(const char* url, const char* target, uint32 len, const char* buf, bool file, void* notifyData, bool sendNotification, bool allowHeaders);
@@ -276,6 +283,10 @@ namespace WebCore {
 
         void handleKeyboardEvent(KeyboardEvent*);
         void handleMouseEvent(MouseEvent*);
+#if defined(Q_WS_X11)
+        void handleFocusInEvent();
+        void handleFocusOutEvent();
+#endif
 
 #ifdef ANDROID_PLUGINS
         void handleTouchEvent(TouchEvent*);
@@ -310,7 +321,7 @@ namespace WebCore {
         bool m_haveInitialized;
         bool m_isWaitingToStart;
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         bool m_needsXEmbed;
 #endif
 
@@ -340,12 +351,13 @@ public:
         PlatformPluginWidget platformPluginWidget() const { return m_window; } // MANUAL MERGE FIXME
 #else
 public:
+        void setPlatformPluginWidget(PlatformPluginWidget widget) { setPlatformWidget(widget); }
         PlatformPluginWidget platformPluginWidget() const { return platformWidget(); }
 #endif
 
 private:
 
-#if PLATFORM(GTK) || defined(Q_WS_X11)
+#if defined(XP_UNIX) || defined(Q_WS_X11)
         void setNPWindowIfNeeded();
 #elif defined(XP_MACOSX)
         NP_CGContext m_npCgContext;
@@ -360,6 +372,12 @@ private:
 
 #if defined(Q_WS_X11)
         bool m_hasPendingGeometryChange;
+        Pixmap m_drawable;
+        Visual* m_visual;
+        Colormap m_colormap;
+        Display* m_pluginDisplay;
+
+        void initXEvent(XEvent* event);
 #endif
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
diff --git a/WebCore/plugins/PluginViewNone.cpp b/WebCore/plugins/PluginViewNone.cpp
index be79567..d4601d4 100644
--- a/WebCore/plugins/PluginViewNone.cpp
+++ b/WebCore/plugins/PluginViewNone.cpp
@@ -114,12 +114,14 @@ void PluginView::forceRedraw()
     notImplemented();
 }
 
-PluginView::~PluginView()
+bool PluginView::platformStart()
 {
     notImplemented();
+
+    return true;
 }
 
-void PluginView::init()
+void PluginView::platformDestroy()
 {
     notImplemented();
 }
@@ -134,9 +136,12 @@ void PluginView::updatePluginWidget()
     notImplemented();
 }
 
-void PluginView::platformStart()
+void PluginView::halt()
+{
+}
+
+void PluginView::restart()
 {
-    notImplemented();
 }
 
 } // namespace WebCore
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index 4dd2b32..bc3a622 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -59,11 +59,10 @@
 #include <gdkconfig.h>
 #include <gtk/gtk.h>
 
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
 #include "gtk2xtbin.h"
 #include <gdk/gdkx.h>
-#endif
-#ifdef GDK_WINDOWING_WIN32
+#elif defined(GDK_WINDOWING_WIN32)
 #include "PluginMessageThrottlerWin.h"
 #include <gdk/gdkwin32.h>
 #endif
@@ -228,7 +227,7 @@ void PluginView::setNPWindowIfNeeded()
 
     GtkAllocation allocation = { m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height() };
     gtk_widget_size_allocate(platformPluginWidget(), &allocation);
-#if PLATFORM(X11)
+#if PLATFORM(XP_UNIX)
     if (!m_needsXEmbed) {
         gtk_xtbin_set_position(GTK_XTBIN(platformPluginWidget()), m_windowRect.x(), m_windowRect.y());
         gtk_xtbin_resize(platformPluginWidget(), m_windowRect.width(), m_windowRect.height());
@@ -293,7 +292,7 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVToolkit:
-#if PLATFORM(GTK)
+#if defined(XP_UNIX)
         *static_cast<uint32*>(value) = 2;
 #else
         *static_cast<uint32*>(value) = 0;
@@ -301,7 +300,7 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         return NPERR_NO_ERROR;
 
     case NPNVSupportsXEmbedBool:
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         *static_cast<NPBool*>(value) = true;
 #else
         *static_cast<NPBool*>(value) = false;
@@ -323,7 +322,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     switch (variable) {
     case NPNVxDisplay:
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         if (m_needsXEmbed)
             *(void **)value = (void *)GDK_DISPLAY();
         else
@@ -333,7 +332,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         return NPERR_GENERIC_ERROR;
 #endif
 
-#if PLATFORM(X11)
+#if PLATFORM(XP_UNIX)
     case NPNVxtAppContext:
         if (!m_needsXEmbed) {
             *(void **)value = XtDisplayToApplicationContext (GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay);
@@ -381,13 +380,13 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 #endif
 
         case NPNVnetscapeWindow: {
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
             void* w = reinterpret_cast<void*>(value);
-            *((XID *)w) = GDK_WINDOW_XWINDOW(m_parentFrame->view()->hostWindow()->platformWindow()->window);
+            *((XID *)w) = GDK_WINDOW_XWINDOW(m_parentFrame->view()->hostWindow()->platformPageClient()->window);
 #endif
 #ifdef GDK_WINDOWING_WIN32
             HGDIOBJ* w = reinterpret_cast<HGDIOBJ*>(value);
-            *w = GDK_WINDOW_HWND(m_parentFrame->view()->hostWindow()->platformWindow()->window);
+            *w = GDK_WINDOW_HWND(m_parentFrame->view()->hostWindow()->platformPageClient()->window);
 #endif
             return NPERR_NO_ERROR;
         }
@@ -429,22 +428,7 @@ void PluginView::forceRedraw()
     if (m_isWindowed)
         gtk_widget_queue_draw(platformPluginWidget());
     else
-        gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformWindow());
-}
-
-PluginView::~PluginView()
-{
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
+        gtk_widget_queue_draw(m_parentFrame->view()->hostWindow()->platformPageClient());
 }
 
 static gboolean
@@ -453,27 +437,10 @@ plug_removed_cb(GtkSocket *socket, gpointer)
     return TRUE;
 }
 
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
@@ -484,22 +451,22 @@ void PluginView::init()
         PluginView::setCurrentPluginView(0);
     }
 
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
     if (m_needsXEmbed) {
         setPlatformWidget(gtk_socket_new());
-        gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformWindow()), platformPluginWidget());
+        gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformPageClient()), platformPluginWidget());
         g_signal_connect(platformPluginWidget(), "plug_removed", G_CALLBACK(plug_removed_cb), NULL);
     } else if (m_isWindowed)
-        setPlatformWidget(gtk_xtbin_new(m_parentFrame->view()->hostWindow()->platformWindow()->window, 0));
+        setPlatformWidget(gtk_xtbin_new(m_parentFrame->view()->hostWindow()->platformPageClient()->window, 0));
 #else
     setPlatformWidget(gtk_socket_new());
-    gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformWindow()), platformPluginWidget());
+    gtk_container_add(GTK_CONTAINER(m_parentFrame->view()->hostWindow()->platformPageClient()), platformPluginWidget());
 #endif
     show();
 
     if (m_isWindowed) {
         m_npWindow.type = NPWindowTypeWindow;
-#if PLATFORM(X11)
+#if defined(XP_UNIX)
         NPSetWindowCallbackStruct *ws = new NPSetWindowCallbackStruct();
 
         ws->type = 0;
@@ -533,10 +500,18 @@ void PluginView::init()
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall)))
         updatePluginWidget(); // was: setNPWindowIfNeeded(), but this doesn't produce 0x0 rects at first go
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+}
+
+void PluginView::halt()
+{
 }
 
-void PluginView::platformStart()
+void PluginView::restart()
 {
 }
 
diff --git a/WebCore/plugins/mac/PluginPackageMac.cpp b/WebCore/plugins/mac/PluginPackageMac.cpp
index bf6a81b..d242fb8 100644
--- a/WebCore/plugins/mac/PluginPackageMac.cpp
+++ b/WebCore/plugins/mac/PluginPackageMac.cpp
@@ -246,9 +246,6 @@ bool PluginPackage::fetchInfo()
 
 bool PluginPackage::isPluginBlacklisted()
 {
-    if (name() == "Silverlight Plug-In" || name().startsWith("QuickTime Plug-in"))
-        return true;
-
     return false;
 }
 
diff --git a/WebCore/plugins/mac/PluginViewMac.cpp b/WebCore/plugins/mac/PluginViewMac.cpp
index 26f9eba..0ab91d1 100644
--- a/WebCore/plugins/mac/PluginViewMac.cpp
+++ b/WebCore/plugins/mac/PluginViewMac.cpp
@@ -75,6 +75,7 @@ using JSC::UString;
 #if PLATFORM(QT)
 #include <QWidget>
 #include <QKeyEvent>
+#include "QWebPageClient.h"
 QT_BEGIN_NAMESPACE
 #if QT_VERSION < 0x040500
 extern Q_GUI_EXPORT WindowPtr qt_mac_window_for(const QWidget* w);
@@ -125,30 +126,10 @@ static inline IntPoint topLevelOffsetFor(PlatformWidget widget)
 
 // --------------- Lifetime management -----------------
 
-void PluginView::init()
+bool PluginView::platformStart()
 {
-    LOG(Plugins, "PluginView::init(): Initializing plug-in '%s'", m_plugin->name().utf8().data());
-
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        stop(); // Make sure we unregister the plugin
-        return;
-    }
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_drawingModel == NPDrawingModel(-1)) {
         // We default to QuickDraw, even though we don't support it,
@@ -180,8 +161,7 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported event model %s",
                 m_plugin->name().utf8().data(), prettyNameForEventModel(m_eventModel));
-        stop();
-        return;
+        return false;
     }
 
     if (getValueStatic(NPNVariable(NPNVsupportsQuickDrawBool + m_drawingModel), &drawingModelSupported) != NPERR_NO_ERROR
@@ -189,38 +169,30 @@ void PluginView::init()
         m_status = PluginStatusCanNotLoadPlugin;
         LOG(Plugins, "Plug-in '%s' uses unsupported drawing model %s",
                 m_plugin->name().utf8().data(), prettyNameForDrawingModel(m_drawingModel));
-        stop();
-        return;
+        return false;
     }
 
-    setPlatformPluginWidget(m_parentFrame->view()->hostWindow()->platformWindow());
+#if PLATFORM(QT)
+    if (QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient()) {
+        if (QWidget* window = QWidget::find(client->winId())) {
+            setPlatformPluginWidget(window);
+        }
+    }
+#endif
 
     show();
 
-    m_status = PluginStatusLoadedSuccessfully;
-
     // TODO: Implement null timer throttling depending on plugin activation
     m_nullEventTimer.set(new Timer<PluginView>(this, &PluginView::nullEventTimerFired));
     m_nullEventTimer->startRepeating(0.02);
+
+    return true;
 }
 
-PluginView::~PluginView()
+void PluginView::platformDestroy()
 {
-    LOG(Plugins, "PluginView::~PluginView()");
-
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    m_window = 0;
+    if (platformPluginWidget())
+        setPlatformPluginWidget(0);
 }
 
 // Used before the plugin view has been initialized properly, and as a
@@ -456,6 +428,14 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
 
     setNPWindowIfNeeded();
 
+    CGContextRef cgContext = m_npCgContext.context;
+    if (!cgContext)
+        return;
+
+    CGContextSaveGState(cgContext);
+    IntPoint offset = frameRect().location();
+    CGContextTranslateCTM(cgContext, offset.x(), offset.y());
+
     EventRecord event;
     event.what = updateEvt;
     event.message = (long unsigned int)m_npCgContext.window;
@@ -464,15 +444,10 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     event.where.v = 0;
     event.modifiers = GetCurrentKeyModifiers();
 
-    CGContextRef cg = m_npCgContext.context;
-    CGContextSaveGState(cg);
-    IntPoint offset = frameRect().location();
-    CGContextTranslateCTM(cg, offset.x(), offset.y());
-
     if (!dispatchNPEvent(event))
         LOG(Events, "PluginView::paint(): Paint event not accepted");
 
-    CGContextRestoreGState(cg);
+    CGContextRestoreGState(cgContext);
 }
 
 void PluginView::invalidateRect(const IntRect& rect)
@@ -717,10 +692,13 @@ NPError PluginView::handlePostReadFile(Vector<char>& buffer, uint32 len, const c
     return NPERR_NO_ERROR;
 }
 
-void PluginView::platformStart()
+void PluginView::halt()
 {
 }
 
+void PluginView::restart()
+{
+}
 
 } // namespace WebCore
 
diff --git a/WebCore/plugins/qt/PluginPackageQt.cpp b/WebCore/plugins/qt/PluginPackageQt.cpp
index b9c1656..8119924 100644
--- a/WebCore/plugins/qt/PluginPackageQt.cpp
+++ b/WebCore/plugins/qt/PluginPackageQt.cpp
@@ -63,7 +63,7 @@ bool PluginPackage::fetchInfo()
     String s = gm();
     Vector<String> types;
     s.split(UChar(';'), false, types);
-    for (int i = 0; i < types.size(); ++i) {
+    for (unsigned i = 0; i < types.size(); ++i) {
         Vector<String> mime;
         types[i].split(UChar(':'), true, mime);
         if (mime.size() > 0) {
@@ -80,6 +80,16 @@ bool PluginPackage::fetchInfo()
     return true;
 }
 
+static NPError staticPluginQuirkRequiresGtkToolKit_NPN_GetValue(NPP instance, NPNVariable variable, void* value)
+{
+    if (variable == NPNVToolkit) {
+        *static_cast<uint32*>(value) = 2;
+        return NPERR_NO_ERROR;
+    }
+
+    return NPN_GetValue(instance, variable, value);
+}
+
 bool PluginPackage::load()
 {
     if (m_isLoaded) {
@@ -111,6 +121,12 @@ bool PluginPackage::load()
 
     initializeBrowserFuncs();
 
+    if (m_path.contains("npwrapper.")) {
+        // nspluginwrapper relies on the toolkit value to know if glib is available
+        // It does so in NP_Initialize with a null instance, therefore it is done this way:
+        m_browserFuncs.getvalue = staticPluginQuirkRequiresGtkToolKit_NPN_GetValue;
+    }
+
 #if defined(XP_UNIX)
     npErr = NP_Initialize(&m_browserFuncs, &m_pluginFuncs);
 #else
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index a02a8fd..27639e1 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  * Copyright (C) 2008 Collabora Ltd. All rights reserved.
+ * Copyright (C) 2009 Girish Ramakrishnan <girish@forwardbias.in>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +31,8 @@
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
+#include "FloatPoint.h"
+#include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoader.h"
@@ -56,12 +59,21 @@
 #include "npruntime_impl.h"
 #include "runtime.h"
 #include "runtime_root.h"
+#include "QWebPageClient.h"
+#include <QApplication>
+#include <QDesktopWidget>
 #include <QKeyEvent>
+#include <QPainter>
 #include <QWidget>
 #include <QX11Info>
 #include <runtime/JSLock.h>
 #include <runtime/JSValue.h>
 #include <X11/X.h>
+#ifndef QT_NO_XRENDER
+#define Bool int
+#define Status int
+#include <X11/extensions/Xrender.h>
+#endif
 
 using JSC::ExecState;
 using JSC::Interpreter;
@@ -79,7 +91,7 @@ using namespace HTMLNames;
 
 void PluginView::updatePluginWidget()
 {
-    if (!parent() || !m_isWindowed || !platformPluginWidget())
+    if (!parent())
         return;
 
     ASSERT(parent()->isFrameView());
@@ -95,6 +107,15 @@ void PluginView::updatePluginWidget()
     if (m_windowRect == oldWindowRect && m_clipRect == oldClipRect)
         return;
 
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (!m_isWindowed) {
+        m_drawable = XCreatePixmap(QX11Info::display(), QX11Info::appRootWindow(), m_windowRect.width(), m_windowRect.height(), 
+                                   ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
+        QApplication::syncX(); // make sure that the server knows about the Drawable
+    }
+
     // do not call setNPWindowIfNeeded immediately, will be called on paint()
     m_hasPendingGeometryChange = true;
 
@@ -149,8 +170,67 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (context->paintingDisabled())
         return;
 
-    if (m_isWindowed && platformPluginWidget())
-        setNPWindowIfNeeded();
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed || !m_drawable)
+        return;
+
+    const bool syncX = m_pluginDisplay && m_pluginDisplay != QX11Info::display();
+
+    QPainter* painter = context->platformContext();
+
+    QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
+    const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
+    ASSERT(drawableDepth == qtDrawable.depth());
+
+    if (m_isTransparent && drawableDepth != 32) {
+        // Attempt content propagation for drawable with no alpha by copying over from the backing store
+        QPoint offset;
+        QPaintDevice* backingStoreDevice =  QPainter::redirected(painter->device(), &offset);
+        offset = -offset; // negating the offset gives us the offset of the view within the backing store pixmap
+
+        const bool hasValidBackingStore = backingStoreDevice && backingStoreDevice->devType() == QInternal::Pixmap;
+        QPixmap* backingStorePixmap = static_cast<QPixmap*>(backingStoreDevice);
+
+        // We cannot grab contents from the backing store when painting on QGraphicsView items
+        // (because backing store contents are already transformed). What we really mean to do 
+        // here is to check if we are painting on QWebView, but let's be a little permissive :)
+        QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+        const bool backingStoreHasUntransformedContents = qobject_cast<QWidget*>(client->pluginParent());
+
+        if (hasValidBackingStore && backingStorePixmap->depth() == drawableDepth 
+            && backingStoreHasUntransformedContents) {
+            GC gc = XDefaultGC(QX11Info::display(), QX11Info::appScreen());
+            XCopyArea(QX11Info::display(), backingStorePixmap->handle(), m_drawable, gc,
+                offset.x() + m_windowRect.x() + m_clipRect.x(), offset.y() + m_windowRect.y() + m_clipRect.y(),
+                m_clipRect.width(), m_clipRect.height(), m_clipRect.x(), m_clipRect.y());
+        } else { // no backing store, clean the pixmap because the plugin thinks its transparent
+            QPainter painter(&qtDrawable);
+            painter.fillRect(m_clipRect, Qt::white);
+        }
+
+        if (syncX)
+            QApplication::syncX();
+    }
+
+    XEvent xevent;
+    memset(&xevent, 0, sizeof(XEvent));
+    XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
+    exposeEvent.type = GraphicsExpose;
+    exposeEvent.display = QX11Info::display();
+    exposeEvent.drawable = m_drawable;
+    exposeEvent.x = m_clipRect.x();
+    exposeEvent.y = m_clipRect.y();
+    exposeEvent.width = m_clipRect.x() + m_clipRect.width(); // flash bug? it thinks width is the right
+    exposeEvent.height = m_clipRect.y() + m_clipRect.height(); // flash bug? it thinks height is the bottom
+
+    dispatchNPEvent(xevent);
+
+    if (syncX)
+        XSync(m_pluginDisplay, False); // sync changes by plugin
+
+    painter->drawPixmap(frameRect().x() + m_clipRect.x(), frameRect().y() + m_clipRect.y(), qtDrawable,
+        m_clipRect.x(), m_clipRect.y(), m_clipRect.width(), m_clipRect.height());
 }
 
 // TODO: Unify across ports.
@@ -163,42 +243,52 @@ bool PluginView::dispatchNPEvent(NPEvent& event)
     JSC::JSLock::DropAllLocks dropAllLocks(false);
 
     setCallingPlugin(true);
-    bool accepted = m_plugin->pluginFuncs();
+    bool accepted = m_plugin->pluginFuncs()->event(m_instance, &event);
     setCallingPlugin(false);
 
     return accepted;
 }
 
-void setSharedXEventFields(XEvent& xEvent, QWidget* hostWindow)
+void setSharedXEventFields(XEvent* xEvent, QWidget* hostWindow)
 {
-    xEvent.xany.serial = 0; // we are unaware of the last request processed by X Server
-    xEvent.xany.send_event = false;
-    xEvent.xany.display = hostWindow->x11Info().display();
-    // NOTE: event.xany.window doesn't always respond to the .window property of other XEvent's
+    xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
+    xEvent->xany.send_event = false;
+    xEvent->xany.display = hostWindow->x11Info().display();
+    // NOTE: event->xany.window doesn't always respond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
-    xEvent.xany.window = hostWindow->window()->handle();
+    xEvent->xany.window = hostWindow->window()->handle();
 }
 
-void setXKeyEventSpecificFields(XEvent& xEvent, KeyboardEvent* event)
+void PluginView::initXEvent(XEvent* xEvent)
+{
+    memset(xEvent, 0, sizeof(XEvent));
+
+    QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+    QWidget* window = QWidget::find(client->winId());
+    setSharedXEventFields(xEvent, window);
+}
+
+void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
 {
     QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
 
-    xEvent.xkey.root = QX11Info::appRootWindow();
-    xEvent.xkey.subwindow = 0; // we have no child window
-    xEvent.xkey.time = event->timeStamp();
-    xEvent.xkey.state = qKeyEvent->nativeModifiers();
-    xEvent.xkey.keycode = qKeyEvent->nativeScanCode();
-    xEvent.xkey.same_screen = true;
+    xEvent->type = (event->type() == eventNames().keydownEvent) ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
+    xEvent->xkey.root = QX11Info::appRootWindow();
+    xEvent->xkey.subwindow = 0; // we have no child window
+    xEvent->xkey.time = event->timeStamp();
+    xEvent->xkey.state = qKeyEvent->nativeModifiers();
+    xEvent->xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent->xkey.same_screen = true;
 
     // NOTE: As the XEvents sent to the plug-in are synthesized and there is not a native window
     // corresponding to the plug-in rectangle, some of the members of the XEvent structures are not
     // set to their normal Xserver values. e.g. Key events don't have a position.
     // source: https://developer.mozilla.org/en/NPEvent
-    xEvent.xkey.x = 0;
-    xEvent.xkey.y = 0;
-    xEvent.xkey.x_root = 0;
-    xEvent.xkey.y_root = 0;
+    xEvent->xkey.x = 0;
+    xEvent->xkey.y = 0;
+    xEvent->xkey.x_root = 0;
+    xEvent->xkey.y_root = 0;
 }
 
 void PluginView::handleKeyboardEvent(KeyboardEvent* event)
@@ -206,23 +296,147 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     if (m_isWindowed)
         return;
 
-    if (event->type() != "keydown" && event->type() != "keyup")
+    if (event->type() != eventNames().keydownEvent && event->type() != eventNames().keyupEvent)
         return;
 
-    XEvent npEvent; // On UNIX NPEvent is a typedef for XEvent.
-
-    npEvent.type = (event->type() == "keydown") ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
-    setSharedXEventFields(npEvent, m_parentFrame->view()->hostWindow()->platformWindow());
-    setXKeyEventSpecificFields(npEvent, event);
+    XEvent npEvent;
+    initXEvent(&npEvent);
+    setXKeyEventSpecificFields(&npEvent, event);
 
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
 }
 
+static unsigned int inputEventState(MouseEvent* event)
+{
+    unsigned int state = 0;
+    if (event->ctrlKey())
+        state |= ControlMask;
+    if (event->shiftKey())
+        state |= ShiftMask;
+    if (event->altKey())
+        state |= Mod1Mask;
+    if (event->metaKey())
+        state |= Mod4Mask;
+    return state;
+}
+
+static void setXButtonEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XButtonEvent& xbutton = xEvent->xbutton;
+    xbutton.type = event->type() == eventNames().mousedownEvent ? ButtonPress : ButtonRelease;
+    xbutton.root = QX11Info::appRootWindow();
+    xbutton.subwindow = 0;
+    xbutton.time = event->timeStamp();
+    xbutton.x = postZoomPos.x();
+    xbutton.y = postZoomPos.y();
+    xbutton.x_root = event->screenX();
+    xbutton.y_root = event->screenY();
+    xbutton.state = inputEventState(event);
+    switch (event->button()) {
+    case MiddleButton:
+        xbutton.button = Button2;
+        break;
+    case RightButton:
+        xbutton.button = Button3;
+        break;
+    case LeftButton:
+    default:
+        xbutton.button = Button1;
+        break;
+    }
+    xbutton.same_screen = true;
+}
+
+static void setXMotionEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XMotionEvent& xmotion = xEvent->xmotion;
+    xmotion.type = MotionNotify;
+    xmotion.root = QX11Info::appRootWindow();
+    xmotion.subwindow = 0;
+    xmotion.time = event->timeStamp();
+    xmotion.x = postZoomPos.x();
+    xmotion.y = postZoomPos.y();
+    xmotion.x_root = event->screenX();
+    xmotion.y_root = event->screenY();
+    xmotion.state = inputEventState(event);
+    xmotion.is_hint = NotifyNormal;
+    xmotion.same_screen = true;
+}
+
+static void setXCrossingEventSpecificFields(XEvent* xEvent, MouseEvent* event, const IntPoint& postZoomPos)
+{
+    XCrossingEvent& xcrossing = xEvent->xcrossing;
+    xcrossing.type = event->type() == eventNames().mouseoverEvent ? EnterNotify : LeaveNotify;
+    xcrossing.root = QX11Info::appRootWindow();
+    xcrossing.subwindow = 0;
+    xcrossing.time = event->timeStamp();
+    xcrossing.x = postZoomPos.y();
+    xcrossing.y = postZoomPos.x();
+    xcrossing.x_root = event->screenX();
+    xcrossing.y_root = event->screenY();
+    xcrossing.state = inputEventState(event);
+    xcrossing.mode = NotifyNormal;
+    xcrossing.detail = NotifyDetailNone;
+    xcrossing.same_screen = true;
+    xcrossing.focus = false;
+}
+
 void PluginView::handleMouseEvent(MouseEvent* event)
 {
     if (m_isWindowed)
         return;
+
+    if (event->type() == eventNames().mousedownEvent) {
+        // Give focus to the plugin on click
+        if (Page* page = m_parentFrame->page())
+            page->focusController()->setActive(true);
+
+        focusPluginElement();
+    }
+
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    IntPoint postZoomPos = roundedIntPoint(m_element->renderer()->absoluteToLocal(event->absoluteLocation()));
+
+    if (event->type() == eventNames().mousedownEvent || event->type() == eventNames().mouseupEvent)
+        setXButtonEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mousemoveEvent)
+        setXMotionEventSpecificFields(&npEvent, event, postZoomPos);
+    else if (event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mouseoverEvent)
+        setXCrossingEventSpecificFields(&npEvent, event, postZoomPos);
+    else
+        return;
+
+    if (!dispatchNPEvent(npEvent))
+        event->setDefaultHandled();
+}
+
+void PluginView::handleFocusInEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 9; /* int as Qt unsets FocusIn */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
+}
+
+void PluginView::handleFocusOutEvent()
+{
+    XEvent npEvent;
+    initXEvent(&npEvent);
+
+    XFocusChangeEvent& event = npEvent.xfocus;
+    event.type = 10; /* int as Qt unsets FocusOut */
+    event.mode = NotifyNormal;
+    event.detail = NotifyDetailNone;
+
+    dispatchNPEvent(npEvent);
 }
 
 void PluginView::setParent(ScrollView* parent)
@@ -235,7 +449,8 @@ void PluginView::setParent(ScrollView* parent)
 
 void PluginView::setNPWindowRect(const IntRect&)
 {
-    // Ignored as we don't want to move immediately.
+    if (!m_isWindowed)
+        setNPWindowIfNeeded();
 }
 
 void PluginView::setNPWindowIfNeeded()
@@ -251,28 +466,38 @@ void PluginView::setNPWindowIfNeeded()
         return;
     m_hasPendingGeometryChange = false;
 
-    ASSERT(platformPluginWidget());
-    platformPluginWidget()->setGeometry(m_windowRect);
-    // if setMask is set with an empty QRegion, no clipping will
-    // be performed, so in that case we hide the plugin view
-    platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
-    platformPluginWidget()->setMask(QRegion(m_clipRect));
+    if (m_isWindowed) {
+        ASSERT(platformPluginWidget());
+        platformPluginWidget()->setGeometry(m_windowRect);
+        // if setMask is set with an empty QRegion, no clipping will
+        // be performed, so in that case we hide the plugin view
+        platformPluginWidget()->setVisible(!m_clipRect.isEmpty());
+        platformPluginWidget()->setMask(QRegion(m_clipRect));
+
+        m_npWindow.x = m_windowRect.x();
+        m_npWindow.y = m_windowRect.y();
+
+        m_npWindow.clipRect.left = m_clipRect.x();
+        m_npWindow.clipRect.top = m_clipRect.y();
+        m_npWindow.clipRect.right = m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.height();
+    } else {
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+
+        m_npWindow.clipRect.left = 0;
+        m_npWindow.clipRect.top = 0;
+        m_npWindow.clipRect.right = 0;
+        m_npWindow.clipRect.bottom = 0;
+    }
 
     // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash.
-    if (m_npWindow.width == -1 || m_npWindow.height == -1) {
+    // setNPWindow() cause the plugin to crash in windowed mode.
+    if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
     }
 
-    m_npWindow.x = m_windowRect.x();
-    m_npWindow.y = m_windowRect.y();
-
-    m_npWindow.clipRect.left = m_clipRect.x();
-    m_npWindow.clipRect.top = m_clipRect.y();
-    m_npWindow.clipRect.right = m_clipRect.width();
-    m_npWindow.clipRect.bottom = m_clipRect.height();
-
     PluginView::setCurrentPluginView(this);
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
@@ -337,6 +562,10 @@ NPError PluginView::getValueStatic(NPNVariable variable, void* value)
         *static_cast<NPBool*>(value) = true;
         return NPERR_NO_ERROR;
 
+    case NPNVSupportsWindowless:
+        *static_cast<NPBool*>(value) = true;
+        return NPERR_NO_ERROR;
+
     default:
         return NPERR_GENERIC_ERROR;
     }
@@ -350,8 +579,11 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
     case NPNVxDisplay:
         if (platformPluginWidget())
             *(void **)value = platformPluginWidget()->x11Info().display();
-        else
-            *(void **)value = m_parentFrame->view()->hostWindow()->platformWindow()->x11Info().display();
+        else {
+            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+            QWidget* window = QWidget::find(client->winId());
+            *(void **)value = window->x11Info().display();
+        }
         return NPERR_NO_ERROR;
 
     case NPNVxtAppContext:
@@ -396,7 +628,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
     case NPNVnetscapeWindow: {
         void* w = reinterpret_cast<void*>(value);
-        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformWindow()->winId();
+        *((XID *)w) = m_parentFrame->view()->hostWindow()->platformPageClient()->winId();
         return NPERR_NO_ERROR;
     }
 
@@ -413,7 +645,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
-    if (platformWidget()) {
+    if (m_isWindowed) {
         platformWidget()->update(rect);
         return;
     }
@@ -423,59 +655,94 @@ void PluginView::invalidateRect(const IntRect& rect)
 
 void PluginView::invalidateRect(NPRect* rect)
 {
-    notImplemented();
+    if (!rect) {
+        invalidate();
+        return;
+    }
+    IntRect r(rect->left, rect->top, rect->right + rect->left, rect->bottom + rect->top);
+    invalidateWindowlessPluginRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
 {
-    notImplemented();
+    invalidate();
 }
 
 void PluginView::forceRedraw()
 {
-    notImplemented();
+    invalidate();
 }
 
-PluginView::~PluginView()
+static Display *getPluginDisplay()
 {
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !(m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin)))
-        m_plugin->unload();
-
-    delete platformPluginWidget();
+    // The plugin toolkit might run using a different X connection. At the moment, we only
+    // support gdk based plugins (like flash) that use a different X connection.
+    // The code below has the same effect as this one:
+    // Display *gdkDisplay = gdk_x11_display_get_xdisplay(gdk_display_get_default());
+    QLibrary library("libgdk-x11-2.0");
+    if (!library.load())
+        return 0;
+
+    typedef void *(*gdk_display_get_default_ptr)();
+    gdk_display_get_default_ptr gdk_display_get_default = (gdk_display_get_default_ptr)library.resolve("gdk_display_get_default");
+    if (!gdk_display_get_default)
+        return 0;
+
+    typedef void *(*gdk_x11_display_get_xdisplay_ptr)(void *);
+    gdk_x11_display_get_xdisplay_ptr gdk_x11_display_get_xdisplay = (gdk_x11_display_get_xdisplay_ptr)library.resolve("gdk_x11_display_get_xdisplay");
+    if (!gdk_x11_display_get_xdisplay)
+        return 0;
+
+    return (Display*)gdk_x11_display_get_xdisplay(gdk_display_get_default());
 }
 
-void PluginView::init()
+static void getVisualAndColormap(int depth, Visual **visual, Colormap *colormap)
 {
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
+    *visual = 0;
+    *colormap = 0;
 
-    m_hasPendingGeometryChange = false;
+#ifndef QT_NO_XRENDER
+    static const bool useXRender = qgetenv("QT_X11_NO_XRENDER").isNull(); // Should also check for XRender >= 0.5
+#else
+    static const bool useXRender = false;
+#endif
 
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
+    if (!useXRender && depth == 32)
         return;
-    }
 
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
+    int nvi;
+    XVisualInfo templ;
+    templ.screen  = QX11Info::appScreen();
+    templ.depth   = depth;
+    templ.c_class = TrueColor;
+    XVisualInfo* xvi = XGetVisualInfo(QX11Info::display(), VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nvi);
 
-    if (!start()) {
-        m_status = PluginStatusCanNotLoadPlugin;
+    if (!xvi)
         return;
-    }
+
+#ifndef QT_NO_XRENDER
+    if (depth == 32) {
+        for (int idx = 0; idx < nvi; ++idx) {
+            XRenderPictFormat* format = XRenderFindVisualFormat(QX11Info::display(), xvi[idx].visual);
+            if (format->type == PictTypeDirect && format->direct.alphaMask) {
+                 *visual = xvi[idx].visual;
+                 break;
+            }
+         }
+    } else
+#endif // QT_NO_XRENDER
+        *visual = xvi[0].visual;
+
+    XFree(xvi);
+
+    if (*visual)
+        *colormap = XCreateColormap(QX11Info::display(), QX11Info::appRootWindow(), *visual, AllocNone);
+}
+
+bool PluginView::platformStart()
+{
+    ASSERT(m_isStarted);
+    ASSERT(m_status == PluginStatusLoadedSuccessfully);
 
     if (m_plugin->pluginFuncs()->getvalue) {
         PluginView::setCurrentPluginView(this);
@@ -486,41 +753,92 @@ void PluginView::init()
         PluginView::setCurrentPluginView(0);
     }
 
-    if (m_needsXEmbed) {
-        setPlatformWidget(new PluginContainerQt(this, m_parentFrame->view()->hostWindow()->platformWindow()));
+    if (m_isWindowed) {
+        if (m_needsXEmbed) {
+            QWebPageClient* client = m_parentFrame->view()->hostWindow()->platformPageClient();
+            setPlatformWidget(new PluginContainerQt(this, QWidget::find(client->winId())));
+            // sync our XEmbed container window creation before sending the xid to plugins.
+            QApplication::syncX();
+        } else {
+            notImplemented();
+            m_status = PluginStatusCanNotLoadPlugin;
+            return false;
+        }
     } else {
-        notImplemented();
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
+        setPlatformWidget(0);
+        m_pluginDisplay = getPluginDisplay();
     }
-    show();
 
-    NPSetWindowCallbackStruct *wsi = new NPSetWindowCallbackStruct();
+    show();
 
+    NPSetWindowCallbackStruct* wsi = new NPSetWindowCallbackStruct();
     wsi->type = 0;
 
-    wsi->display = platformPluginWidget()->x11Info().display();
-    wsi->visual = (Visual*)platformPluginWidget()->x11Info().visual();
-    wsi->depth = platformPluginWidget()->x11Info().depth();
-    wsi->colormap = platformPluginWidget()->x11Info().colormap();
-    m_npWindow.ws_info = wsi;
+    if (m_isWindowed) {
+        const QX11Info* x11Info = &platformPluginWidget()->x11Info();
+
+        wsi->display = x11Info->display();
+        wsi->visual = (Visual*)x11Info->visual();
+        wsi->depth = x11Info->depth();
+        wsi->colormap = x11Info->colormap();
+
+        m_npWindow.type = NPWindowTypeWindow;
+        m_npWindow.window = (void*)platformPluginWidget()->winId();
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    } else {
+        const QX11Info* x11Info = &QApplication::desktop()->x11Info();
+
+        if (x11Info->depth() == 32 || !m_plugin->quirks().contains(PluginQuirkRequiresDefaultScreenDepth)) {
+            getVisualAndColormap(32, &m_visual, &m_colormap);
+            wsi->depth = 32;
+        }
+
+        if (!m_visual) {
+            getVisualAndColormap(x11Info->depth(), &m_visual, &m_colormap);
+            wsi->depth = x11Info->depth();
+        }
+
+        wsi->display = x11Info->display();
+        wsi->visual = m_visual;
+        wsi->colormap = m_colormap;
 
-    m_npWindow.type = NPWindowTypeWindow;
-    m_npWindow.window = (void*)platformPluginWidget()->winId();
-    m_npWindow.width = -1;
-    m_npWindow.height = -1;
+        m_npWindow.type = NPWindowTypeDrawable;
+        m_npWindow.window = 0; // Not used?
+        m_npWindow.x = 0;
+        m_npWindow.y = 0;
+        m_npWindow.width = -1;
+        m_npWindow.height = -1;
+    }
+
+    m_npWindow.ws_info = wsi;
 
     if (!(m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))) {
         updatePluginWidget();
         setNPWindowIfNeeded();
     }
 
-    m_status = PluginStatusLoadedSuccessfully;
+    return true;
 }
 
-void PluginView::platformStart()
+void PluginView::platformDestroy()
+{
+    if (platformPluginWidget())
+        delete platformPluginWidget();
+
+    if (m_drawable)
+        XFreePixmap(QX11Info::display(), m_drawable);
+
+    if (m_colormap)
+        XFreeColormap(QX11Info::display(), m_colormap);
+}
+
+void PluginView::halt()
 {
 }
 
+void PluginView::restart()
+{
+}
 
 } // namespace WebCore
diff --git a/WebCore/plugins/win/PaintHooks.asm b/WebCore/plugins/win/PaintHooks.asm
new file mode 100644
index 0000000..1508813
--- /dev/null
+++ b/WebCore/plugins/win/PaintHooks.asm
@@ -0,0 +1,50 @@
+;/*
+;    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+;
+;    This library is free software; you can redistribute it and/or
+;    modify it under the terms of the GNU Library General Public
+;    License as published by the Free Software Foundation; either
+;    version 2 of the License, or (at your option) any later version.
+;
+;    This library is distributed in the hope that it will be useful,
+;    but WITHOUT ANY WARRANTY; without even the implied warranty of
+;    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+;    Library General Public License for more details.
+;
+;    You should have received a copy of the GNU Library General Public License
+;    along with this library; see the file COPYING.LIB.  If not, write to
+;    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+;    Boston, MA 02110-1301, USA.
+;*/
+
+;HDC __stdcall _HBeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint);
+
+PUBLIC  _HBeginPaint
+
+_TEXT   SEGMENT
+
+_HBeginPaint PROC
+     mov  r10,rcx
+     mov  eax,1017h
+     syscall
+     ret
+_HBeginPaint ENDP
+
+_TEXT   ENDS
+
+;BOOL __stdcall _HEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint);
+
+PUBLIC  _HEndPaint
+
+_TEXT   SEGMENT
+
+_HEndPaint PROC
+    mov  r10,rcx
+    mov  eax,1019h
+    syscall
+    ret
+_HEndPaint ENDP
+
+_TEXT   ENDS
+
+END
diff --git a/WebCore/plugins/win/PluginViewWin.cpp b/WebCore/plugins/win/PluginViewWin.cpp
index 0da4402..ccbf6f8 100644
--- a/WebCore/plugins/win/PluginViewWin.cpp
+++ b/WebCore/plugins/win/PluginViewWin.cpp
@@ -29,6 +29,7 @@
 
 #include "PluginView.h"
 
+#include "BitmapImage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -52,6 +53,7 @@
 #include "PluginMessageThrottlerWin.h"
 #include "PluginPackage.h"
 #include "PluginMainThreadScheduler.h"
+#include "RenderWidget.h"
 #include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include "PluginDatabase.h"
@@ -74,17 +76,17 @@
 #endif
 
 #if PLATFORM(QT)
-#include <QWidget.h>
+#include "QWebPageClient.h"
 #endif
 
-static inline HWND windowHandleForPlatformWidget(PlatformWidget widget)
+static inline HWND windowHandleForPageClient(PlatformPageClient client)
 {
 #if PLATFORM(QT)
-    if (!widget)
+    if (!client)
         return 0;
-    return widget->winId();
+    return client->winId();
 #else
-    return widget;
+    return client;
 #endif
 }
 
@@ -115,6 +117,14 @@ static BYTE* beginPaint;
 static unsigned endPaintSysCall;
 static BYTE* endPaint;
 
+typedef HDC (WINAPI *PtrBeginPaint)(HWND, PAINTSTRUCT*);
+typedef BOOL (WINAPI *PtrEndPaint)(HWND, const PAINTSTRUCT*);
+
+#if PLATFORM(WIN_OS) && PLATFORM(X86_64) && COMPILER(MSVC)
+extern "C" HDC __stdcall _HBeginPaint(HWND hWnd, LPPAINTSTRUCT lpPaint);
+extern "C" BOOL __stdcall _HEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint);
+#endif
+
 HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
 {
     PluginView* pluginView = reinterpret_cast<PluginView*>(GetProp(hWnd, kWebPluginViewProperty));
@@ -137,12 +147,14 @@ HDC WINAPI PluginView::hookedBeginPaint(HWND hWnd, PAINTSTRUCT* lpPaint)
          : "memory"
         );
     return result;
-#else
+#elif defined(_M_IX86)
     // Call through to the original BeginPaint.
     __asm   mov     eax, beginPaintSysCall
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    beginPaint
+#else
+    return _HBeginPaint(hWnd, lpPaint);
 #endif
 }
 
@@ -164,12 +176,14 @@ BOOL WINAPI PluginView::hookedEndPaint(HWND hWnd, const PAINTSTRUCT* lpPaint)
          : "a" (endPaintSysCall), "g" (lpPaint), "g" (hWnd), "m" (*endPaint)
         );
     return result;
-#else
+#elif defined (_M_IX86)
     // Call through to the original EndPaint.
     __asm   mov     eax, endPaintSysCall
     __asm   push    lpPaint
     __asm   push    hWnd
     __asm   call    endPaint
+#else
+    return _HEndPaint(hWnd, lpPaint);
 #endif
 }
 
@@ -182,6 +196,7 @@ static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE
 
     pProc = reinterpret_cast<BYTE*>(reinterpret_cast<ptrdiff_t>(GetProcAddress(hMod, proc)));
 
+#if COMPILER(GCC) || defined(_M_IX86)
     if (pProc[0] != 0xB8)
         return;
 
@@ -197,6 +212,35 @@ static void hook(const char* module, const char* proc, unsigned& sysCallID, BYTE
     *reinterpret_cast<unsigned*>(pProc + 1) = reinterpret_cast<intptr_t>(pNewProc) - reinterpret_cast<intptr_t>(pProc + 5);
 
     pProc += 5;
+#else
+    /* Disassembly of BeginPaint()
+    00000000779FC5B0 4C 8B D1         mov         r10,rcx
+    00000000779FC5B3 B8 17 10 00 00   mov         eax,1017h
+    00000000779FC5B8 0F 05            syscall
+    00000000779FC5BA C3               ret
+    00000000779FC5BB 90               nop
+    00000000779FC5BC 90               nop
+    00000000779FC5BD 90               nop
+    00000000779FC5BE 90               nop
+    00000000779FC5BF 90               nop
+    00000000779FC5C0 90               nop
+    00000000779FC5C1 90               nop
+    00000000779FC5C2 90               nop
+    00000000779FC5C3 90               nop
+    */
+    // Check for the signature as in the above disassembly
+    DWORD guard = 0xB8D18B4C;
+    if (*reinterpret_cast<DWORD*>(pProc) != guard)
+        return;
+
+    DWORD flOldProtect;
+    VirtualProtect(pProc, 12, PAGE_EXECUTE_READWRITE, & flOldProtect);
+    pProc[0] = 0x48;    // mov rax, this
+    pProc[1] = 0xb8;
+    *(__int64*)(pProc+2) = (__int64)pNewProc;
+    pProc[10] = 0xff;   // jmp rax
+    pProc[11] = 0xe0;
+#endif
 }
 
 static void setUpOffscreenPaintingHooks(HDC (WINAPI*hookedBeginPaint)(HWND, PAINTSTRUCT*), BOOL (WINAPI*hookedEndPaint)(HWND, const PAINTSTRUCT*))
@@ -838,7 +882,7 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         case NPNVnetscapeWindow: {
             HWND* w = reinterpret_cast<HWND*>(value);
 
-            *w = windowHandleForPlatformWidget(parent() ? parent()->hostWindow()->platformWindow() : 0);
+            *w = windowHandleForPageClient(parent() ? parent()->hostWindow()->platformPageClient() : 0);
 
             return NPERR_NO_ERROR;
         }
@@ -910,55 +954,10 @@ void PluginView::forceRedraw()
     if (m_isWindowed)
         ::UpdateWindow(platformPluginWidget());
     else
-        ::UpdateWindow(windowHandleForPlatformWidget(parent() ? parent()->hostWindow()->platformWindow() : 0));
-}
-
-PluginView::~PluginView()
-{
-    removeFromUnstartedListIfNecessary();
-
-    stop();
-
-    deleteAllValues(m_requests);
-
-    freeStringArray(m_paramNames, m_paramCount);
-    freeStringArray(m_paramValues, m_paramCount);
-
-    if (platformPluginWidget())
-        DestroyWindow(platformPluginWidget());
-
-    m_parentFrame->script()->cleanupScriptObjectsForPlugin(this);
-
-    if (m_plugin && !m_plugin->quirks().contains(PluginQuirkDontUnloadPlugin))
-        m_plugin->unload();
+        ::UpdateWindow(windowHandleForPageClient(parent() ? parent()->hostWindow()->platformPageClient() : 0));
 }
 
-void PluginView::init()
-{
-    if (m_haveInitialized)
-        return;
-    m_haveInitialized = true;
-
-    if (!m_plugin) {
-        ASSERT(m_status == PluginStatusCanNotFindPlugin);
-        return;
-    }
-
-    if (!m_plugin->load()) {
-        m_plugin = 0;
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    if (!startOrAddToUnstartedList()) {
-        m_status = PluginStatusCanNotLoadPlugin;
-        return;
-    }
-
-    m_status = PluginStatusLoadedSuccessfully;
-}
-
-void PluginView::platformStart()
+bool PluginView::platformStart()
 {
     ASSERT(m_isStarted);
     ASSERT(m_status == PluginStatusLoadedSuccessfully);
@@ -973,7 +972,7 @@ void PluginView::platformStart()
         if (isSelfVisible())
             flags |= WS_VISIBLE;
 
-        HWND parentWindowHandle = windowHandleForPlatformWidget(m_parentFrame->view()->hostWindow()->platformWindow());
+        HWND parentWindowHandle = windowHandleForPageClient(m_parentFrame->view()->hostWindow()->platformPageClient());
         HWND window = ::CreateWindowEx(0, kWebPluginViewdowClassName, 0, flags,
                                        0, 0, 0, 0, parentWindowHandle, 0, Page::instanceHandle(), 0);
 
@@ -1005,6 +1004,40 @@ void PluginView::platformStart()
 
     if (!m_plugin->quirks().contains(PluginQuirkDeferFirstSetWindowCall))
         setNPWindowRect(frameRect());
+
+    return true;
+}
+
+void PluginView::platformDestroy()
+{
+    if (!platformPluginWidget())
+        return;
+
+    DestroyWindow(platformPluginWidget());
+    setPlatformPluginWidget(0);
+}
+
+void PluginView::halt()
+{
+#if !PLATFORM(QT)
+    // Show a screenshot of the plug-in.
+    OwnPtr<HBITMAP> nodeImage(m_parentFrame->nodeImage(m_element));
+    toRenderWidget(m_element->renderer())->showSubstituteImage(BitmapImage::create(nodeImage.get()));
+#endif
+
+    stop();
+    platformDestroy();
+}
+
+void PluginView::restart()
+{
+    ASSERT(!m_isStarted);
+
+    // Clear any substitute image.
+    toRenderWidget(m_element->renderer())->showSubstituteImage(0);
+
+    m_haveUpdatedPluginWidget = false;
+    start();
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index c30ca9a..f546abb 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -63,11 +63,17 @@ void CounterNode::recount()
     for (CounterNode* c = this; c; c = c->m_nextSibling) {
         int oldCount = c->m_countInParent;
         int newCount = c->computeCountInParent();
-        c->m_countInParent = newCount;
         if (oldCount == newCount)
             break;
-        if (c->m_renderer->isCounter())
-            c->m_renderer->setNeedsLayoutAndPrefWidthsRecalc();
+        c->m_countInParent = newCount;
+        // m_renderer contains the parent of the render node
+        // corresponding to a CounterNode. Let's find the counter
+        // child and make this re-layout.
+        for (RenderObject* o = c->m_renderer->firstChild(); o; o = o->nextSibling())
+            if (!o->documentBeingDestroyed() && o->isCounter()) {
+                o->setNeedsLayoutAndPrefWidthsRecalc();
+                break;
+            }
     }
 }
 
@@ -167,13 +173,13 @@ static void showTreeAndMark(const CounterNode* node)
 
     for (const CounterNode* c = root; c; c = nextInPreOrder(c)) {
         if (c == node)
-            fprintf(stderr, "*");                        
+            fprintf(stderr, "*");
         for (const CounterNode* d = c; d && d != root; d = d->parent())
             fprintf(stderr, "\t");
         if (c->isReset())
-            fprintf(stderr, "reset: %d\n", c->value());
+            fprintf(stderr, "reset: %d %d\n", c->value(), c->countInParent());
         else
-            fprintf(stderr, "increment: %d\n", c->value());
+            fprintf(stderr, "increment: %d %d\n", c->value(), c->countInParent());
     }
 }
 
diff --git a/WebCore/rendering/FixedTableLayout.cpp b/WebCore/rendering/FixedTableLayout.cpp
index ee3e75a..4852708 100644
--- a/WebCore/rendering/FixedTableLayout.cpp
+++ b/WebCore/rendering/FixedTableLayout.cpp
@@ -188,6 +188,11 @@ int FixedTableLayout::calcWidthArray(int)
     return usedWidth;
 }
 
+// Use a very large value (in effect infinite). But not too large!
+// numeric_limits<int>::max() will too easily overflow widths.
+// Keep this in synch with BLOCK_MAX_WIDTH in RenderBlock.cpp
+#define TABLE_MAX_WIDTH 15000
+
 void FixedTableLayout::calcPrefWidths(int& minWidth, int& maxWidth)
 {
     // FIXME: This entire calculation is incorrect for both minwidth and maxwidth.
@@ -206,6 +211,24 @@ void FixedTableLayout::calcPrefWidths(int& minWidth, int& maxWidth)
 
     minWidth = max(mw, tableWidth);
     maxWidth = minWidth;
+
+    // This quirk is very similar to one that exists in RenderBlock::calcBlockPrefWidths().
+    // Here's the example for this one:
+    /*
+        <table style="width:100%; background-color:red"><tr><td>
+            <table style="background-color:blue"><tr><td>
+                <table style="width:100%; background-color:green; table-layout:fixed"><tr><td>
+                    Content
+                </td></tr></table>
+            </td></tr></table>
+        </td></tr></table>
+    */ 
+    // In this example, the two inner tables should be as large as the outer table. 
+    // We can achieve this effect by making the maxwidth of fixed tables with percentage
+    // widths be infinite.
+    if (m_table->style()->htmlHacks() && m_table->style()->width().isPercent() 
+        && maxWidth < TABLE_MAX_WIDTH)
+        maxWidth = TABLE_MAX_WIDTH;
 }
 
 void FixedTableLayout::layout()
diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index b7de46b..0aaddc9 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -209,7 +209,7 @@ String HitTestResult::altDisplayString() const
     
     if (m_innerNonSharedNode->hasTagName(imgTag)) {
         HTMLImageElement* image = static_cast<HTMLImageElement*>(m_innerNonSharedNode.get());
-        return displayString(image->alt(), m_innerNonSharedNode.get());
+        return displayString(image->getAttribute(altAttr), m_innerNonSharedNode.get());
     }
     
     if (m_innerNonSharedNode->hasTagName(inputTag)) {
diff --git a/WebCore/rendering/InlineBox.cpp b/WebCore/rendering/InlineBox.cpp
index bbf11b3..2575fb7 100644
--- a/WebCore/rendering/InlineBox.cpp
+++ b/WebCore/rendering/InlineBox.cpp
@@ -98,18 +98,11 @@ int InlineBox::height() const
         return toRenderBox(m_renderer)->height();
 
     ASSERT(isInlineFlowBox());
-    const InlineFlowBox* flowBox = static_cast<const InlineFlowBox*>(this);
     RenderBoxModelObject* flowObject = boxModelObject();
     const Font& font = renderer()->style(m_firstLine)->font();
     int result = font.height();
-    bool strictMode = renderer()->document()->inStrictMode();
     if (parent())
         result += flowObject->borderTop() + flowObject->paddingTop() + flowObject->borderBottom() + flowObject->paddingBottom();
-    if (strictMode || flowBox->hasTextChildren() || flowObject->hasHorizontalBordersOrPadding())
-        return result;
-    int bottom = root()->bottomOverflow();
-    if (y() + result > bottom)
-        result = bottom - y();
     return result;
 }
 
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index c03758d..e165f0c 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -208,11 +208,6 @@ public:
     inline int baselinePosition(bool isRootLineBox) const { return renderer()->baselinePosition(m_firstLine, isRootLineBox); }
     inline int lineHeight(bool isRootLineBox) const { return renderer()->lineHeight(m_firstLine, isRootLineBox); }
 
-    virtual int topOverflow() const { return y(); }
-    virtual int bottomOverflow() const { return y() + height(); }
-    virtual int leftOverflow() const { return x(); }
-    virtual int rightOverflow() const { return x() + width(); }
-
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
     virtual unsigned caretMaxRenderedOffset() const;
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 543c190..143d3d8 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -29,6 +29,7 @@
 #include "RootInlineBox.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
+#include "RenderLayer.h"
 #include "RenderListMarker.h"
 #include "RenderTableCell.h"
 #include "RootInlineBox.h"
@@ -167,6 +168,8 @@ void InlineFlowBox::adjustPosition(int dx, int dy)
     InlineRunBox::adjustPosition(dx, dy);
     for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
         child->adjustPosition(dx, dy);
+    if (m_overflow)
+        m_overflow->move(dx, dy);
 }
 
 RenderLineBoxList* InlineFlowBox::rendererLineBoxes() const
@@ -248,16 +251,21 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     }
 }
 
-int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& rightPosition, bool& needsWordSpacing)
+int InlineFlowBox::placeBoxesHorizontally(int xPos, bool& needsWordSpacing)
 {
     // Set our x position.
     setX(xPos);
 
+    int leftLayoutOverflow = xPos;
+    int rightLayoutOverflow = xPos;
+    int leftVisualOverflow = xPos;
+    int rightVisualOverflow = xPos;
+
     int boxShadowLeft;
     int boxShadowRight;
     renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(boxShadowLeft, boxShadowRight);
 
-    leftPosition = min(xPos + boxShadowLeft, leftPosition);
+    leftVisualOverflow = min(xPos + boxShadowLeft, leftVisualOverflow);
 
     int startX = xPos;
     xPos += borderLeft() + paddingLeft();
@@ -275,23 +283,24 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             
             int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
             
-            // If letter-spacing is negative, we should factor that into right overflow. (Even in RTL, letter-spacing is
+            // If letter-spacing is negative, we should factor that into right layout overflow. (Even in RTL, letter-spacing is
             // applied to the right, so this is not an issue with left overflow.
             int letterSpacing = min(0, (int)rt->style(m_firstLine)->font().letterSpacing());
-            
+            rightLayoutOverflow = max(xPos + text->width() - letterSpacing, rightLayoutOverflow);
+
             int leftGlyphOverflow = -strokeOverflow;
             int rightGlyphOverflow = strokeOverflow - letterSpacing;
             
-            int visualOverflowLeft = leftGlyphOverflow;
-            int visualOverflowRight = rightGlyphOverflow;
+            int childOverflowLeft = leftGlyphOverflow;
+            int childOverflowRight = rightGlyphOverflow;
             for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
-                visualOverflowLeft = min(visualOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
-                visualOverflowRight = max(visualOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
+                childOverflowLeft = min(childOverflowLeft, shadow->x - shadow->blur + leftGlyphOverflow);
+                childOverflowRight = max(childOverflowRight, shadow->x + shadow->blur + rightGlyphOverflow);
             }
             
-            leftPosition = min(xPos + visualOverflowLeft, leftPosition);
-            rightPosition = max(xPos + text->width() + visualOverflowRight, rightPosition);
-            m_maxHorizontalVisualOverflow = max(max(visualOverflowRight, -visualOverflowLeft), (int)m_maxHorizontalVisualOverflow);
+            leftVisualOverflow = min(xPos + childOverflowLeft, leftVisualOverflow);
+            rightVisualOverflow = max(xPos + text->width() + childOverflowRight, rightVisualOverflow);
+            
             xPos += text->width();
         } else {
             if (curr->renderer()->isPositioned()) {
@@ -307,13 +316,26 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
             if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
                 xPos += flow->marginLeft();
-                xPos = flow->placeBoxesHorizontally(xPos, leftPosition, rightPosition, needsWordSpacing);
+                xPos = flow->placeBoxesHorizontally(xPos, needsWordSpacing);
                 xPos += flow->marginRight();
+                leftLayoutOverflow = min(leftLayoutOverflow, flow->leftLayoutOverflow());
+                rightLayoutOverflow = max(rightLayoutOverflow, flow->rightLayoutOverflow());
+                leftVisualOverflow = min(leftVisualOverflow, flow->leftVisualOverflow());
+                rightVisualOverflow = max(rightVisualOverflow, flow->rightVisualOverflow());
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 xPos += curr->boxModelObject()->marginLeft();
                 curr->setX(xPos);
-                leftPosition = min(xPos + toRenderBox(curr->renderer())->overflowLeft(false), leftPosition);
-                rightPosition = max(xPos + toRenderBox(curr->renderer())->overflowWidth(false), rightPosition);
+                 
+                RenderBox* box = toRenderBox(curr->renderer());
+                int childLeftOverflow = box->hasOverflowClip() ? 0 : box->leftLayoutOverflow();
+                int childRightOverflow = box->hasOverflowClip() ? curr->width() : box->rightLayoutOverflow();
+                
+                leftLayoutOverflow = min(xPos + childLeftOverflow, leftLayoutOverflow);
+                rightLayoutOverflow = max(xPos + childRightOverflow, rightLayoutOverflow);
+
+                leftVisualOverflow = min(xPos + box->leftVisualOverflow(), leftVisualOverflow);
+                rightVisualOverflow = max(xPos + box->rightVisualOverflow(), rightVisualOverflow);
+               
                 xPos += curr->width() + curr->boxModelObject()->marginRight();
             }
         }
@@ -321,45 +343,13 @@ int InlineFlowBox::placeBoxesHorizontally(int xPos, int& leftPosition, int& righ
 
     xPos += borderRight() + paddingRight();
     setWidth(xPos - startX);
-    rightPosition = max(x() + width() + boxShadowRight, rightPosition);
+    rightVisualOverflow = max(x() + width() + boxShadowRight, rightVisualOverflow);
+    rightLayoutOverflow = max(x() + width(), rightLayoutOverflow);
 
+    setHorizontalOverflowPositions(leftLayoutOverflow, rightLayoutOverflow, leftVisualOverflow, rightVisualOverflow);
     return xPos;
 }
 
-int InlineFlowBox::verticallyAlignBoxes(int heightOfBlock)
-{
-    int maxPositionTop = 0;
-    int maxPositionBottom = 0;
-    int maxAscent = 0;
-    int maxDescent = 0;
-
-    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
-    // because that would match almost strict mode as well.
-    RenderObject* curr = renderer();
-    while (curr && !curr->node())
-        curr = curr->container();
-    bool strictMode = (curr && curr->document()->inStrictMode());
-    
-    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
-
-    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
-        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
-
-    int maxHeight = maxAscent + maxDescent;
-    int topPosition = heightOfBlock;
-    int bottomPosition = heightOfBlock;
-    int selectionTop = heightOfBlock;
-    int selectionBottom = heightOfBlock;
-    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
-
-    setVerticalOverflowPositions(topPosition, bottomPosition);
-    setVerticalSelectionPositions(selectionTop, selectionBottom);
-    
-    heightOfBlock += maxHeight;
-    
-    return heightOfBlock;
-}
-
 void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                               int maxPositionTop, int maxPositionBottom)
 {
@@ -479,11 +469,10 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
     }
 }
 
-void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode,
-                                         int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom)
+void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent, bool strictMode, int& selectionTop, int& selectionBottom)
 {
     if (isRootInlineBox())
-        setY(yPos + max(0, maxAscent - baselinePosition(true))); // Place our root box.
+        setY(yPos + maxAscent - baselinePosition(true)); // Place our root box.
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
@@ -493,7 +482,7 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
         // line-height).
         bool isInlineFlow = curr->isInlineFlowBox();
         if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, topPosition, bottomPosition, selectionTop, selectionBottom);
+            static_cast<InlineFlowBox*>(curr)->placeBoxesVertically(yPos, maxHeight, maxAscent, strictMode, selectionTop, selectionBottom);
 
         bool childAffectsTopBottomPos = true;
         if (curr->y() == PositionTop)
@@ -504,43 +493,18 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasHorizontalBordersOrPadding() && !strictMode)
                 childAffectsTopBottomPos = false;
             int posAdjust = maxAscent - curr->baselinePosition(false);
-            if (!childAffectsTopBottomPos)
-                posAdjust = max(0, posAdjust);
             curr->setY(curr->y() + yPos + posAdjust);
         }
         
-        // FIXME: By only considering overflow as part of the root line box, we can't get an accurate picture regarding what the line
-        // actually needs to paint.  A line box that is part of a self-painting layer technically shouldn't contribute to the overflow
-        // of the line, but in order to not do this and paint accurately, we have to track the overflow somewhere else (either by storing overflow
-        // in each InlineFlowBox up the chain or in the layer itself).  Relative positioned objects on a line will cause scrollbars
-        // to appear when they shouldn't until we fix this issue.
         int newY = curr->y();
-        int overflowTop = 0;
-        int overflowBottom = 0;
         if (curr->isText() || curr->isInlineFlowBox()) {
             const Font& font = curr->renderer()->style(m_firstLine)->font();
             newY += curr->baselinePosition(false) - font.ascent();
-
-            curr->renderer()->style(m_firstLine)->getBoxShadowVerticalExtent(overflowTop, overflowBottom);
-
-            for (ShadowData* textShadow = curr->renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-                overflowTop = min(overflowTop, textShadow->y - textShadow->blur);
-                overflowBottom = max(overflowBottom, textShadow->y + textShadow->blur);
-            }
-
-            if (curr->renderer()->hasReflection()) {
-                RenderBox* box = toRenderBox(curr->renderer());
-                overflowTop = min(overflowTop, box->reflectionBox().y());
-                overflowBottom = max(overflowBottom, box->reflectionBox().bottom());
-            }
-
             if (curr->isInlineFlowBox())
                 newY -= curr->boxModelObject()->borderTop() + curr->boxModelObject()->paddingTop();
         } else if (!curr->renderer()->isBR()) {
             RenderBox* box = toRenderBox(curr->renderer());
             newY += box->marginTop();
-            overflowTop = box->overflowTop(false);
-            overflowBottom = box->overflowHeight(false) - box->height();
         }
 
         curr->setY(newY);
@@ -549,8 +513,6 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
             int boxHeight = curr->height();
             selectionTop = min(selectionTop, newY);
             selectionBottom = max(selectionBottom, newY + boxHeight);
-            topPosition = min(topPosition, newY + overflowTop);
-            bottomPosition = max(bottomPosition, newY + boxHeight + overflowBottom);
         }
     }
 
@@ -564,8 +526,88 @@ void InlineFlowBox::placeBoxesVertically(int yPos, int maxHeight, int maxAscent,
     }
 }
 
+void InlineFlowBox::computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode)
+{
+    int boxHeight = height();
+
+    // Any spillage outside of the line top and bottom is not considered overflow.  We just ignore this, since it only happens
+    // from the "your ascent/descent don't affect the line" quirk.
+    // FIXME: Technically this means there can be repaint errors in the case where a line box has a shadow or background that spills
+    // outside of the block. We should consider making any line box that has anything to render just stop respecting the quirk or making
+    // boxes that render something set visual overflow.
+    int topOverflow = max(y(), lineTop);
+    int bottomOverflow = min(y() + boxHeight, lineBottom);
+    
+    int topLayoutOverflow = topOverflow;
+    int bottomLayoutOverflow = bottomOverflow;
+    
+    int topVisualOverflow = topOverflow;
+    int bottomVisualOverflow = bottomOverflow;
+  
+    // box-shadow on root line boxes is applying to the block and not to the lines.
+    if (parent()) {
+        int boxShadowTop;
+        int boxShadowBottom;
+        renderer()->style(m_firstLine)->getBoxShadowVerticalExtent(boxShadowTop, boxShadowBottom);
+        
+        topVisualOverflow = min(y() + boxShadowTop, topVisualOverflow);
+        bottomVisualOverflow = max(y() + boxHeight + boxShadowBottom, bottomVisualOverflow);
+    }
+
+    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
+        if (curr->renderer()->isPositioned())
+            continue; // Positioned placeholders don't affect calculations.
+        
+        if (curr->renderer()->isText()) {
+            InlineTextBox* text = static_cast<InlineTextBox*>(curr);
+            RenderText* rt = toRenderText(text->renderer());
+            if (rt->isBR())
+                continue;
+
+            int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
+            
+            int topGlyphOverflow = -strokeOverflow;
+            int bottomGlyphOverflow = strokeOverflow;
+            
+            int childOverflowTop = topGlyphOverflow;
+            int childOverflowBottom = bottomGlyphOverflow;
+            for (ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next) {
+                childOverflowTop = min(childOverflowTop, shadow->y - shadow->blur + topGlyphOverflow);
+                childOverflowBottom = max(childOverflowBottom, shadow->y + shadow->blur + bottomGlyphOverflow);
+            }
+            
+            topVisualOverflow = min(curr->y() + childOverflowTop, topVisualOverflow);
+            bottomVisualOverflow = max(curr->y() + text->height() + childOverflowBottom, bottomVisualOverflow);
+        } else  if (curr->renderer()->isRenderInline()) {
+            InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
+            flow->computeVerticalOverflow(lineTop, lineBottom, strictMode);
+            topLayoutOverflow = min(topLayoutOverflow, flow->topLayoutOverflow());
+            bottomLayoutOverflow = max(bottomLayoutOverflow, flow->bottomLayoutOverflow());
+            topVisualOverflow = min(topVisualOverflow, flow->topVisualOverflow());
+            bottomVisualOverflow = max(bottomVisualOverflow, flow->bottomVisualOverflow());
+        } else if (!curr->boxModelObject()->hasSelfPaintingLayer()){
+            // Only include overflow from replaced inlines if they do not paint themselves.
+            RenderBox* box = toRenderBox(curr->renderer());
+            int boxY = curr->y();
+            int childTopOverflow = box->hasOverflowClip() ? 0 : box->topLayoutOverflow();
+            int childBottomOverflow = box->hasOverflowClip() ? curr->height() : box->bottomLayoutOverflow();
+            topLayoutOverflow = min(boxY + childTopOverflow, topLayoutOverflow);
+            bottomLayoutOverflow = max(boxY + childBottomOverflow, bottomLayoutOverflow);
+            topVisualOverflow = min(boxY + box->topVisualOverflow(), topVisualOverflow);
+            bottomVisualOverflow = max(boxY + box->bottomVisualOverflow(), bottomVisualOverflow);
+        }
+    }
+    
+    setVerticalOverflowPositions(topLayoutOverflow, bottomLayoutOverflow, topVisualOverflow, bottomVisualOverflow, boxHeight);
+}
+
 bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty)
 {
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.move(tx, ty);
+    if (!overflowRect.contains(x, y))
+        return false;
+
     // Check children first.
     for (InlineBox* curr = lastChild(); curr; curr = curr->prevOnLine()) {
         if ((curr->renderer()->isText() || !curr->boxModelObject()->hasSelfPaintingLayer()) && curr->nodeAtPoint(request, result, x, y, tx, ty)) {
@@ -586,23 +628,14 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
 void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 {
-    int xPos = tx + m_x - renderer()->maximalOutlineSize(paintInfo.phase);
-    int w = width() + 2 * renderer()->maximalOutlineSize(paintInfo.phase);
-    int shadowLeft;
-    int shadowRight;
-
-    renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-    for (ShadowData* textShadow = renderer()->style(m_firstLine)->textShadow(); textShadow; textShadow = textShadow->next) {
-        shadowLeft = min(textShadow->x - textShadow->blur, shadowLeft);
-        shadowRight = max(textShadow->x + textShadow->blur, shadowRight);
-    }
-
-    xPos += shadowLeft;
-    w += -shadowLeft + shadowRight;
-    bool intersectsDamageRect = xPos < paintInfo.rect.right() && xPos + w > paintInfo.rect.x();
+    IntRect overflowRect(visibleOverflowRect());
+    overflowRect.inflate(renderer()->maximalOutlineSize(paintInfo.phase));
+    overflowRect.move(tx, ty);
+    
+    if (!paintInfo.rect.intersects(overflowRect))
+        return;
 
-    if (intersectsDamageRect && paintInfo.phase != PaintPhaseChildOutlines) {
+    if (paintInfo.phase != PaintPhaseChildOutlines) {
         if (paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) {
             // Add ourselves to the paint info struct's list of inlines that need to paint their
             // outlines.
@@ -645,7 +678,7 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
     }
 
     // 4. Paint our strike-through
-    if (intersectsDamageRect && (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection))
+    if (paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
@@ -774,18 +807,23 @@ void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty
     int w = width();
     int h = height();
 
-    // Figure out if we need to push a transparency layer to render our mask.
-    bool pushTransparencyLayer = false;
     const NinePieceImage& maskNinePieceImage = renderer()->style()->maskBoxImage();
     StyleImage* maskBoxImage = renderer()->style()->maskBoxImage().image();
-    if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
-        pushTransparencyLayer = true;
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+
+    // Figure out if we need to push a transparency layer to render our mask.
+    bool pushTransparencyLayer = false;
+    bool compositedMask = renderer()->hasLayer() && boxModelObject()->layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+    if (!compositedMask) {
+        if ((maskBoxImage && renderer()->style()->maskLayers()->hasImage()) || renderer()->style()->maskLayers()->next())
+            pushTransparencyLayer = true;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), renderer()->style()->maskLayers(), tx, ty, w, h, compositeOp);
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index 809fd54..23b5cc9 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -22,6 +22,7 @@
 #define InlineFlowBox_h
 
 #include "InlineRunBox.h"
+#include "RenderOverflow.h"
 
 namespace WebCore {
 
@@ -35,10 +36,8 @@ public:
         : InlineRunBox(obj)
         , m_firstChild(0)
         , m_lastChild(0)
-        , m_maxHorizontalVisualOverflow(0)
         , m_includeLeftEdge(false)
         , m_includeRightEdge(false)
-        , m_hasTextChildren(true)
 #ifndef NDEBUG
         , m_hasBadChildList(false)
 #endif
@@ -121,18 +120,13 @@ public:
     void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
     int getFlowSpacingWidth();
     bool onEndChain(RenderObject* endObject);
-    virtual int placeBoxesHorizontally(int x, int& leftPosition, int& rightPosition, bool& needsWordSpacing);
-    virtual int verticallyAlignBoxes(int heightOfBlock);
+    virtual int placeBoxesHorizontally(int x, bool& needsWordSpacing);
     void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool strictMode);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                    int maxPositionTop, int maxPositionBottom);
-    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode,
-                              int& topPosition, int& bottomPosition, int& selectionTop, int& selectionBottom);
-    
-    virtual void setVerticalOverflowPositions(int /*top*/, int /*bottom*/) { }
-    virtual void setVerticalSelectionPositions(int /*top*/, int /*bottom*/) { }
-    short maxHorizontalVisualOverflow() const { return m_maxHorizontalVisualOverflow; }
+    void placeBoxesVertically(int y, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom);
+    void computeVerticalOverflow(int lineTop, int lineBottom, bool strictMode);
 
     void removeChild(InlineBox* child);
 
@@ -146,12 +140,35 @@ public:
     void checkConsistency() const;
     void setHasBadChildList();
 
+    int topVisibleOverflow() const { return std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    IntRect visibleOverflowRect() const { return m_overflow ? m_overflow->visibleOverflowRect() : IntRect(m_x, m_y, m_width, height());  }
+
+    int topLayoutOverflow() const { return m_overflow ? m_overflow->topLayoutOverflow() : m_y; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : m_y + height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : m_x; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : m_x + m_width; }
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    int topVisualOverflow() const { return m_overflow ? m_overflow->topVisualOverflow() : m_y; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : m_y + height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : m_x; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : m_x + m_width; }
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : IntRect(m_x, m_y, m_width, height()); }
+
+    void setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow);
+    void setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight);
+
+protected:
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     virtual bool isInlineFlowBox() const { return true; }
 
     InlineBox* m_firstChild;
     InlineBox* m_lastChild;
-    short m_maxHorizontalVisualOverflow;
     
     bool m_includeLeftEdge : 1;
     bool m_includeRightEdge : 1;
@@ -162,6 +179,34 @@ private:
 #endif
 };
 
+inline void InlineFlowBox::setHorizontalOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow) 
+{ 
+    if (!m_overflow) {
+        if (leftLayoutOverflow == m_x && rightLayoutOverflow == m_x + m_width && leftVisualOverflow == m_x && rightVisualOverflow == m_x + m_width)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, m_renderer->style(m_firstLine)->font().height())));    
+    }
+
+    m_overflow->setLeftLayoutOverflow(leftLayoutOverflow);
+    m_overflow->setRightLayoutOverflow(rightLayoutOverflow);
+    m_overflow->setLeftVisualOverflow(leftVisualOverflow); 
+    m_overflow->setRightVisualOverflow(rightVisualOverflow);  
+}
+
+inline void InlineFlowBox::setVerticalOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight)
+{
+    if (!m_overflow) {
+        if (topLayoutOverflow == m_y && bottomLayoutOverflow == m_y + boxHeight && topVisualOverflow == m_y && bottomVisualOverflow == m_y + boxHeight)
+            return;
+        m_overflow.set(new RenderOverflow(IntRect(m_x, m_y, m_width, boxHeight)));
+    }
+
+    m_overflow->setTopLayoutOverflow(topLayoutOverflow);
+    m_overflow->setBottomLayoutOverflow(bottomLayoutOverflow);
+    m_overflow->setTopVisualOverflow(topVisualOverflow); 
+    m_overflow->setBottomVisualOverflow(bottomVisualOverflow);  
+}
+
 #ifdef NDEBUG
 inline void InlineFlowBox::checkConsistency() const
 {
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 619fb95..751340d 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -312,8 +312,12 @@ void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
 
     ASSERT(paintInfo.phase != PaintPhaseSelfOutline && paintInfo.phase != PaintPhaseChildOutlines);
 
-    int xPos = tx + m_x - parent()->maxHorizontalVisualOverflow();
-    int w = width() + 2 * parent()->maxHorizontalVisualOverflow();
+    // FIXME: Technically we're potentially incorporating other visual overflow that had nothing to do with us.
+    // Would it be simpler to just check our own shadow and stroke overflow by hand here?
+    int leftOverflow = parent()->x() - parent()->leftVisualOverflow();
+    int rightOverflow = parent()->rightVisualOverflow() - (parent()->x() + parent()->width());
+    int xPos = tx + m_x - leftOverflow;
+    int w = width() + leftOverflow + rightOverflow;
     if (xPos >= paintInfo.rect.right() || xPos + w <= paintInfo.rect.x())
         return;
 
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 352f270..73b9a3a 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -32,28 +32,37 @@
 
 #include "MediaControlElements.h"
 
-#include "LocalizedStrings.h"
 #include "EventNames.h"
 #include "FloatConversion.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "RenderMedia.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
-#include "CString.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-// FIXME: These constants may need to be tweaked to better match the seeking in the QT plugin
+HTMLMediaElement* toParentMediaElement(RenderObject* o)
+{
+    Node* node = o->node();
+    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
+    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
+        return 0;
+
+    return static_cast<HTMLMediaElement*>(mediaNode);
+}
+
+// FIXME: These constants may need to be tweaked to better match the seeking in the QuickTime plug-in.
 static const float cSeekRepeatDelay = 0.1f;
 static const float cStepTime = 0.07f;
 static const float cSeekTime = 0.2f;
 
-MediaControlShadowRootElement::MediaControlShadowRootElement(Document* doc, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlShadowRootElement::MediaControlShadowRootElement(Document* document, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement) 
 {
     RefPtr<RenderStyle> rootStyle = RenderStyle::create();
@@ -76,14 +85,36 @@ void MediaControlShadowRootElement::updateStyle()
 }
 
 // ----------------------------
-    
 
-MediaControlElement::MediaControlElement(Document* doc, PseudoId pseudo, HTMLMediaElement* mediaElement) 
-    : HTMLDivElement(divTag, doc)
+MediaControlElement::MediaControlElement(Document* document, PseudoId pseudo, HTMLMediaElement* mediaElement)
+    : HTMLDivElement(divTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
 {
     setInDocument(true);
+    switch (pseudo) {
+    case MEDIA_CONTROLS_CURRENT_TIME_DISPLAY:
+        m_displayType = MediaCurrentTimeDisplay;
+        break;
+    case MEDIA_CONTROLS_TIME_REMAINING_DISPLAY:
+        m_displayType = MediaTimeRemainingDisplay;
+        break;
+    case MEDIA_CONTROLS_TIMELINE_CONTAINER:
+        m_displayType = MediaTimelineContainer;
+        break;
+    case MEDIA_CONTROLS_STATUS_DISPLAY:
+        m_displayType = MediaStatusDisplay;
+        break;
+    case MEDIA_CONTROLS_PANEL:
+        m_displayType = MediaControlsPanel;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER:
+        m_displayType = MediaVolumeSliderContainer;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlElement::attachToParent(Element* parent)
@@ -114,7 +145,10 @@ PassRefPtr<RenderStyle> MediaControlElement::styleForElement()
 
 bool MediaControlElement::rendererIsNeeded(RenderStyle* style)
 {
-    return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer();
+    ASSERT(document()->page());
+
+    return HTMLDivElement::rendererIsNeeded(style) && parent() && parent()->renderer()
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
     
 void MediaControlElement::attach()
@@ -165,8 +199,8 @@ void MediaControlElement::updateStyle()
 
 // ----------------------------
 
-MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
+MediaControlTimelineContainerElement::MediaControlTimelineContainerElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_TIMELINE_CONTAINER, element)
 {
 }
 
@@ -185,12 +219,54 @@ bool MediaControlTimelineContainerElement::rendererIsNeeded(RenderStyle* style)
     return !isnan(duration) && !isinf(duration);
 }
 
-    
 // ----------------------------
 
-MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* doc, HTMLMediaElement* element)
-: MediaControlElement(doc, MEDIA_CONTROLS_STATUS_DISPLAY, element)
-, m_stateBeingDisplayed(Nothing)
+MediaControlVolumeSliderContainerElement::MediaControlVolumeSliderContainerElement(Document* doc, HTMLMediaElement* element)
+    : MediaControlElement(doc, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, element)
+    , m_isVisible(false)
+    , m_x(0)
+    , m_y(0)
+{
+}
+
+PassRefPtr<RenderStyle> MediaControlVolumeSliderContainerElement::styleForElement()
+{
+    RefPtr<RenderStyle> style = MediaControlElement::styleForElement();
+    style->setPosition(AbsolutePosition);
+    style->setLeft(Length(m_x, Fixed));
+    style->setTop(Length(m_y, Fixed));
+    style->setDisplay(m_isVisible ? BLOCK : NONE);
+    return style;
+}
+
+void MediaControlVolumeSliderContainerElement::setVisible(bool visible)
+{
+    if (visible == m_isVisible)
+        return;
+    m_isVisible = visible;
+}
+
+void MediaControlVolumeSliderContainerElement::setPosition(int x, int y)
+{
+    if (x == m_x && y == m_y)
+        return;
+    m_x = x;
+    m_y = y;
+}
+
+bool MediaControlVolumeSliderContainerElement::hitTest(const IntPoint& absPoint)
+{
+    if (renderer() && renderer()->style()->hasAppearance())
+        return renderer()->theme()->hitTestMediaControlPart(renderer(), absPoint);
+
+    return false;
+}
+
+// ----------------------------
+
+MediaControlStatusDisplayElement::MediaControlStatusDisplayElement(Document* document, HTMLMediaElement* element)
+    : MediaControlElement(document, MEDIA_CONTROLS_STATUS_DISPLAY, element)
+    , m_stateBeingDisplayed(Nothing)
 {
 }
 
@@ -235,14 +311,46 @@ bool MediaControlStatusDisplayElement::rendererIsNeeded(RenderStyle* style)
 
 // ----------------------------
     
-MediaControlInputElement::MediaControlInputElement(Document* doc, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement, MediaControlElementType displayType) 
-    : HTMLInputElement(inputTag, doc)
+MediaControlInputElement::MediaControlInputElement(Document* document, PseudoId pseudo, const String& type, HTMLMediaElement* mediaElement)
+    : HTMLInputElement(inputTag, document)
     , m_mediaElement(mediaElement)
     , m_pseudoStyleId(pseudo)
-    , m_displayType(displayType)
 {
     setInputType(type);
     setInDocument(true);
+
+    switch (pseudo) {
+    case MEDIA_CONTROLS_MUTE_BUTTON:
+        m_displayType = MediaMuteButton;
+        break;
+    case MEDIA_CONTROLS_PLAY_BUTTON:
+        m_displayType = MediaPlayButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_FORWARD_BUTTON:
+        m_displayType = MediaSeekForwardButton;
+        break;
+    case MEDIA_CONTROLS_SEEK_BACK_BUTTON:
+        m_displayType = MediaSeekBackButton;
+        break;
+    case MEDIA_CONTROLS_FULLSCREEN_BUTTON:
+        m_displayType = MediaFullscreenButton;
+        break;
+    case MEDIA_CONTROLS_TIMELINE:
+        m_displayType = MediaSlider;
+        break;
+    case MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON:
+        m_displayType = MediaReturnToRealtimeButton;
+        break;
+    case MEDIA_CONTROLS_REWIND_BUTTON:
+        m_displayType = MediaRewindButton;
+        break;
+    case MEDIA_CONTROLS_VOLUME_SLIDER:
+        m_displayType = MediaVolumeSlider;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+        break;
+    }
 }
 
 void MediaControlInputElement::attachToParent(Element* parent)
@@ -265,7 +373,10 @@ PassRefPtr<RenderStyle> MediaControlInputElement::styleForElement()
 
 bool MediaControlInputElement::rendererIsNeeded(RenderStyle* style)
 {
-    return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer();
+    ASSERT(document()->page());
+
+    return HTMLInputElement::rendererIsNeeded(style) && parent() && parent()->renderer()
+        && (!style->hasAppearance() || document()->page()->theme()->shouldRenderMediaControlPart(style->appearance(), m_mediaElement));
 }
 
 void MediaControlInputElement::attach()
@@ -324,14 +435,14 @@ void MediaControlInputElement::setDisplayType(MediaControlElementType displayTyp
         return;
 
     m_displayType = displayType;
-    if (RenderObject* o = renderer())
-        o->repaint();
+    if (RenderObject* object = renderer())
+        object->repaint();
 }
 
 // ----------------------------
 
-MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_MUTE_BUTTON, "button", element, element->muted() ? MediaUnMuteButton : MediaMuteButton)
+MediaControlMuteButtonElement::MediaControlMuteButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_MUTE_BUTTON, "button", element)
 {
 }
 
@@ -351,8 +462,8 @@ void MediaControlMuteButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_PLAY_BUTTON, "button", element, element->canPlay() ? MediaPlayButton : MediaPauseButton)
+MediaControlPlayButtonElement::MediaControlPlayButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_PLAY_BUTTON, "button", element)
 {
 }
 
@@ -372,9 +483,9 @@ void MediaControlPlayButtonElement::updateDisplayType()
 
 // ----------------------------
 
-MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* doc, HTMLMediaElement* element, bool forward)
-    : MediaControlInputElement(doc, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
-                               "button", element, forward ? MediaSeekForwardButton : MediaSeekBackButton)
+MediaControlSeekButtonElement::MediaControlSeekButtonElement(Document* document, HTMLMediaElement* element, bool forward)
+    : MediaControlInputElement(document, forward ? MEDIA_CONTROLS_SEEK_FORWARD_BUTTON : MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+                               "button", element)
     , m_forward(forward)
     , m_seeking(false)
     , m_capturing(false)
@@ -432,8 +543,8 @@ void MediaControlSeekButtonElement::detach()
 
 // ----------------------------
 
-MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_REWIND_BUTTON, "button", element, MediaRewindButton)
+MediaControlRewindButtonElement::MediaControlRewindButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_REWIND_BUTTON, "button", element)
 {
 }
 
@@ -446,16 +557,11 @@ void MediaControlRewindButtonElement::defaultEventHandler(Event* event)
     HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlRewindButtonElement::rendererIsNeeded(RenderStyle* style)
-{
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->movieLoadType() != MediaPlayer::LiveStream;
-}
-
 
 // ----------------------------
 
-MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* doc, HTMLMediaElement* element)
-: MediaControlInputElement(doc, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element, MediaReturnToRealtimeButton)
+MediaControlReturnToRealtimeButtonElement::MediaControlReturnToRealtimeButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, "button", element)
 {
 }
 
@@ -468,22 +574,18 @@ void MediaControlReturnToRealtimeButtonElement::defaultEventHandler(Event* event
     HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlReturnToRealtimeButtonElement::rendererIsNeeded(RenderStyle* style)
-{
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->movieLoadType() == MediaPlayer::LiveStream;
-}
 
 // ----------------------------
 
 MediaControlTimelineElement::MediaControlTimelineElement(Document* document, HTMLMediaElement* element)
-    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element, MediaTimelineContainer)
-{ 
+    : MediaControlInputElement(document, MEDIA_CONTROLS_TIMELINE, "range", element)
+{
 }
 
 void MediaControlTimelineElement::defaultEventHandler(Event* event)
 {
-    // Left button is 0. Accepts only if mouse event is from left button.
-    if (!event->isMouseEvent() || static_cast<MouseEvent*>(event)->button())
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
         return;
 
     if (event->type() == eventNames().mousedownEvent)
@@ -520,29 +622,51 @@ void MediaControlTimelineElement::update(bool updateDuration)
 
 // ----------------------------
 
-MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* doc, HTMLMediaElement* element)
-    : MediaControlInputElement(doc, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element, MediaFullscreenButton)
+MediaControlVolumeSliderElement::MediaControlVolumeSliderElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_VOLUME_SLIDER, "range", element)
 {
 }
 
-void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
+void MediaControlVolumeSliderElement::defaultEventHandler(Event* event)
 {
-    if (event->type() == eventNames().clickEvent) {
-        event->setDefaultHandled();
+    // Left button is 0. Rejects mouse events not from left button.
+    if (event->isMouseEvent() && static_cast<MouseEvent*>(event)->button())
+        return;
+
+    MediaControlInputElement::defaultEventHandler(event);
+
+    if (event->type() == eventNames().mouseoverEvent || event->type() == eventNames().mouseoutEvent || event->type() == eventNames().mousemoveEvent)
+        return;
+
+    float volume = narrowPrecisionToFloat(value().toDouble());
+    if (volume != m_mediaElement->volume()) {
+        ExceptionCode ec = 0;
+        m_mediaElement->setVolume(volume, ec);
+        ASSERT(!ec);
     }
-    HTMLInputElement::defaultEventHandler(event);
 }
 
-bool MediaControlFullscreenButtonElement::rendererIsNeeded(RenderStyle* style)
+// ----------------------------
+
+MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement(Document* document, HTMLMediaElement* element)
+    : MediaControlInputElement(document, MEDIA_CONTROLS_FULLSCREEN_BUTTON, "button", element)
 {
-    return MediaControlInputElement::rendererIsNeeded(style) && m_mediaElement->supportsFullscreen();
 }
 
+void MediaControlFullscreenButtonElement::defaultEventHandler(Event* event)
+{
+    if (event->type() == eventNames().clickEvent) {
+        m_mediaElement->enterFullscreen();
+        event->setDefaultHandled();
+    }
+    HTMLInputElement::defaultEventHandler(event);
+}
 
 // ----------------------------
 
-MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* doc, PseudoId pseudo, HTMLMediaElement* element)
-    : MediaControlElement(doc, pseudo, element)
+MediaControlTimeDisplayElement::MediaControlTimeDisplayElement(Document* document, PseudoId pseudo, HTMLMediaElement* element)
+    : MediaControlElement(document, pseudo, element)
+    , m_currentValue(0)
     , m_isVisible(true)
 {
 }
@@ -572,6 +696,32 @@ void MediaControlTimeDisplayElement::setVisible(bool visible)
     renderer()->setStyle(style.get());
 }
 
+String MediaControlTimeDisplayElement::formatTime(float time)
+{
+    if (!isfinite(time))
+        time = 0;
+    int seconds = (int)fabsf(time);
+    int hours = seconds / (60 * 60);
+    int minutes = (seconds / 60) % 60;
+    seconds %= 60;
+    if (hours) {
+        if (hours > 9)
+            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+
+        return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
+    }
+
+    return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
+}
+
+void MediaControlTimeDisplayElement::setCurrentValue(float time)
+{
+    m_currentValue = time;
+
+    ExceptionCode ec;
+    setInnerText(formatTime(m_currentValue), ec);
+}
+
 
 } //namespace WebCore
 #endif // enable(video)
diff --git a/WebCore/rendering/MediaControlElements.h b/WebCore/rendering/MediaControlElements.h
index d5fa5d2..e562bb5 100644
--- a/WebCore/rendering/MediaControlElements.h
+++ b/WebCore/rendering/MediaControlElements.h
@@ -57,12 +57,17 @@ enum MediaControlElementType {
     MediaUnMuteButton,
     MediaPauseButton,
     MediaTimelineContainer,
-    MediaCurrentTimeDisplay, 
+    MediaCurrentTimeDisplay,
     MediaTimeRemainingDisplay,
     MediaStatusDisplay,
-    MediaControlsPanel
+    MediaControlsPanel,
+    MediaVolumeSliderContainer,
+    MediaVolumeSlider,
+    MediaVolumeSliderThumb
 };
 
+HTMLMediaElement* toParentMediaElement(RenderObject*);
+
 class MediaControlShadowRootElement : public HTMLDivElement {
 public:
     MediaControlShadowRootElement(Document*, HTMLMediaElement*);
@@ -89,9 +94,15 @@ public:
     void update();
     virtual void updateStyle();
 
+    MediaControlElementType displayType() const { return m_displayType; }
+
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
+    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
 };
 
 // ----------------------------
@@ -104,6 +115,22 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderContainerElement : public MediaControlElement {
+public:
+    MediaControlVolumeSliderContainerElement(Document*, HTMLMediaElement*);
+    virtual PassRefPtr<RenderStyle> styleForElement();
+    void setVisible(bool);
+    bool isVisible() { return m_isVisible; }
+    void setPosition(int x, int y);
+    bool hitTest(const IntPoint& absPoint);
+
+private:
+    bool m_isVisible;
+    int m_x, m_y;
+};
+
+// ----------------------------
+
 class MediaControlStatusDisplayElement : public MediaControlElement {
 public:
     MediaControlStatusDisplayElement(Document*, HTMLMediaElement*);
@@ -118,7 +145,7 @@ private:
 
 class MediaControlInputElement : public HTMLInputElement {
 public:
-    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*, MediaControlElementType);
+    MediaControlInputElement(Document*, PseudoId, const String& type, HTMLMediaElement*);
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
 
@@ -130,13 +157,16 @@ public:
     bool hitTest(const IntPoint& absPoint);
     MediaControlElementType displayType() const { return m_displayType; }
 
+    HTMLMediaElement* mediaElement() const { return m_mediaElement; }
+    virtual bool isMediaControlElement() const { return true; }
+
 protected:
     virtual void updateDisplayType() { }
     void setDisplayType(MediaControlElementType);
 
     HTMLMediaElement* m_mediaElement;   
     PseudoId m_pseudoStyleId;
-    MediaControlElementType m_displayType;  // some elements can show multiple types (e.g. play/pause)
+    MediaControlElementType m_displayType;
 };
 
 // ----------------------------
@@ -179,7 +209,6 @@ class MediaControlRewindButtonElement : public MediaControlInputElement {
 public:
     MediaControlRewindButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
@@ -188,7 +217,6 @@ class MediaControlReturnToRealtimeButtonElement : public MediaControlInputElemen
 public:
     MediaControlReturnToRealtimeButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };    
 
 // ----------------------------
@@ -202,11 +230,18 @@ public:
 
 // ----------------------------
 
+class MediaControlVolumeSliderElement : public MediaControlInputElement {
+public:
+    MediaControlVolumeSliderElement(Document*, HTMLMediaElement*);
+    virtual void defaultEventHandler(Event*);
+};
+
+// ----------------------------
+
 class MediaControlFullscreenButtonElement : public MediaControlInputElement {
 public:
     MediaControlFullscreenButtonElement(Document*, HTMLMediaElement*);
     virtual void defaultEventHandler(Event*);
-    virtual bool rendererIsNeeded(RenderStyle*);
 };
 
 // ----------------------------
@@ -217,7 +252,13 @@ public:
     void setVisible(bool);
     virtual PassRefPtr<RenderStyle> styleForElement();
 
+    void setCurrentValue(float);
+    float currentValue() const { return m_currentValue; }
+
 private:
+    String formatTime(float time);
+
+    float m_currentValue;
     bool m_isVisible;
 };
 
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index e10c331..c6d18d2 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InlineTextBox.h"
+#include "RenderFlexibleBox.h"
 #include "RenderImage.h"
 #include "RenderInline.h"
 #include "RenderMarquee.h"
@@ -118,8 +119,6 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int top, int bottom)
 
     m_posMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(true) : 0;
     m_negMargin = m_canCollapseTopWithChildren ? block->maxTopMargin(false) : 0;
-
-    m_selfCollapsingBlockClearedFloat = false;
     
     m_topQuirk = m_bottomQuirk = m_determinedTopQuirk = false;
 }
@@ -132,10 +131,6 @@ RenderBlock::RenderBlock(Node* node)
       , m_positionedObjects(0)
       , m_inlineContinuation(0)
       , m_maxMargin(0)
-      , m_overflowHeight(0)
-      , m_overflowWidth(0)
-      , m_overflowLeft(0)
-      , m_overflowTop(0)
       , m_lineHeight(-1)
 {
     setChildrenInline(true);
@@ -554,103 +549,6 @@ void RenderBlock::removeChild(RenderObject* oldChild)
     }
 }
 
-int RenderBlock::overflowHeight(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
-
-        int inflatedHeight = height() + shadowBottom;
-        if (hasReflection())
-            inflatedHeight = max(inflatedHeight, reflectionBox().bottom());
-        return inflatedHeight;
-    }
-    return m_overflowHeight;
-}
-
-int RenderBlock::overflowWidth(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-        int inflatedWidth = width() + shadowRight;
-        if (hasReflection())
-            inflatedWidth = max(inflatedWidth, reflectionBox().right());
-        return inflatedWidth;
-    }
-    return m_overflowWidth;
-}
-
-int RenderBlock::overflowLeft(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        style()->getBoxShadowHorizontalExtent(shadowLeft, shadowRight);
-
-        int left = shadowLeft;
-        if (hasReflection())
-            left = min(left, reflectionBox().x());
-        return left;
-    }
-    return m_overflowLeft;
-}
-
-int RenderBlock::overflowTop(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowVerticalExtent(shadowTop, shadowBottom);
-
-        int top = shadowTop;
-        if (hasReflection())
-            top = min(top, reflectionBox().y());
-        return top;
-    }
-    return m_overflowTop;
-}
-
-IntRect RenderBlock::overflowRect(bool includeInterior) const
-{
-    if (!includeInterior && hasOverflowClip()) {
-        IntRect box = borderBoxRect();
-
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        box.move(shadowLeft, shadowTop);
-        box.setWidth(box.width() - shadowLeft + shadowRight);
-        box.setHeight(box.height() - shadowTop + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            int reflectTop = min(box.y(), reflection.y());
-            int reflectBottom = max(box.bottom(), reflection.bottom());
-            box.setHeight(reflectBottom - reflectTop);
-            box.setY(reflectTop);
-            
-            int reflectLeft = min(box.x(), reflection.x());
-            int reflectRight = max(box.right(), reflection.right());
-            box.setWidth(reflectRight - reflectLeft);
-            box.setX(reflectLeft);
-        }
-        return box;
-    }
-
-    if (!includeInterior && hasOverflowClip())
-        return borderBoxRect();
-    int l = overflowLeft(includeInterior);
-    int t = overflowTop(includeInterior);
-    return IntRect(l, t, overflowWidth(includeInterior) - l, max(overflowHeight(includeInterior), height()) - t);
-}
-
 bool RenderBlock::isSelfCollapsingBlock() const
 {
     // We are not self-collapsing if we
@@ -744,13 +642,9 @@ void RenderBlock::layout()
     layoutBlock(false);
     
     // It's safe to check for control clip here, since controls can never be table cells.
-    if (hasControlClip()) {
-        // Because of the lightweight clip, there can never be any overflow from children.
-        m_overflowWidth = width();
-        m_overflowHeight = height();
-        m_overflowLeft = 0;
-        m_overflowTop = 0;
-    }
+    // If we have a lightweight clip, there can never be any overflow from children.
+    if (hasControlClip() && m_overflow)
+        clearLayoutOverflow();
 }
 
 void RenderBlock::layoutBlock(bool relayoutChildren)
@@ -776,8 +670,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     calcWidth();
     calcColumnWidth();
 
-    m_overflowWidth = width();
-    m_overflowLeft = 0;
+    m_overflow.clear();
 
     if (oldWidth != width() || oldColumnWidth != desiredColumnWidth())
         relayoutChildren = true;
@@ -795,8 +688,6 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     int previousHeight = height();
     setHeight(0);
 
-    m_overflowHeight = 0;
-
     // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
     // are collapsed with adjacent blocks, so for example, if you have block A and B
@@ -861,50 +752,35 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
                 }
             }
         }
+        
         // We have to rebalance columns to the new height.
         layoutColumns(singleColumnBottom);
-
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= toAdd;
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
     }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
-    if ((isCell || isInline() || isFloatingOrPositioned() || isRoot()) && !hasOverflowClip() && !hasControlClip())
-        addVisualOverflow(floatRect());
+    // It's weird that we're treating float information as normal flow overflow, but we do this because floatRect() isn't
+    // able to be propagated up the render tree yet.  Overflow information is however.  This check is designed to catch anyone
+    // who wasn't going to propagate float information up to the parent and yet could potentially be painted by its ancestor.
+    if (isRoot() || expandsToEncloseOverhangingFloats())
+        addOverflowFromFloats();
 
-    layoutPositionedObjects(relayoutChildren || isRoot());
+    // Add overflow from children (unless we're multi-column, since in that case all our child overflow is clipped anyway).
+    if (!hasColumns()) {
+        if (childrenInline())
+            addOverflowFromInlineChildren();
+        else
+            addOverflowFromBlockChildren();
+    }
 
-    positionListMarker();
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
-    // Always ensure our overflow width/height are at least as large as our width/height.
-    m_overflowWidth = max(m_overflowWidth, width());
-    m_overflowHeight = max(m_overflowHeight, height());
-
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowWidth = max(m_overflowWidth, reflection.right());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-        }
-    }
+    layoutPositionedObjects(relayoutChildren || isRoot());
 
+    positionListMarker();
+    
     statePusher.pop();
 
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
@@ -914,7 +790,9 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
     if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        IntRect repaintRect(m_overflowLeft, repaintTop, m_overflowWidth - m_overflowLeft, repaintBottom - repaintTop);
+        int repaintLeft = min(leftVisualOverflow(), leftLayoutOverflow());
+        int repaintRight = max(rightVisualOverflow(), rightLayoutOverflow());
+        IntRect repaintRect(repaintLeft, repaintTop, repaintRight - repaintLeft, repaintBottom - repaintTop);
 
         // FIXME: Deal with multiple column repainting.  We have to split the repaint
         // rect up into multiple rects if it spans columns.
@@ -943,6 +821,28 @@ void RenderBlock::layoutBlock(bool relayoutChildren)
     setNeedsLayout(false);
 }
 
+void RenderBlock::addOverflowFromBlockChildren()
+{
+    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
+        if (!child->isFloatingOrPositioned())
+            addOverflowFromChild(child);
+    }
+}
+
+void RenderBlock::addOverflowFromFloats()
+{
+    IntRect result;
+    if (!m_floatingObjects)
+        return;
+    FloatingObject* r;
+    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
+    for (; (r = it.current()); ++it) {
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
+    }
+    return;
+}
+
 bool RenderBlock::expandsToEncloseOverhangingFloats() const
 {
     return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isFlexibleBox()) || hasColumns() || isTableCell() || isFieldset();
@@ -1032,7 +932,10 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
     // See if we have a run-in element with inline children.  If the
     // children aren't inline, then just treat the run-in as a normal
     // block.
-    if (!child->isRunIn() || !child->childrenInline() && !child->isReplaced())
+    if (!child->isRunIn() || !child->childrenInline())
+        return false;
+    // FIXME: We don't handle non-block elements with run-in for now.
+    if (!child->isRenderBlock())
         return false;
 
     // Get the next non-positioned/non-floating RenderBlock.
@@ -1166,8 +1069,6 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
 
         if (marginInfo.margin())
             marginInfo.setBottomQuirk(child->isBottomMarginQuirk() || style()->marginBottomCollapse() == MDISCARD);
-
-        marginInfo.setSelfCollapsingBlockClearedFloat(false);
     }
     
     return ypos;
@@ -1183,16 +1084,26 @@ int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, i
         // For self-collapsing blocks that clear, they can still collapse their
         // margins with following siblings.  Reset the current margins to represent
         // the self-collapsing block's margins only.
-        marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
-        marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        // CSS2.1 states:
+        // "An element that has had clearance applied to it never collapses its top margin with its parent block's bottom margin.
+        // Therefore if we are at the bottom of the block, let's go ahead and reset margins to only include the
+        // self-collapsing block's bottom margin.
+        bool atBottomOfBlock = true;
+        for (RenderBox* curr = child->nextSiblingBox(); curr && atBottomOfBlock; curr = curr->nextSiblingBox()) {
+            if (!curr->isFloatingOrPositioned())
+                atBottomOfBlock = false;
+        }
+        if (atBottomOfBlock) {
+            marginInfo.setPosMargin(child->maxBottomMargin(true));
+            marginInfo.setNegMargin(child->maxBottomMargin(false));
+        } else {
+            marginInfo.setPosMargin(max(child->maxTopMargin(true), child->maxBottomMargin(true)));
+            marginInfo.setNegMargin(max(child->maxTopMargin(false), child->maxBottomMargin(false)));
+        }
         
-        // Adjust our height such that we are ready to be collapsed with subsequent siblings.
+        // Adjust our height such that we are ready to be collapsed with subsequent siblings (or the bottom
+        // of the parent block).
         setHeight(child->y() - max(0, marginInfo.margin()));
-        
-        // Set a flag that we cleared a float so that we know both to increase the height of the block
-        // to compensate for the clear and to avoid collapsing our margins with the parent block's
-        // bottom margin.
-        marginInfo.setSelfCollapsingBlockClearedFloat(true);
     } else
         // Increase our height by the amount we had to clear.
         setHeight(height() + heightIncrease);
@@ -1296,17 +1207,7 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
 
 void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInfo)
 {
-    // If our last flow was a self-collapsing block that cleared a float, then we don't
-    // collapse it with the bottom of the block.
-    if (!marginInfo.selfCollapsingBlockClearedFloat())
-        marginInfo.setAtBottomOfBlock(true);
-    else {
-        // We have to special case the negative margin situation (where the collapsed
-        // margin of the self-collapsing block is negative), since there's no need
-        // to make an adjustment in that case.
-        if (marginInfo.margin() < 0)
-            marginInfo.clearMargin();
-    }
+    marginInfo.setAtBottomOfBlock(true);
 
     // If we can't collapse with children then go ahead and add in the bottom margin.
     if (!marginInfo.canCollapseWithBottom() && !marginInfo.canCollapseWithTop()
@@ -1320,9 +1221,6 @@ void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInf
     // If this happens, ensure that the computed height is increased to the minimal height.
     setHeight(max(height(), top + bottom));
 
-    // Always make sure our overflow height is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
     // Update our bottom collapsed margin info.
     setCollapsedBottomMargin(marginInfo);
 }
@@ -1350,8 +1248,7 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
     int top = borderTop() + paddingTop();
     int bottom = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
 
-    m_overflowHeight = top;
-    setHeight(m_overflowHeight);
+    setHeight(top);
 
     // The margin struct caches all our current margin collapsing state.  The compact struct caches state when we encounter compacts,
     MarginInfo marginInfo(this, top, bottom);
@@ -1372,9 +1269,6 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (legend == child)
             continue; // Skip the legend, since it has already been positioned up in the fieldset's border.
 
-        int oldTopPosMargin = maxTopPosMargin();
-        int oldTopNegMargin = maxTopNegMargin();
-
         // Make sure we layout children if they need it.
         // FIXME: Technically percentage height objects only need a relayout if their percentage isn't going to be turned into
         // an auto value.  Add a method to determine this, so that we can avoid the relayout.
@@ -1390,127 +1284,127 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         if (handleSpecialChild(child, marginInfo))
             continue;
 
-        // The child is a normal flow object.  Compute its vertical margins now.
-        child->calcVerticalMargins();
+        // Lay out the child.
+        layoutBlockChild(child, marginInfo, previousFloatBottom, maxFloatBottom);
+    }
+    
+    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
+    // determining the correct collapsed bottom margin information.
+    handleBottomOfBlock(top, bottom, marginInfo);
+}
 
-        // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
-        if (child->style()->marginTopCollapse() == MSEPARATE) {
-            marginInfo.setAtTopOfBlock(false);
-            marginInfo.clearMargin();
-        }
+void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int& previousFloatBottom, int& maxFloatBottom)
+{
+    int oldTopPosMargin = maxTopPosMargin();
+    int oldTopNegMargin = maxTopNegMargin();
 
-        // Try to guess our correct y position.  In most cases this guess will
-        // be correct.  Only if we're wrong (when we compute the real y position)
-        // will we have to potentially relayout.
-        int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+    // The child is a normal flow object.  Compute its vertical margins now.
+    child->calcVerticalMargins();
 
-        // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
-        IntRect oldRect(child->x(), child->y() , child->width(), child->height());
+    // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
+    if (child->style()->marginTopCollapse() == MSEPARATE) {
+        marginInfo.setAtTopOfBlock(false);
+        marginInfo.clearMargin();
+    }
+
+    // Try to guess our correct y position.  In most cases this guess will
+    // be correct.  Only if we're wrong (when we compute the real y position)
+    // will we have to potentially relayout.
+    int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+
+    // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
+    IntRect oldRect(child->x(), child->y() , child->width(), child->height());
 #ifndef NDEBUG
-        IntSize oldLayoutDelta = view()->layoutDelta();
+    IntSize oldLayoutDelta = view()->layoutDelta();
 #endif
-        // Go ahead and position the child as though it didn't collapse with the top.
-        view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
-        child->setLocation(child->x(), yPosEstimate);
-
-        bool markDescendantsWithFloats = false;
-        if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+    // Go ahead and position the child as though it didn't collapse with the top.
+    view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
+    child->setLocation(child->x(), yPosEstimate);
+
+    bool markDescendantsWithFloats = false;
+    if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        markDescendantsWithFloats = true;
+    else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
+        // If an element might be affected by the presence of floats, then always mark it for
+        // layout.
+        int fb = max(previousFloatBottom, floatBottom());
+        if (fb > yPosEstimate)
             markDescendantsWithFloats = true;
-        else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
-            // If an element might be affected by the presence of floats, then always mark it for
-            // layout.
-            int fb = max(previousFloatBottom, floatBottom());
-            if (fb > yPosEstimate)
-                markDescendantsWithFloats = true;
-        }
+    }
 
-        if (child->isRenderBlock()) {
-            if (markDescendantsWithFloats)
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+    if (child->isRenderBlock()) {
+        if (markDescendantsWithFloats)
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
 
-            previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
-        }
+        previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
+    }
 
-        bool childHadLayout = child->m_everHadLayout;
-        bool childNeededLayout = child->needsLayout();
-        if (childNeededLayout)
-            child->layout();
+    bool childHadLayout = child->m_everHadLayout;
+    bool childNeededLayout = child->needsLayout();
+    if (childNeededLayout)
+        child->layout();
 
-        // Now determine the correct ypos based off examination of collapsing margin
-        // values.
-        int yBeforeClear = collapseMargins(child, marginInfo);
+    // Now determine the correct ypos based off examination of collapsing margin
+    // values.
+    int yBeforeClear = collapseMargins(child, marginInfo);
 
-        // Now check for clear.
-        int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
-        
-        view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
-        child->setLocation(child->x(), yAfterClear);
+    // Now check for clear.
+    int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
     
-        // Now we have a final y position.  See if it really does end up being different from our estimate.
-        if (yAfterClear != yPosEstimate) {
-            if (child->shrinkToAvoidFloats()) {
-                // The child's width depends on the line width.
-                // When the child shifts to clear an item, its width can
-                // change (because it has more available line width).
-                // So go ahead and mark the item as dirty.
-                child->setChildNeedsLayout(true, false);
-            }
-            if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-                toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
-            // Our guess was wrong. Make the child lay itself out again.
-            child->layoutIfNeeded();
+    view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
+    child->setLocation(child->x(), yAfterClear);
+
+    // Now we have a final y position.  See if it really does end up being different from our estimate.
+    if (yAfterClear != yPosEstimate) {
+        if (child->shrinkToAvoidFloats()) {
+            // The child's width depends on the line width.
+            // When the child shifts to clear an item, its width can
+            // change (because it has more available line width).
+            // So go ahead and mark the item as dirty.
+            child->setChildNeedsLayout(true, false);
         }
+        if (!child->avoidsFloats() && child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+            toRenderBlock(child)->markAllDescendantsWithFloatsForLayout();
+        // Our guess was wrong. Make the child lay itself out again.
+        child->layoutIfNeeded();
+    }
 
-        // We are no longer at the top of the block if we encounter a non-empty child.  
-        // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
-        if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
-            marginInfo.setAtTopOfBlock(false);
-
-        // Now place the child in the correct horizontal position
-        determineHorizontalPosition(child);
+    // We are no longer at the top of the block if we encounter a non-empty child.  
+    // This has to be done after checking for clear, so that margins can be reset if a clear occurred.
+    if (marginInfo.atTopOfBlock() && !child->isSelfCollapsingBlock())
+        marginInfo.setAtTopOfBlock(false);
 
-        // Update our height now that the child has been placed in the correct position.
-        setHeight(height() + child->height());
-        if (child->style()->marginBottomCollapse() == MSEPARATE) {
-            setHeight(height() + child->marginBottom());
-            marginInfo.clearMargin();
-        }
-        // If the child has overhanging floats that intrude into following siblings (or possibly out
-        // of this block), then the parent gets notified of the floats now.
-        if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
-            maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
-
-        // Update our visual overflow in case the child spills out the block, but only if we were going to paint
-        // the child block ourselves.
-        if (!child->hasSelfPaintingLayer()) {
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, height() + child->overflowHeight(false) - child->height());
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-        }
+    // Now place the child in the correct horizontal position
+    determineHorizontalPosition(child);
 
-        IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
-        if (childOffset.width() || childOffset.height()) {
-            view()->addLayoutDelta(childOffset);
+    // Update our height now that the child has been placed in the correct position.
+    setHeight(height() + child->height());
+    if (child->style()->marginBottomCollapse() == MSEPARATE) {
+        setHeight(height() + child->marginBottom());
+        marginInfo.clearMargin();
+    }
+    // If the child has overhanging floats that intrude into following siblings (or possibly out
+    // of this block), then the parent gets notified of the floats now.
+    if (child->isBlockFlow() && toRenderBlock(child)->containsFloats())
+        maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
 
-            // If the child moved, we have to repaint it as well as any floating/positioned
-            // descendants.  An exception is if we need a layout.  In this case, we know we're going to
-            // repaint ourselves (and the child) anyway.
-            if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
-                child->repaintDuringLayoutIfMoved(oldRect);
-        }
+    IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
+    if (childOffset.width() || childOffset.height()) {
+        view()->addLayoutDelta(childOffset);
 
-        if (!childHadLayout && child->checkForRepaintDuringLayout()) {
-            child->repaint();
-            child->repaintOverhangingFloats(true);
-        }
+        // If the child moved, we have to repaint it as well as any floating/positioned
+        // descendants.  An exception is if we need a layout.  In this case, we know we're going to
+        // repaint ourselves (and the child) anyway.
+        if (childHadLayout && !selfNeedsLayout() && child->checkForRepaintDuringLayout())
+            child->repaintDuringLayoutIfMoved(oldRect);
+    }
 
-        ASSERT(oldLayoutDelta == view()->layoutDelta());
+    if (!childHadLayout && child->checkForRepaintDuringLayout()) {
+        child->repaint();
+        child->repaintOverhangingFloats(true);
     }
 
-    // Now do the handling of the bottom of the block, adding in our bottom border/padding and
-    // determining the correct collapsed bottom margin information.
-    handleBottomOfBlock(top, bottom, marginInfo);
+    ASSERT(oldLayoutDelta == view()->layoutDelta());
 }
 
 bool RenderBlock::layoutOnlyPositionedObjects()
@@ -1623,7 +1517,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // FIXME: Could eliminate the isRoot() check if we fix background painting so that the RenderView
     // paints the root's background.
     if (!isRoot()) {
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.inflate(maximalOutlineSize(paintInfo.phase));
         overflowBox.move(tx, ty);
         if (!overflowBox.intersects(paintInfo.rect))
@@ -2160,9 +2054,9 @@ GapRects RenderBlock::fillInlineSelectionGaps(RenderBlock* rootBlock, int blockX
 
     if (lastSelectedLine && selectionState() != SelectionEnd && selectionState() != SelectionBoth) {
         // Go ahead and update our lastY to be the bottom of the last selected line.
-        lastTop = (ty - blockY) + lastSelectedLine->bottomOverflow();
-        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
-        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->bottomOverflow());
+        lastTop = (ty - blockY) + lastSelectedLine->selectionBottom();
+        lastLeft = leftSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
+        lastRight = rightSelectionOffset(rootBlock, lastSelectedLine->selectionBottom());
     }
     return result;
 }
@@ -2713,13 +2607,13 @@ RenderBlock::floatBottom() const
 IntRect RenderBlock::floatRect() const
 {
     IntRect result;
-    if (!m_floatingObjects || hasOverflowClip())
+    if (!m_floatingObjects || hasOverflowClip() || hasColumns())
         return result;
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect childRect = r->m_renderer->overflowRect(false);
+            IntRect childRect = r->m_renderer->visibleOverflowRect();
             childRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
             result.unite(childRect);
         }
@@ -2730,10 +2624,11 @@ IntRect RenderBlock::floatRect() const
 
 int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int bottom = includeSelf && width() > 0 ? height() : 0;
+
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && width() > 0 ? overflowHeight(false) : 0;
+        return bottom;
     
-    int bottom = includeSelf && width() > 0 ? height() : 0;
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2757,7 +2652,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetY() : 0;
 
     if (includeSelf)
-        bottom = max(bottom, m_overflowHeight + relativeOffset);
+        bottom = max(bottom, bottomLayoutOverflow() + relativeOffset);
         
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2799,8 +2694,8 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
     if (!includeSelf) {
         bottom = max(bottom, borderTop() + paddingTop() + paddingBottom() + relativeOffset);
         if (childrenInline()) {
-            if (lastLineBox()) {
-                int childBottomEdge = lastLineBox()->y() + lastLineBox()->height();
+            if (lastRootBox()) {
+                int childBottomEdge = lastRootBox()->selectionBottom();
                 bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         } else {
@@ -2820,11 +2715,11 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
 
 int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
-    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowWidth(false) : 0;
-
     int right = includeSelf && height() > 0 ? width() : 0;
 
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return right;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2847,7 +2742,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        right = max(right, m_overflowWidth + relativeOffset);
+        right = max(right, rightLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -2914,10 +2809,11 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
 int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
 {
+    int left = includeSelf && height() > 0 ? 0 : width();
+    
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return includeSelf && height() > 0 ? overflowLeft(false) : width();
+        return left;
 
-    int left = includeSelf && height() > 0 ? 0 : width();
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -2940,7 +2836,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
     int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetX() : 0;
 
     if (includeSelf)
-        left = min(left, m_overflowLeft + relativeOffset);
+        left = min(left, leftLayoutOverflow() + relativeOffset);
 
     if (m_positionedObjects) {
         RenderBox* r;
@@ -3134,9 +3030,8 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
 
     int lowestFloatBottom = 0;
 
-    // Floats that will remain the child's responsiblity to paint should factor into its
-    // visual overflow.
-    IntRect floatsOverflowRect;
+    // Floats that will remain the child's responsibility to paint should factor into its
+    // overflow.
     DeprecatedPtrListIterator<FloatingObject> it(*child->m_floatingObjects);
     for (FloatingObject* r; (r = it.current()); ++it) {
         int bottom = child->y() + r->m_bottom;
@@ -3177,13 +3072,9 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
             // it should paint.
             r->m_shouldPaint = true;
 
-        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
-            IntRect floatOverflowRect = r->m_renderer->overflowRect(false);
-            floatOverflowRect.move(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop());
-            floatsOverflowRect.unite(floatOverflowRect);
-        }
+        if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
+            child->addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
     }
-    child->addVisualOverflow(floatsOverflowRect);
     return lowestFloatBottom;
 }
 
@@ -3298,26 +3189,20 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
     // We also clear floats if we are too big to sit on the same line as a float (and wish to avoid floats by default).
     // FIXME: Note that the remaining space checks aren't quite accurate, since you should be able to clear only some floats (the minimum # needed
     // to fit) and not all (we should be using nextFloatBottomBelow and looping).
-    // Do not allow tables to wrap in quirks or even in almost strict mode 
-    // (ebay on the PLT, finance.yahoo.com in the real world, versiontracker.com forces even almost strict mode not to work)
     int result = clearSet ? max(0, bottom - yPos) : 0;
-    if (!result && child->avoidsFloats() && child->style()->width().isFixed() && 
-        child->minPrefWidth() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth() && 
-        document()->inStrictMode())   
-        result = max(0, floatBottom() - yPos);
+    if (!result && child->avoidsFloats()) {
+        int oldYPos = child->y();
+        int oldWidth = child->width();
+        child->setY(yPos);
+        child->calcWidth();
+        if (child->width() > lineWidth(yPos, false) && child->minPrefWidth() <= availableWidth())
+            result = max(0, floatBottom() - yPos);
+        child->setY(oldYPos);
+        child->setWidth(oldWidth);
+    }
     return result;
 }
 
-void RenderBlock::addVisualOverflow(const IntRect& r)
-{
-    if (r.isEmpty())
-        return;
-    m_overflowLeft = min(m_overflowLeft, r.x());
-    m_overflowWidth = max(m_overflowWidth, r.right());
-    m_overflowTop = min(m_overflowTop, r.y());
-    m_overflowHeight = max(m_overflowHeight, r.bottom());
-}
-
 bool RenderBlock::isPointInOverflowControl(HitTestResult& result, int _x, int _y, int _tx, int _ty)
 {
     if (!scrollsOverflow())
@@ -3333,7 +3218,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     if (!isRenderView()) {
         // Check if we need to do anything at all.
-        IntRect overflowBox = overflowRect(false);
+        IntRect overflowBox = visibleOverflowRect();
         overflowBox.move(tx, ty);
         if (!overflowBox.contains(_x, _y))
             return false;
@@ -3542,9 +3427,9 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
         if (root->nextRootBox()) {
             // FIXME: We would prefer to make the break point halfway between the bottom
             // of the previous root box and the top of the next root box.
-            bottom = root->nextRootBox()->topOverflow();
+            bottom = root->nextRootBox()->lineTop();
         } else
-            bottom = root->bottomOverflow() + verticalLineClickFudgeFactor;
+            bottom = root->lineBottom() + verticalLineClickFudgeFactor;
 
         // check if this root line box is located at this y coordinate
         if (pointInContents.y() < bottom) {
@@ -3563,7 +3448,7 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const IntPoint&
     }
 
     if (closestBox) {
-        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->topOverflow() - verticalLineClickFudgeFactor) {
+        if (!useWindowsBehavior && pointInContents.y() < firstRootBoxWithChildren->lineTop() - verticalLineClickFudgeFactor) {
             // y coordinate is above first root line box, so return the start of the first
             return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
         }
@@ -3699,7 +3584,7 @@ void RenderBlock::calcColumnWidth()
 
 void RenderBlock::setDesiredColumnCountAndWidth(int count, int width)
 {
-    if (count == 1) {
+    if (count == 1 && style()->hasAutoColumnWidth()) {
         if (hasColumns()) {
             delete gColumnInfoMap->take(this);
             setHasColumns(false);
@@ -3836,14 +3721,16 @@ int RenderBlock::layoutColumns(int endOfContent)
             colCount++;
     }
 
-    m_overflowWidth = max(width(), currX - colGap);
-    m_overflowLeft = min(0, currX + desiredColumnWidth + colGap);
-
-    m_overflowHeight = maxColBottom;
+    int overflowRight = max(width(), currX - colGap);
+    int overflowLeft = min(0, currX + desiredColumnWidth + colGap);
+    int overflowHeight = maxColBottom;
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
         
     if (computeIntrinsicHeight)
-        setHeight(m_overflowHeight + toAdd);
+        setHeight(maxColBottom + toAdd);
+
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(overflowLeft, 0, overflowRight - overflowLeft, overflowHeight));
 
     v->setPrintRect(IntRect());
     v->setTruncatedAt(0);
@@ -4767,7 +4654,7 @@ static int getHeightForLineCount(RenderBlock* block, int l, bool includeBottom,
         if (block->childrenInline()) {
             for (RootInlineBox* box = block->firstRootBox(); box; box = box->nextRootBox()) {
                 if (++count == l)
-                    return box->bottomOverflow() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
+                    return box->lineBottom() + (includeBottom ? (block->borderBottom() + block->paddingBottom()) : 0);
             }
         }
         else {
@@ -5098,8 +4985,11 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
         graphicsContext->addFocusRingRect(IntRect(tx, ty, width(), height()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
-        for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+        for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
+            int top = max(curr->lineTop(), curr->y());
+            int bottom = min(curr->lineBottom(), curr->y() + curr->height());
+            graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+        }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
             if (!curr->isText() && !curr->isListMarker() && curr->isBox()) {
@@ -5121,13 +5011,20 @@ void RenderBlock::addFocusRingRects(GraphicsContext* graphicsContext, int tx, in
                                                 ty - y() + inlineContinuation()->containingBlock()->y());
 }
 
-RenderBlock* RenderBlock::createAnonymousBlock() const
+RenderBlock* RenderBlock::createAnonymousBlock(bool isFlexibleBox) const
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
-    newStyle->setDisplay(BLOCK);
 
-    RenderBlock* newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    RenderBlock* newBox = 0;
+    if (isFlexibleBox) {
+        newStyle->setDisplay(BOX);
+        newBox = new (renderArena()) RenderFlexibleBox(document() /* anonymous box */);
+    } else {
+        newStyle->setDisplay(BLOCK);
+        newBox = new (renderArena()) RenderBlock(document() /* anonymous box */);
+    }
+
     newBox->setStyle(newStyle.release());
     return newBox;
 }
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 839be16..e23ebda 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -67,17 +67,6 @@ public:
 
     void deleteLineBoxTree();
 
-    // The height (and width) of a block when you include overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-
-    void addVisualOverflow(const IntRect&);
-
     virtual void addChild(RenderObject* newChild, RenderObject* beforeChild = 0);
     virtual void removeChild(RenderObject*);
 
@@ -104,6 +93,7 @@ public:
     IntRect floatRect() const;
 
     int lineWidth(int y, bool firstLine) const;
+    
     virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
     virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
@@ -147,15 +137,12 @@ public:
 
     // This function is a convenience helper for creating an anonymous block that inherits its
     // style from this RenderBlock.
-    RenderBlock* createAnonymousBlock() const;
+    RenderBlock* createAnonymousBlock(bool isFlexibleBox = false) const;
 
     Vector<IntRect>* columnRects() const;
     int columnGap() const;
 
 protected:
-    virtual void setOverflowHeight(int h) { m_overflowHeight = h; }
-    virtual void setOverflowWidth(int w) { m_overflowWidth = w; }
-
     int maxTopPosMargin() const { return m_maxMargin ? m_maxMargin->m_topPos : MaxMargin::topPosDefault(this); }
     int maxTopNegMargin() const { return m_maxMargin ? m_maxMargin->m_topNeg : MaxMargin::topNegDefault(this); }
     int maxBottomPosMargin() const { return m_maxMargin ? m_maxMargin->m_bottomPos : MaxMargin::bottomPosDefault(this); }
@@ -207,7 +194,7 @@ protected:
 
     virtual bool hasLineIfEmpty() const;
     bool layoutOnlyPositionedObjects();
-    
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
@@ -275,11 +262,14 @@ private:
     InlineFlowBox* createLineBoxes(RenderObject*, bool firstLine);
     void computeHorizontalPositionsForLine(RootInlineBox*, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd);
     void computeVerticalPositionsForLine(RootInlineBox*, BidiRun*);
-    void checkLinesForOverflow();
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
+    void addOverflowFromInlineChildren();
     // End of functions defined in RenderBlockLineLayout.cpp.
 
+    void addOverflowFromBlockChildren();
+    void addOverflowFromFloats();
+
     void paintFloats(PaintInfo&, int tx, int ty, bool preservePhase = false);
     void paintContents(PaintInfo&, int tx, int ty);
     void paintColumnContents(PaintInfo&, int tx, int ty, bool paintFloats = false);
@@ -432,10 +422,6 @@ private:
         // This flag is set when we know we're examining bottom margins and we know we're at the bottom of the block.
         bool m_atBottomOfBlock : 1;
 
-        // If our last normal flow child was a self-collapsing block that cleared a float,
-        // we track it in this variable.
-        bool m_selfCollapsingBlockClearedFloat : 1;
-
         // These variables are used to detect quirky margins that we need to collapse away (in table cells
         // and in the body element).
         bool m_topQuirk : 1;
@@ -452,7 +438,6 @@ private:
         void setAtTopOfBlock(bool b) { m_atTopOfBlock = b; }
         void setAtBottomOfBlock(bool b) { m_atBottomOfBlock = b; }
         void clearMargin() { m_posMargin = m_negMargin = 0; }
-        void setSelfCollapsingBlockClearedFloat(bool b) { m_selfCollapsingBlockClearedFloat = b; }
         void setTopQuirk(bool b) { m_topQuirk = b; }
         void setBottomQuirk(bool b) { m_bottomQuirk = b; }
         void setDeterminedTopQuirk(bool b) { m_determinedTopQuirk = b; }
@@ -468,7 +453,6 @@ private:
         bool canCollapseWithBottom() const { return m_atBottomOfBlock && m_canCollapseBottomWithChildren; }
         bool canCollapseTopWithChildren() const { return m_canCollapseTopWithChildren; }
         bool canCollapseBottomWithChildren() const { return m_canCollapseBottomWithChildren; }
-        bool selfCollapsingBlockClearedFloat() const { return m_selfCollapsingBlockClearedFloat; }
         bool quirkContainer() const { return m_quirkContainer; }
         bool determinedTopQuirk() const { return m_determinedTopQuirk; }
         bool topQuirk() const { return m_topQuirk; }
@@ -478,6 +462,7 @@ private:
         int margin() const { return m_posMargin - m_negMargin; }
     };
 
+    void layoutBlockChild(RenderBox* child, MarginInfo&, int& previousFloatBottom, int& maxFloatBottom);
     void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
     bool handleSpecialChild(RenderBox* child, const MarginInfo&);
@@ -528,14 +513,6 @@ private:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
-protected:
-    // How much content overflows out of our block vertically or horizontally.
-    int m_overflowHeight;
-    int m_overflowWidth;
-    int m_overflowLeft;
-    int m_overflowTop;
-
-private:
     mutable int m_lineHeight;
 };
 
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index 3950372..538225d 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -770,11 +770,8 @@ void RenderBlock::computeHorizontalPositionsForLine(RootInlineBox* lineBox, bool
 
     // The widths of all runs are now known.  We can now place every inline box (and
     // compute accurate widths for the inline flow boxes).
-    int leftPosition = x;
-    int rightPosition = x;
     needsWordSpacing = false;
-    lineBox->placeBoxesHorizontally(x, leftPosition, rightPosition, needsWordSpacing);
-    lineBox->setHorizontalOverflowPositions(leftPosition, rightPosition);
+    lineBox->placeBoxesHorizontally(x, needsWordSpacing);
 }
 
 void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun)
@@ -782,11 +779,6 @@ void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRu
     setHeight(lineBox->verticallyAlignBoxes(height()));
     lineBox->setBlockHeight(height());
 
-    // See if the line spilled out.  If so set overflow height accordingly.
-    int bottomOfLine = lineBox->bottomOverflow();
-    if (bottomOfLine > height() && bottomOfLine > m_overflowHeight)
-        m_overflowHeight = bottomOfLine;
-
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
         ASSERT(r->m_box);
@@ -831,7 +823,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 {
     bool useRepaintBounds = false;
     
-    m_overflowHeight = 0;
+    m_overflow.clear();
         
     setHeight(borderTop() + paddingTop());
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
@@ -1022,8 +1014,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
-                repaintTop = min(repaintTop, box->topOverflow());
-                repaintBottom = max(repaintBottom, box->bottomOverflow());
+                repaintTop = min(repaintTop, box->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, box->bottomVisibleOverflow());
                 RootInlineBox* next = box->nextRootBox();
                 box->deleteLine(arena);
                 box = next;
@@ -1159,8 +1151,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 if (lineBox) {
                     lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
                     if (useRepaintBounds) {
-                        repaintTop = min(repaintTop, lineBox->topOverflow());
-                        repaintBottom = max(repaintBottom, lineBox->bottomOverflow());
+                        repaintTop = min(repaintTop, lineBox->topVisibleOverflow());
+                        repaintBottom = max(repaintBottom, lineBox->bottomVisibleOverflow());
                     }
                 }
 
@@ -1199,8 +1191,8 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 for (RootInlineBox* line = endLine; line; line = line->nextRootBox()) {
                     line->attachLine();
                     if (delta) {
-                        repaintTop = min(repaintTop, line->topOverflow() + min(delta, 0));
-                        repaintBottom = max(repaintBottom, line->bottomOverflow() + max(delta, 0));
+                        repaintTop = min(repaintTop, line->topVisibleOverflow() + min(delta, 0));
+                        repaintBottom = max(repaintBottom, line->bottomVisibleOverflow() + max(delta, 0));
                         line->adjustPosition(0, delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
@@ -1216,12 +1208,12 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 setHeight(lastRootBox()->blockHeight());
             } else {
                 // Delete all the remaining lines.
-                InlineRunBox* line = endLine;
+                RootInlineBox* line = endLine;
                 RenderArena* arena = renderArena();
                 while (line) {
-                    repaintTop = min(repaintTop, line->topOverflow());
-                    repaintBottom = max(repaintBottom, line->bottomOverflow());
-                    InlineRunBox* next = line->nextLineBox();
+                    repaintTop = min(repaintTop, line->topVisibleOverflow());
+                    repaintBottom = max(repaintBottom, line->bottomVisibleOverflow());
+                    RootInlineBox* next = line->nextRootBox();
                     line->deleteLine(arena);
                     line = next;
                 }
@@ -1259,12 +1251,6 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     // Now add in the bottom border/padding.
     setHeight(height() + toAdd);
 
-    // Always make sure this is at least our height.
-    m_overflowHeight = max(height(), m_overflowHeight);
-
-    // See if any lines spill out of the block.  If so, we need to update our overflow width.
-    checkLinesForOverflow();
-
     if (!firstLineBox() && hasLineIfEmpty())
         setHeight(height() + lineHeight(true, true));
 
@@ -1491,8 +1477,8 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             RootInlineBox* boxToDelete = endLine;
             RenderArena* arena = renderArena();
             while (boxToDelete && boxToDelete != result) {
-                repaintTop = min(repaintTop, boxToDelete->topOverflow());
-                repaintBottom = max(repaintBottom, boxToDelete->bottomOverflow());
+                repaintTop = min(repaintTop, boxToDelete->topVisibleOverflow());
+                repaintBottom = max(repaintBottom, boxToDelete->bottomVisibleOverflow());
                 RootInlineBox* next = boxToDelete->nextRootBox();
                 boxToDelete->deleteLine(arena);
                 boxToDelete = next;
@@ -2312,14 +2298,12 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     return lBreak;
 }
 
-void RenderBlock::checkLinesForOverflow()
+void RenderBlock::addOverflowFromInlineChildren()
 {
-    m_overflowWidth = width();
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-        m_overflowLeft = min(curr->leftOverflow(), m_overflowLeft);
-        m_overflowTop = min(curr->topOverflow(), m_overflowTop);
-        m_overflowWidth = max(curr->rightOverflow(), m_overflowWidth);
-        m_overflowHeight = max(curr->bottomOverflow(), m_overflowHeight);
+        addLayoutOverflow(curr->layoutOverflowRect());
+        if (!hasOverflowClip())
+            addVisualOverflow(curr->visualOverflowRect());
     }
 }
 
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index 4c2bff0..efd88a7 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -406,16 +406,28 @@ int RenderBox::horizontalScrollbarHeight() const
     return includeHorizontalScrollbarSize() ? layer()->horizontalScrollbarHeight() : 0;
 }
 
-bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* l = layer();
-    if (l && l->scroll(direction, granularity, multiplier))
+    if (l && l->scroll(direction, granularity, multiplier)) {
+        if (stopNode)
+            *stopNode = node();
         return true;
+    }
+
+    if (stopNode && *stopNode && *stopNode == node())
+        return true;
+
     RenderBlock* b = containingBlock();
     if (b && !b->isRenderView())
-        return b->scroll(direction, granularity, multiplier);
+        return b->scroll(direction, granularity, multiplier, stopNode);
     return false;
 }
+
+bool RenderBox::canBeScrolledAndHasScrollableArea() const
+{
+   return canBeProgramaticallyScrolled(false) && (scrollHeight() != clientHeight() || scrollWidth() != clientWidth());
+}
     
 bool RenderBox::canBeProgramaticallyScrolled(bool) const
 {
@@ -653,31 +665,36 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
 {
     // Figure out if we need to push a transparency layer to render our mask.
     bool pushTransparencyLayer = false;
-    StyleImage* maskBoxImage = style()->maskBoxImage().image();
-    if (maskBoxImage && style()->maskLayers()->hasImage()) {
-        pushTransparencyLayer = true;
-    } else {
-        // We have to use an extra image buffer to hold the mask. Multiple mask images need
-        // to composite together using source-over so that they can then combine into a single unified mask that
-        // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
-        // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
-        // and composite that buffer as the mask.
-        // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
-        // before pushing the transparency layer.
-        for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
-            if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
-                pushTransparencyLayer = true;
-                // We found one image that can be used in rendering, exit the loop
-                break;
+    bool compositedMask = hasLayer() && layer()->hasCompositedMask();
+    CompositeOperator compositeOp = CompositeSourceOver;
+
+    if (!compositedMask) {
+        StyleImage* maskBoxImage = style()->maskBoxImage().image();
+        if (maskBoxImage && style()->maskLayers()->hasImage()) {
+            pushTransparencyLayer = true;
+        } else {
+            // We have to use an extra image buffer to hold the mask. Multiple mask images need
+            // to composite together using source-over so that they can then combine into a single unified mask that
+            // can be composited with the content using destination-in.  SVG images need to be able to set compositing modes
+            // as they draw images contained inside their sub-document, so we paint all our images into a separate buffer
+            // and composite that buffer as the mask.
+            // We have to check that the mask images to be rendered contain at least one image that can be actually used in rendering
+            // before pushing the transparency layer.
+            for (const FillLayer* fillLayer = style()->maskLayers()->next(); fillLayer; fillLayer = fillLayer->next()) {
+                if (fillLayer->hasImage() && fillLayer->image()->canRender(style()->effectiveZoom())) {
+                    pushTransparencyLayer = true;
+                    // We found one image that can be used in rendering, exit the loop
+                    break;
+                }
             }
         }
-    }
-    
-    CompositeOperator compositeOp = CompositeDestinationIn;
-    if (pushTransparencyLayer) {
-        paintInfo.context->setCompositeOperation(CompositeDestinationIn);
-        paintInfo.context->beginTransparencyLayer(1.0f);
-        compositeOp = CompositeSourceOver;
+        
+        compositeOp = CompositeDestinationIn;
+        if (pushTransparencyLayer) {
+            paintInfo.context->setCompositeOperation(CompositeDestinationIn);
+            paintInfo.context->beginTransparencyLayer(1.0f);
+            compositeOp = CompositeSourceOver;
+        }
     }
 
     paintFillLayers(paintInfo, Color(), style()->maskLayers(), tx, ty, w, h, compositeOp);
@@ -930,7 +947,8 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     if (style()->position() == FixedPosition)
         fixed = true;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -948,6 +966,14 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     } else
         transformState.move(containerOffset.width(), containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
 
+    if (containerSkipped) {
+        // There can't be a transform between repaintContainer and o, because transforms create containers, so it should be safe
+        // to just subtract the delta between the repaintContainer and o.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        transformState.move(-containerOffset.width(), -containerOffset.height(), preserve3D ? TransformState::AccumulateTransform : TransformState::FlattenTransform);
+        return;
+    }
+    
     o->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
@@ -1068,7 +1094,7 @@ IntRect RenderBox::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintCo
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
         return IntRect();
 
-    IntRect r = overflowRect(false);
+    IntRect r = visibleOverflowRect();
 
     RenderView* v = view();
     if (v) {
@@ -1120,7 +1146,8 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
     if (repaintContainer == this)
         return;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -1177,6 +1204,13 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, In
             return;
     } else
         rect.setLocation(topLeft);
+
+    if (containerSkipped) {
+        // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        rect.move(-containerOffset);
+        return;
+    }
     
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
@@ -1520,7 +1554,7 @@ int RenderBox::calcHeightUsing(const Length& h)
 int RenderBox::calcPercentageHeight(const Length& height)
 {
     int result = -1;
-    bool includeBorderPadding = isTable();
+    bool skippedAutoHeightContainingBlock = false;
     RenderBlock* cb = containingBlock();
     if (style()->htmlHacks()) {
         // In quirks mode, blocks with auto height are skipped, and we keep looking for an enclosing
@@ -1528,6 +1562,7 @@ int RenderBox::calcPercentageHeight(const Length& height)
         // specification, which states that percentage heights just revert to auto if the containing
         // block has an auto height.
         while (!cb->isRenderView() && !cb->isBody() && !cb->isTableCell() && !cb->isPositioned() && cb->style()->height().isAuto()) {
+            skippedAutoHeightContainingBlock = true;
             cb = cb->containingBlock();
             cb->addPercentHeightDescendant(this);
         }
@@ -1537,25 +1572,29 @@ int RenderBox::calcPercentageHeight(const Length& height)
     // explicitly specified that can be used for any percentage computations.
     bool isPositionedWithSpecifiedHeight = cb->isPositioned() && (!cb->style()->height().isAuto() || (!cb->style()->top().isAuto() && !cb->style()->bottom().isAuto()));
 
+    bool includeBorderPadding = isTable();
+
     // Table cells violate what the CSS spec says to do with heights.  Basically we
     // don't care if the cell specified a height or not.  We just always make ourselves
     // be a percentage of the cell's current content height.
     if (cb->isTableCell()) {
-        result = cb->overrideSize();
-        if (result == -1) {
-            // Normally we would let the cell size intrinsically, but scrolling overflow has to be
-            // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
-            // While we can't get all cases right, we can at least detect when the cell has a specified
-            // height or when the table has a specified height.  In these cases we want to initially have
-            // no size and allow the flexing of the table or the cell to its specified height to cause us
-            // to grow to fill the space.  This could end up being wrong in some cases, but it is
-            // preferable to the alternative (sizing intrinsically and making the row end up too big).
-            RenderTableCell* cell = toRenderTableCell(cb);
-            if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
-                return 0;
-            return -1;
+        if (!skippedAutoHeightContainingBlock) {
+            result = cb->overrideSize();
+            if (result == -1) {
+                // Normally we would let the cell size intrinsically, but scrolling overflow has to be
+                // treated differently, since WinIE lets scrolled overflow regions shrink as needed.
+                // While we can't get all cases right, we can at least detect when the cell has a specified
+                // height or when the table has a specified height.  In these cases we want to initially have
+                // no size and allow the flexing of the table or the cell to its specified height to cause us
+                // to grow to fill the space.  This could end up being wrong in some cases, but it is
+                // preferable to the alternative (sizing intrinsically and making the row end up too big).
+                RenderTableCell* cell = toRenderTableCell(cb);
+                if (scrollsOverflowY() && (!cell->style()->height().isAuto() || !cell->table()->style()->height().isAuto()))
+                    return 0;
+                return -1;
+            }
+            includeBorderPadding = true;
         }
-        includeBorderPadding = true;
     }
     // Otherwise we only use our percentage height if our containing block had a specified
     // height.
@@ -2485,7 +2524,7 @@ void RenderBox::calcAbsoluteHorizontalReplaced()
     // positioned, inline containing block because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isInline() && containerBlock->style()->direction() == RTL) {
+    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
         const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
@@ -2646,9 +2685,9 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
 
     if (box) {
         RootInlineBox* rootBox = box->root();
-        int top = rootBox->topOverflow();
+        int top = rootBox->lineTop();
         rect.setY(top);
-        rect.setHeight(rootBox->bottomOverflow() - top);
+        rect.setHeight(rootBox->lineBottom() - top);
     }
 
     // If height of box is smaller than font height, use the latter one,
@@ -2701,11 +2740,6 @@ int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSe
     return left;
 }
 
-bool RenderBox::isAfterContent(RenderObject* child) const
-{
-    return (child && child->style()->styleType() == AFTER && (!child->isText() || child->isBR()));
-}
-
 VisiblePosition RenderBox::positionForPoint(const IntPoint& point)
 {
     // no children...return this render object's element, if there is one, and offset 0
@@ -2813,6 +2847,81 @@ bool RenderBox::avoidsFloats() const
     return isReplaced() || hasOverflowClip() || isHR();
 }
 
+void RenderBox::addShadowOverflow()
+{
+    int shadowLeft;
+    int shadowRight;
+    int shadowTop;
+    int shadowBottom;
+    style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
+    IntRect borderBox = borderBoxRect();
+    int overflowLeft = borderBox.x() + shadowLeft;
+    int overflowRight = borderBox.right() + shadowRight;
+    int overflowTop = borderBox.y() + shadowTop;
+    int overflowBottom = borderBox.bottom() + shadowBottom;
+    addVisualOverflow(IntRect(overflowLeft, overflowTop, overflowRight - overflowLeft, overflowBottom - overflowTop));
+}
+
+void RenderBox::addOverflowFromChild(RenderBox* child, const IntSize& delta)
+{
+    // Update our overflow in case the child spills out the block, but only if we were going to paint
+    // the child block ourselves.
+    if (child->hasSelfPaintingLayer())
+        return;
+
+    // Only propagate layout overflow from the child if the child isn't clipping its overflow.  If it is, then
+    // its overflow is internal to it, and we don't care about it.
+    IntRect childLayoutOverflowRect = child->hasOverflowClip() ? child->borderBoxRect() : child->layoutOverflowRect();
+    childLayoutOverflowRect.move(delta);
+    addLayoutOverflow(childLayoutOverflowRect);
+            
+    // Add in visual overflow from the child.  Even if the child clips its overflow, it may still
+    // have visual overflow of its own set from box shadows or reflections.  It is unnecessary to propagate this
+    // overflow if we are clipping our own overflow.
+    if (hasOverflowClip())
+        return;
+    IntRect childVisualOverflowRect = child->visualOverflowRect();
+    childVisualOverflowRect.move(delta);
+    addVisualOverflow(childVisualOverflowRect);
+}
+
+void RenderBox::addLayoutOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addLayoutOverflow(rect);
+}
+
+void RenderBox::addVisualOverflow(const IntRect& rect)
+{
+    IntRect borderBox = borderBoxRect();
+    if (borderBox.contains(rect))
+        return;
+        
+    if (!m_overflow)
+        m_overflow.set(new RenderOverflow(borderBox));
+    
+    m_overflow->addVisualOverflow(rect);
+}
+
+void RenderBox::clearLayoutOverflow()
+{
+    if (!m_overflow)
+        return;
+    
+    if (visualOverflowRect() == borderBoxRect()) {
+        m_overflow.clear();
+        return;
+    }
+    
+    m_overflow->resetLayoutOverflow(borderBoxRect());
+}
+
 #if ENABLE(SVG)
 
 TransformationMatrix RenderBox::localTransform() const
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index cb2297b..897d9b3 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -24,6 +24,7 @@
 #define RenderBox_h
 
 #include "RenderBoxModelObject.h"
+#include "RenderOverflow.h"
 #include "ScrollTypes.h"
 
 namespace WebCore {
@@ -80,16 +81,31 @@ public:
     RenderBox* nextSiblingBox() const;
     RenderBox* parentBox() const;
 
-    // The height of a block when you include normal flow overflow spillage out of the bottom
-    // of the block (e.g., a <div style="height:25px"> that has a 100px tall image inside
-    // it would have an overflow height of borderTop() + paddingTop() + 100px.
-    virtual int overflowHeight(bool /*includeInterior*/ = true) const { return height(); }
-    virtual int overflowWidth(bool /*includeInterior*/ = true) const { return width(); }
-    virtual void setOverflowHeight(int) { }
-    virtual void setOverflowWidth(int) { }
-    virtual int overflowLeft(bool /*includeInterior*/ = true) const { return 0; }
-    virtual int overflowTop(bool /*includeInterior*/ = true) const { return 0; }
-    virtual IntRect overflowRect(bool /*includeInterior*/ = true) const { return borderBoxRect(); }
+    IntRect visibleOverflowRect() const { return hasOverflowClip() ? visualOverflowRect() : (m_overflow ? m_overflow->visibleOverflowRect() : borderBoxRect()); }
+    int topVisibleOverflow() const { return hasOverflowClip() ? topVisualOverflow() : std::min(topLayoutOverflow(), topVisualOverflow()); }
+    int bottomVisibleOverflow() const { return hasOverflowClip() ? bottomVisualOverflow() : std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
+    int leftVisibleOverflow() const { return hasOverflowClip() ? leftVisualOverflow() : std::min(leftLayoutOverflow(), leftVisualOverflow()); }
+    int rightVisibleOverflow() const { return hasOverflowClip() ? rightVisualOverflow() :  std::max(rightLayoutOverflow(), rightVisualOverflow()); }
+    
+    IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : borderBoxRect(); }
+    int topLayoutOverflow() const { return m_overflow? m_overflow->topLayoutOverflow() : 0; }
+    int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : height(); }
+    int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : 0; }
+    int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : width(); }
+    
+    IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
+    int topVisualOverflow() const { return m_overflow? m_overflow->topVisualOverflow() : 0; }
+    int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : height(); }
+    int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : 0; }
+    int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : width(); }
+
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+    
+    void addShadowOverflow();
+    void addOverflowFromChild(RenderBox* child) { addOverflowFromChild(child, IntSize(child->x(), child->y())); }
+    void addOverflowFromChild(RenderBox* child, const IntSize& delta);
+    void clearLayoutOverflow();
 
     int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
     int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
@@ -229,7 +245,8 @@ public:
 
     virtual int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
+    bool canBeScrolledAndHasScrollableArea() const;
     virtual bool canBeProgramaticallyScrolled(bool) const;
     virtual void autoscroll();
     virtual void stopAutoscroll() { }
@@ -333,9 +350,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void calcPrefWidths() { setPrefWidthsDirty(false); }
 
-protected:
-    bool isAfterContent(RenderObject* child) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     IntRect m_frameRect;
@@ -360,6 +374,9 @@ protected:
     // For inline replaced elements, the inline box that owns us.
     InlineBox* m_inlineBoxWrapper;
 
+    // Our overflow information.
+    OwnPtr<RenderOverflow> m_overflow;
+
 private:
     // Used to store state between styleWillChange and styleDidChange
     static bool s_hadOverflowClip;
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 2b05170..23dad2d 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -316,10 +316,14 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
 
     bool clippedToBorderRadius = false;
     if (style()->hasBorderRadius() && (includeLeftEdge || includeRightEdge)) {
+        IntRect borderRect(tx, ty, w, h);
+
+        if (borderRect.isEmpty())
+            return;
+
         context->save();
 
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect(tx, ty, w, h);
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         context->addRoundedRectClip(borderRect, includeLeftEdge ? topLeft : IntSize(),
@@ -489,153 +493,130 @@ void RenderBoxModelObject::paintFillLayerExtended(const PaintInfo& paintInfo, co
         context->restore();
 }
 
-IntSize RenderBoxModelObject::calculateBackgroundSize(const FillLayer* bgLayer, int scaledWidth, int scaledHeight) const
+IntSize RenderBoxModelObject::calculateFillTileSize(const FillLayer* fillLayer, IntSize positioningAreaSize) const
 {
-    StyleImage* bg = bgLayer->image();
-    bg->setImageContainerSize(IntSize(scaledWidth, scaledHeight)); // Use the box established by background-origin.
-
-    if (bgLayer->isSizeSet()) {
-        int w = scaledWidth;
-        int h = scaledHeight;
-        Length bgWidth = bgLayer->size().width();
-        Length bgHeight = bgLayer->size().height();
-
-        if (bgWidth.isFixed())
-            w = bgWidth.value();
-        else if (bgWidth.isPercent())
-            w = bgWidth.calcValue(scaledWidth);
-        
-        if (bgHeight.isFixed())
-            h = bgHeight.value();
-        else if (bgHeight.isPercent())
-            h = bgHeight.calcValue(scaledHeight);
-        
-        // If one of the values is auto we have to use the appropriate
-        // scale to maintain our aspect ratio.
-        if (bgWidth.isAuto() && !bgHeight.isAuto())
-            w = bg->imageSize(this, style()->effectiveZoom()).width() * h / bg->imageSize(this, style()->effectiveZoom()).height();        
-        else if (!bgWidth.isAuto() && bgHeight.isAuto())
-            h = bg->imageSize(this, style()->effectiveZoom()).height() * w / bg->imageSize(this, style()->effectiveZoom()).width();
-        else if (bgWidth.isAuto() && bgHeight.isAuto()) {
-            // If both width and height are auto, we just want to use the image's
-            // intrinsic size.
-            w = bg->imageSize(this, style()->effectiveZoom()).width();
-            h = bg->imageSize(this, style()->effectiveZoom()).height();
+    StyleImage* image = fillLayer->image();
+    image->setImageContainerSize(positioningAreaSize); // Use the box established by background-origin.
+
+    EFillSizeType type = fillLayer->size().type;
+
+    switch (type) {
+        case SizeLength: {
+            int w = positioningAreaSize.width();
+            int h = positioningAreaSize.height();
+            Length layerWidth = fillLayer->size().size.width();
+            Length layerHeight = fillLayer->size().size.height();
+
+            if (layerWidth.isFixed())
+                w = layerWidth.value();
+            else if (layerWidth.isPercent())
+                w = layerWidth.calcValue(positioningAreaSize.width());
+            
+            if (layerHeight.isFixed())
+                h = layerHeight.value();
+            else if (layerHeight.isPercent())
+                h = layerHeight.calcValue(positioningAreaSize.height());
+            
+            // If one of the values is auto we have to use the appropriate
+            // scale to maintain our aspect ratio.
+            if (layerWidth.isAuto() && !layerHeight.isAuto())
+                w = image->imageSize(this, style()->effectiveZoom()).width() * h / image->imageSize(this, style()->effectiveZoom()).height();        
+            else if (!layerWidth.isAuto() && layerHeight.isAuto())
+                h = image->imageSize(this, style()->effectiveZoom()).height() * w / image->imageSize(this, style()->effectiveZoom()).width();
+            else if (layerWidth.isAuto() && layerHeight.isAuto()) {
+                // If both width and height are auto, we just want to use the image's
+                // intrinsic size.
+                w = image->imageSize(this, style()->effectiveZoom()).width();
+                h = image->imageSize(this, style()->effectiveZoom()).height();
+            }
+            
+            return IntSize(max(1, w), max(1, h));
         }
-        
-        return IntSize(max(1, w), max(1, h));
-    } else
-        return bg->imageSize(this, style()->effectiveZoom());
+        case Contain:
+        case Cover: {
+            IntSize imageIntrinsicSize = image->imageSize(this, 1);
+            float horizontalScaleFactor = static_cast<float>(positioningAreaSize.width()) / imageIntrinsicSize.width();
+            float verticalScaleFactor = static_cast<float>(positioningAreaSize.height()) / imageIntrinsicSize.height();
+            float scaleFactor = type == Contain ? min(horizontalScaleFactor, verticalScaleFactor) : max(horizontalScaleFactor, verticalScaleFactor);
+
+            return IntSize(max<int>(1, imageIntrinsicSize.width() * scaleFactor), max<int>(1, imageIntrinsicSize.height() * scaleFactor));
+        }
+        case SizeNone:
+            break;
+    }
+    return image->imageSize(this, style()->effectiveZoom());
 }
 
-void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* bgLayer, int tx, int ty, int w, int h, 
+void RenderBoxModelObject::calculateBackgroundImageGeometry(const FillLayer* fillLayer, int tx, int ty, int w, int h, 
                                                             IntRect& destRect, IntPoint& phase, IntSize& tileSize)
 {
-    int pw;
-    int ph;
     int left = 0;
-    int right = 0;
     int top = 0;
-    int bottom = 0;
-    int cx;
-    int cy;
-    int rw = 0;
-    int rh = 0;
-
-    // CSS2 chapter 14.2.1
-    bool fixedAttachment = bgLayer->attachment() == FixedBackgroundAttachment;
+    IntSize positioningAreaSize;
+
+    // Determine the background positioning area and set destRect to the background painting area.
+    // destRect will be adjusted later if the background is non-repeating.
+    bool fixedAttachment = fillLayer->attachment() == FixedBackgroundAttachment;
     if (!fixedAttachment) {
-        // Scroll and Local
-        if (bgLayer->origin() != BorderFillBox) {
+        destRect = IntRect(tx, ty, w, h);
+
+        int right = 0;
+        int bottom = 0;
+        // Scroll and Local.
+        if (fillLayer->origin() != BorderFillBox) {
             left = borderLeft();
             right = borderRight();
             top = borderTop();
             bottom = borderBottom();
-            if (bgLayer->origin() == ContentFillBox) {
+            if (fillLayer->origin() == ContentFillBox) {
                 left += paddingLeft();
                 right += paddingRight();
                 top += paddingTop();
                 bottom += paddingBottom();
             }
         }
-        
+
         // The background of the box generated by the root element covers the entire canvas including
-        // its margins.  Since those were added in already, we have to factor them out when computing the
-        // box used by background-origin/size/position.
+        // its margins. Since those were added in already, we have to factor them out when computing
+        // the background positioning area.
         if (isRoot()) {
-            rw = toRenderBox(this)->width() - left - right;
-            rh = toRenderBox(this)->height() - top - bottom; 
+            positioningAreaSize = IntSize(toRenderBox(this)->width() - left - right, toRenderBox(this)->height() - top - bottom);
             left += marginLeft();
-            right += marginRight();
             top += marginTop();
-            bottom += marginBottom();
-        }
-        cx = tx;
-        cy = ty;
-        pw = w - left - right;
-        ph = h - top - bottom;
+        } else
+            positioningAreaSize = IntSize(w - left - right, h - top - bottom);
     } else {
-        // Fixed background attachment.
-        IntRect vr = viewRect();
-        cx = vr.x();
-        cy = vr.y();
-        pw = vr.width();
-        ph = vr.height();
+        destRect = viewRect();
+        positioningAreaSize = destRect.size();
     }
 
-    int sx = 0;
-    int sy = 0;
-    int cw;
-    int ch;
+    tileSize = calculateFillTileSize(fillLayer, positioningAreaSize);
 
-    IntSize scaledImageSize;
-    if (isRoot() && !fixedAttachment)
-        scaledImageSize = calculateBackgroundSize(bgLayer, rw, rh);
-    else
-        scaledImageSize = calculateBackgroundSize(bgLayer, pw, ph);
-        
-    int scaledImageWidth = scaledImageSize.width();
-    int scaledImageHeight = scaledImageSize.height();
+    EFillRepeat backgroundRepeatX = fillLayer->repeatX();
+    EFillRepeat backgroundRepeatY = fillLayer->repeatY();
 
-    EFillRepeat backgroundRepeat = bgLayer->repeat();
-    
-    int xPosition;
-    if (isRoot() && !fixedAttachment)
-        xPosition = bgLayer->xPosition().calcMinValue(rw - scaledImageWidth, true);
-    else
-        xPosition = bgLayer->xPosition().calcMinValue(pw - scaledImageWidth, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatXFill) {
-        cw = pw + left + right;
-        sx = scaledImageWidth ? scaledImageWidth - (xPosition + left) % scaledImageWidth : 0;
-    } else {
-        cx += max(xPosition + left, 0);
-        sx = -min(xPosition + left, 0);
-        cw = scaledImageWidth + min(xPosition + left, 0);
-    }
-    
-    int yPosition;
-    if (isRoot() && !fixedAttachment)
-        yPosition = bgLayer->yPosition().calcMinValue(rh - scaledImageHeight, true);
-    else 
-        yPosition = bgLayer->yPosition().calcMinValue(ph - scaledImageHeight, true);
-    if (backgroundRepeat == RepeatFill || backgroundRepeat == RepeatYFill) {
-        ch = ph + top + bottom;
-        sy = scaledImageHeight ? scaledImageHeight - (yPosition + top) % scaledImageHeight : 0;
-    } else {
-        cy += max(yPosition + top, 0);
-        sy = -min(yPosition + top, 0);
-        ch = scaledImageHeight + min(yPosition + top, 0);
+    int xPosition = fillLayer->xPosition().calcMinValue(positioningAreaSize.width() - tileSize.width(), true);
+    if (backgroundRepeatX == RepeatFill)
+        phase.setX(tileSize.width() ? tileSize.width() - (xPosition + left) % tileSize.width() : 0);
+    else {
+        destRect.move(max(xPosition + left, 0), 0);
+        phase.setX(-min(xPosition + left, 0));
+        destRect.setWidth(tileSize.width() + min(xPosition + left, 0));
     }
 
-    if (fixedAttachment) {
-        sx += max(tx - cx, 0);
-        sy += max(ty - cy, 0);
+    int yPosition = fillLayer->yPosition().calcMinValue(positioningAreaSize.height() - tileSize.height(), true);
+    if (backgroundRepeatY == RepeatFill)
+        phase.setY(tileSize.height() ? tileSize.height() - (yPosition + top) % tileSize.height() : 0);
+    else {
+        destRect.move(0, max(yPosition + top, 0));
+        phase.setY(-min(yPosition + top, 0));
+        destRect.setHeight(tileSize.height() + min(yPosition + top, 0));
     }
 
-    destRect = IntRect(cx, cy, cw, ch);
+    if (fixedAttachment)
+        phase.move(max(tx - destRect.x(), 0), max(ty - destRect.y(), 0));
+
     destRect.intersect(IntRect(tx, ty, w, h));
-    phase = IntPoint(sx, sy);
-    tileSize = IntSize(scaledImageWidth, scaledImageHeight);
 }
 
 int RenderBoxModelObject::verticalPosition(bool firstLine) const
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index baa5ecb..c9a4a0a 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -100,10 +100,12 @@ public:
 
 protected:
     void calculateBackgroundImageGeometry(const FillLayer*, int tx, int ty, int w, int h, IntRect& destRect, IntPoint& phase, IntSize& tileSize);
-    IntSize calculateBackgroundSize(const FillLayer*, int scaledWidth, int scaledHeight) const;
 
 private:
     virtual bool isBoxModelObject() const { return true; }
+
+    IntSize calculateFillTileSize(const FillLayer*, IntSize scaledSize) const;
+
     friend class RenderView;
 
     RenderLayer* m_layer;
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index 6d36a0f..f3ae558 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -52,7 +52,8 @@ void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
     if (!m_inner) {
         // Create an anonymous block.
         ASSERT(!firstChild());
-        m_inner = createAnonymousBlock();
+        bool isFlexibleBox = style()->display() == BOX || style()->display() == INLINE_BOX;
+        m_inner = createAnonymousBlock(isFlexibleBox);
         setupInnerStyle(m_inner->style());
         RenderFlexibleBox::addChild(m_inner);
     }
@@ -108,6 +109,7 @@ void RenderButton::setupInnerStyle(RenderStyle* innerStyle)
     // RenderBlock::createAnonymousBlock creates a new RenderStyle, so this is
     // safe to modify.
     innerStyle->setBoxFlex(1.0f);
+    innerStyle->setBoxOrient(style()->boxOrient());
 
     innerStyle->setPaddingTop(Length(theme()->buttonInternalPaddingTop(), Fixed));
     innerStyle->setPaddingRight(Length(theme()->buttonInternalPaddingRight(), Fixed));
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 67e5cba..17c6dad 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -143,13 +143,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
     RenderObject* resetCandidate = isReset ? object->parent() : previousSiblingOrParent(object);
     RenderObject* prevCounterCandidate = object;
     CounterNode* candidateCounter = 0;
+    // When a reset counter is chosen as candidateCounter, we'll
+    // decide the new node should be a child of the reset node or a
+    // sibling or the reset node. This flag controls it.
+    bool createChildForReset = true;
     while ((prevCounterCandidate = prevCounterCandidate->previousInPreOrder())) {
         CounterNode* c = counter(prevCounterCandidate, counterName, false);
         if (prevCounterCandidate == resetCandidate) {
-            if (!candidateCounter)
+            if (!candidateCounter) {
                 candidateCounter = c;
+                createChildForReset = true;
+            }
             if (candidateCounter) {
-                if (candidateCounter->isReset()) {
+                if (createChildForReset && candidateCounter->isReset()) {
                     parent = candidateCounter;
                     previousSibling = 0;
                 } else {
@@ -160,10 +166,19 @@ static bool findPlaceForCounter(RenderObject* object, const AtomicString& counte
             }
             resetCandidate = previousSiblingOrParent(resetCandidate);
         } else if (c) {
-            if (c->isReset())
-                candidateCounter = 0;
-            else if (!candidateCounter)
+            if (c->isReset()) {
+                if (c->parent()) {
+                    // The new node may be the next sibling of this reset node.
+                    createChildForReset = false;
+                    candidateCounter = c;
+                } else {
+                    createChildForReset = true;
+                    candidateCounter = 0;
+                }
+            } else if (!candidateCounter) {
+                createChildForReset = true;
                 candidateCounter = c;
+            }
         }
     }
 
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 437991a..8618d11 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -108,10 +108,11 @@ RenderBox* RenderFieldset::findLegend() const
 {
     for (RenderObject* legend = firstChild(); legend; legend = legend->nextSibling()) {
         if (!legend->isFloatingOrPositioned() && legend->node() &&
-            legend->node()->hasTagName(legendTag)
+            (legend->node()->hasTagName(legendTag)
 #if ENABLE(WML)
             || legend->node()->hasTagName(WMLNames::insertedLegendTag)
 #endif
+            )
            )
             return toRenderBox(legend);
     }
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index 84c94e4..531477e 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -225,7 +225,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
 
     calcWidth();
     calcHeight();
-    m_overflowWidth = width();
+    
+    m_overflow.clear();
 
     if (previousWidth != width() || previousHeight != height() ||
         (parent()->isFlexibleBox() && parent()->style()->boxOrient() == HORIZONTAL &&
@@ -241,7 +242,10 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
 #endif
     setHeight(0);
 
+<<<<<<< HEAD:WebCore/rendering/RenderFlexibleBox.cpp
     m_overflowHeight = 0;
+=======
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderFlexibleBox.cpp
     m_flexingChildren = m_stretchingChildren = false;
 
     initMaxMarginValues();
@@ -259,15 +263,8 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
     else
         layoutVerticalBox(relayoutChildren);
 
-    int oldHeight = height();
     calcHeight();
-    if (oldHeight != height()) {
-        // If the block got expanded in size, then increase our overflowheight to match.
-        if (m_overflowHeight > height())
-            m_overflowHeight -= (borderBottom() + paddingBottom() + horizontalScrollbarHeight());
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-    }
+
     if (previousHeight != height())
         relayoutChildren = true;
 
@@ -290,31 +287,14 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren)
         setMaxTopMargins(pos, neg);
         setMaxBottomMargins(0, 0);
     }
+    
+    // Add in the overflow from children.
+    FlexBoxIterator iterator(this);
+    for (RenderBox* child = iterator.first(); child; child = iterator.next())
+        addOverflowFromChild(child);
 
-    // Always ensure our overflow width is at least as large as our width.
-    if (m_overflowWidth < width())
-        m_overflowWidth = width();
-
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
-        }
-    }
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
 
     statePusher.pop();
 
@@ -363,7 +343,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     int oldHeight = 0;
 
     int remainingSpace = 0;
-    m_overflowHeight = height();
+
 
     FlexBoxIterator iterator(this);
     unsigned int highestFlexGroup = 0;
@@ -380,7 +360,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     do {
         // Reset our height.
         setHeight(yPos);
-        m_overflowHeight = height();
+
         xPos = borderLeft() + paddingLeft();
                 
         // Our first pass is done without flexing.  We simply lay the children
@@ -431,10 +411,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             setHeight(height() + lineHeight(true, true));
         
         setHeight(height() + toAdd);
-
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
         
         oldHeight = height();
         calcHeight();
@@ -493,12 +469,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             }
 
             placeChild(child, xPos, childY);
-
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
-
-            m_overflowHeight = max(m_overflowHeight, childY + child->overflowHeight(false));
-            m_overflowTop = min(m_overflowTop, child->y() + child->overflowTop(false));
             
             xPos += child->width() + child->marginRight();
     
@@ -662,22 +632,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         }
     }
     
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowWidth = max(lastChild->x() + lastChild->overflowWidth(false), m_overflowWidth);
-    }
-    
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
     if (heightSpecified)
@@ -820,7 +774,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     do {
         setHeight(borderTop() + paddingTop());
         int minHeight = height() + toAdd;
-        m_overflowHeight = height();
 
         child = iterator.first();
         while (child) {
@@ -828,8 +781,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (!haveLineClamp && (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))))
                 child->setChildNeedsLayout(true, false);
     
-            if (child->isPositioned())
-            {
+            if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 if (child->style()->hasStaticX()) {
                     if (style()->direction() == LTR)
@@ -876,14 +828,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             // Place the child.
             placeChild(child, childX, height());
             setHeight(height() + child->height() + child->marginBottom());
-    
-            if (child->isRenderBlock())
-                toRenderBlock(child)->addVisualOverflow(toRenderBlock(child)->floatRect());
 
-            // See if this child has made our overflow need to grow.
-            m_overflowWidth = max(child->x() + child->overflowWidth(false), m_overflowWidth);
-            m_overflowLeft = min(child->x() + child->overflowLeft(false), m_overflowLeft);
-            
             child = iterator.next();
         }
 
@@ -899,10 +844,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         if (height() < minHeight)
             setHeight(minHeight);
 
-        // Always make sure our overflowheight is at least our height.
-        if (m_overflowHeight < height())
-            m_overflowHeight = height();
-
         // Now we have to calc our height, so we know how much space we have remaining.
         oldHeight = height();
         calcHeight();
@@ -1060,22 +1001,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             }
         }
     }
-    
-    child = iterator.first();
-    while (child && child->isPositioned()) {
-        child = iterator.next();
-    }
-    
-    if (child) {
-        m_overflowTop = min(child->y() + child->overflowTop(false), m_overflowTop);
-
-        RenderBox* lastChild = child;
-        while ((child = iterator.next())) {
-            if (!child->isPositioned())
-                lastChild = child;
-        }
-        m_overflowHeight = max(lastChild->y() + lastChild->overflowHeight(false), m_overflowHeight);
-    }
 
     // So that the calcHeight in layoutBlock() knows to relayout positioned objects because of
     // a height change, we revert our height back to the intrinsic height before returning.
@@ -1161,6 +1086,8 @@ const char *RenderFlexibleBox::renderName() const
         return "RenderFlexibleBox (floating)";
     if (isPositioned())
         return "RenderFlexibleBox (positioned)";
+    if (isAnonymous())
+        return "RenderFlexibleBox (generated)";
     if (isRelPositioned())
         return "RenderFlexibleBox (relative positioned)";
     return "RenderFlexibleBox";
diff --git a/WebCore/rendering/RenderForeignObject.h b/WebCore/rendering/RenderForeignObject.h
index 8fdb816..e014f22 100644
--- a/WebCore/rendering/RenderForeignObject.h
+++ b/WebCore/rendering/RenderForeignObject.h
@@ -49,6 +49,7 @@ public:
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
+    virtual bool isSVGForeignObject() const { return true; }
 
  private:
     TransformationMatrix translationForAttributes() const;
diff --git a/WebCore/rendering/RenderHTMLCanvas.cpp b/WebCore/rendering/RenderHTMLCanvas.cpp
index 1fc07f0..8c17a0e 100644
--- a/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -43,6 +43,19 @@ RenderHTMLCanvas::RenderHTMLCanvas(HTMLCanvasElement* element)
     view()->frameView()->setIsVisuallyNonEmpty();
 }
 
+bool RenderHTMLCanvas::requiresLayer() const
+{
+    if (RenderReplaced::requiresLayer())
+        return true;
+    
+#if ENABLE(3D_CANVAS)
+    HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(node());
+    return canvas && canvas->is3D();
+#else
+    return false;
+#endif
+}
+
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, int tx, int ty)
 {
     IntRect rect = contentBoxRect();
@@ -55,10 +68,13 @@ void RenderHTMLCanvas::canvasSizeChanged()
     IntSize canvasSize = static_cast<HTMLCanvasElement*>(node())->size();
     IntSize zoomedSize(canvasSize.width() * style()->effectiveZoom(), canvasSize.height() * style()->effectiveZoom());
 
-    if (canvasSize == intrinsicSize())
+    if (zoomedSize == intrinsicSize())
         return;
 
-    setIntrinsicSize(canvasSize);
+    setIntrinsicSize(zoomedSize);
+
+    if (!parent())
+        return;
 
     if (!prefWidthsDirty())
         setPrefWidthsDirty(true);
diff --git a/WebCore/rendering/RenderHTMLCanvas.h b/WebCore/rendering/RenderHTMLCanvas.h
index e82cf9a..473dad5 100644
--- a/WebCore/rendering/RenderHTMLCanvas.h
+++ b/WebCore/rendering/RenderHTMLCanvas.h
@@ -36,6 +36,9 @@ class RenderHTMLCanvas : public RenderReplaced {
 public:
     RenderHTMLCanvas(HTMLCanvasElement*);
 
+    virtual bool isCanvas() const { return true; }
+    virtual bool requiresLayer() const;
+
     void canvasSizeChanged();
     
 private:
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index 91200bc..ec2a4d3 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -446,7 +446,7 @@ int RenderImage::minimumReplacedHeight() const
 HTMLMapElement* RenderImage::imageMap()
 {
     HTMLImageElement* i = node() && node()->hasTagName(imgTag) ? static_cast<HTMLImageElement*>(node()) : 0;
-    return i ? i->document()->getImageMap(i->useMap()) : 0;
+    return i ? i->document()->getImageMap(i->getAttribute(usemapAttr)) : 0;
 }
 
 bool RenderImage::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index 53962d2..05d29d0 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -131,18 +131,6 @@ void RenderInline::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
-static inline bool isAfterContent(RenderObject* child)
-{
-    if (!child)
-        return false;
-    if (child->style()->styleType() != AFTER)
-        return false;
-    // Text nodes don't have their own styles, so ignore the style on a text node.
-    if (child->isText() && !child->isBR())
-        return false;
-    return true;
-}
-
 void RenderInline::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (continuation())
@@ -556,6 +544,23 @@ IntRect RenderInline::linesBoundingBox() const
     return result;
 }
 
+IntRect RenderInline::linesVisibleOverflowBoundingBox() const
+{
+    if (!firstLineBox() || !lastLineBox())
+        return IntRect();
+
+    // Return the width of the minimal left side and the maximal right side.
+    int leftSide = numeric_limits<int>::max();
+    int rightSide = numeric_limits<int>::min();
+    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextFlowBox()) {
+        leftSide = min(leftSide, curr->leftVisibleOverflow());
+        rightSide = max(rightSide, curr->rightVisibleOverflow());
+    }
+
+    return IntRect(leftSide, firstLineBox()->topVisibleOverflow(), rightSide - leftSide,
+        lastLineBox()->bottomVisibleOverflow() - firstLineBox()->topVisibleOverflow());
+}
+
 IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     // Only run-ins are allowed in here during layout.
@@ -565,7 +570,7 @@ IntRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repain
         return IntRect();
 
     // Find our leftmost position.
-    IntRect boundingBox(linesBoundingBox());
+    IntRect boundingBox(linesVisibleOverflowBoundingBox());
     int left = boundingBox.x();
     int top = boundingBox.y();
 
@@ -647,7 +652,8 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
     if (repaintContainer == this)
         return;
 
-    RenderObject* o = container();
+    bool containerSkipped;
+    RenderObject* o = container(repaintContainer, &containerSkipped);
     if (!o)
         return;
 
@@ -688,6 +694,13 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             return;
     } else
         rect.setLocation(topLeft);
+
+    if (containerSkipped) {
+        // If the repaintContainer is below o, then we need to map the rect into repaintContainer's coordinates.
+        IntSize containerOffset = repaintContainer->offsetFromAncestorContainer(o);
+        rect.move(-containerOffset);
+        return;
+    }
     
     o->computeRectForRepaint(repaintContainer, rect, fixed);
 }
@@ -830,8 +843,12 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
 
 void RenderInline::addFocusRingRects(GraphicsContext* graphicsContext, int tx, int ty)
 {
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + curr->y(), curr->width(), curr->height()));
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        graphicsContext->addFocusRingRect(IntRect(tx + curr->x(), ty + top, curr->width(), bottom - top));
+    }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
         if (!curr->isText() && !curr->isListMarker()) {
@@ -883,9 +900,12 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     Vector<IntRect> rects;
 
     rects.append(IntRect());
-    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-        rects.append(IntRect(curr->x(), curr->y(), curr->width(), curr->height()));
-
+    for (InlineRunBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
+        RootInlineBox* root = curr->root();
+        int top = max(root->lineTop(), curr->y());
+        int bottom = min(root->lineBottom(), curr->y() + curr->height());
+        rects.append(IntRect(curr->x(), top, curr->width(), bottom - top));
+    }
     rects.append(IntRect());
 
     for (unsigned i = 1; i < rects.size() - 1; i++)
diff --git a/WebCore/rendering/RenderInline.h b/WebCore/rendering/RenderInline.h
index 14d76ca..8e0064e 100644
--- a/WebCore/rendering/RenderInline.h
+++ b/WebCore/rendering/RenderInline.h
@@ -45,6 +45,7 @@ public:
     virtual void absoluteQuads(Vector<FloatQuad>&);
 
     IntRect linesBoundingBox() const;
+    IntRect linesVisibleOverflowBoundingBox() const;
 
     InlineFlowBox* createAndAppendInlineFlowBox();
 
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index ab78f40..7a8b428 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -207,12 +207,8 @@ RenderLayer::~RenderLayer()
     // Make sure we have no lingering clip rects.
     ASSERT(!m_clipRects);
     
-    if (m_reflection) {
-        if (!m_reflection->documentBeingDestroyed())
-            m_reflection->removeLayers(this);
-        m_reflection->setParent(0);
-        m_reflection->destroy();
-    }
+    if (m_reflection)
+        removeReflection();
     
     if (m_scrollCorner)
         m_scrollCorner->destroy();
@@ -584,10 +580,10 @@ void RenderLayer::updateLayerPosition()
         setHeight(box->height());
 
         if (!box->hasOverflowClip()) {
-            if (box->overflowWidth() > box->width())
-                setWidth(box->overflowWidth());
-            if (box->overflowHeight() > box->height())
-                setHeight(box->overflowHeight());
+            if (box->rightLayoutOverflow() > box->width())
+                setWidth(box->rightLayoutOverflow());
+            if (box->bottomLayoutOverflow() > box->height())
+                setHeight(box->bottomLayoutOverflow());
         }
     }
 }
@@ -642,37 +638,44 @@ RenderLayer* RenderLayer::stackingContext() const
     return layer;
 }
 
+static inline bool isPositionedContainer(RenderLayer* layer)
+{
+    RenderObject* o = layer->renderer();
+    return o->isRenderView() || o->isPositioned() || o->isRelPositioned() || layer->hasTransform();
+}
+
 RenderLayer* RenderLayer::enclosingPositionedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->renderer()->isPositioned() && !curr->renderer()->isRelPositioned() && !curr->hasTransform();
-         curr = curr->parent()) { }
+    while (curr && !isPositionedContainer(curr))
+        curr = curr->parent();
+
     return curr;
 }
 
 RenderLayer* RenderLayer::enclosingTransformedAncestor() const
 {
     RenderLayer* curr = parent();
-    for ( ; curr && !curr->renderer()->isRenderView() && !curr->transform(); curr = curr->parent())
-        { }
+    while (curr && !curr->renderer()->isRenderView() && !curr->transform())
+        curr = curr->parent();
+
     return curr;
 }
 
+static inline const RenderLayer* compositingContainer(const RenderLayer* layer)
+{
+    return layer->isNormalFlowOnly() ? layer->parent() : layer->stackingContext();
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 RenderLayer* RenderLayer::enclosingCompositingLayer(bool includeSelf) const
 {
     if (includeSelf && isComposited())
         return const_cast<RenderLayer*>(this);
 
-    // Compositing layers are parented according to stacking order and overflow list,
-    // so we have to check whether the parent is a stacking context, or whether 
-    // the child is overflow-only.
-    bool inNormalFlowList = isNormalFlowOnly();
-    for (RenderLayer* curr = parent(); curr; curr = curr->parent()) {
-        if (curr->isComposited() && (inNormalFlowList || curr->isStackingContext()))
-            return curr;
-        
-        inNormalFlowList = curr->isNormalFlowOnly();
+    for (const RenderLayer* curr = compositingContainer(this); curr; curr = compositingContainer(curr)) {
+        if (curr->isComposited())
+            return const_cast<RenderLayer*>(curr);
     }
          
     return 0;
@@ -760,6 +763,19 @@ static IntRect transparencyClipBox(const TransformationMatrix& enclosingTransfor
         }
     }
 
+    // If we have a reflection, then we need to account for that when we push the clip.  Reflect our entire
+    // current transparencyClipBox to catch all child layers.
+    // FIXME: Accelerated compositing will eventually want to do something smart here to avoid incorporating this
+    // size into the parent layer.
+    if (l->renderer()->hasReflection()) {
+        int deltaX = 0;
+        int deltaY = 0;
+        l->convertToLayerCoords(rootLayer, deltaX, deltaY);
+        clipRect.move(-deltaX, -deltaY);
+        clipRect.unite(l->renderBox()->reflectedRect(clipRect));
+        clipRect.move(deltaX, deltaY);
+    }
+
     // Now map the clipRect via the enclosing transform
     return enclosingTransform.mapRect(clipRect);
 }
@@ -946,12 +962,44 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     }
  
     RenderLayer* parentLayer;
-    if (renderer()->style()->position() == AbsolutePosition)
-        parentLayer = enclosingPositionedAncestor();
-    else
+    if (renderer()->style()->position() == AbsolutePosition) {
+        // Do what enclosingPositionedAncestor() does, but check for ancestorLayer along the way
+        parentLayer = parent();
+        bool foundAncestorFirst = false;
+        while (parentLayer) {
+            if (isPositionedContainer(parentLayer))
+                break;
+
+            if (parentLayer == ancestorLayer) {
+                foundAncestorFirst = true;
+                break;
+            }
+
+            parentLayer = parentLayer->parent();
+        }
+
+        if (foundAncestorFirst) {
+            // Found ancestorLayer before the abs. positioned container, so compute offset of both relative
+            // to enclosingPositionedAncestor and subtract.
+            RenderLayer* positionedAncestor = parentLayer->enclosingPositionedAncestor();
+
+            int thisX = 0;
+            int thisY = 0;
+            convertToLayerCoords(positionedAncestor, thisX, thisY);
+            
+            int ancestorX = 0;
+            int ancestorY = 0;
+            ancestorLayer->convertToLayerCoords(positionedAncestor, ancestorX, ancestorY);
+        
+            xPos += (thisX - ancestorX);
+            yPos += (thisY - ancestorY);
+            return;
+        }
+    } else
         parentLayer = parent();
     
-    if (!parentLayer) return;
+    if (!parentLayer)
+        return;
     
     parentLayer->convertToLayerCoords(ancestorLayer, xPos, yPos);
 
@@ -959,12 +1007,22 @@ RenderLayer::convertToLayerCoords(const RenderLayer* ancestorLayer, int& xPos, i
     yPos += y();
 }
 
+static inline int adjustedScrollDelta(int beginningDelta) {
+    // This implemention matches Firefox's.
+    // http://mxr.mozilla.org/firefox/source/toolkit/content/widgets/browser.xml#856.
+    const int speedReducer = 12;
+
+    int adjustedDelta = beginningDelta / speedReducer;
+    if (adjustedDelta > 1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(adjustedDelta))) - 1;
+    else if (adjustedDelta < -1)
+        adjustedDelta = static_cast<int>(adjustedDelta * sqrt(static_cast<double>(-adjustedDelta))) + 1;
+
+    return adjustedDelta;
+}
+
 void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint) 
 {
-    // We want to reduce the speed if we're close from the original point to improve the handleability of the scroll
-    const int shortDistanceLimit = 100;  // We delimit a 200 pixels long square enclosing the original point
-    const int speedReducer = 2;          // Within this square we divide the scrolling speed by 2
-    
     Frame* frame = renderer()->document()->frame();
     if (!frame)
         return;
@@ -981,22 +1039,19 @@ void RenderLayer::panScrollFromPoint(const IntPoint& sourcePoint)
     int xDelta = currentMousePosition.x() - sourcePoint.x();
     int yDelta = currentMousePosition.y() - sourcePoint.y();
 
-    if (abs(xDelta) < ScrollView::noPanScrollRadius) // at the center we let the space for the icon
+    if (abs(xDelta) <= ScrollView::noPanScrollRadius) // at the center we let the space for the icon
         xDelta = 0;
-    if (abs(yDelta) < ScrollView::noPanScrollRadius)
+    if (abs(yDelta) <= ScrollView::noPanScrollRadius)
         yDelta = 0;
 
-    // Let's attenuate the speed for the short distances
-    if (abs(xDelta) < shortDistanceLimit)
-        xDelta /= speedReducer;
-    if (abs(yDelta) < shortDistanceLimit)
-        yDelta /= speedReducer;
-
-    scrollByRecursively(xDelta, yDelta);
+    scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta));
 }
 
 void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
 {
+    if (!xDelta && !yDelta)
+        return;
+
     bool restrictedByLineClamp = false;
     if (renderer()->parent())
         restrictedByLineClamp = renderer()->parent()->style()->lineClamp() >= 0;
@@ -1006,17 +1061,30 @@ void RenderLayer::scrollByRecursively(int xDelta, int yDelta)
         int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY);
 
-        // If this layer can't do the scroll we ask its parent
+        // If this layer can't do the scroll we ask the next layer up that can scroll to try
         int leftToScrollX = newOffsetX - scrollXOffset();
         int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
-            renderer()->parent()->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+            RenderObject* nextRenderer = renderer()->parent();
+            while (nextRenderer) {
+                if (nextRenderer->isBox() && toRenderBox(nextRenderer)->canBeScrolledAndHasScrollableArea()) {
+                    nextRenderer->enclosingLayer()->scrollByRecursively(leftToScrollX, leftToScrollY);
+                    break;
+                }
+                nextRenderer = nextRenderer->parent();
+            }
+
             Frame* frame = renderer()->document()->frame();
             if (frame)
                 frame->eventHandler()->updateAutoscrollRenderer();
         }
-    } else if (renderer()->view()->frameView())
+    } else if (renderer()->view()->frameView()) {
+        // If we are here, we were called on a renderer that can be programatically scrolled, but doesn't
+        // have an overflow clip. Which means that it is a document node that can be scrolled.
         renderer()->view()->frameView()->scrollBy(IntSize(xDelta, yDelta));
+        // FIXME: If we didn't scroll the whole way, do we want to try looking at the frames ownerElement? 
+        // https://bugs.webkit.org/show_bug.cgi?id=28237
+    }
 }
 
 
@@ -1275,7 +1343,9 @@ void RenderLayer::autoscroll()
     if (!frameView)
         return;
 
+#if ENABLE(DRAG_SUPPORT)
     frame->eventHandler()->updateSelectionForMouseDrag();
+#endif
 
     IntPoint currentDocumentPosition = frameView->windowToContents(frame->eventHandler()->currentMousePosition());
     scrollRectToVisible(IntRect(currentDocumentPosition, IntSize(1, 1)), false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
@@ -2056,9 +2126,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         // Make sure the parent's clip rects have been calculated.
         IntRect clipRect = paintDirtyRect;
         if (parent()) {
-            ClipRects parentRects;
-            parentClipRects(rootLayer, parentRects, paintFlags & PaintLayerTemporaryClipRects);
-            clipRect = parentRects.overflowClipRect();
+            clipRect = backgroundClipRect(rootLayer, paintFlags & PaintLayerTemporaryClipRects);
             clipRect.intersect(paintDirtyRect);
         }
         
@@ -2368,9 +2436,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     if (transform() && !appliedTransform) {
         // Make sure the parent's clip rects have been calculated.
         if (parent()) {
-            ClipRects parentRects;
-            parentClipRects(rootLayer, parentRects, useTemporaryClipRects);
-            IntRect clipRect = parentRects.overflowClipRect();
+            IntRect clipRect = backgroundClipRect(rootLayer, useTemporaryClipRects);
             // Go ahead and test the enclosing clip now.
             if (!clipRect.contains(hitTestPoint))
                 return 0;
@@ -2668,10 +2734,10 @@ void RenderLayer::parentClipRects(const RenderLayer* rootLayer, ClipRects& clipR
     clipRects = *parent()->clipRects();
 }
 
-void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
-                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
+IntRect RenderLayer::backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const
 {
-    if (rootLayer != this && parent()) {
+    IntRect backgroundRect;
+    if (parent()) {
         ClipRects parentRects;
         parentClipRects(rootLayer, parentRects, temporaryClipRects);
         backgroundRect = renderer()->style()->position() == FixedPosition ? parentRects.fixedClipRect() :
@@ -2681,7 +2747,15 @@ void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& pa
         ASSERT(view);
         if (view && parentRects.fixed() && rootLayer->renderer() == view)
             backgroundRect.move(view->frameView()->scrollX(), view->frameView()->scrollY());
+    }
+    return backgroundRect;
+}
 
+void RenderLayer::calculateRects(const RenderLayer* rootLayer, const IntRect& paintDirtyRect, IntRect& layerBounds,
+                                 IntRect& backgroundRect, IntRect& foregroundRect, IntRect& outlineRect, bool temporaryClipRects) const
+{
+    if (rootLayer != this && parent()) {
+        backgroundRect = backgroundClipRect(rootLayer, temporaryClipRects);
         backgroundRect.intersect(paintDirtyRect);
     } else
         backgroundRect = paintDirtyRect;
@@ -2771,7 +2845,7 @@ IntRect RenderLayer::localBoundingBox() const
 {
     // There are three special cases we need to consider.
     // (1) Inline Flows.  For inline flows we will create a bounding box that fully encompasses all of the lines occupied by the
-    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the root
+    // inline.  In other words, if some <span> wraps to three lines, we'll create a bounding box that fully encloses the
     // line boxes of all three lines (including overflow on those lines).
     // (2) Left/Top Overflow.  The width/height of layers already includes right/bottom overflow.  However, in the case of left/top
     // overflow, we have to create a bounding box that will extend to include this overflow.
@@ -2785,8 +2859,8 @@ IntRect RenderLayer::localBoundingBox() const
         InlineFlowBox* firstBox = inlineFlow->firstLineBox();
         if (!firstBox)
             return result;
-        int top = firstBox->root()->topOverflow();
-        int bottom = inlineFlow->lastLineBox()->root()->bottomOverflow();
+        int top = firstBox->topVisibleOverflow();
+        int bottom = inlineFlow->lastLineBox()->bottomVisibleOverflow();
         int left = firstBox->x();
         for (InlineRunBox* curr = firstBox->nextLineBox(); curr; curr = curr->nextLineBox())
             left = min(left, curr->x());
@@ -2797,7 +2871,7 @@ IntRect RenderLayer::localBoundingBox() const
             if (child->isTableCell()) {
                 IntRect bbox = toRenderBox(child)->borderBoxRect();
                 result.unite(bbox);
-                IntRect overflowRect = renderBox()->overflowRect(false);
+                IntRect overflowRect = renderBox()->visibleOverflowRect();
                 if (bbox != overflowRect)
                     result.unite(overflowRect);
             }
@@ -2810,7 +2884,7 @@ IntRect RenderLayer::localBoundingBox() const
         else {
             IntRect bbox = box->borderBoxRect();
             result = bbox;
-            IntRect overflowRect = box->overflowRect(false);
+            IntRect overflowRect = box->visibleOverflowRect();
             if (bbox != overflowRect)
                 result.unite(overflowRect);
         }
@@ -2873,6 +2947,11 @@ void RenderLayer::clearBacking()
 {
     m_backing.clear();
 }
+
+bool RenderLayer::hasCompositedMask() const
+{
+    return m_backing && m_backing->hasMaskLayer();
+}
 #endif
 
 void RenderLayer::setParent(RenderLayer* parent)
@@ -3183,10 +3262,9 @@ void RenderLayer::styleChanged(StyleDifference diff, const RenderStyle*)
         m_marquee = 0;
     }
     
-    if (!hasReflection() && m_reflection) {
-        m_reflection->destroy();
-        m_reflection = 0;
-    } else if (hasReflection()) {
+    if (!hasReflection() && m_reflection)
+        removeReflection();
+    else if (hasReflection()) {
         if (!m_reflection)
             createReflection();
         updateReflectionStyle();
@@ -3260,6 +3338,16 @@ void RenderLayer::createReflection()
     m_reflection->setParent(renderer()); // We create a 1-way connection.
 }
 
+void RenderLayer::removeReflection()
+{
+    if (!m_reflection->documentBeingDestroyed())
+        m_reflection->removeLayers(this);
+
+    m_reflection->setParent(0);
+    m_reflection->destroy();
+    m_reflection = 0;
+}
+
 void RenderLayer::updateReflectionStyle()
 {
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 1772c66..9d2212b 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -415,11 +415,13 @@ public:
 
 #if USE(ACCELERATED_COMPOSITING)
     bool isComposited() const { return m_backing != 0; }
+    bool hasCompositedMask() const;
     RenderLayerBacking* backing() const { return m_backing.get(); }
     RenderLayerBacking* ensureBacking();
     void clearBacking();
 #else
     bool isComposited() const { return false; }
+    bool hasCompositedMask() const { return false; }
 #endif
 
     bool paintsWithTransparency() const
@@ -507,11 +509,14 @@ private:
     Node* enclosingElement() const;
 
     void createReflection();
+    void removeReflection();
+
     void updateReflectionStyle();
     bool paintingInsideReflection() const { return m_paintingInsideReflection; }
     void setPaintingInsideReflection(bool b) { m_paintingInsideReflection = b; }
     
     void parentClipRects(const RenderLayer* rootLayer, ClipRects&, bool temporaryClipRects = false) const;
+    IntRect backgroundClipRect(const RenderLayer* rootLayer, bool temporaryClipRects) const;
 
     RenderLayer* enclosingTransformedAncestor() const;
 
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index e98c458..941817c 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -28,11 +28,13 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "AnimationController.h"
+#include "CanvasRenderingContext3D.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "HTMLCanvasElement.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "RenderBox.h"
@@ -47,17 +49,16 @@ using namespace std;
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 static bool hasBorderOutlineOrShadow(const RenderStyle*);
 static bool hasBoxDecorations(const RenderStyle*);
 static bool hasBoxDecorationsWithBackgroundImage(const RenderStyle*);
 
 RenderLayerBacking::RenderLayerBacking(RenderLayer* layer)
     : m_owningLayer(layer)
-    , m_ancestorClippingLayer(0)
-    , m_graphicsLayer(0)
-    , m_foregroundLayer(0)
-    , m_clippingLayer(0)
     , m_hasDirectlyCompositedContent(false)
+    , m_artificiallyInflatedBounds(false)
 {
     createGraphicsLayer();
 }
@@ -66,12 +67,13 @@ RenderLayerBacking::~RenderLayerBacking()
 {
     updateClippingLayers(false, false);
     updateForegroundLayer(false);
+    updateMaskLayer(false);
     destroyGraphicsLayer();
 }
 
 void RenderLayerBacking::createGraphicsLayer()
 {
-    m_graphicsLayer = GraphicsLayer::createGraphicsLayer(this);
+    m_graphicsLayer = GraphicsLayer::create(this);
     
 #ifndef NDEBUG
     if (renderer()->node()) {
@@ -79,7 +81,7 @@ void RenderLayerBacking::createGraphicsLayer()
             m_graphicsLayer->setName("Document Node");
         else {
             if (renderer()->node()->isHTMLElement() && renderer()->node()->hasID())
-                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->id());
+                m_graphicsLayer->setName(renderer()->renderName() + String(" ") + static_cast<HTMLElement*>(renderer()->node())->getAttribute(idAttr));
             else
                 m_graphicsLayer->setName(renderer()->renderName());
         }
@@ -96,14 +98,10 @@ void RenderLayerBacking::destroyGraphicsLayer()
     if (m_graphicsLayer)
         m_graphicsLayer->removeFromParent();
 
-    delete m_graphicsLayer;
     m_graphicsLayer = 0;
-
-    delete m_foregroundLayer;
     m_foregroundLayer = 0;
-
-    delete m_clippingLayer;
     m_clippingLayer = 0;
+    m_maskLayer = 0;
 }
 
 void RenderLayerBacking::updateLayerOpacity()
@@ -126,6 +124,30 @@ void RenderLayerBacking::updateLayerTransform()
     m_graphicsLayer->setTransform(t);
 }
 
+static bool hasNonZeroTransformOrigin(const RenderObject* renderer)
+{
+    RenderStyle* style = renderer->style();
+    return (style->transformOriginX().type() == Fixed && style->transformOriginX().value())
+        || (style->transformOriginY().type() == Fixed && style->transformOriginY().value());
+}
+
+void RenderLayerBacking::updateCompositedBounds()
+{
+    IntRect layerBounds = compositor()->calculateCompositedBounds(m_owningLayer, m_owningLayer);
+
+    // If the element has a transform-origin that has fixed lengths, and the renderer has zero size,
+    // then we need to ensure that the compositing layer has non-zero size so that we can apply
+    // the transform-origin via the GraphicsLayer anchorPoint (which is expressed as a fractional value).
+    if (layerBounds.isEmpty() && hasNonZeroTransformOrigin(renderer())) {
+        layerBounds.setWidth(1);
+        layerBounds.setHeight(1);
+        m_artificiallyInflatedBounds = true;
+    } else
+        m_artificiallyInflatedBounds = false;
+
+    setCompositedBounds(layerBounds);
+}
+
 void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
 {
     RenderLayerCompositor* layerCompositor = compositor();
@@ -137,7 +159,7 @@ void RenderLayerBacking::updateAfterLayout(UpdateDepth updateDepth)
         //
         // The solution is to update compositing children of this layer here,
         // via updateCompositingChildrenGeometry().
-        setCompositedBounds(layerCompositor->calculateCompositedBounds(m_owningLayer, m_owningLayer));
+        updateCompositedBounds();
         layerCompositor->updateCompositingDescendantGeometry(m_owningLayer, m_owningLayer, updateDepth);
         
         if (!m_owningLayer->parent()) {
@@ -158,6 +180,9 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
     if (updateClippingLayers(compositor->clippedByAncestor(m_owningLayer), compositor->clipsCompositingDescendants(m_owningLayer)))
         layerConfigChanged = true;
 
+    if (updateMaskLayer(m_owningLayer->renderer()->hasMask()))
+        m_graphicsLayer->setMaskLayer(m_maskLayer.get());
+
     m_hasDirectlyCompositedContent = false;
     if (canUseDirectCompositing()) {
         if (renderer()->isImage()) {
@@ -165,6 +190,16 @@ bool RenderLayerBacking::updateGraphicsLayerConfiguration()
             m_hasDirectlyCompositedContent = true;
             m_graphicsLayer->setDrawsContent(false);
         }
+#if ENABLE(3D_CANVAS)    
+        else if (renderer()->isCanvas()) {
+            HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+            if (canvas->is3D()) {
+                CanvasRenderingContext3D* context = static_cast<CanvasRenderingContext3D*>(canvas->renderingContext());
+                if (context->graphicsContext3D()->platformGraphicsContext3D())
+                    m_graphicsLayer->setContentsToGraphicsContext3D(context->graphicsContext3D());
+            }
+        }
+#endif
 
         if (rendererHasBackground())
             m_graphicsLayer->setBackgroundColor(rendererBackgroundColor());
@@ -222,10 +257,7 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
         // Call calculateRects to get the backgroundRect which is what is used to clip the contents of this
         // layer. Note that we call it with temporaryClipRects = true because normally when computing clip rects
         // for a compositing layer, rootLayer is the layer itself.
-        ClipRects parentRects;
-        m_owningLayer->parentClipRects(compAncestor, parentRects, true);
-        IntRect parentClipRect = parentRects.overflowClipRect();
-        
+        IntRect parentClipRect = m_owningLayer->backgroundClipRect(compAncestor, true);
         m_ancestorClippingLayer->setPosition(FloatPoint() + (parentClipRect.location() - graphicsLayerParentLocation));
         m_ancestorClippingLayer->setSize(parentClipRect.size());
 
@@ -251,13 +283,19 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     // If we have a layer that clips children, position it.
+    IntRect clippingBox;
     if (m_clippingLayer) {
-        IntRect clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
+        clippingBox = toRenderBox(renderer())->overflowClipRect(0, 0);
         m_clippingLayer->setPosition(FloatPoint() + (clippingBox.location() - localCompositingBounds.location()));
         m_clippingLayer->setSize(clippingBox.size());
         m_clippingLayer->setOffsetFromRenderer(clippingBox.location() - IntPoint());
     }
     
+    if (m_maskLayer) {
+        m_maskLayer->setSize(m_graphicsLayer->size());
+        m_maskLayer->setPosition(FloatPoint());
+    }
+    
     if (m_owningLayer->hasTransform()) {
         const IntRect borderBox = toRenderBox(renderer())->borderBoxRect();
 
@@ -293,15 +331,25 @@ void RenderLayerBacking::updateGraphicsLayerGeometry()
     }
 
     if (m_foregroundLayer) {
-        // The contents layer is always coincidental with the graphicsLayer for now.
-        m_foregroundLayer->setPosition(IntPoint(0, 0));
-        m_foregroundLayer->setSize(newSize);
-        m_foregroundLayer->setOffsetFromRenderer(m_graphicsLayer->offsetFromRenderer());
+        FloatPoint foregroundPosition;
+        FloatSize foregroundSize = newSize;
+        IntSize foregroundOffset = m_graphicsLayer->offsetFromRenderer();
+        // If we have a clipping layer (which clips descendants), then the foreground layer is a child of it,
+        // so that it gets correctly sorted with children. In that case, position relative to the clipping layer.
+        if (m_clippingLayer) {
+            foregroundPosition = FloatPoint() + (localCompositingBounds.location() - clippingBox.location());
+            foregroundSize = FloatSize(clippingBox.size());
+            foregroundOffset = clippingBox.location() - IntPoint();
+        }
+
+        m_foregroundLayer->setPosition(foregroundPosition);
+        m_foregroundLayer->setSize(foregroundSize);
+        m_foregroundLayer->setOffsetFromRenderer(foregroundOffset);
     }
 
     m_graphicsLayer->setContentsRect(contentsBox());
     if (!m_hasDirectlyCompositedContent)
-        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow());
+        m_graphicsLayer->setDrawsContent(!isSimpleContainerCompositingLayer() && !paintingGoesToWindow() && !m_artificiallyInflatedBounds);
 }
 
 void RenderLayerBacking::updateInternalHierarchy()
@@ -311,12 +359,12 @@ void RenderLayerBacking::updateInternalHierarchy()
     if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeAllChildren();
         m_graphicsLayer->removeFromParent();
-        m_ancestorClippingLayer->addChild(m_graphicsLayer);
+        m_ancestorClippingLayer->addChild(m_graphicsLayer.get());
     }
 
     if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        m_graphicsLayer->addChild(m_clippingLayer);
+        m_graphicsLayer->addChild(m_clippingLayer.get());
     }
 }
 
@@ -327,7 +375,7 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
 
     if (needsAncestorClip) {
         if (!m_ancestorClippingLayer) {
-            m_ancestorClippingLayer = GraphicsLayer::createGraphicsLayer(this);
+            m_ancestorClippingLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
             m_ancestorClippingLayer->setName("Ancestor clipping Layer");
 #endif
@@ -336,14 +384,13 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_ancestorClippingLayer) {
         m_ancestorClippingLayer->removeFromParent();
-        delete m_ancestorClippingLayer;
         m_ancestorClippingLayer = 0;
         layersChanged = true;
     }
     
     if (needsDescendantClip) {
         if (!m_clippingLayer) {
-            m_clippingLayer = GraphicsLayer::createGraphicsLayer(0);
+            m_clippingLayer = GraphicsLayer::create(0);
 #ifndef NDEBUG
             m_clippingLayer->setName("Child clipping Layer");
 #endif
@@ -352,7 +399,6 @@ bool RenderLayerBacking::updateClippingLayers(bool needsAncestorClip, bool needs
         }
     } else if (m_clippingLayer) {
         m_clippingLayer->removeFromParent();
-        delete m_clippingLayer;
         m_clippingLayer = 0;
         layersChanged = true;
     }
@@ -368,25 +414,61 @@ bool RenderLayerBacking::updateForegroundLayer(bool needsForegroundLayer)
     bool layerChanged = false;
     if (needsForegroundLayer) {
         if (!m_foregroundLayer) {
-            m_foregroundLayer = GraphicsLayer::createGraphicsLayer(this);
+            m_foregroundLayer = GraphicsLayer::create(this);
 #ifndef NDEBUG
-            m_foregroundLayer->setName("Contents");
+            m_foregroundLayer->setName("Foreground");
 #endif
             m_foregroundLayer->setDrawsContent(true);
-            m_foregroundLayer->setDrawingPhase(GraphicsLayerPaintForegroundMask);
-            m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintBackgroundMask);
+            m_foregroundLayer->setPaintingPhase(GraphicsLayerPaintForeground);
             layerChanged = true;
         }
     } else if (m_foregroundLayer) {
         m_foregroundLayer->removeFromParent();
-        delete m_foregroundLayer;
         m_foregroundLayer = 0;
-        m_graphicsLayer->setDrawingPhase(GraphicsLayerPaintAllMask);
         layerChanged = true;
     }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
+    return layerChanged;
+}
+
+bool RenderLayerBacking::updateMaskLayer(bool needsMaskLayer)
+{
+    bool layerChanged = false;
+    if (needsMaskLayer) {
+        if (!m_maskLayer) {
+            m_maskLayer = GraphicsLayer::create(this);
+#ifndef NDEBUG
+            m_maskLayer->setName("Mask");
+#endif
+            m_maskLayer->setDrawsContent(true);
+            m_maskLayer->setPaintingPhase(GraphicsLayerPaintMask);
+            layerChanged = true;
+        }
+    } else if (m_maskLayer) {
+        m_maskLayer = 0;
+        layerChanged = true;
+    }
+
+    if (layerChanged)
+        m_graphicsLayer->setPaintingPhase(paintingPhaseForPrimaryLayer());
+
     return layerChanged;
 }
 
+GraphicsLayerPaintingPhase RenderLayerBacking::paintingPhaseForPrimaryLayer() const
+{
+    unsigned phase = GraphicsLayerPaintBackground;
+    if (!m_foregroundLayer)
+        phase |= GraphicsLayerPaintForeground;
+    if (!m_maskLayer)
+        phase |= GraphicsLayerPaintMask;
+
+    return static_cast<GraphicsLayerPaintingPhase>(phase);
+}
+
 float RenderLayerBacking::compositingOpacity(float rendererOpacity) const
 {
     float finalOpacity = rendererOpacity;
@@ -500,7 +582,7 @@ bool RenderLayerBacking::isSimpleContainerCompositingLayer() const
         
         // Now look at the body's renderer.
         HTMLElement* body = renderObject->document()->body();
-        RenderObject* bodyObject = (body && body->hasLocalName(HTMLNames::bodyTag)) ? body->renderer() : 0;
+        RenderObject* bodyObject = (body && body->hasLocalName(bodyTag)) ? body->renderer() : 0;
         if (!bodyObject)
             return false;
         
@@ -582,6 +664,14 @@ bool RenderLayerBacking::canUseDirectCompositing() const
 {
     RenderObject* renderObject = renderer();
     
+    // Canvas3D is always direct composited
+#if ENABLE(3D_CANVAS)    
+    if (renderer()->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+        return canvas->is3D();
+    }
+#endif
+
     // Reject anything that isn't an image
     if (!renderObject->isImage() && !renderObject->isVideo())
         return false;
@@ -600,8 +690,19 @@ bool RenderLayerBacking::canUseDirectCompositing() const
     
 void RenderLayerBacking::rendererContentChanged()
 {
-    if (canUseDirectCompositing() && renderer()->isImage())
-        updateImageContents();
+    if (canUseDirectCompositing()) {
+        if (renderer()->isImage())
+            updateImageContents();
+        else {
+#if ENABLE(3D_CANVAS)    
+            if (renderer()->isCanvas()) {
+                HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer()->node());
+                if (canvas->is3D())
+                    m_graphicsLayer->setGraphicsContext3DNeedsDisplay();
+            }
+#endif
+        }
+    }
 }
 
 void RenderLayerBacking::updateImageContents()
@@ -705,13 +806,16 @@ void RenderLayerBacking::setContentsNeedDisplay()
     
     if (m_foregroundLayer && m_foregroundLayer->drawsContent())
         m_foregroundLayer->setNeedsDisplay();
+
+    if (m_maskLayer && m_maskLayer->drawsContent())
+        m_maskLayer->setNeedsDisplay();
 }
 
 // r is in the coordinate space of the layer's render object
 void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
 {
     if (m_graphicsLayer && m_graphicsLayer->drawsContent()) {
-        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer, FloatPoint(r.x(), r.y()));
+        FloatPoint dirtyOrigin = contentsToGraphicsLayerCoordinates(m_graphicsLayer.get(), FloatPoint(r.x(), r.y()));
         FloatRect dirtyRect(dirtyOrigin, r.size());
         FloatRect bounds(FloatPoint(), m_graphicsLayer->size());
         if (bounds.intersects(dirtyRect))
@@ -722,6 +826,11 @@ void RenderLayerBacking::setContentsNeedDisplayInRect(const IntRect& r)
         // FIXME: do incremental repaint
         m_foregroundLayer->setNeedsDisplay();
     }
+
+    if (m_maskLayer && m_maskLayer->drawsContent()) {
+        // FIXME: do incremental repaint
+        m_maskLayer->setNeedsDisplay();
+    }
 }
 
 static void setClip(GraphicsContext* p, const IntRect& paintDirtyRect, const IntRect& clipRect)
@@ -779,7 +888,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
     bool shouldPaint = m_owningLayer->hasVisibleContent() && m_owningLayer->isSelfPaintingLayer();
 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackgroundMask)) {
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintBackground)) {
         // If this is the root then we need to send in a bigger bounding box
         // because we'll be painting the background as well (see RenderBox::paintRootBoxDecorations()).
         IntRect paintBox = clipRectToApply;
@@ -823,7 +932,10 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         restoreClip(context, paintDirtyRect, damageRect);
     }
                 
-    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForegroundMask)) {
+    bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+    bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
+
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintForeground)) {
         // Now walk the sorted list of children with negative z-indices. Only RenderLayers without compositing layers will paint.
         // FIXME: should these be painted as background?
         Vector<RenderLayer*>* negZOrderList = m_owningLayer->negZOrderList();
@@ -832,9 +944,6 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
 
-        bool forceBlackText = paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-        bool selectionOnly  = paintRestriction == PaintRestrictionSelectionOnly || paintRestriction == PaintRestrictionSelectionOnlyBlackText;
-
         // Set up the clip used when painting our children.
         setClip(context, paintDirtyRect, clipRectToApply);
         RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
@@ -877,7 +986,9 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             for (Vector<RenderLayer*>::iterator it = posZOrderList->begin(); it != posZOrderList->end(); ++it)
                 it[0]->paintLayer(rootLayer, context, paintDirtyRect, paintRestriction, paintingRoot);
         }
-        
+    }
+    
+    if (shouldPaint && (paintingPhase & GraphicsLayerPaintMask)) {
         if (renderer()->hasMask() && !selectionOnly && !damageRect.isEmpty()) {
             setClip(context, paintDirtyRect, damageRect);
 
@@ -894,7 +1005,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 }
 
 // Up-call from compositing layer drawing callback.
-void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase drawingPhase, const IntRect& clip)
+void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
@@ -912,7 +1023,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
     IntRect dirtyRect = enclosingBBox;
     dirtyRect.intersect(clipRect);
 
-    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, drawingPhase, renderer());
+    paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintRestrictionNone, paintingPhase, renderer());
 }
 
 bool RenderLayerBacking::startAnimation(double beginTime, const Animation* anim, const KeyframeList& keyframes)
@@ -970,7 +1081,8 @@ bool RenderLayerBacking::startTransition(double beginTime, int property, const R
             KeyframeValueList opacityVector(AnimatedPropertyOpacity);
             opacityVector.insert(new FloatAnimationValue(0, compositingOpacity(fromStyle->opacity())));
             opacityVector.insert(new FloatAnimationValue(1, compositingOpacity(toStyle->opacity())));
-            if (m_graphicsLayer->addAnimation(opacityVector, toRenderBox(renderer())->borderBoxRect().size(), opacityAnim, String(), beginTime))
+            // The boxSize param is only used for transform animations (which can only run on RenderBoxes), so we pass an empty size here.
+            if (m_graphicsLayer->addAnimation(opacityVector, IntSize(), opacityAnim, String(), beginTime))
                 didAnimate = true;
         }
     }
diff --git a/WebCore/rendering/RenderLayerBacking.h b/WebCore/rendering/RenderLayerBacking.h
index b027685..e12aa58 100644
--- a/WebCore/rendering/RenderLayerBacking.h
+++ b/WebCore/rendering/RenderLayerBacking.h
@@ -63,21 +63,23 @@ public:
     // Update contents and clipping structure.
     void updateInternalHierarchy(); // make private
     
-    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer; }
+    GraphicsLayer* graphicsLayer() const { return m_graphicsLayer.get(); }
 
     // Layer to clip children
     bool hasClippingLayer() const { return m_clippingLayer != 0; }
-    GraphicsLayer* clippingLayer() const { return m_clippingLayer; }
+    GraphicsLayer* clippingLayer() const { return m_clippingLayer.get(); }
 
     // Layer to get clipped by ancestor
     bool hasAncestorClippingLayer() const { return m_ancestorClippingLayer != 0; }
-    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer; }
+    GraphicsLayer* ancestorClippingLayer() const { return m_ancestorClippingLayer.get(); }
 
     bool hasContentsLayer() const { return m_foregroundLayer != 0; }
-    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer; }
+    GraphicsLayer* foregroundLayer() const { return m_foregroundLayer.get(); }
     
-    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer : m_graphicsLayer; }
-    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer : m_graphicsLayer; }
+    bool hasMaskLayer() const { return m_maskLayer != 0; }
+
+    GraphicsLayer* parentForSublayers() const { return m_clippingLayer ? m_clippingLayer.get() : m_graphicsLayer.get(); }
+    GraphicsLayer* childForSuperlayers() const { return m_ancestorClippingLayer ? m_ancestorClippingLayer.get() : m_graphicsLayer.get(); }
 
     // RenderLayers with backing normally short-circuit paintLayer() because
     // their content is rendered via callbacks from GraphicsLayer. However, the document
@@ -106,6 +108,7 @@ public:
 
     IntRect compositedBounds() const;
     void setCompositedBounds(const IntRect&);
+    void updateCompositedBounds();
 
     FloatPoint graphicsLayerToContentsCoordinates(const GraphicsLayer*, const FloatPoint&);
     FloatPoint contentsToGraphicsLayerCoordinates(const GraphicsLayer*, const FloatPoint&);
@@ -127,7 +130,10 @@ private:
 
     bool updateClippingLayers(bool needsAncestorClip, bool needsDescendantClip);
     bool updateForegroundLayer(bool needsForegroundLayer);
+    bool updateMaskLayer(bool needsMaskLayer);
 
+    GraphicsLayerPaintingPhase paintingPhaseForPrimaryLayer() const;
+    
     IntSize contentOffsetInCompostingLayer() const;
     // Result is transform origin in pixels.
     FloatPoint3D computeTransformOrigin(const IntRect& borderBox) const;
@@ -162,14 +168,16 @@ private:
 private:
     RenderLayer* m_owningLayer;
 
-    GraphicsLayer* m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
-    GraphicsLayer* m_graphicsLayer;
-    GraphicsLayer* m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
-    GraphicsLayer* m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_ancestorClippingLayer; // only used if we are clipped by an ancestor which is not a stacking context
+    OwnPtr<GraphicsLayer> m_graphicsLayer;
+    OwnPtr<GraphicsLayer> m_foregroundLayer;       // only used in cases where we need to draw the foreground separately
+    OwnPtr<GraphicsLayer> m_clippingLayer;         // only used if we have clipping on a stacking context, with compositing children
+    OwnPtr<GraphicsLayer> m_maskLayer;             // only used if we have a mask
 
     IntRect m_compositedBounds;
 
     bool m_hasDirectlyCompositedContent;
+    bool m_artificiallyInflatedBounds;      // bounds had to be made non-zero to make transform-origin work
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index fb15800..5201287 100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "GraphicsLayer.h"
-#include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLCanvasElement.h"
 #include "Page.h"
 #include "RenderLayerBacking.h"
 #include "RenderVideo.h"
@@ -92,7 +92,6 @@ RenderLayerCompositor::RenderLayerCompositor(RenderView* renderView)
 RenderLayerCompositor::~RenderLayerCompositor()
 {
     ASSERT(!m_rootLayerAttached);
-    delete m_rootPlatformLayer;
 }
 
 void RenderLayerCompositor::enableCompositingMode(bool enable /* = true */)
@@ -287,6 +286,13 @@ IntRect RenderLayerCompositor::calculateCompositedBounds(const RenderLayer* laye
         return boundingBoxRect;
     }
 
+    if (RenderLayer* reflection = layer->reflectionLayer()) {
+        if (!reflection->isComposited()) {
+            IntRect childUnionBounds = calculateCompositedBounds(reflection, layer);
+            unionBounds.unite(childUnionBounds);
+        }
+    }
+    
     ASSERT(layer->isStackingContext() || (!layer->m_posZOrderList || layer->m_posZOrderList->size() == 0));
 
     if (Vector<RenderLayer*>* negZOrderList = layer->negZOrderList()) {
@@ -425,11 +431,11 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
     bool haveComputedBounds = false;
     IntRect absBounds;
-    if (overlapMap && mustOverlapCompositedLayers) {
+    if (overlapMap && !overlapMap->isEmpty()) {
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         haveComputedBounds = true;
-        mustOverlapCompositedLayers &= overlapsCompositedLayers(*overlapMap, absBounds);
+        mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
     }
     
     layer->setMustOverlapCompositedLayers(mustOverlapCompositedLayers);
@@ -503,8 +509,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
-    if (childState.m_subtreeIsCompositing &&
-        (layer->renderer()->hasTransform() || layer->renderer()->style()->opacity() < 1)) {
+    if (childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
         if (overlapMap)
             addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
@@ -530,6 +535,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
 
 void RenderLayerCompositor::setCompositingParent(RenderLayer* childLayer, RenderLayer* parentLayer)
 {
+    ASSERT(!parentLayer || childLayer->ancestorCompositingLayer() == parentLayer);
     ASSERT(childLayer->isComposited());
 
     // It's possible to be called with a parent that isn't yet composited when we're doing
@@ -573,7 +579,7 @@ bool RenderLayerCompositor::canAccelerateVideoRendering(RenderVideo* o) const
 {
     // FIXME: ideally we need to look at all ancestors for mask or video. But for now,
     // just bail on the obvious cases.
-    if (o->hasMask() || o->hasReflection() || !m_hasAcceleratedCompositing)
+    if (o->hasReflection() || !m_hasAcceleratedCompositing)
         return false;
 
     return o->supportsAcceleratedRendering();
@@ -589,8 +595,7 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
     if (layerBacking) {
         // The compositing state of all our children has been updated already, so now
         // we can compute and cache the composited bounds for this layer.
-        layerBacking->setCompositedBounds(calculateCompositedBounds(layer, layer));
-
+        layerBacking->updateCompositedBounds();
         layerBacking->updateGraphicsLayerConfiguration();
         layerBacking->updateGraphicsLayerGeometry();
 
@@ -632,10 +637,10 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, stru
         }
 
         if (updateHierarchy && layerBacking && layerBacking->foregroundLayer()) {
-            // we only have a contents layer if we have an m_layer
             layerBacking->foregroundLayer()->removeFromParent();
-
-            GraphicsLayer* hostingLayer = layerBacking->clippingLayer() ? layerBacking->clippingLayer() : layerBacking->graphicsLayer();
+            
+            // The foreground layer has to be correctly sorted with child layers, so needs to become a child of the clipping layer.
+            GraphicsLayer* hostingLayer = layerBacking->parentForSublayers();
             hostingLayer->addChild(layerBacking->foregroundLayer());
         }
     }
@@ -670,7 +675,7 @@ void RenderLayerCompositor::updateCompositingDescendantGeometry(RenderLayer* com
 {
     if (layer != compositingAncestor) {
         if (RenderLayerBacking* layerBacking = layer->backing()) {
-            layerBacking->setCompositedBounds(calculateCompositedBounds(layer, layer));
+            layerBacking->updateCompositedBounds();
             layerBacking->updateGraphicsLayerGeometry();
             if (updateDepth == RenderLayerBacking::CompositingChildren)
                 return;
@@ -759,7 +764,7 @@ RenderLayer* RenderLayerCompositor::rootRenderLayer() const
 
 GraphicsLayer* RenderLayerCompositor::rootPlatformLayer() const
 {
-    return m_rootPlatformLayer;
+    return m_rootPlatformLayer.get();
 }
 
 void RenderLayerCompositor::didMoveOnscreen()
@@ -772,7 +777,7 @@ void RenderLayerCompositor::didMoveOnscreen()
     if (!page)
         return;
 
-    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer);
+    page->chrome()->client()->attachRootGraphicsLayer(frame, m_rootPlatformLayer.get());
     m_rootLayerAttached = true;
 }
 
@@ -793,7 +798,7 @@ void RenderLayerCompositor::willMoveOffscreen()
 void RenderLayerCompositor::updateRootLayerPosition()
 {
     if (m_rootPlatformLayer)
-        m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+        m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
 }
 
 void RenderLayerCompositor::didStartAcceleratedAnimation()
@@ -821,11 +826,12 @@ bool RenderLayerCompositor::needsToBeComposited(const RenderLayer* layer) const
 // Use needsToBeComposited() to determine if a RL actually needs a compositing layer.
 // static
 bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) const
-{
+{    
     // The root layer always has a compositing layer, but it may not have backing.
     return (inCompositingMode() && layer->isRootLayer()) ||
              requiresCompositingForTransform(layer->renderer()) ||
              requiresCompositingForVideo(layer->renderer()) ||
+             requiresCompositingForCanvas(layer->renderer()) ||
              layer->renderer()->style()->backfaceVisibility() == BackfaceVisibilityHidden ||
              clipsCompositingDescendants(layer) ||
              requiresCompositingForAnimation(layer->renderer());
@@ -862,10 +868,8 @@ bool RenderLayerCompositor::clippedByAncestor(RenderLayer* layer) const
     if (!computeClipRoot || computeClipRoot == layer)
         return false;
 
-    ClipRects parentRects;
-    layer->parentClipRects(computeClipRoot, parentRects, true);
-
-    return parentRects.overflowClipRect() != ClipRects::infiniteRect();
+    IntRect backgroundRect = layer->backgroundClipRect(computeClipRoot, true);
+    return backgroundRect != ClipRects::infiniteRect();
 }
 
 // Return true if the given layer is a stacking context and has compositing child
@@ -897,6 +901,19 @@ bool RenderLayerCompositor::requiresCompositingForVideo(RenderObject* renderer)
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingForCanvas(RenderObject* renderer) const
+{
+#if ENABLE(3D_CANVAS)    
+    if (renderer->isCanvas()) {
+        HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(renderer->node());
+        return canvas->is3D();
+    }
+#else
+    UNUSED_PARAM(renderer);
+#endif
+    return false;
+}
+
 bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* renderer) const
 {
     if (AnimationController* animController = renderer->animation()) {
@@ -906,6 +923,11 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
     return false;
 }
 
+bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(RenderObject* renderer) const
+{
+    return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask();
+}
+
 // If an element has negative z-index children, those children render in front of the 
 // layer background, so we need an extra 'contents' layer for the foreground of the layer
 // object.
@@ -919,8 +941,8 @@ void RenderLayerCompositor::ensureRootPlatformLayer()
     if (m_rootPlatformLayer)
         return;
 
-    m_rootPlatformLayer = GraphicsLayer::createGraphicsLayer(0);
-    m_rootPlatformLayer->setSize(FloatSize(m_renderView->overflowWidth(), m_renderView->overflowHeight()));
+    m_rootPlatformLayer = GraphicsLayer::create(0);
+    m_rootPlatformLayer->setSize(FloatSize(m_renderView->rightLayoutOverflow(), m_renderView->bottomLayoutOverflow()));
     m_rootPlatformLayer->setPosition(FloatPoint(0, 0));
     // The root layer does flipping if we need it on this platform.
     m_rootPlatformLayer->setGeometryOrientation(GraphicsLayer::compositingCoordinatesOrientation());
@@ -937,7 +959,6 @@ void RenderLayerCompositor::destroyRootPlatformLayer()
         return;
 
     willMoveOffscreen();
-    delete m_rootPlatformLayer;
     m_rootPlatformLayer = 0;
 }
 
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index 02929dc..a809a70 100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
@@ -164,10 +164,12 @@ private:
     bool requiresCompositingForAnimation(RenderObject*) const;
     bool requiresCompositingForTransform(RenderObject*) const;
     bool requiresCompositingForVideo(RenderObject*) const;
+    bool requiresCompositingForCanvas(RenderObject*) const;
+    bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
 
 private:
     RenderView* m_renderView;
-    GraphicsLayer* m_rootPlatformLayer;
+    OwnPtr<GraphicsLayer> m_rootPlatformLayer;
     bool m_hasAcceleratedCompositing;
     bool m_compositingConsultsOverlap;
     bool m_compositing;
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 00566b8..76a2e2f 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -162,8 +162,8 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
     // intersect.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    int yPos = firstLineBox()->root()->topOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
-    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->root()->bottomOverflow() - yPos;
+    int yPos = firstLineBox()->topVisibleOverflow() - renderer->maximalOutlineSize(paintInfo.phase);
+    int h = renderer->maximalOutlineSize(paintInfo.phase) + lastLineBox()->bottomVisibleOverflow() - yPos;
     yPos += ty;
     if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
         return;
@@ -184,19 +184,19 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
             // The whole way objects break across pages needs to be redone.
             // Try to avoid splitting a line vertically, but only if it's less than the height
             // of the entire page.
-            if (curr->root()->bottomOverflow() - curr->root()->topOverflow() <= v->printRect().height()) {
-                if (ty + curr->root()->bottomOverflow() > v->printRect().bottom()) {
-                    if (ty + curr->root()->topOverflow() < v->truncatedAt())
-                        v->setBestTruncatedAt(ty + curr->root()->topOverflow(), renderer);
+            if (curr->bottomVisibleOverflow() - curr->topVisibleOverflow() <= v->printRect().height()) {
+                if (ty + curr->bottomVisibleOverflow() > v->printRect().bottom()) {
+                    if (ty + curr->topVisibleOverflow() < v->truncatedAt())
+                        v->setBestTruncatedAt(ty + curr->root()->topVisibleOverflow(), renderer);
                     // If we were able to truncate, don't paint.
-                    if (ty + curr->root()->topOverflow() >= v->truncatedAt())
+                    if (ty + curr->topVisibleOverflow() >= v->truncatedAt())
                         break;
                 }
             }
         }
 
-        int top = min(curr->root()->topOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
-        int bottom = curr->root()->bottomOverflow() + renderer->maximalOutlineSize(info.phase);
+        int top = min(curr->topVisibleOverflow(), curr->root()->selectionTop()) - renderer->maximalOutlineSize(info.phase);
+        int bottom = curr->bottomVisibleOverflow() + renderer->maximalOutlineSize(info.phase);
         h = bottom - top;
         yPos = ty + top;
         if (yPos < info.rect.bottom() && yPos + h > info.rect.y())
@@ -229,14 +229,14 @@ bool RenderLineBoxList::hitTest(RenderBoxModelObject* renderer, const HitTestReq
     // contain the point.  This is a quick short-circuit that we can take to avoid walking any lines.
     // FIXME: This check is flawed in the following extremely obscure way:
     // if some line in the middle has a huge overflow, it might actually extend below the last line.
-    if ((y >= ty + lastLineBox()->root()->bottomOverflow()) || (y < ty + firstLineBox()->root()->topOverflow()))
+    if ((y >= ty + lastLineBox()->root()->bottomVisibleOverflow()) || (y < ty + firstLineBox()->root()->topVisibleOverflow()))
         return false;
 
     // See if our root lines contain the point.  If so, then we hit test
     // them further.  Note that boxes can easily overlap, so we can't make any assumptions
     // based off positions of our first line box or our last line box.
     for (InlineFlowBox* curr = lastLineBox(); curr; curr = curr->prevFlowBox()) {
-        if (y >= ty + curr->root()->topOverflow() && y < ty + curr->root()->bottomOverflow()) {
+        if (y >= ty + curr->root()->topVisibleOverflow() && y < ty + curr->root()->bottomVisibleOverflow()) {
             bool inside = curr->nodeAtPoint(request, result, x, y, tx, ty);
             if (inside) {
                 renderer->updateHitTestResult(result, IntPoint(x - tx, y - ty));
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index e6c28f7..0edfdef 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -508,7 +508,7 @@ bool RenderListBox::listIndexIsVisible(int index)
     return index >= m_indexOffset && index < m_indexOffset + numVisibleItems();
 }
 
-bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderListBox::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node**)
 {
     return m_vBar && m_vBar->scroll(direction, granularity, multiplier);
 }
@@ -527,8 +527,7 @@ void RenderListBox::valueChanged(Scrollbar*)
     if (newOffset != m_indexOffset) {
         m_indexOffset = newOffset;
         repaint();
-        // Fire the scroll DOM event.
-        node()->dispatchEvent(eventNames().scrollEvent, false, false);
+        node()->dispatchEvent(Event::create(eventNames().scrollEvent, false, false));
     }
 }
 
diff --git a/WebCore/rendering/RenderListBox.h b/WebCore/rendering/RenderListBox.h
index e5454e5..aafb87e 100644
--- a/WebCore/rendering/RenderListBox.h
+++ b/WebCore/rendering/RenderListBox.h
@@ -68,7 +68,7 @@ private:
 
     virtual bool isPointInOverflowControl(HitTestResult&, int x, int y, int tx, int ty);
 
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     virtual void calcPrefWidths();
     virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index 374ef66..e487c60 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -247,21 +247,30 @@ void RenderListItem::positionListMarker()
         int markerXPos;
         RootInlineBox* root = m_marker->inlineBoxWrapper()->root();
 
+        // FIXME: Inline flows in the line box hierarchy that have self-painting layers should act as cutoff points
+        // and really shouldn't keep propagating overflow up.  This won't really break anything other than repainting
+        // not being as tight as it could be though.
         if (style()->direction() == LTR) {
             int leftLineOffset = leftRelOffset(yOffset, leftOffset(yOffset, false), false);
             markerXPos = leftLineOffset - xOffset - paddingLeft() - borderLeft() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos < root->leftOverflow()) {
-                root->setHorizontalOverflowPositions(markerXPos, root->rightOverflow());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos < box->leftLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(markerXPos, box->rightLayoutOverflow(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         } else {
             int rightLineOffset = rightRelOffset(yOffset, rightOffset(yOffset, false), false);
             markerXPos = rightLineOffset - xOffset + paddingRight() + borderRight() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
-            if (markerXPos + m_marker->width() > root->rightOverflow()) {
-                root->setHorizontalOverflowPositions(root->leftOverflow(), markerXPos + m_marker->width());
-                adjustOverflow = true;
+            for (InlineFlowBox* box = m_marker->inlineBoxWrapper()->parent(); box; box = box->parent()) {
+                if (markerXPos + m_marker->width() > box->rightLayoutOverflow()) {
+                    box->setHorizontalOverflowPositions(box->leftLayoutOverflow(), markerXPos + m_marker->width(), box->leftVisualOverflow(), box->rightVisualOverflow());
+                    if (box == root)
+                        adjustOverflow = true;
+                }
             }
         }
 
@@ -271,9 +280,9 @@ void RenderListItem::positionListMarker()
             do {
                 o = o->parentBox();
                 if (o->isRenderBlock())
-                    toRenderBlock(o)->addVisualOverflow(markerRect);
+                    toRenderBlock(o)->addLayoutOverflow(markerRect);
                 markerRect.move(-o->x(), -o->y());
-            } while (o != this);
+            } while (o != this && !o->hasSelfPaintingLayer());
         }
     }
 }
diff --git a/WebCore/rendering/RenderListItem.h b/WebCore/rendering/RenderListItem.h
index 21544f9..c4c41dc 100644
--- a/WebCore/rendering/RenderListItem.h
+++ b/WebCore/rendering/RenderListItem.h
@@ -44,6 +44,8 @@ public:
     void setNotInList(bool notInList) { m_notInList = notInList; }
     bool notInList() const { return m_notInList; }
 
+    const String& markerText() const;
+
 private:
     virtual const char* renderName() const { return "RenderListItem"; }
 
@@ -59,8 +61,6 @@ private:
 
     virtual void positionListMarker();
 
-    const String& markerText() const;
-
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     void updateMarkerLocation();
diff --git a/WebCore/rendering/RenderMarquee.cpp b/WebCore/rendering/RenderMarquee.cpp
index 31a8305..bb917f8 100644
--- a/WebCore/rendering/RenderMarquee.cpp
+++ b/WebCore/rendering/RenderMarquee.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Portions are Copyright (C) 1998 Netscape Communications Corporation.
  *
@@ -152,7 +153,11 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
 
 void RenderMarquee::start()
 {
-    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero())
+    if (m_timer.isActive() || m_layer->renderer()->style()->marqueeIncrement().isZero()
+#if ENABLE(WCSS) && ENABLE(XHTMLMP)
+        || (m_layer->renderer()->document()->isXHTMLMPDocument() && !m_layer->renderer()->style()->marqueeLoopCount())
+#endif
+       )
         return;
 
     // We may end up propagating a scroll event. It is important that we suspend events until 
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index b87e99d..1da2628 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -33,6 +33,7 @@
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
+#include "RenderTheme.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
@@ -132,6 +133,10 @@ void RenderMedia::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
             m_currentTimeDisplay->updateStyle();
         if (m_timeRemainingDisplay)
             m_timeRemainingDisplay->updateStyle();
+        if (m_volumeSliderContainer)
+            m_volumeSliderContainer->updateStyle();
+        if (m_volumeSlider)
+            m_volumeSlider->updateStyle();
     }
 }
 
@@ -240,6 +245,22 @@ void RenderMedia::createTimeline()
     m_timeline->attachToParent(m_timelineContainer.get());
 }
 
+void RenderMedia::createVolumeSliderContainer()
+{
+    ASSERT(!m_volumeSliderContainer);
+    m_volumeSliderContainer = new MediaControlVolumeSliderContainerElement(document(), mediaElement());
+    m_volumeSliderContainer->attachToParent(m_panel.get());
+}
+
+void RenderMedia::createVolumeSlider()
+{
+    ASSERT(!m_volumeSlider);
+    m_volumeSlider = new MediaControlVolumeSliderElement(document(), mediaElement());
+    m_volumeSlider->setAttribute(precisionAttr, "float");
+    m_volumeSlider->setAttribute(maxAttr, "1");
+    m_volumeSlider->attachToParent(m_volumeSliderContainer.get());
+}
+
 void RenderMedia::createCurrentTimeDisplay()
 {
     ASSERT(!m_currentTimeDisplay);
@@ -285,6 +306,8 @@ void RenderMedia::updateControls()
             m_currentTimeDisplay = 0;
             m_timeRemainingDisplay = 0;
             m_fullscreenButton = 0;
+            m_volumeSliderContainer = 0;
+            m_volumeSlider = 0;
             m_controlsShadowRoot = 0;
         }
         m_opacityAnimationTo = 1.0f;
@@ -298,19 +321,22 @@ void RenderMedia::updateControls()
         createPanel();
         if (m_panel) {
             createRewindButton();
-            createMuteButton();
             createPlayButton();
             createReturnToRealtimeButton();
             createStatusDisplay();
             createTimelineContainer();
-            createSeekBackButton();
-            createSeekForwardButton();
-            createFullscreenButton();
             if (m_timelineContainer) {
                 createCurrentTimeDisplay();
                 createTimeline();
                 createTimeRemainingDisplay();
             }
+            createSeekBackButton();
+            createSeekForwardButton();
+            createFullscreenButton();
+            createMuteButton();
+            createVolumeSliderContainer();
+            if (m_volumeSliderContainer)
+                createVolumeSlider();
             m_panel->attach();
         }
     }
@@ -336,6 +362,8 @@ void RenderMedia::updateControls()
         m_playButton->update();
     if (m_timelineContainer)
         m_timelineContainer->update();
+    if (m_volumeSliderContainer)
+        m_volumeSliderContainer->update();
     if (m_timeline)
         m_timeline->update();
     if (m_currentTimeDisplay)
@@ -354,6 +382,8 @@ void RenderMedia::updateControls()
         m_statusDisplay->update();
     if (m_fullscreenButton)
         m_fullscreenButton->update();
+    if (m_volumeSlider)
+        m_volumeSlider->update();
 
     updateTimeDisplay();
     updateControlVisibility();
@@ -366,24 +396,6 @@ void RenderMedia::timeUpdateTimerFired(Timer<RenderMedia>*)
     updateTimeDisplay();
 }
     
-String RenderMedia::formatTime(float time)
-{
-    if (!isfinite(time))
-        time = 0;
-    int seconds = (int)fabsf(time); 
-    int hours = seconds / (60 * 60);
-    int minutes = (seconds / 60) % 60;
-    seconds %= 60;
-    if (hours) {
-        if (hours > 9)
-            return String::format("%s%02d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-        else
-            return String::format("%s%01d:%02d:%02d", (time < 0 ? "-" : ""), hours, minutes, seconds);
-    }
-    else
-        return String::format("%s%02d:%02d", (time < 0 ? "-" : ""), minutes, seconds);
-}
-
 void RenderMedia::updateTimeDisplay()
 {
     if (!m_currentTimeDisplay || !m_currentTimeDisplay->renderer() || m_currentTimeDisplay->renderer()->style()->display() == NONE || style()->visibility() != VISIBLE)
@@ -391,12 +403,8 @@ void RenderMedia::updateTimeDisplay()
     float now = mediaElement()->currentTime();
     float duration = mediaElement()->duration();
 
-    String timeString = formatTime(now);
-    ExceptionCode ec;
-    m_currentTimeDisplay->setInnerText(timeString, ec);
-    
-    timeString = formatTime(now - duration);
-    m_timeRemainingDisplay->setInnerText(timeString, ec);
+    m_currentTimeDisplay->setCurrentValue(now);
+    m_timeRemainingDisplay->setCurrentValue(now - duration);
 }
 
 void RenderMedia::updateControlVisibility() 
@@ -463,13 +471,53 @@ void RenderMedia::opacityAnimationTimerFired(Timer<RenderMedia>*)
     changeOpacity(m_panel.get(), opacity);
 }
 
+void RenderMedia::updateVolumeSliderContainer(bool visible)
+{
+    if (!mediaElement()->hasAudio() || !m_volumeSliderContainer || !m_volumeSlider)
+        return;
+
+    if (visible && !m_volumeSliderContainer->isVisible()) {
+        if (!m_muteButton || !m_muteButton->renderer() || !m_muteButton->renderBox())
+            return;
+
+        RefPtr<RenderStyle> s = m_volumeSliderContainer->styleForElement();
+        int height = s->height().isPercent() ? 0 : s->height().value();
+        int x = m_muteButton->renderBox()->offsetLeft();
+        int y = m_muteButton->renderBox()->offsetTop() - height;
+        FloatPoint absPoint = m_muteButton->renderer()->localToAbsolute(FloatPoint(x, y), true, true);
+        if (absPoint.y() < 0)
+            y = m_muteButton->renderBox()->offsetTop() + m_muteButton->renderBox()->height();
+        m_volumeSliderContainer->setVisible(true);
+        m_volumeSliderContainer->setPosition(x, y);
+        m_volumeSliderContainer->update();
+        m_volumeSlider->update();
+    } else if (!visible && m_volumeSliderContainer->isVisible()) {
+        m_volumeSliderContainer->setVisible(false);
+        m_volumeSliderContainer->updateStyle();
+    }
+}
+
 void RenderMedia::forwardEvent(Event* event)
 {
     if (event->isMouseEvent() && m_controlsShadowRoot) {
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         IntPoint point(mouseEvent->absoluteLocation());
-        if (m_muteButton && m_muteButton->hitTest(point))
+        bool showVolumeSlider = false;
+        if (m_muteButton && m_muteButton->hitTest(point)) {
             m_muteButton->defaultEventHandler(event);
+            if (event->type() != eventNames().mouseoutEvent)
+                showVolumeSlider = true;
+        }
+
+        if (m_volumeSliderContainer && m_volumeSliderContainer->hitTest(point))
+            showVolumeSlider = true;
+
+        if (m_volumeSlider && m_volumeSlider->hitTest(point)) {
+            m_volumeSlider->defaultEventHandler(event);
+            showVolumeSlider = true;
+        }
+
+        updateVolumeSliderContainer(showVolumeSlider);
 
         if (m_playButton && m_playButton->hitTest(point))
             m_playButton->defaultEventHandler(event);
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 5697bda..602cd26 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -41,10 +41,12 @@ class MediaControlSeekButtonElement;
 class MediaControlRewindButtonElement;
 class MediaControlReturnToRealtimeButtonElement;
 class MediaControlTimelineElement;
+class MediaControlVolumeSliderElement;
 class MediaControlFullscreenButtonElement;
 class MediaControlTimeDisplayElement;
 class MediaControlStatusDisplayElement;
 class MediaControlTimelineContainerElement;
+class MediaControlVolumeSliderContainerElement;
 class MediaControlElement;
 class MediaPlayer;
 
@@ -60,8 +62,6 @@ public:
     HTMLMediaElement* mediaElement() const;
     MediaPlayer* player() const;
 
-    static String formatTime(float time);
-
     bool shouldShowTimeDisplayControls() const;
 
     void updateFromElement();
@@ -99,6 +99,8 @@ private:
     void createStatusDisplay();
     void createTimelineContainer();
     void createTimeline();
+    void createVolumeSliderContainer();
+    void createVolumeSlider();
     void createCurrentTimeDisplay();
     void createTimeRemainingDisplay();
     void createFullscreenButton();
@@ -109,6 +111,8 @@ private:
     void changeOpacity(HTMLElement*, float opacity);
     void opacityAnimationTimerFired(Timer<RenderMedia>*);
 
+    void updateVolumeSliderContainer(bool visible);
+
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
     RefPtr<HTMLElement> m_controlsShadowRoot;
@@ -120,8 +124,10 @@ private:
     RefPtr<MediaControlRewindButtonElement> m_rewindButton;
     RefPtr<MediaControlReturnToRealtimeButtonElement> m_returnToRealtimeButton;
     RefPtr<MediaControlTimelineElement> m_timeline;
+    RefPtr<MediaControlVolumeSliderElement> m_volumeSlider;
     RefPtr<MediaControlFullscreenButtonElement> m_fullscreenButton;
     RefPtr<MediaControlTimelineContainerElement> m_timelineContainer;
+    RefPtr<MediaControlVolumeSliderContainerElement> m_volumeSliderContainer;
     RefPtr<MediaControlTimeDisplayElement> m_currentTimeDisplay;
     RefPtr<MediaControlTimeDisplayElement> m_timeRemainingDisplay;
     RefPtr<MediaControlStatusDisplayElement> m_statusDisplay;
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 06d901a..4303aaa 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -82,16 +82,6 @@ void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
     o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
 }
 
-static HTMLMediaElement* parentMediaElement(RenderObject* o)
-{
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
-
-    return static_cast<HTMLMediaElement*>(mediaNode);
-}
-
 bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
@@ -110,8 +100,8 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaPauseButton:
         case MediaPlayButton:
             if (MediaControlPlayButtonElement* btn = static_cast<MediaControlPlayButtonElement*>(o->node())) {
-                bool currentlyPlaying = btn->displayType() == MediaPlayButton;
-                paintThemePart(currentlyPlaying ? SafariTheme::MediaPauseButtonPart : SafariTheme::MediaPlayButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
+                bool canPlay = btn->displayType() == MediaPlayButton;
+                paintThemePart(canPlay ? SafariTheme::MediaPlayButtonPart : SafariTheme::MediaPauseButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             }
             break;
         case MediaSeekBackButton:
@@ -121,13 +111,25 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
             paintThemePart(SafariTheme::MediaSeekForwardButtonPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
         case MediaSlider: {
-            if (HTMLMediaElement* mediaElement = parentMediaElement(o))
+            if (HTMLMediaElement* mediaElement = toParentMediaElement(o))
                 STPaintProgressIndicator(SafariTheme::MediaType, paintInfo.context->platformContext(), r, NSRegularControlSize, 0, mediaElement->percentLoaded());
             break;
         }
         case MediaSliderThumb:
             paintThemePart(SafariTheme::MediaSliderThumbPart, paintInfo.context->platformContext(), r, NSRegularControlSize, determineState(o));
             break;
+        case MediaVolumeSliderContainer:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSlider:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
+        case MediaVolumeSliderThumb:
+            // FIXME: Implement volume slider.
+            ASSERT_NOT_REACHED();
+            break;
         case MediaTimelineContainer:
             ASSERT_NOT_REACHED();
             break;
@@ -147,4 +149,3 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
 #endif  // #if ENABLE(VIDEO)
 
 } // namespace WebCore
-
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
new file mode 100644
index 0000000..bba2fa2
--- /dev/null
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -0,0 +1,289 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderMediaControlsChromium.h"
+
+#include "Gradient.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+
+namespace WebCore {
+
+#if ENABLE(VIDEO)
+
+typedef WTF::HashMap<const char*, Image*> MediaControlImageMap;
+static MediaControlImageMap* gMediaControlImageMap = 0;
+
+static Image* platformResource(const char* name)
+{
+    if (!gMediaControlImageMap)
+        gMediaControlImageMap = new MediaControlImageMap();
+    if (Image* image = gMediaControlImageMap->get(name))
+        return image;
+    if (Image* image = Image::loadPlatformResource(name).releaseRef()) {
+        gMediaControlImageMap->set(name, image);
+        return image;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
+{
+    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
+    IntRect imageRect = image->rect();
+    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
+    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
+
+    context->drawImage(image, imageRect);
+    return true;
+}
+
+static bool paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+      return false;
+
+    static Image* soundFull = platformResource("mediaSoundFull");
+    static Image* soundNone = platformResource("mediaSoundNone");
+    static Image* soundDisabled = platformResource("mediaSoundDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE || !mediaElement->hasAudio())
+        return paintMediaButton(paintInfo.context, rect, soundDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+}
+
+static bool paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    static Image* mediaPlay = platformResource("mediaPlay");
+    static Image* mediaPause = platformResource("mediaPause");
+    static Image* mediaPlayDisabled = platformResource("mediaPlayDisabled");
+
+    if (mediaElement->networkState() == HTMLMediaElement::NETWORK_NO_SOURCE)
+        return paintMediaButton(paintInfo.context, rect, mediaPlayDisabled);
+
+    return paintMediaButton(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+}
+
+static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    RenderStyle* style = object->style();
+    GraphicsContext* context = paintInfo.context;
+
+    // Draw the border of the time bar.
+    // FIXME: this should be a rounded rect but need to fix GraphicsContextSkia first.
+    // https://bugs.webkit.org/show_bug.cgi?id=30143
+    context->save();
+    context->setStrokeStyle(SolidStroke);
+    context->setStrokeColor(style->borderLeftColor());
+    context->setStrokeThickness(style->borderLeftWidth());
+    context->setFillColor(style->backgroundColor());
+    context->drawRect(rect);
+    context->restore();
+
+    // Draw the buffered ranges.
+    // FIXME: Draw multiple ranges if there are multiple buffered ranges.
+    // FIXME: percentLoaded() doesn't always hit 1.0 so we're using round().
+    IntRect bufferedRect = rect;
+    bufferedRect.inflate(-style->borderLeftWidth());
+    bufferedRect.setWidth(round((bufferedRect.width() * mediaElement->percentLoaded())));
+
+    // Don't bother drawing an empty area.
+    if (!bufferedRect.isEmpty()) {
+        IntPoint sliderTopLeft = bufferedRect.location();
+        IntPoint sliderTopRight = sliderTopLeft;
+        sliderTopRight.move(0, bufferedRect.height());
+
+        RefPtr<Gradient> gradient = Gradient::create(sliderTopLeft, sliderTopRight);
+        Color startColor = object->style()->color();
+        gradient->addColorStop(0.0, startColor);
+        gradient->addColorStop(1.0, Color(startColor.red() / 2, startColor.green() / 2, startColor.blue() / 2, startColor.alpha()));
+
+        context->save();
+        context->setStrokeStyle(NoStroke);
+        context->setFillGradient(gradient);
+        context->drawRect(bufferedRect);
+        context->restore();
+    }
+
+    return true;
+}
+
+static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
+}
+
+static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    GraphicsContext* context = paintInfo.context;
+    Color originalColor = context->strokeColor();
+    if (originalColor != Color::white)
+        context->setStrokeColor(Color::white);
+
+    int x = rect.x() + rect.width() / 2;
+    context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
+
+    if (originalColor != Color::white)
+        context->setStrokeColor(originalColor);
+    return true;
+}
+
+static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!object->parent()->isSlider())
+        return false;
+
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+    return paintMediaButton(paintInfo.context, rect, mediaVolumeSliderThumb);
+}
+
+static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    if (!rect.isEmpty()) {
+        GraphicsContext* context = paintInfo.context;
+        Color originalColor = context->strokeColor();
+        float originalThickness = context->strokeThickness();
+        StrokeStyle originalStyle = context->strokeStyle();
+
+        context->setStrokeStyle(SolidStroke);
+
+        // Draw the left border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderLeftWidth());
+        context->setStrokeColor(object->style()->borderLeftColor().rgb());
+        context->drawLine(IntPoint(rect.x() + 1, rect.y()),
+                          IntPoint(rect.x() + 1, rect.y() + rect.height()));
+
+        // Draw the right border using CSS defined width and color.
+        context->setStrokeThickness(object->style()->borderRightWidth());
+        context->setStrokeColor(object->style()->borderRightColor().rgb());
+        context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
+                          IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
+
+        context->setStrokeColor(originalColor);
+        context->setStrokeThickness(originalThickness);
+        context->setStrokeStyle(originalStyle);
+    }
+    return true;
+}
+
+bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    UNUSED_PARAM(e);
+
+    switch (part) {
+    case MediaMuteButtonPart:
+    case MediaPlayButtonPart:
+    case MediaSliderPart:
+    case MediaSliderThumbPart:
+    case MediaVolumeSliderContainerPart:
+    case MediaVolumeSliderPart:
+    case MediaVolumeSliderThumbPart:
+    case MediaControlsBackgroundPart:
+    case MediaCurrentTimePart:
+    case MediaTimeRemainingPart:
+        return true;
+    }
+    return false;
+}
+
+bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+    switch (part) {
+    case MediaMuteButton:
+    case MediaUnMuteButton:
+        return paintMediaMuteButton(object, paintInfo, rect);
+    case MediaPauseButton:
+    case MediaPlayButton:
+        return paintMediaPlayButton(object, paintInfo, rect);
+    case MediaSlider:
+        return paintMediaSlider(object, paintInfo, rect);
+    case MediaSliderThumb:
+        return paintMediaSliderThumb(object, paintInfo, rect);
+    case MediaVolumeSlider:
+        return paintMediaVolumeSlider(object, paintInfo, rect);
+    case MediaVolumeSliderThumb:
+        return paintMediaVolumeSliderThumb(object, paintInfo, rect);
+    case MediaTimelineContainer:
+        return paintMediaTimelineContainer(object, paintInfo, rect);
+    case MediaFullscreenButton:
+    case MediaSeekBackButton:
+    case MediaSeekForwardButton:
+    case MediaVolumeSliderContainer:
+    case MediaCurrentTimeDisplay:
+    case MediaTimeRemainingDisplay:
+    case MediaControlsPanel:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+    return false;
+}
+
+void RenderMediaControlsChromium::adjustMediaSliderThumbSize(RenderObject* object)
+{
+    static Image* mediaSliderThumb = platformResource("mediaSliderThumb");
+    static Image* mediaVolumeSliderThumb = platformResource("mediaVolumeSliderThumb");
+
+    Image* thumbImage = 0;
+    if (object->style()->appearance() == MediaSliderThumbPart)
+        thumbImage = mediaSliderThumb;
+    else if (object->style()->appearance() == MediaVolumeSliderThumbPart)
+        thumbImage = mediaVolumeSliderThumb;
+
+    if (thumbImage) {
+        object->style()->setWidth(Length(thumbImage->width(), Fixed));
+        object->style()->setHeight(Length(thumbImage->height(), Fixed));
+    }
+}
+
+#endif  // #if ENABLE(VIDEO)
+
+} // namespace WebCore
diff --git a/WebCore/rendering/RenderMediaControlsChromium.h b/WebCore/rendering/RenderMediaControlsChromium.h
new file mode 100644
index 0000000..d6d986c
--- /dev/null
+++ b/WebCore/rendering/RenderMediaControlsChromium.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc.
+ * Copyright (C) 2009 Google Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderMediaControlsChromium_h
+#define RenderMediaControlsChromium_h
+
+#include "RenderObject.h"
+#include "MediaControlElements.h"
+
+namespace WebCore {
+
+class HTMLMediaElement;
+class RenderMediaControlsChromium {
+public:
+    static bool shouldRenderMediaControlPart(ControlPart, Element*);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static void adjustMediaSliderThumbSize(RenderObject*);
+};
+
+} // namespace WebCore
+
+#endif // RenderMediaControlsChromium_h
diff --git a/WebCore/rendering/RenderMenuList.cpp b/WebCore/rendering/RenderMenuList.cpp
index 9d2e7e0..cbbc7cb 100644
--- a/WebCore/rendering/RenderMenuList.cpp
+++ b/WebCore/rendering/RenderMenuList.cpp
@@ -292,7 +292,6 @@ void RenderMenuList::hidePopup()
 {
     if (m_popup)
         m_popup->hide();
-    m_popupIsVisible = false;
 }
 
 void RenderMenuList::valueChanged(unsigned listIndex, bool fireOnChange)
@@ -428,6 +427,11 @@ int RenderMenuList::selectedIndex() const
     return select->optionToListIndex(select->selectedIndex());
 }
 
+void RenderMenuList::popupDidHide()
+{
+    m_popupIsVisible = false;
+}
+
 bool RenderMenuList::itemIsSeparator(unsigned listIndex) const
 {
     SelectElement* select = toSelectElement(static_cast<Element*>(node()));
diff --git a/WebCore/rendering/RenderMenuList.h b/WebCore/rendering/RenderMenuList.h
index 5c18e9e..2d617c1 100644
--- a/WebCore/rendering/RenderMenuList.h
+++ b/WebCore/rendering/RenderMenuList.h
@@ -82,6 +82,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 5137338..d83e4d0 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -46,6 +47,7 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "TransformState.h"
+#include "htmlediting.h"
 #include <algorithm>
 #ifdef ANDROID_LAYOUT
 #include "Settings.h"
@@ -145,6 +147,12 @@ RenderObject* RenderObject::createObject(Node* node, RenderStyle* style)
             o = new (arena) RenderTableCell(node);
             break;
         case TABLE_CAPTION:
+#if ENABLE(WCSS)
+        // As per the section 17.1 of the spec WAP-239-WCSS-20011026-a.pdf, 
+        // the marquee box inherits and extends the characteristics of the 
+        // principal block box ([CSS2] section 9.2.1).
+        case WAP_MARQUEE:
+#endif
             o = new (arena) RenderBlock(node);
             break;
         case BOX:
@@ -200,7 +208,6 @@ RenderObject::RenderObject(Node* node)
     , m_selectionState(SelectionNone)
     , m_hasColumns(false)
     , m_cellWidthChanged(false)
-    , m_replacedHasOverflow(false)
 {
 #ifndef NDEBUG
     renderObjectCounter.increment();
@@ -621,6 +628,11 @@ RenderBlock* RenderObject::containingBlock() const
             // inline directly.
             if (o->style()->position() == RelativePosition && o->isInline() && !o->isReplaced())
                 return o->containingBlock();
+#if ENABLE(SVG)
+            if (o->isSVGForeignObject()) //foreignObject is the containing block for contents inside it
+                break;
+#endif
+
             o = o->parent();
         }
     } else {
@@ -653,10 +665,10 @@ static bool mustRepaintFillLayers(const RenderObject* renderer, const FillLayer*
     if (!layer->xPosition().isZero() || !layer->yPosition().isZero())
         return true;
 
-    if (layer->isSizeSet()) {
-        if (layer->size().width().isPercent() || layer->size().height().isPercent())
+    if (layer->size().type == SizeLength) {
+        if (layer->size().size.width().isPercent() || layer->size().size.height().isPercent())
             return true;
-    } else if (img->usesImageContainerSize())
+    } else if (layer->size().type == Contain || layer->size().type == Cover || img->usesImageContainerSize())
         return true;
 
     return false;
@@ -1365,6 +1377,7 @@ Color RenderObject::selectionForegroundColor() const
     return color;
 }
 
+#if ENABLE(DRAG_SUPPORT)
 Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const
 {
     if (!dhtmlOK && !uaOK)
@@ -1399,6 +1412,7 @@ Node* RenderObject::draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& d
     }
     return 0;
 }
+#endif // ENABLE(DRAG_SUPPORT)
 
 void RenderObject::selectionStartEnd(int& spos, int& epos) const
 {
@@ -1612,15 +1626,20 @@ void RenderObject::styleDidChange(StyleDifference diff, const RenderStyle*)
 
 void RenderObject::updateFillImages(const FillLayer* oldLayers, const FillLayer* newLayers)
 {
-    // FIXME: This will be slow when a large number of images is used.  Fix by using a dict.
-    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
-        if (currOld->image() && (!newLayers || !newLayers->containsImage(currOld->image())))
-            currOld->image()->removeClient(this);
-    }
+    // Optimize the common case
+    if (oldLayers && !oldLayers->next() && newLayers && !newLayers->next() && (oldLayers->image() == newLayers->image()))
+        return;
+    
+    // Go through the new layers and addClients first, to avoid removing all clients of an image.
     for (const FillLayer* currNew = newLayers; currNew; currNew = currNew->next()) {
-        if (currNew->image() && (!oldLayers || !oldLayers->containsImage(currNew->image())))
+        if (currNew->image())
             currNew->image()->addClient(this);
     }
+
+    for (const FillLayer* currOld = oldLayers; currOld; currOld = currOld->next()) {
+        if (currOld->image())
+            currOld->image()->removeClient(this);
+    }
 }
 
 void RenderObject::updateImage(StyleImage* oldImage, StyleImage* newImage)
@@ -1739,6 +1758,23 @@ IntSize RenderObject::offsetFromContainer(RenderObject* o) const
     return offset;
 }
 
+IntSize RenderObject::offsetFromAncestorContainer(RenderObject* container) const
+{
+    IntSize offset;
+    const RenderObject* currContainer = this;
+    do {
+        RenderObject* nextContainer = currContainer->container();
+        ASSERT(nextContainer);  // This means we reached the top without finding container.
+        if (!nextContainer)
+            break;
+        ASSERT(!currContainer->hasTransform());
+        offset += currContainer->offsetFromContainer(nextContainer);
+        currContainer = nextContainer;
+    } while (currContainer != container);
+
+    return offset;
+}
+
 IntRect RenderObject::localCaretRect(InlineBox*, int, int* extraWidthToEndOfLine)
 {
     if (extraWidthToEndOfLine)
@@ -1772,8 +1808,11 @@ bool RenderObject::hasOutlineAnnotation() const
     return node() && node()->isLink() && document()->printing();
 }
 
-RenderObject* RenderObject::container() const
+RenderObject* RenderObject::container(RenderBoxModelObject* repaintContainer, bool* repaintContainerSkipped) const
 {
+    if (repaintContainerSkipped)
+        *repaintContainerSkipped = false;
+
     // This method is extremely similar to containingBlock(), but with a few notable
     // exceptions.
     // (1) It can be used on orphaned subtrees, i.e., it can be called safely even when
@@ -1798,14 +1837,20 @@ RenderObject* RenderObject::container() const
         // we'll just return 0).
         // FIXME: The definition of view() has changed to not crawl up the render tree.  It might
         // be safe now to use it.
-        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock()))
+        while (o && o->parent() && !(o->hasTransform() && o->isRenderBlock())) {
+            if (repaintContainerSkipped && o == repaintContainer)
+                *repaintContainerSkipped = true;
             o = o->parent();
+        }
     } else if (pos == AbsolutePosition) {
         // Same goes here.  We technically just want our containing block, but
         // we may not have one if we're part of an uninstalled subtree.  We'll
         // climb as high as we can though.
-        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock()))
+        while (o && o->style()->position() == StaticPosition && !o->isRenderView() && !(o->hasTransform() && o->isRenderBlock())) {
+            if (repaintContainerSkipped && o == repaintContainer)
+                *repaintContainerSkipped = true;
             o = o->parent();
+        }
     }
 
     return o;
@@ -1825,7 +1870,12 @@ void RenderObject::destroy()
         children->destroyLeftoverChildren();
 
     // If this renderer is being autoscrolled, stop the autoscroll timer
-    if (document()->frame()->eventHandler()->autoscrollRenderer() == this)
+    
+    // FIXME: RenderObject::destroy should not get called with a renderar whose document
+    // has a null frame, so we assert this. However, we don't want release builds to crash which is why we
+    // check that the frame is not null.
+    ASSERT(document()->frame());
+    if (document()->frame() && document()->frame()->eventHandler()->autoscrollRenderer() == this)
         document()->frame()->eventHandler()->stopAutoscrollTimer(true);
 
     if (m_hasCounterNodeMap)
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index 911169d..e358c98 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -278,6 +278,7 @@ public:
     virtual bool isTextField() const { return false; }
     virtual bool isVideo() const { return false; }
     virtual bool isWidget() const { return false; }
+    virtual bool isCanvas() const { return false; }
 
     bool isRoot() const { return document()->documentElement() == m_node; }
     bool isBody() const;
@@ -285,6 +286,9 @@ public:
 
     bool isHTMLMarquee() const;
 
+    inline bool isAfterContent() const;
+    static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
+
     bool childrenInline() const { return m_childrenInline; }
     void setChildrenInline(bool b = true) { m_childrenInline = b; }
     bool hasColumns() const { return m_hasColumns; }
@@ -301,6 +305,7 @@ public:
     virtual bool isRenderPath() const { return false; }
     virtual bool isSVGText() const { return false; }
     virtual bool isSVGImage() const { return false; }
+    virtual bool isSVGForeignObject() const { return false; }
 
     // Per SVG 1.1 objectBoundingBox ignores clipping, masking, filter effects, opacity and stroke-width.
     // This is used for all computation of objectBoundingBox relative units and by SVGLocateable::getBBox().
@@ -398,11 +403,11 @@ public:
     bool hasOutlineAnnotation() const;
     bool hasOutline() const { return style()->hasOutline() || hasOutlineAnnotation(); }
 
-   /**
-     * returns the object containing this one. can be different from parent for
-     * positioned elements
-     */
-    RenderObject* container() const;
+    // Returns the object containing this one. Can be different from parent for positioned elements.
+    // If repaintContainer and repaintContainerSkipped are not null, on return *repaintContainerSkipped
+    // is true if the renderer returned is an ancestor of repaintContainer.
+    RenderObject* container(RenderBoxModelObject* repaintContainer = 0, bool* repaintContainerSkipped = 0) const;
+
     virtual RenderObject* hoverAncestor() const { return parent(); }
 
     // IE Extension that can be called on any RenderObject.  See the implementation for the details.
@@ -536,6 +541,8 @@ public:
 
     // Return the offset from the container() renderer (excluding transforms)
     virtual IntSize offsetFromContainer(RenderObject*) const;
+    // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
+    IntSize offsetFromAncestorContainer(RenderObject*) const;
     
     virtual void absoluteRects(Vector<IntRect>&, int, int) { }
     // FIXME: useTransforms should go away eventually
@@ -658,7 +665,9 @@ public:
     // Whether or not a given block needs to paint selection gaps.
     virtual bool shouldPaintSelectionGaps() const { return false; }
 
+#if ENABLE(DRAG_SUPPORT)
     Node* draggableNode(bool dhtmlOK, bool uaOK, int x, int y, bool& dhtmlWillDrag) const;
+#endif
 
     /**
      * Returns the local coordinates of the caret within this render object.
@@ -734,9 +743,6 @@ public:
         return outlineBoundsForRepaint(0);
     }
 
-    bool replacedHasOverflow() const { return m_replacedHasOverflow; }
-    void setReplacedHasOverflow(bool b = true) { m_replacedHasOverflow = b; }
-    
 protected:
     // Overrides should call the superclass at the end
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
@@ -845,9 +851,6 @@ private:
     // from RenderTableCell
     bool m_cellWidthChanged : 1;
 
-    // from RenderReplaced
-    bool m_replacedHasOverflow : 1;
-
 private:
     // Store state between styleWillChange and styleDidChange
     static bool s_affectsParentBlock;
@@ -858,6 +861,16 @@ inline bool RenderObject::documentBeingDestroyed() const
     return !document()->renderer();
 }
 
+inline bool RenderObject::isAfterContent() const
+{
+    if (style()->styleType() != AFTER)
+        return false;
+    // Text nodes don't have their own styles, so ignore the style on a text node.
+    if (isText() && !isBR())
+        return false;
+    return true;
+}
+
 inline void RenderObject::setNeedsLayout(bool b, bool markParents)
 {
     bool alreadyNeededLayout = m_needsLayout;
@@ -974,6 +987,42 @@ inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRenderi
 #endif
 }
 
+inline int adjustForAbsoluteZoom(int value, RenderObject* renderer)
+{
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
+inline void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
+inline FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+inline void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/WebCore/rendering/RenderOverflow.h b/WebCore/rendering/RenderOverflow.h
new file mode 100644
index 0000000..ed8976a
--- /dev/null
+++ b/WebCore/rendering/RenderOverflow.h
@@ -0,0 +1,153 @@
+/*
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RenderOverflow_h
+#define RenderOverflow_h
+
+#include "IntRect.h"
+
+namespace WebCore
+{
+// RenderOverflow is a class for tracking content that spills out of a box.  This class is used by RenderBox and
+// InlineFlowBox.
+//
+// There are two types of overflow: layout overflow (which is expected to be reachable via scrolling mechanisms) and
+// visual overflow (which is not expected to be reachable via scrolling mechanisms).
+//
+// Layout overflow examples include other boxes that spill out of our box,  For example, in the inline case a tall image
+// could spill out of a line box. 
+    
+// Examples of visual overflow are shadows, text stroke (and eventually outline and border-image).
+
+// This object is allocated only when some of these fields have non-default values in the owning box.
+class RenderOverflow {
+public:
+    RenderOverflow(const IntRect& defaultRect = IntRect()) 
+        : m_topLayoutOverflow(defaultRect.y())
+        , m_bottomLayoutOverflow(defaultRect.bottom())
+        , m_leftLayoutOverflow(defaultRect.x())
+        , m_rightLayoutOverflow(defaultRect.right())
+        , m_topVisualOverflow(defaultRect.y())
+        , m_bottomVisualOverflow(defaultRect.bottom())
+        , m_leftVisualOverflow(defaultRect.x())
+        , m_rightVisualOverflow(defaultRect.right())
+    {
+    }
+   
+    int topLayoutOverflow() const { return m_topLayoutOverflow; }
+    int bottomLayoutOverflow() const { return m_bottomLayoutOverflow; }
+    int leftLayoutOverflow() const { return m_leftLayoutOverflow; }
+    int rightLayoutOverflow() const { return m_rightLayoutOverflow; }
+    IntRect layoutOverflowRect() const;
+
+    int topVisualOverflow() const { return m_topVisualOverflow; }
+    int bottomVisualOverflow() const { return m_bottomVisualOverflow; }
+    int leftVisualOverflow() const { return m_leftVisualOverflow; }
+    int rightVisualOverflow() const { return m_rightVisualOverflow; }
+    IntRect visualOverflowRect() const;
+
+    IntRect visibleOverflowRect() const;
+
+    void setTopLayoutOverflow(int overflow) { m_topLayoutOverflow = overflow; }
+    void setBottomLayoutOverflow(int overflow) { m_bottomLayoutOverflow = overflow; }
+    void setLeftLayoutOverflow(int overflow) { m_leftLayoutOverflow = overflow; }
+    void setRightLayoutOverflow(int overflow) { m_rightLayoutOverflow = overflow; }
+    
+    void setTopVisualOverflow(int overflow) { m_topVisualOverflow = overflow; }
+    void setBottomVisualOverflow(int overflow) { m_bottomVisualOverflow = overflow; }
+    void setLeftVisualOverflow(int overflow) { m_leftVisualOverflow = overflow; }
+    void setRightVisualOverflow(int overflow) { m_rightVisualOverflow = overflow; }
+    
+    void move(int dx, int dy);
+    
+    void addLayoutOverflow(const IntRect&);
+    void addVisualOverflow(const IntRect&);
+
+    void resetLayoutOverflow(const IntRect& defaultRect);
+
+private:
+    int m_topLayoutOverflow;
+    int m_bottomLayoutOverflow;
+    int m_leftLayoutOverflow;
+    int m_rightLayoutOverflow;
+
+    int m_topVisualOverflow;
+    int m_bottomVisualOverflow;
+    int m_leftVisualOverflow;
+    int m_rightVisualOverflow;
+};
+
+inline IntRect RenderOverflow::layoutOverflowRect() const
+{
+    return IntRect(m_leftLayoutOverflow, m_topLayoutOverflow, m_rightLayoutOverflow - m_leftLayoutOverflow, m_bottomLayoutOverflow - m_topLayoutOverflow);
+}
+
+inline IntRect RenderOverflow::visualOverflowRect() const
+{
+    return IntRect(m_leftVisualOverflow, m_topVisualOverflow, m_rightVisualOverflow - m_leftVisualOverflow, m_bottomVisualOverflow - m_topVisualOverflow);
+}
+
+inline IntRect RenderOverflow::visibleOverflowRect() const
+{
+    IntRect combinedRect(layoutOverflowRect());
+    combinedRect.unite(visualOverflowRect());
+    return combinedRect;
+}
+
+inline void RenderOverflow::move(int dx, int dy)
+{
+    m_topLayoutOverflow += dy;
+    m_bottomLayoutOverflow += dy;
+    m_leftLayoutOverflow += dx;
+    m_rightLayoutOverflow += dx;
+    
+    m_topVisualOverflow += dy;
+    m_bottomVisualOverflow += dy;
+    m_leftVisualOverflow += dx;
+    m_rightVisualOverflow += dx;
+}
+
+inline void RenderOverflow::addLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = std::min(rect.y(), m_topLayoutOverflow);
+    m_bottomLayoutOverflow = std::max(rect.bottom(), m_bottomLayoutOverflow);
+    m_leftLayoutOverflow = std::min(rect.x(), m_leftLayoutOverflow);
+    m_rightLayoutOverflow = std::max(rect.right(), m_rightLayoutOverflow);
+}
+
+inline void RenderOverflow::addVisualOverflow(const IntRect& rect)
+{
+    m_topVisualOverflow = std::min(rect.y(), m_topVisualOverflow);
+    m_bottomVisualOverflow = std::max(rect.bottom(), m_bottomVisualOverflow);
+    m_leftVisualOverflow = std::min(rect.x(), m_leftVisualOverflow);
+    m_rightVisualOverflow = std::max(rect.right(), m_rightVisualOverflow);
+}
+
+inline void RenderOverflow::resetLayoutOverflow(const IntRect& rect)
+{
+    m_topLayoutOverflow = rect.y();
+    m_bottomLayoutOverflow = rect.bottom();
+    m_leftLayoutOverflow = rect.x();
+    m_rightLayoutOverflow = rect.right();
+}
+
+} // namespace WebCore
+
+#endif // RenderOverflow_h
diff --git a/WebCore/rendering/RenderPartObject.cpp b/WebCore/rendering/RenderPartObject.cpp
index 72298c6..cba341b 100644
--- a/WebCore/rendering/RenderPartObject.cpp
+++ b/WebCore/rendering/RenderPartObject.cpp
@@ -33,8 +33,8 @@
 #include "HTMLParamElement.h"
 #include "MIMETypeRegistry.h"
 #include "Page.h"
-#include "PluginData.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 #include "Text.h"
 
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
@@ -90,25 +90,12 @@ static ClassIdToTypeMap* createClassIdToTypeMap()
     map->add("clsid:CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA", "audio/x-pn-realaudio-plugin");
     map->add("clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B", "video/quicktime");
     map->add("clsid:166B1BCA-3F9C-11CF-8075-444553540000", "application/x-director");
-#if ENABLE(ACTIVEX_TYPE_CONVERSION_WMPLAYER)
     map->add("clsid:6BF52A52-394A-11D3-B153-00C04F79FAA6", "application/x-mplayer2");
     map->add("clsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95", "application/x-mplayer2");
-#endif
     return map;
 }
 
-static const String& activeXType()
-{
-    DEFINE_STATIC_LOCAL(String, activeXType, ("application/x-oleobject"));
-    return activeXType;
-}
-
-static inline bool havePlugin(const PluginData* pluginData, const String& type)
-{
-    return pluginData && !type.isEmpty() && pluginData->supportsMimeType(type);
-}
-
-static String serviceTypeForClassId(const String& classId, const PluginData* pluginData)
+static String serviceTypeForClassId(const String& classId)
 {
     // Return early if classId is empty (since we won't do anything below).
     // Furthermore, if classId is null, calling get() below will crash.
@@ -116,30 +103,7 @@ static String serviceTypeForClassId(const String& classId, const PluginData* plu
         return String();
 
     static ClassIdToTypeMap* map = createClassIdToTypeMap();
-    String type = map->get(classId);
-
-    // If we do have a plug-in that supports generic ActiveX content and don't have a plug-in
-    // for the MIME type we came up with, ignore the MIME type we came up with and just use
-    // the ActiveX type.
-    if (havePlugin(pluginData, activeXType()) && !havePlugin(pluginData, type))
-        return activeXType();
-
-    return type;
-}
-
-static inline bool shouldUseEmbedDescendant(HTMLObjectElement* objectElement, const PluginData* pluginData)
-{
-#if PLATFORM(MAC)
-    UNUSED_PARAM(objectElement);
-    UNUSED_PARAM(pluginData);
-    // On Mac, we always want to use the embed descendant.
-    return true;
-#else
-    // If we have both an <object> and <embed>, we always want to use the <embed> except when we have
-    // an ActiveX plug-in and plan to use it.
-    return !(havePlugin(pluginData, activeXType())
-        && serviceTypeForClassId(objectElement->classId(), pluginData) == activeXType());
-#endif
+    return map->get(classId);
 }
 
 static void mapDataParamToSrc(Vector<String>* paramNames, Vector<String>* paramValues)
@@ -168,6 +132,12 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
     Vector<String> paramValues;
     Frame* frame = frameView()->frame();
 
+    // The calls to FrameLoader::requestObject within this function can result in a plug-in being initialized.
+    // This can run cause arbitrary JavaScript to run and may result in this RenderObject being detached from
+    // the render tree and destroyed, causing a crash like <rdar://problem/6954546>.  By extending our lifetime
+    // artifically to ensure that we remain alive for the duration of plug-in initialization.
+    RenderWidgetProtector protector(this);
+
     if (node()->hasTagName(objectTag)) {
         HTMLObjectElement* o = static_cast<HTMLObjectElement*>(node());
 
@@ -177,17 +147,14 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // Check for a child EMBED tag.
         HTMLEmbedElement* embed = 0;
-        const PluginData* pluginData = frame->page()->pluginData();
-        if (shouldUseEmbedDescendant(o, pluginData)) {
-            for (Node* child = o->firstChild(); child; ) {
-                if (child->hasTagName(embedTag)) {
-                    embed = static_cast<HTMLEmbedElement*>(child);
-                    break;
-                } else if (child->hasTagName(objectTag))
-                    child = child->nextSibling();         // Don't descend into nested OBJECT tags
-                else
-                    child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
-            }
+        for (Node* child = o->firstChild(); child; ) {
+            if (child->hasTagName(embedTag)) {
+                embed = static_cast<HTMLEmbedElement*>(child);
+                break;
+            } else if (child->hasTagName(objectTag))
+                child = child->nextSibling();         // Don't descend into nested OBJECT tags
+            else
+                child = child->traverseNextNode(o);   // Otherwise descend (EMBEDs may be inside COMMENT tags)
         }
 
         // Use the attributes from the EMBED tag instead of the OBJECT tag including WIDTH and HEIGHT.
@@ -260,7 +227,7 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         // If we still don't have a type, try to map from a specific CLASSID to a type.
         if (serviceType.isEmpty())
-            serviceType = serviceTypeForClassId(o->classId(), pluginData);
+            serviceType = serviceTypeForClassId(o->classId());
 
         if (!isURLAllowed(document(), url))
             return;
@@ -282,7 +249,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
                 return;
         }
 
-        bool success = frame->loader()->requestObject(this, url, AtomicString(o->name()), serviceType, paramNames, paramValues);
+        bool success = o->dispatchBeforeLoadEvent(url) &&
+                       frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
         if (!success && m_hasFallbackContent)
             o->renderFallbackContent();
     } else if (node()->hasTagName(embedTag)) {
@@ -316,7 +284,8 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
         }
 
-        frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, o->getAttribute(nameAttr), serviceType, paramNames, paramValues);
     }
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)        
     else if (node()->hasTagName(videoTag) || node()->hasTagName(audioTag)) {
@@ -339,7 +308,9 @@ void RenderPartObject::updateWidget(bool onlyCreateNonNetscapePlugins)
         }
 
         serviceType = "application/x-media-element-proxy-plugin";
-        frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
+        
+        if (o->dispatchBeforeLoadEvent(url))
+            frame->loader()->requestObject(this, url, nullAtom, serviceType, paramNames, paramValues);
     }
 #endif
 }
@@ -425,12 +396,18 @@ void RenderPartObject::layout()
 #else
     calcWidth();
     calcHeight();
+<<<<<<< HEAD:WebCore/rendering/RenderPartObject.cpp
 #endif
 
     adjustOverflowForBoxShadowAndReflect();
+=======
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderPartObject.cpp
 
     RenderPart::layout();
 
+    m_overflow.clear();
+    addShadowOverflow();
+
     if (!widget() && frameView())
         frameView()->addWidgetToUpdate(this);
 
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index 692a66e..27d2e72 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -34,9 +34,6 @@ using namespace std;
 
 namespace WebCore {
 
-typedef WTF::HashMap<const RenderReplaced*, IntRect> OverflowRectMap;
-static OverflowRectMap* gOverflowRectMap = 0;
-
 const int cDefaultWidth = 300;
 const int cDefaultHeight = 150;
 
@@ -56,8 +53,6 @@ RenderReplaced::RenderReplaced(Node* node, const IntSize& intrinsicSize)
 
 RenderReplaced::~RenderReplaced()
 {
-    if (replacedHasOverflow())
-        gOverflowRectMap->remove(this);
 }
 
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -66,7 +61,7 @@ void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* old
 
     bool hadStyle = (oldStyle != 0);
     float oldZoom = hadStyle ? oldStyle->effectiveZoom() : RenderStyle::initialZoom();
-    if (hadStyle && style() && style()->effectiveZoom() != oldZoom)
+    if (style() && style()->effectiveZoom() != oldZoom)
         intrinsicSizeChanged();
 }
 
@@ -77,10 +72,12 @@ void RenderReplaced::layout()
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
     
     setHeight(minimumReplacedHeight());
-    
+
     calcWidth();
     calcHeight();
-    adjustOverflowForBoxShadowAndReflect();
+
+    m_overflow.clear();
+    addShadowOverflow();
     
     repainter.repaintAfterLayout();    
 
@@ -127,21 +124,29 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
         drawSelectionTint = false;
     }
 
+    bool completelyClippedOut = false;
     if (style()->hasBorderRadius()) {
-        // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
-        paintInfo.context->save();
-        
-        IntSize topLeft, topRight, bottomLeft, bottomRight;
         IntRect borderRect = IntRect(tx, ty, width(), height());
-        style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
-        paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        if (borderRect.isEmpty())
+            completelyClippedOut = true;
+        else {
+            // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
+            paintInfo.context->save();
+            
+            IntSize topLeft, topRight, bottomLeft, bottomRight;
+            style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+
+            paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        }
     }
 
-    paintReplaced(paintInfo, tx, ty);
+    if (!completelyClippedOut) {
+        paintReplaced(paintInfo, tx, ty);
 
-    if (style()->hasBorderRadius())
-        paintInfo.context->restore();
+        if (style()->hasBorderRadius())
+            paintInfo.context->restore();
+    }
         
     // The selection tint never gets clipped by border-radius rounding, since we want it to run right up to the edges of
     // surrounding content.
@@ -169,8 +174,8 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     int currentTY = ty + y();
 
     // Early exit if the element touches the edges.
-    int top = currentTY + overflowTop();
-    int bottom = currentTY + overflowHeight();
+    int top = currentTY + topVisibleOverflow();
+    int bottom = currentTY + bottomVisibleOverflow();
     if (isSelected() && m_inlineBoxWrapper) {
         int selTop = ty + m_inlineBoxWrapper->root()->selectionTop();
         int selBottom = ty + selTop + m_inlineBoxWrapper->root()->selectionHeight();
@@ -179,7 +184,7 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
     }
     
     int os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (currentTX + overflowLeft() >= paintInfo.rect.right() + os || currentTX + overflowWidth() <= paintInfo.rect.x() - os)
+    if (currentTX + leftVisibleOverflow() >= paintInfo.rect.right() + os || currentTX + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return false;
     if (top >= paintInfo.rect.bottom() + os || bottom <= paintInfo.rect.y() - os)
         return false;
@@ -231,8 +236,8 @@ VisiblePosition RenderReplaced::positionForPoint(const IntPoint& point)
 
     RootInlineBox* root = box->root();
 
-    int top = root->topOverflow();
-    int bottom = root->nextRootBox() ? root->nextRootBox()->topOverflow() : root->bottomOverflow();
+    int top = root->lineTop();
+    int bottom = root->nextRootBox() ? root->nextRootBox()->lineTop() : root->lineBottom();
 
     if (point.y() + y() < top)
         return createVisiblePosition(caretMinOffset(), DOWNSTREAM); // coordinates are above
@@ -327,82 +332,6 @@ void RenderReplaced::setIntrinsicSize(const IntSize& size)
     m_intrinsicSize = size;
 }
 
-void RenderReplaced::adjustOverflowForBoxShadowAndReflect()
-{
-    IntRect overflow;
-    for (ShadowData* boxShadow = style()->boxShadow(); boxShadow; boxShadow = boxShadow->next) {
-        if (boxShadow->style == Inset)
-            continue;
-        IntRect shadow = borderBoxRect();
-        shadow.move(boxShadow->x, boxShadow->y);
-        shadow.inflate(boxShadow->blur + boxShadow->spread);
-        overflow.unite(shadow);
-    }
-
-    // Now that we have an overflow rect including shadow, let's make sure that
-    // the reflection (which can also include the shadow) is also included.
-    if (hasReflection()) {
-        if (overflow.isEmpty())
-            overflow = borderBoxRect();
-        overflow.unite(reflectedRect(overflow));
-    }
-
-    if (!overflow.isEmpty()) {
-        if (!gOverflowRectMap)
-            gOverflowRectMap = new OverflowRectMap();
-        overflow.unite(borderBoxRect());
-        gOverflowRectMap->set(this, overflow);
-        setReplacedHasOverflow(true);
-    } else if (replacedHasOverflow()) {
-        gOverflowRectMap->remove(this);
-        setReplacedHasOverflow(false);
-    }
-}
-
-int RenderReplaced::overflowHeight(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->height() + r->y();
-    }
-
-    return height();
-}
-
-int RenderReplaced::overflowWidth(bool) const
-{
-    if (replacedHasOverflow()) {
-        IntRect *r = &gOverflowRectMap->find(this)->second;
-        return r->width() + r->x();
-    }
-
-    return width();
-}
-
-int RenderReplaced::overflowLeft(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).x();
-
-    return 0;
-}
-
-int RenderReplaced::overflowTop(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->get(this).y();
-
-    return 0;
-}
-
-IntRect RenderReplaced::overflowRect(bool) const
-{
-    if (replacedHasOverflow())
-        return gOverflowRectMap->find(this)->second;
-
-    return borderBoxRect();
-}
-
 IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     if (style()->visibility() != VISIBLE && !enclosingLayer()->hasVisibleContent())
@@ -410,7 +339,7 @@ IntRect RenderReplaced::clippedOverflowRectForRepaint(RenderBoxModelObject* repa
 
     // The selectionRect can project outside of the overflowRect, so take their union
     // for repainting to avoid selection painting glitches.
-    IntRect r = unionRect(localSelectionRect(false), overflowRect(false));
+    IntRect r = unionRect(localSelectionRect(false), visibleOverflowRect());
 
     RenderView* v = view();
     if (v) {
diff --git a/WebCore/rendering/RenderReplaced.h b/WebCore/rendering/RenderReplaced.h
index 70ad4f2..0ba6b8a 100644
--- a/WebCore/rendering/RenderReplaced.h
+++ b/WebCore/rendering/RenderReplaced.h
@@ -65,12 +65,6 @@ private:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintReplaced(PaintInfo&, int /*tx*/, int /*ty*/) { }
 
-    virtual int overflowHeight(bool includeInterior = true) const;
-    virtual int overflowWidth(bool includeInterior = true) const;
-    virtual int overflowLeft(bool includeInterior = true) const;
-    virtual int overflowTop(bool includeInterior = true) const;
-    virtual IntRect overflowRect(bool includeInterior = true) const;
-
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
 
     virtual unsigned caretMaxRenderedOffset() const;
diff --git a/WebCore/rendering/RenderScrollbar.cpp b/WebCore/rendering/RenderScrollbar.cpp
index b3c5369..63fce8d 100644
--- a/WebCore/rendering/RenderScrollbar.cpp
+++ b/WebCore/rendering/RenderScrollbar.cpp
@@ -40,6 +40,16 @@ RenderScrollbar::RenderScrollbar(ScrollbarClient* client, ScrollbarOrientation o
     : Scrollbar(client, orientation, RegularScrollbar, RenderScrollbarTheme::renderScrollbarTheme())
     , m_owner(renderer)
 {
+    // FIXME: We need to do this because RenderScrollbar::styleChanged is called as soon as the scrollbar is created.
+    
+    // Update the scrollbar size.
+    updateScrollbarPart(ScrollbarBGPart);
+    RenderScrollbarPart* part = m_parts.get(ScrollbarBGPart);
+    if (!part)
+        return;
+
+    part->layout();
+    setFrameRect(IntRect(0, 0, part->width(), part->height()));
 }
 
 RenderScrollbar::~RenderScrollbar()
diff --git a/WebCore/rendering/RenderScrollbarPart.cpp b/WebCore/rendering/RenderScrollbarPart.cpp
index 0f29aeb..c83248a 100644
--- a/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/WebCore/rendering/RenderScrollbarPart.cpp
@@ -27,6 +27,7 @@
 #include "RenderScrollbarPart.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarTheme.h"
+#include "RenderView.h"
 
 using namespace std;
 
@@ -51,9 +52,6 @@ void RenderScrollbarPart::layout()
     else
         layoutVerticalPart();
 
-    m_overflowWidth = max(width(), m_overflowWidth);
-    m_overflowHeight = max(height(), m_overflowHeight);
-    
     setNeedsLayout(false);
 }
 
@@ -143,8 +141,16 @@ void RenderScrollbarPart::imageChanged(WrappedImagePtr image, const IntRect* rec
 {
     if (m_scrollbar && m_part != NoPart)
         m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
-    else
+    else {
+        if (FrameView* frameView = view()->frameView()) {
+            if (frameView->isFrameViewScrollCorner(this)) {
+                frameView->invalidateScrollCorner();
+                return;
+            }
+        }
+        
         RenderBlock::imageChanged(image, rect);
+    }
 }
 
 void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx, int ty, const IntRect& rect)
@@ -153,8 +159,6 @@ void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx
     setLocation(rect.x() - tx, rect.y() - ty);
     setWidth(rect.width());
     setHeight(rect.height());
-    setOverflowWidth(max(rect.width(), overflowWidth()));
-    setOverflowHeight(max(rect.height(), overflowHeight()));
 
     if (graphicsContext->paintingDisabled())
         return;
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index 8a19d97..c8b60fd 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -54,7 +54,7 @@ static const int defaultTrackLength = 129;
 struct SliderRange {
     bool isIntegral;
     double minimum;
-    double maximum;
+    double maximum;  // maximum must be >= minimum.
 
     explicit SliderRange(HTMLInputElement*);
     double clampValue(double value);
@@ -84,12 +84,8 @@ SliderRange::SliderRange(HTMLInputElement* element)
 
     isIntegral = !equalIgnoringCase(element->getAttribute(precisionAttr), "float");
 
-    // FIXME: This treats maximum strings that can't be parsed as 0, but perhaps 100 would be more appropriate.
-    const AtomicString& maxString = element->getAttribute(maxAttr);
-    maximum = maxString.isNull() ? 100.0 : maxString.toDouble();
-
-    // If the maximum is smaller, use it as the minimum.
-    minimum = min(element->getAttribute(minAttr).toDouble(), maximum);
+    maximum = element->rangeMaximum();
+    minimum = element->rangeMinimum();
 }
 
 double SliderRange::clampValue(double value)
@@ -100,12 +96,14 @@ double SliderRange::clampValue(double value)
 
 double SliderRange::valueFromElement(HTMLInputElement* element, bool* wasClamped)
 {
-    String valueString = element->value();
-    double oldValue = valueString.isNull() ? (minimum + maximum) / 2 : valueString.toDouble();
+    double oldValue;
+    bool parseSuccess = HTMLInputElement::formStringToDouble(element->value(), &oldValue);
+    if (!parseSuccess)
+        oldValue = (minimum + maximum) / 2;
     double newValue = clampValue(oldValue);
 
     if (wasClamped)
-        *wasClamped = valueString.isNull() || newValue != oldValue;
+        *wasClamped = !parseSuccess || newValue != oldValue;
 
     return newValue;
 }
@@ -285,6 +283,8 @@ PassRefPtr<RenderStyle> RenderSlider::createThumbStyle(const RenderStyle* parent
         style->setAppearance(SliderThumbHorizontalPart);
     else if (parentStyle->appearance() == MediaSliderPart)
         style->setAppearance(MediaSliderThumbPart);
+    else if (parentStyle->appearance() == MediaVolumeSliderPart)
+        style->setAppearance(MediaVolumeSliderThumbPart);
 
     return style.release();
 }
@@ -302,7 +302,7 @@ IntRect RenderSlider::thumbRect()
 
     double fraction = sliderPosition(static_cast<HTMLInputElement*>(node()));
     IntRect contentRect = contentBoxRect();
-    if (style()->appearance() == SliderVerticalPart) {
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart) {
         thumbRect.setX(contentRect.x() + (contentRect.width() - thumbRect.width()) / 2);
         thumbRect.setY(contentRect.y() + static_cast<int>(nextafter((contentRect.height() - thumbRect.height()) + 1, 0) * (1 - fraction)));
     } else {
@@ -340,8 +340,6 @@ void RenderSlider::layout()
     calcWidth();
     calcHeight();
 
-    IntRect overflowRect(IntPoint(), size());
-
     if (thumb) {
         if (oldSize != size())
             thumb->setChildNeedsLayout(true, false);
@@ -358,18 +356,9 @@ void RenderSlider::layout()
             thumb->repaintDuringLayoutIfMoved(oldThumbRect);
 
         statePusher.pop();
-
-        IntRect thumbOverflowRect = thumb->overflowRect();
-        thumbOverflowRect.move(thumb->x(), thumb->y());
-        overflowRect.unite(thumbOverflowRect);
     }
 
-    // FIXME: m_overflowWidth and m_overflowHeight should be renamed
-    // m_overflowRight and m_overflowBottom.
-    m_overflowLeft = overflowRect.x();
-    m_overflowTop = overflowRect.y();
-    m_overflowWidth = overflowRect.right();
-    m_overflowHeight = overflowRect.bottom();
+    addOverflowFromChild(thumb);
 
     repainter.repaintAfterLayout();    
 
@@ -406,7 +395,7 @@ bool RenderSlider::mouseEventIsInThumb(MouseEvent* evt)
         return false;
 
 #if ENABLE(VIDEO)
-    if (style()->appearance() == MediaSliderPart) {
+    if (style()->appearance() == MediaSliderPart || style()->appearance() == MediaVolumeSliderPart) {
         MediaControlInputElement *sliderThumb = static_cast<MediaControlInputElement*>(m_thumb->renderer()->node());
         return sliderThumb->hitTest(evt->absoluteLocation());
     }
@@ -438,7 +427,7 @@ void RenderSlider::setValueForPosition(int position)
     // Calculate the new value based on the position, and send it to the element.
     SliderRange range(element);
     double fraction = static_cast<double>(position) / trackSize();
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         fraction = 1 - fraction;
     double value = range.clampValue(range.valueFromProportion(fraction));
     element->setValueFromRenderer(String::number(value));
@@ -459,7 +448,7 @@ int RenderSlider::positionForOffset(const IntPoint& p)
         return 0;
 
     int position;
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         position = p.y() - m_thumb->renderBox()->height() / 2;
     else
         position = p.x() - m_thumb->renderBox()->width() / 2;
@@ -472,7 +461,7 @@ int RenderSlider::currentPosition()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return toRenderBox(m_thumb->renderer())->y() - contentBoxRect().y();
     return toRenderBox(m_thumb->renderer())->x() - contentBoxRect().x();
 }
@@ -482,7 +471,7 @@ int RenderSlider::trackSize()
     ASSERT(m_thumb);
     ASSERT(m_thumb->renderer());
 
-    if (style()->appearance() == SliderVerticalPart)
+    if (style()->appearance() == SliderVerticalPart || style()->appearance() == MediaVolumeSliderPart)
         return contentHeight() - m_thumb->renderBox()->height();
     return contentWidth() - m_thumb->renderBox()->width();
 }
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index 7599999..0acaa43 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -265,8 +265,8 @@ void RenderTable::layout()
     LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()));
 
     setHeight(0);
-    m_overflowHeight = 0;
-    m_overflowTop = 0;
+    m_overflow.clear();
+
     initMaxMarginValues();
     
 #ifdef ANDROID_LAYOUT
@@ -354,9 +354,6 @@ void RenderTable::layout()
     if (m_caption)
         m_caption->layoutIfNeeded();
 
-    m_overflowWidth = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
-    m_overflowLeft = collapsing ? borderLeft() - outerBorderLeft() : 0;
-
     // If any table section moved vertically, we will just repaint everything from that
     // section down (it is quite unlikely that any of the following sections
     // did not shift).
@@ -372,10 +369,6 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, m_caption->y() + m_caption->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, m_caption->y() + m_caption->overflowHeight(false));
 
         if (height() != oldTableTop) {
             sectionMoved = true;
@@ -421,15 +414,11 @@ void RenderTable::layout()
     while (section) {
         if (!sectionMoved && section->y() != height()) {
             sectionMoved = true;
-            movedSectionTop = min(height(), section->y()) + section->overflowTop(false);
+            movedSectionTop = min(height(), section->y()) + section->topVisibleOverflow();
         }
         section->setLocation(bl, height());
 
         setHeight(height() + section->height());
-        m_overflowLeft = min(m_overflowLeft, section->x() + section->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, section->x() + section->overflowWidth(false));
-        m_overflowTop = min(m_overflowTop, section->y() + section->overflowTop(false));
-        m_overflowHeight = max(m_overflowHeight, section->y() + section->overflowHeight(false));
         section = sectionBelow(section);
     }
 
@@ -443,37 +432,34 @@ void RenderTable::layout()
             m_caption->repaintDuringLayoutIfMoved(captionRect);
 
         setHeight(height() + m_caption->height() + m_caption->marginTop() + m_caption->marginBottom());
-        m_overflowLeft = min(m_overflowLeft, m_caption->x() + m_caption->overflowLeft(false));
-        m_overflowWidth = max(m_overflowWidth, m_caption->x() + m_caption->overflowWidth(false));
     }
 
     if (isPositioned())
         calcHeight();
 
-    m_overflowHeight = max(m_overflowHeight, height());
-
     // table can be containing block of positioned elements.
     // FIXME: Only pass true if width or height changed.
     layoutPositionedObjects(true);
 
-    if (!hasOverflowClip()) {
-        int shadowLeft;
-        int shadowRight;
-        int shadowTop;
-        int shadowBottom;
-        style()->getBoxShadowExtent(shadowTop, shadowRight, shadowBottom, shadowLeft);
-
-        m_overflowLeft = min(m_overflowLeft, shadowLeft);
-        m_overflowWidth = max(m_overflowWidth, width() + shadowRight);
-        m_overflowTop = min(m_overflowTop, shadowTop);
-        m_overflowHeight = max(m_overflowHeight, height() + shadowBottom);
-
-        if (hasReflection()) {
-            IntRect reflection(reflectionBox());
-            m_overflowTop = min(m_overflowTop, reflection.y());
-            m_overflowHeight = max(m_overflowHeight, reflection.bottom());
-            m_overflowLeft = min(m_overflowLeft, reflection.x());
-            m_overflowHeight = max(m_overflowWidth, reflection.right());
+    // Add overflow from borders.
+    int rightBorderOverflow = width() + (collapsing ? outerBorderRight() - borderRight() : 0);
+    int leftBorderOverflow = collapsing ? borderLeft() - outerBorderLeft() : 0;
+    int bottomBorderOverflow = height() + (collapsing ? outerBorderBottom() - borderBottom() : 0);
+    int topBorderOverflow = collapsing ? borderTop() - outerBorderTop() : 0;
+    addLayoutOverflow(IntRect(leftBorderOverflow, topBorderOverflow, rightBorderOverflow - leftBorderOverflow, bottomBorderOverflow - topBorderOverflow));
+    
+    // Add visual overflow from box-shadow and reflections.
+    addShadowOverflow();
+    
+    // Add overflow from our caption.
+    if (m_caption)
+        addOverflowFromChild(m_caption);
+
+    // Add overflow from our sections.
+    for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->isTableSection()) {
+            RenderTableSection* section = toRenderTableSection(child);
+            addOverflowFromChild(section);
         }
     }
 
@@ -482,7 +468,7 @@ void RenderTable::layout()
     bool didFullRepaint = repainter.repaintAfterLayout();
     // Repaint with our new bounds if they are different from our old bounds.
     if (!didFullRepaint && sectionMoved)
-        repaintRectangle(IntRect(m_overflowLeft, movedSectionTop, m_overflowWidth - m_overflowLeft, m_overflowHeight - movedSectionTop));
+        repaintRectangle(IntRect(leftVisibleOverflow(), movedSectionTop, rightVisibleOverflow() - leftVisibleOverflow(), bottomVisibleOverflow() - movedSectionTop));
     
     setNeedsLayout(false);
 }
@@ -503,9 +489,9 @@ void RenderTable::paint(PaintInfo& paintInfo, int tx, int ty)
     PaintPhase paintPhase = paintInfo.phase;
 
     int os = 2 * maximalOutlineSize(paintPhase);
-    if (ty + overflowTop(false) >= paintInfo.rect.bottom() + os || ty + overflowHeight(false) <= paintInfo.rect.y() - os)
+    if (ty + topVisibleOverflow() >= paintInfo.rect.bottom() + os || ty + bottomVisibleOverflow() <= paintInfo.rect.y() - os)
         return;
-    if (tx + overflowLeft(false) >= paintInfo.rect.right() + os || tx + overflowWidth(false) <= paintInfo.rect.x() - os)
+    if (tx + leftVisibleOverflow() >= paintInfo.rect.right() + os || tx + rightVisibleOverflow() <= paintInfo.rect.x() - os)
         return;
 
     bool pushedClip = pushContentsClip(paintInfo, tx, ty);    
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 8b7a068..8e0b613 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -207,9 +207,9 @@ IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
             right = max(right, below->borderHalfRight(true));
         }
     }
-    left = max(left, -overflowLeft(false));
-    top = max(top, -overflowTop(false));
-    IntRect r(-left, - top, left + max(width() + right, overflowWidth(false)), top + max(height() + bottom, overflowHeight(false)));
+    left = max(left, -leftVisibleOverflow());
+    top = max(top, -topVisibleOverflow());
+    IntRect r(-left, - top, left + max(width() + right, rightVisibleOverflow()), top + max(height() + bottom, bottomVisibleOverflow()));
 
     if (RenderView* v = view()) {
         // FIXME: layoutDelta needs to be applied in parts before/after transforms and
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 5d47357..1e087f6 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -55,10 +55,6 @@ RenderTableSection::RenderTableSection(Node* node)
     , m_outerBorderRight(0)
     , m_outerBorderTop(0)
     , m_outerBorderBottom(0)
-    , m_overflowLeft(0)
-    , m_overflowWidth(0)
-    , m_overflowTop(0)
-    , m_overflowHeight(0)
     , m_needsCellRecalc(false)
     , m_hasOverflowingCell(false)
 {
@@ -501,10 +497,7 @@ int RenderTableSection::layoutRows(int toAdd)
     
     // Set the width of our section now.  The rows will also be this width.
     setWidth(table()->contentWidth());
-    m_overflowLeft = 0;
-    m_overflowWidth = width();
-    m_overflowTop = 0;
-    m_overflowHeight = 0;
+    m_overflow.clear();
     m_hasOverflowingCell = false;
 
     if (toAdd && totalRows && (m_rowPos[totalRows] || !nextSibling())) {
@@ -705,12 +698,6 @@ int RenderTableSection::layoutRows(int toAdd)
             } else
                 cell->setLocation(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
 
-            m_overflowLeft = min(m_overflowLeft, cell->x() + cell->overflowLeft(false));
-            m_overflowWidth = max(m_overflowWidth, cell->x() + cell->overflowWidth(false));
-            m_overflowTop = min(m_overflowTop, cell->y() + cell->overflowTop(false));
-            m_overflowHeight = max(m_overflowHeight, cell->y() + cell->overflowHeight(false));
-            m_hasOverflowingCell |= cell->overflowLeft(false) || cell->overflowWidth(false) > cell->width() || cell->overflowTop(false) || cell->overflowHeight(false) > cell->height();
-
             // If the cell moved, we have to repaint it as well as any floating/positioned
             // descendants.  An exception is if we need a layout.  In this case, we know we're going to
             // repaint ourselves (and the cell) anyway.
@@ -725,10 +712,23 @@ int RenderTableSection::layoutRows(int toAdd)
 
     ASSERT(!needsLayout());
 
+    setHeight(m_rowPos[totalRows]);
+
+    // Now that our height has been determined, add in overflow from cells.
+    for (int r = 0; r < totalRows; r++) {
+        for (int c = 0; c < nEffCols; c++) {
+            RenderTableCell* cell = cellAt(r, c).cell;
+            if (!cell)
+                continue;
+            if (r < totalRows - 1 && cell == cellAt(r + 1, c).cell)
+                continue;
+            addOverflowFromChild(cell);
+        }
+    }
+    m_hasOverflowingCell = m_overflow;
+    
     statePusher.pop();
 
-    setHeight(m_rowPos[totalRows]);
-    m_overflowHeight = max(m_overflowHeight, height());
     return height();
 }
 
diff --git a/WebCore/rendering/RenderTableSection.h b/WebCore/rendering/RenderTableSection.h
index c0098bc..9f6d5ea 100644
--- a/WebCore/rendering/RenderTableSection.h
+++ b/WebCore/rendering/RenderTableSection.h
@@ -73,11 +73,6 @@ public:
     void appendColumn(int pos);
     void splitColumn(int pos, int newSize);
 
-    virtual int overflowWidth(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? width() : m_overflowWidth; }
-    virtual int overflowLeft(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowLeft; }
-    virtual int overflowHeight(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? height() : m_overflowHeight; }
-    virtual int overflowTop(bool includeInterior = true) const { return (!includeInterior && hasOverflowClip()) ? 0 : m_overflowTop; }
-
     int calcOuterBorderTop() const;
     int calcOuterBorderBottom() const;
     int calcOuterBorderLeft(bool rtl) const;
@@ -152,10 +147,6 @@ private:
     int m_outerBorderRight;
     int m_outerBorderTop;
     int m_outerBorderBottom;
-    int m_overflowLeft;
-    int m_overflowWidth;
-    int m_overflowTop;
-    int m_overflowHeight;
 
     bool m_needsCellRecalc;
     bool m_hasOverflowingCell;
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index ada3961..40c3d75 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -207,7 +207,7 @@ void RenderText::deleteTextBoxes()
 PassRefPtr<StringImpl> RenderText::originalText() const
 {
     Node* e = node();
-    return e ? static_cast<Text*>(e)->string() : 0;
+    return e ? static_cast<Text*>(e)->dataImpl() : 0;
 }
 
 void RenderText::absoluteRects(Vector<IntRect>& rects, int tx, int ty)
@@ -328,13 +328,13 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
     int offset;
 
     // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && point.y() <  firstTextBox()->root()->bottomOverflow() && point.x() < firstTextBox()->m_x) {
+    if (firstTextBox() && point.y() <  firstTextBox()->root()->lineBottom() && point.x() < firstTextBox()->m_x) {
         // at the y coordinate of the first line or above
         // and the x coordinate is to the left of the first text box left edge
         offset = firstTextBox()->offsetForPosition(point.x());
         return createVisiblePosition(offset + firstTextBox()->start(), DOWNSTREAM);
     }
-    if (lastTextBox() && point.y() >= lastTextBox()->root()->topOverflow() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
+    if (lastTextBox() && point.y() >= lastTextBox()->root()->lineTop() && point.x() >= lastTextBox()->m_x + lastTextBox()->m_width) {
         // at the y coordinate of the last line or below
         // and the x coordinate is to the right of the last text box right edge
         offset = lastTextBox()->offsetForPosition(point.x());
@@ -343,8 +343,8 @@ VisiblePosition RenderText::positionForPoint(const IntPoint& point)
 
     InlineTextBox* lastBoxAbove = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
-        if (point.y() >= box->root()->topOverflow()) {
-            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->topOverflow() : box->root()->bottomOverflow();
+        if (point.y() >= box->root()->lineTop()) {
+            int bottom = box->root()->nextRootBox() ? box->root()->nextRootBox()->lineTop() : box->root()->lineBottom();
             if (point.y() < bottom) {
                 offset = box->offsetForPosition(point.x());
 
@@ -387,8 +387,8 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
 
     InlineTextBox* box = static_cast<InlineTextBox*>(inlineBox);
 
-    int height = box->root()->bottomOverflow() - box->root()->topOverflow();
-    int top = box->root()->topOverflow();
+    int height = box->root()->lineBottom() - box->root()->lineTop();
+    int top = box->root()->lineTop();
 
     int left = box->positionForOffset(caretOffset);
 
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index 70b6518..bcb2455 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -67,8 +67,9 @@ static Color disabledTextColor(const Color& textColor, const Color& backgroundCo
     return disabledColor;
 }
 
-RenderTextControl::RenderTextControl(Node* node)
+RenderTextControl::RenderTextControl(Node* node, bool placeholderVisible)
     : RenderBlock(node)
+    , m_placeholderVisible(placeholderVisible)
     , m_edited(false)
     , m_userEdited(false)
 {
@@ -92,14 +93,22 @@ void RenderTextControl::styleDidChange(StyleDifference diff, const RenderStyle*
         // Reset them now to avoid getting a spurious layout hint.
         textBlockRenderer->style()->setHeight(Length());
         textBlockRenderer->style()->setWidth(Length());
-        textBlockRenderer->setStyle(textBlockStyle);
+        setInnerTextStyle(textBlockStyle);
+    }
+
+    setReplaced(isInline());
+}
+
+void RenderTextControl::setInnerTextStyle(PassRefPtr<RenderStyle> style)
+{
+    if (m_innerText) {
+        RefPtr<RenderStyle> textStyle = style;
+        m_innerText->renderer()->setStyle(textStyle);
         for (Node* n = m_innerText->firstChild(); n; n = n->traverseNextNode(m_innerText.get())) {
             if (n->renderer())
-                n->renderer()->setStyle(textBlockStyle);
+                n->renderer()->setStyle(textStyle);
         }
     }
-
-    setReplaced(isInline());
 }
 
 static inline bool updateUserModifyProperty(Node* node, RenderStyle* style)
@@ -173,7 +182,7 @@ void RenderTextControl::setInnerTextValue(const String& innerTextValue)
                 frame->editor()->clearUndoRedoOperations();
                 
                 if (AXObjectCache::accessibilityEnabled())
-                    document()->axObjectCache()->postNotification(this, "AXValueChanged", false);
+                    document()->axObjectCache()->postNotification(this, AXObjectCache::AXValueChanged, false);
             }
         }
 
@@ -507,7 +516,7 @@ void RenderTextControl::selectionChanged(bool userTriggered)
 
     if (Frame* frame = document()->frame()) {
         if (frame->selection()->isRange() && userTriggered)
-            node()->dispatchEvent(eventNames().selectEvent, true, false);
+            node()->dispatchEvent(Event::create(eventNames().selectEvent, true, false));
     }
 }
 
@@ -521,4 +530,18 @@ HTMLElement* RenderTextControl::innerTextElement() const
     return m_innerText.get();
 }
 
+void RenderTextControl::updatePlaceholderVisibility(bool placeholderShouldBeVisible, bool placeholderValueChanged)
+{
+    bool oldPlaceholderVisible = m_placeholderVisible;
+    m_placeholderVisible = placeholderShouldBeVisible;
+    if (oldPlaceholderVisible != m_placeholderVisible || placeholderValueChanged) {
+        // Sets the inner text style to the normal style or :placeholder style.
+        setInnerTextStyle(createInnerTextStyle(textBaseStyle()));
+
+        // updateFromElement() of the subclasses updates the text content
+        // to the element's value(), placeholder(), or the empty string.
+        updateFromElement();
+    }
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index c0fc343..cdd8716 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -56,8 +56,10 @@ public:
     VisiblePosition visiblePositionForIndex(int index);
     int indexForVisiblePosition(const VisiblePosition&);
 
+    void updatePlaceholderVisibility(bool, bool);
+
 protected:
-    RenderTextControl(Node*);
+    RenderTextControl(Node*, bool);
 
     int scrollbarThickness() const;
     void adjustInnerTextStyle(const RenderStyle* startStyle, RenderStyle* textBlockStyle) const;
@@ -76,6 +78,7 @@ protected:
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight) = 0;
     virtual void cacheSelection(int start, int end) = 0;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const = 0;
+    virtual RenderStyle* textBaseStyle() const = 0;
 
     virtual void updateFromElement();
     virtual void calcHeight();
@@ -83,6 +86,8 @@ protected:
     friend class TextIterator;
     HTMLElement* innerTextElement() const;
 
+    bool m_placeholderVisible;
+
 private:
     virtual const char* renderName() const { return "RenderTextControl"; }
     virtual bool isTextControl() const { return true; }
@@ -92,6 +97,7 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
     virtual bool canHaveChildren() const { return false; }
     virtual bool avoidsFloats() const { return true; }
+    void setInnerTextStyle(PassRefPtr<RenderStyle>);
     
     virtual void addFocusRingRects(GraphicsContext*, int tx, int ty);
 
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index ac790e2..f1f60ab 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -22,18 +22,23 @@
 #include "config.h"
 #include "RenderTextControlMultiLine.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "HitTestResult.h"
+#include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
+<<<<<<< HEAD:WebCore/rendering/RenderTextControlMultiLine.cpp
 #ifdef ANDROID_LAYOUT
 #include "Settings.h"
 #endif
+=======
+#include "HitTestResult.h"
+>>>>>>> webkit.org at 49305:WebCore/rendering/RenderTextControlMultiLine.cpp
 
 namespace WebCore {
 
-RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node)
-    : RenderTextControl(node)
+RenderTextControlMultiLine::RenderTextControlMultiLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
 {
 }
 
@@ -46,16 +51,17 @@ RenderTextControlMultiLine::~RenderTextControlMultiLine()
 void RenderTextControlMultiLine::subtreeHasChanged()
 {
     RenderTextControl::subtreeHasChanged();
-    static_cast<Element*>(node())->setFormControlValueMatchesRenderer(false);
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    textArea->setFormControlValueMatchesRenderer(false);
+    textArea->updateValidity();
 
     if (!node()->focused())
         return;
 
-    // Fire the "input" DOM event
-    node()->dispatchEvent(eventNames().inputEvent, true, false);
+    node()->dispatchEvent(Event::create(eventNames().inputEvent, true, false));
 
     if (Frame* frame = document()->frame())
-        frame->textDidChangeInTextArea(static_cast<Element*>(node()));
+        frame->textDidChangeInTextArea(textArea);
 }
 
 bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitTestResult& result, int x, int y, int tx, int ty, HitTestAction hitTestAction)
@@ -63,7 +69,10 @@ bool RenderTextControlMultiLine::nodeAtPoint(const HitTestRequest& request, HitT
     if (!RenderTextControl::nodeAtPoint(request, result, x, y, tx, ty, hitTestAction))
         return false;
 
-    if (result.innerNode() == node() || result.innerNode() == innerTextElement())
+    bool resultIsTextValueOrPlaceholder
+        = !m_placeholderVisible && result.innerNode() == innerTextElement()
+        || m_placeholderVisible && result.innerNode()->isDescendantOf(innerTextElement());
+    if (result.innerNode() == node() || resultIsTextValueOrPlaceholder)
         hitInnerTextElement(result, x, y, tx, ty);
 
     return true;
@@ -95,7 +104,11 @@ void RenderTextControlMultiLine::updateFromElement()
     createSubtreeIfNeeded(0);
     RenderTextControl::updateFromElement();
 
-    setInnerTextValue(static_cast<HTMLTextAreaElement*>(node())->value());
+    HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(node());
+    if (m_placeholderVisible)
+        setInnerTextValue(textArea->getAttribute(HTMLNames::placeholderAttr));
+    else
+        setInnerTextValue(textArea->value());
 }
 
 void RenderTextControlMultiLine::cacheSelection(int start, int end)
@@ -105,8 +118,15 @@ void RenderTextControlMultiLine::cacheSelection(int start, int end)
 
 PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
-    RefPtr<RenderStyle> textBlockStyle = RenderStyle::create();
-    textBlockStyle->inheritFrom(startStyle);
+    RefPtr<RenderStyle> textBlockStyle;
+    if (m_placeholderVisible) {
+        if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
+            textBlockStyle = RenderStyle::clone(pseudoStyle);
+    }
+    if (!textBlockStyle) {
+        textBlockStyle = RenderStyle::create();
+        textBlockStyle->inheritFrom(startStyle);
+    }
 
     adjustInnerTextStyle(startStyle, textBlockStyle.get());
     textBlockStyle->setDisplay(BLOCK);
@@ -114,4 +134,9 @@ PassRefPtr<RenderStyle> RenderTextControlMultiLine::createInnerTextStyle(const R
     return textBlockStyle.release();
 }
 
+RenderStyle* RenderTextControlMultiLine::textBaseStyle() const
+{
+    return style();
+}
+
 }
diff --git a/WebCore/rendering/RenderTextControlMultiLine.h b/WebCore/rendering/RenderTextControlMultiLine.h
index 7296653..3371a8f 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/WebCore/rendering/RenderTextControlMultiLine.h
@@ -28,7 +28,7 @@ namespace WebCore {
 
 class RenderTextControlMultiLine : public RenderTextControl {
 public:
-    RenderTextControlMultiLine(Node*);
+    RenderTextControlMultiLine(Node*, bool);
     virtual ~RenderTextControlMultiLine();
 
     void forwardEvent(Event*);
@@ -47,6 +47,7 @@ private:
     virtual void updateFromElement();
     virtual void cacheSelection(int start, int end);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
 };
 
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index b448eb7..dd1c24c 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -48,9 +48,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node)
-    : RenderTextControl(node)
-    , m_placeholderVisible(false)
+RenderTextControlSingleLine::RenderTextControlSingleLine(Node* node, bool placeholderVisible)
+    : RenderTextControl(node, placeholderVisible)
     , m_searchPopupIsVisible(false)
     , m_shouldDrawCapsLockIndicator(false)
     , m_searchEventTimer(this, &RenderTextControlSingleLine::searchEventTimerFired)
@@ -69,25 +68,9 @@ RenderTextControlSingleLine::~RenderTextControlSingleLine()
         m_innerBlock->detach();
 }
 
-bool RenderTextControlSingleLine::placeholderShouldBeVisible() const
+RenderStyle* RenderTextControlSingleLine::textBaseStyle() const
 {
-    return inputElement()->placeholderShouldBeVisible();
-}
-
-void RenderTextControlSingleLine::updatePlaceholderVisibility()
-{
-    RenderStyle* parentStyle = m_innerBlock ? m_innerBlock->renderer()->style() : style();
-
-    RefPtr<RenderStyle> textBlockStyle = createInnerTextStyle(parentStyle);
-    HTMLElement* innerText = innerTextElement();
-    innerText->renderer()->setStyle(textBlockStyle);
-
-    for (Node* n = innerText->firstChild(); n; n = n->traverseNextNode(innerText)) {
-        if (RenderObject* renderer = n->renderer())
-            renderer->setStyle(textBlockStyle);
-    }
-
-    updateFromElement();
+    return m_innerBlock ? m_innerBlock->renderer()->style() : style();
 }
 
 void RenderTextControlSingleLine::addSearchResult()
@@ -163,8 +146,6 @@ void RenderTextControlSingleLine::hidePopup()
     ASSERT(node()->isHTMLElement());
     if (m_searchPopup)
         m_searchPopup->hide();
-
-    m_searchPopupIsVisible = false;
 }
 
 void RenderTextControlSingleLine::subtreeHasChanged()
@@ -173,7 +154,11 @@ void RenderTextControlSingleLine::subtreeHasChanged()
     RenderTextControl::subtreeHasChanged();
 
     InputElement* input = inputElement();
-    input->setValueFromRenderer(input->constrainValue(text()));
+    // We don't need to call sanitizeUserInputValue() function here because
+    // InputElement::handleBeforeTextInsertedEvent() has already called
+    // sanitizeUserInputValue().
+    // sanitizeValue() is needed because IME input doesn't dispatch BeforeTextInsertedEvent.
+    input->setValueFromRenderer(input->sanitizeValue(text()));
 
     if (m_cancelButton)
         updateCancelButtonVisibility();
@@ -480,17 +465,14 @@ void RenderTextControlSingleLine::updateFromElement()
     createSubtreeIfNeeded();
     RenderTextControl::updateFromElement();
 
-    bool placeholderVisibilityShouldChange = m_placeholderVisible != placeholderShouldBeVisible();
-    m_placeholderVisible = placeholderShouldBeVisible();
-
     if (m_cancelButton)
         updateCancelButtonVisibility();
 
     if (m_placeholderVisible) {
         ExceptionCode ec = 0;
-        innerTextElement()->setInnerText(inputElement()->placeholder(), ec);
+        innerTextElement()->setInnerText(static_cast<Element*>(node())->getAttribute(placeholderAttr), ec);
         ASSERT(!ec);
-    } else if (!static_cast<Element*>(node())->formControlValueMatchesRenderer() || placeholderVisibilityShouldChange)
+    } else
         setInnerTextValue(inputElement()->value());
 
     if (m_searchPopupIsVisible)
@@ -505,7 +487,7 @@ void RenderTextControlSingleLine::cacheSelection(int start, int end)
 PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const RenderStyle* startStyle) const
 {
     RefPtr<RenderStyle> textBlockStyle;
-    if (placeholderShouldBeVisible()) {
+    if (m_placeholderVisible) {
         if (RenderStyle* pseudoStyle = getCachedPseudoStyle(INPUT_PLACEHOLDER))
             textBlockStyle = RenderStyle::clone(pseudoStyle);
     } 
@@ -535,7 +517,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
     // After this, updateFromElement will immediately update the text displayed.
     // When the placeholder is no longer visible, updatePlaceholderVisiblity will reset the style, 
     // and the text security mode will be set back to the computed value correctly.
-    if (placeholderShouldBeVisible())
+    if (m_placeholderVisible)
         textBlockStyle->setTextSecurity(TSNONE);
 
     return textBlockStyle.release();
@@ -753,6 +735,11 @@ int RenderTextControlSingleLine::selectedIndex() const
     return -1;
 }
 
+void RenderTextControlSingleLine::popupDidHide()
+{
+    m_searchPopupIsVisible = false;
+}
+
 bool RenderTextControlSingleLine::itemIsSeparator(unsigned listIndex) const
 {
     // The separator will be the second to last item in our list.
@@ -832,12 +819,12 @@ void RenderTextControlSingleLine::setScrollTop(int newTop)
         innerTextElement()->setScrollTop(newTop);
 }
 
-bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier)
+bool RenderTextControlSingleLine::scroll(ScrollDirection direction, ScrollGranularity granularity, float multiplier, Node** stopNode)
 {
     RenderLayer* layer = innerTextElement()->renderBox()->layer();
     if (layer && layer->scroll(direction, granularity, multiplier))
         return true;
-    return RenderBlock::scroll(direction, granularity, multiplier);
+    return RenderBlock::scroll(direction, granularity, multiplier, stopNode);
 }
 
 PassRefPtr<Scrollbar> RenderTextControlSingleLine::createScrollbar(ScrollbarClient* client, ScrollbarOrientation orientation, ScrollbarControlSize controlSize)
diff --git a/WebCore/rendering/RenderTextControlSingleLine.h b/WebCore/rendering/RenderTextControlSingleLine.h
index da9838f..e30ff0d 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/WebCore/rendering/RenderTextControlSingleLine.h
@@ -36,19 +36,18 @@ class TextControlInnerElement;
 
 class RenderTextControlSingleLine : public RenderTextControl, private PopupMenuClient {
 public:
-    RenderTextControlSingleLine(Node*);
+    RenderTextControlSingleLine(Node*, bool);
     virtual ~RenderTextControlSingleLine();
 
     bool placeholderIsVisible() const { return m_placeholderVisible; }
     bool placeholderShouldBeVisible() const;
-    void updatePlaceholderVisibility();
 
     void addSearchResult();
     void stopSearchEventTimer();
 
     bool popupIsVisible() const { return m_searchPopupIsVisible; }
     void showPopup();
-    virtual void hidePopup(); // PopupMenuClient method
+    void hidePopup();
 
     void forwardEvent(Event*);
 
@@ -73,7 +72,7 @@ private:
     virtual int scrollHeight() const;
     virtual void setScrollLeft(int);
     virtual void setScrollTop(int);
-    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f);
+    virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1.0f, Node** stopNode = 0);
 
     int textBlockWidth() const;
     virtual int preferredContentWidth(float charWidth) const;
@@ -84,6 +83,7 @@ private:
     virtual void cacheSelection(int start, int end);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    virtual RenderStyle* textBaseStyle() const;
     virtual PassRefPtr<RenderStyle> createInnerTextStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createInnerBlockStyle(const RenderStyle* startStyle) const;
     PassRefPtr<RenderStyle> createResultsButtonStyle(const RenderStyle* startStyle) const;
@@ -109,6 +109,7 @@ private:
     virtual int clientPaddingRight() const;
     virtual int listSize() const;
     virtual int selectedIndex() const;
+    virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
     virtual bool itemIsLabel(unsigned listIndex) const;
     virtual bool itemIsSelected(unsigned listIndex) const;
@@ -121,7 +122,6 @@ private:
 
     InputElement* inputElement() const;
 
-    bool m_placeholderVisible;
     bool m_searchPopupIsVisible;
     bool m_shouldDrawCapsLockIndicator;
 
diff --git a/WebCore/rendering/RenderTextFragment.cpp b/WebCore/rendering/RenderTextFragment.cpp
index 7da9e5a..9ff1106 100644
--- a/WebCore/rendering/RenderTextFragment.cpp
+++ b/WebCore/rendering/RenderTextFragment.cpp
@@ -47,7 +47,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
-    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->string() : contentString());
+    RefPtr<StringImpl> result = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
     if (result && (start() > 0 || start() < result->length()))
         result = result->substring(start(), end());
     return result.release();
@@ -76,7 +76,7 @@ UChar RenderTextFragment::previousCharacter()
 {
     if (start()) {
         Node* e = node();
-        StringImpl*  original = (e ? static_cast<Text*>(e)->string() : contentString());
+        StringImpl*  original = (e ? static_cast<Text*>(e)->dataImpl() : contentString());
         if (original)
             return (*original)[start() - 1];
     }
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index 63e7d45..238279a 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -30,6 +30,7 @@
 #include "GraphicsContext.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "MediaControlElements.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderView.h"
@@ -84,6 +85,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
     
 #if USE(NEW_THEME)
     switch (part) {
+        case ListButtonPart:
         case CheckboxPart:
         case RadioPart:
         case PushButtonPart:
@@ -170,6 +172,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustRadioStyle(selector, style, e);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return adjustButtonStyle(selector, style, e);
@@ -187,6 +190,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
         case MenulistButtonPart:
             return adjustMenuListButtonStyle(selector, style, e);
         case MediaSliderPart:
+        case MediaVolumeSliderPart:
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return adjustSliderTrackStyle(selector, style, e);
@@ -229,6 +233,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             m_theme->paint(part, controlStatesForRenderer(o), const_cast<GraphicsContext*>(paintInfo.context), r, o->style()->effectiveZoom(), o->view()->frameView());
@@ -247,6 +252,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintRadio(o, paintInfo, r);
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return paintButton(o, paintInfo, r);
@@ -282,6 +288,14 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             if (o->parent()->isSlider())
                 return paintMediaSliderThumb(o, paintInfo, r);
             break;
+        case MediaVolumeSliderContainerPart:
+            return paintMediaVolumeSliderContainer(o, paintInfo, r);
+        case MediaVolumeSliderPart:
+            return paintMediaVolumeSliderTrack(o, paintInfo, r);
+        case MediaVolumeSliderThumbPart:
+            if (o->parent()->isSlider())
+                return paintMediaVolumeSliderThumb(o, paintInfo, r);
+            break;
         case MediaTimeRemainingPart:
             return paintMediaTimeRemaining(o, paintInfo, r);
         case MediaCurrentTimePart:
@@ -329,6 +343,7 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -363,6 +378,7 @@ bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInf
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
         case MenulistPart:
@@ -391,6 +407,23 @@ bool RenderTheme::hitTestMediaControlPart(RenderObject* o, const IntPoint& absPo
     FloatPoint localPoint = o->absoluteToLocal(absPoint, false, true);  // respect transforms
     return toRenderBox(o)->borderBoxRect().contains(roundedIntPoint(localPoint));
 }
+
+bool RenderTheme::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(e);
+    switch (part) {
+    case MediaMuteButtonPart:
+        return mediaElement->hasAudio();
+    case MediaRewindButtonPart:
+        return mediaElement->movieLoadType() != MediaPlayer::LiveStream;
+    case MediaReturnToRealtimeButtonPart:
+        return mediaElement->movieLoadType() == MediaPlayer::LiveStream;
+    case MediaFullscreenButtonPart:
+        return mediaElement->supportsFullscreen();
+    default:
+        return true;
+    }
+}
 #endif
 
 Color RenderTheme::activeSelectionBackgroundColor() const
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 4f37015..68e2eba 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -172,6 +172,7 @@ public:
 #if ENABLE(VIDEO)
     // Media controls
     virtual bool hitTestMediaControlPart(RenderObject*, const IntPoint& absPoint);
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 protected:
@@ -247,6 +248,9 @@ protected:
     virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index c4020d3..9048ce3 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -45,6 +45,7 @@ PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
 
 RenderThemeChromiumLinux::RenderThemeChromiumLinux()
 {
+    m_caretBlinkInterval = RenderTheme::caretBlinkInterval();
 }
 
 RenderThemeChromiumLinux::~RenderThemeChromiumLinux()
@@ -91,9 +92,34 @@ Color RenderThemeChromiumLinux::inactiveListBoxSelectionForegroundColor() const
     return Color(0x32, 0x32, 0x32);
 }
 
+void RenderThemeChromiumLinux::adjustSliderThumbSize(RenderObject* o) const
+{
+    // These sizes match the sizes in Chromium Win.
+    const int sliderThumbAlongAxis = 11;
+    const int sliderThumbAcrossAxis = 21;
+    if (o->style()->appearance() == SliderThumbHorizontalPart) {
+        o->style()->setWidth(Length(sliderThumbAlongAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAcrossAxis, Fixed));
+    } else if (o->style()->appearance() == SliderThumbVerticalPart) {
+        o->style()->setWidth(Length(sliderThumbAcrossAxis, Fixed));
+        o->style()->setHeight(Length(sliderThumbAlongAxis, Fixed));
+    } else
+        RenderThemeChromiumSkia::adjustSliderThumbSize(o);
+}
+
 bool RenderThemeChromiumLinux::supportsControlTints() const
 {
     return true;
 }
 
+void RenderThemeChromiumLinux::setCaretBlinkInterval(double interval)
+{
+    m_caretBlinkInterval = interval;
+}
+
+double RenderThemeChromiumLinux::caretBlinkIntervalInternal() const
+{
+    return m_caretBlinkInterval;
+}
+
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.h b/WebCore/rendering/RenderThemeChromiumLinux.h
index e75ddd5..e137ad5 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.h
+++ b/WebCore/rendering/RenderThemeChromiumLinux.h
@@ -49,12 +49,19 @@ namespace WebCore {
         virtual Color inactiveListBoxSelectionBackgroundColor() const;
         virtual Color inactiveListBoxSelectionForegroundColor() const;
 
+        virtual void adjustSliderThumbSize(RenderObject*) const;
+
+        void setCaretBlinkInterval(double interval);
+        virtual double caretBlinkIntervalInternal() const;
+
     private:
         RenderThemeChromiumLinux();
         virtual ~RenderThemeChromiumLinux();
 
         // A general method asking if any control tinting is supported at all.
         virtual bool supportsControlTints() const;
+
+        double m_caretBlinkInterval;
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeChromiumMac.h b/WebCore/rendering/RenderThemeChromiumMac.h
index ffb2548..61b5e8f 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/WebCore/rendering/RenderThemeChromiumMac.h
@@ -3,7 +3,6 @@
  *
  * Copyright (C) 2005 Apple Computer, Inc.
  * Copyright (C) 2008, 2009 Google, Inc.
- * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,7 +25,6 @@
 #define RenderThemeChromiumMac_h
 
 #import "RenderTheme.h"
-#import <AppKit/AppKit.h>
 #import <wtf/HashMap.h>
 #import <wtf/RetainPtr.h>
 
@@ -36,185 +34,166 @@
 class WebCoreRenderThemeNotificationObserver;
 #endif
 
+// This file (and its associated .mm file) is a clone of RenderThemeMac.h. See
+// the .mm file for details.
+
 namespace WebCore {
 
-    class RenderStyle;
+class RenderStyle;
+
+class RenderThemeChromiumMac : public RenderTheme {
+public:
+    static PassRefPtr<RenderTheme> create();
+
+    // A method asking if the control changes its tint when the window has focus or not.
+    virtual bool controlSupportsTints(const RenderObject*) const;
+
+    // A general method asking if any control tinting is supported at all.
+    virtual bool supportsControlTints() const { return true; }
+
+    virtual void adjustRepaintRect(const RenderObject*, IntRect&);
+
+    virtual bool isControlStyled(const RenderStyle*, const BorderData&,
+                                 const FillLayer&, const Color& backgroundColor) const;
+
+    virtual Color platformActiveSelectionBackgroundColor() const;
+    virtual Color platformInactiveSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformActiveListBoxSelectionForegroundColor() const;
+    virtual Color platformInactiveListBoxSelectionBackgroundColor() const;
+    virtual Color platformInactiveListBoxSelectionForegroundColor() const;
+    virtual Color platformFocusRingColor() const;
 
-    class RenderThemeChromiumMac : public RenderTheme {
-    public:
-        static PassRefPtr<RenderTheme> create();
+    virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
+    
+    virtual void platformColorsDidChange();
+
+    // System fonts.
+    virtual void systemFont(int cssValueId, FontDescription&) const;
+
+    virtual int minimumMenuListSize(RenderStyle*) const;
+
+    virtual void adjustSliderThumbSize(RenderObject*) const;
+    
+    virtual int popupInternalPaddingLeft(RenderStyle*) const;
+    virtual int popupInternalPaddingRight(RenderStyle*) const;
+    virtual int popupInternalPaddingTop(RenderStyle*) const;
+    virtual int popupInternalPaddingBottom(RenderStyle*) const;
+    
+    virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
-        // A method to obtain the baseline position for a "leaf" control.  This will only be used if a baseline
-        // position cannot be determined by examining child content. Checkboxes and radio buttons are examples of
-        // controls that need to do this.
-        virtual int baselinePosition(const RenderObject*) const;
+    virtual Color systemColor(int cssValueId) const;
 
-        // A method asking if the control changes its tint when the window has focus or not.
-        virtual bool controlSupportsTints(const RenderObject*) const;
+protected:
+    virtual bool supportsSelectionForegroundColors() const { return false; }
 
-        // A general method asking if any control tinting is supported at all.
-        virtual bool supportsControlTints() const { return true; }
+    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual void adjustRepaintRect(const RenderObject*, IntRect&);
+    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual bool isControlStyled(const RenderStyle*, const BorderData&,
-                                     const FillLayer&, const Color& backgroundColor) const;
+    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual Color platformActiveSelectionBackgroundColor() const;
-        virtual Color platformInactiveSelectionBackgroundColor() const;
-        virtual Color platformActiveListBoxSelectionBackgroundColor() const;
+    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual Color platformFocusRingColor() const;
-        
-        virtual void platformColorsDidChange();
+    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        // System fonts.
-        virtual void systemFont(int cssValueId, FontDescription&) const;
+    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual int minimumMenuListSize(RenderStyle*) const;
+    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual void adjustSliderThumbSize(RenderObject*) const;
-        
-        virtual int popupInternalPaddingLeft(RenderStyle*) const;
-        virtual int popupInternalPaddingRight(RenderStyle*) const;
-        virtual int popupInternalPaddingTop(RenderStyle*) const;
-        virtual int popupInternalPaddingBottom(RenderStyle*) const;
-        
-        virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return SmallScrollbar; }
+    virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+#if ENABLE(VIDEO)
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
+    // Media controls
+    virtual String extraMediaControlsStyleSheet();
+#endif
+
+private:
+    RenderThemeChromiumMac();
+    virtual ~RenderThemeChromiumMac();
+
+    IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
+
+    FloatRect convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const;
     
-        virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    // Get the control size based off the font.  Used by some of the controls (like buttons).
+    NSControlSize controlSizeForFont(RenderStyle*) const;
+    NSControlSize controlSizeForSystemFont(RenderStyle*) const;
+    void setControlSize(NSCell*, const IntSize* sizes, const IntSize& minSize, float zoomLevel = 1.0f);
+    void setSizeFromFont(RenderStyle*, const IntSize* sizes) const;
+    IntSize sizeForFont(RenderStyle*, const IntSize* sizes) const;
+    IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
+    void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
+
+    void updateActiveState(NSCell*, const RenderObject*);
+    void updateCheckedState(NSCell*, const RenderObject*);
+    void updateEnabledState(NSCell*, const RenderObject*);
+    void updateFocusedState(NSCell*, const RenderObject*);
+    void updatePressedState(NSCell*, const RenderObject*);
+
+    // Helpers for adjusting appearance and for painting
+
+    void setPopupButtonCellState(const RenderObject*, const IntRect&);
+    const IntSize* popupButtonSizes() const;
+    const int* popupButtonMargins() const;
+    const int* popupButtonPadding(NSControlSize) const;
+    void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    const IntSize* menuListSizes() const;
+
+    const IntSize* searchFieldSizes() const;
+    const IntSize* cancelButtonSizes() const;
+    const IntSize* resultsButtonSizes() const;
+    void setSearchCellState(RenderObject*, const IntRect&);
+    void setSearchFieldSize(RenderStyle*) const;
+    
+    NSPopUpButtonCell* popupButton() const;
+    NSSearchFieldCell* search() const;
+    NSMenu* searchMenuTemplate() const;
+    NSSliderCell* sliderThumbHorizontal() const;
+    NSSliderCell* sliderThumbVertical() const;
+
+private:
+    mutable RetainPtr<NSPopUpButtonCell> m_popupButton;
+    mutable RetainPtr<NSSearchFieldCell> m_search;
+    mutable RetainPtr<NSMenu> m_searchMenuTemplate;
+    mutable RetainPtr<NSSliderCell> m_sliderThumbHorizontal;
+    mutable RetainPtr<NSSliderCell> m_sliderThumbVertical;
 
-        virtual Color systemColor(int cssValueId) const;
+    bool m_isSliderThumbHorizontalPressed;
+    bool m_isSliderThumbVerticalPressed;
 
-    protected:
-        virtual bool supportsSelectionForegroundColors() const { return false; }
+    mutable HashMap<int, RGBA32> m_systemColorCache;
 
-        // Methods for each appearance value.
-        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setCheckboxSize(RenderStyle*) const;
-
-        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setRadioSize(RenderStyle*) const;
-
-        virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void setButtonSize(RenderStyle*) const;
-
-        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-        virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-        virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-
-    private:
-        RenderThemeChromiumMac();
-        virtual ~RenderThemeChromiumMac();
-
-        IntRect inflateRect(const IntRect&, const IntSize&, const int* margins, float zoomLevel = 1.0f) const;
-
-        // Get the control size based off the font.  Used by some of the controls (like buttons).
-        NSControlSize controlSizeForFont(RenderStyle*) const;
-        NSControlSize controlSizeForSystemFont(RenderStyle*) const;
-        void setControlSize(NSCell*, const IntSize* sizes, const IntSize& minSize, float zoomLevel = 1.0f);
-        void setSizeFromFont(RenderStyle*, const IntSize* sizes) const;
-        IntSize sizeForFont(RenderStyle*, const IntSize* sizes) const;
-        IntSize sizeForSystemFont(RenderStyle*, const IntSize* sizes) const;
-        void setFontFromControlSize(CSSStyleSelector*, RenderStyle*, NSControlSize) const;
-
-        void updateCheckedState(NSCell*, const RenderObject*);
-        void updateEnabledState(NSCell*, const RenderObject*);
-        void updateFocusedState(NSCell*, const RenderObject*);
-        void updatePressedState(NSCell*, const RenderObject*);
-
-        // Helpers for adjusting appearance and for painting
-        const IntSize* checkboxSizes() const;
-        const int* checkboxMargins() const;
-        void setCheckboxCellState(const RenderObject*, const IntRect&);
-
-        const IntSize* radioSizes() const;
-        const int* radioMargins() const;
-        void setRadioCellState(const RenderObject*, const IntRect&);
-
-        void setButtonPaddingFromControlSize(RenderStyle*, NSControlSize) const;
-        const IntSize* buttonSizes() const;
-        const int* buttonMargins() const;
-        void setButtonCellState(const RenderObject*, const IntRect&);
-
-        void setPopupButtonCellState(const RenderObject*, const IntRect&);
-        const IntSize* popupButtonSizes() const;
-        const int* popupButtonMargins() const;
-        const int* popupButtonPadding(NSControlSize) const;
-        void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        const IntSize* menuListSizes() const;
-
-        const IntSize* searchFieldSizes() const;
-        const IntSize* cancelButtonSizes() const;
-        const IntSize* resultsButtonSizes() const;
-        void setSearchCellState(RenderObject*, const IntRect&);
-        void setSearchFieldSize(RenderStyle*) const;
-        
-        NSButtonCell* checkbox() const;
-        NSButtonCell* radio() const;
-        NSButtonCell* button() const;
-        NSPopUpButtonCell* popupButton() const;
-        NSSearchFieldCell* search() const;
-        NSMenu* searchMenuTemplate() const;
-        NSSliderCell* sliderThumbHorizontal() const;
-        NSSliderCell* sliderThumbVertical() const;
-
-    private:
-        mutable RetainPtr<NSButtonCell> m_checkbox;
-        mutable RetainPtr<NSButtonCell> m_radio;
-        mutable RetainPtr<NSButtonCell> m_button;
-        mutable RetainPtr<NSPopUpButtonCell> m_popupButton;
-        mutable RetainPtr<NSSearchFieldCell> m_search;
-        mutable RetainPtr<NSMenu> m_searchMenuTemplate;
-        mutable RetainPtr<NSSliderCell> m_sliderThumbHorizontal;
-        mutable RetainPtr<NSSliderCell> m_sliderThumbVertical;
-
-        bool m_isSliderThumbHorizontalPressed;
-        bool m_isSliderThumbVerticalPressed;
-
-        mutable HashMap<int, RGBA32> m_systemColorCache;
-
-        RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
-    };
+    RetainPtr<WebCoreRenderThemeNotificationObserver> m_notificationObserver;
+    bool paintMediaButtonInternal(GraphicsContext*, const IntRect&, Image*);
+};
 
 } // namespace WebCore
 
-#endif
+#endif // RenderThemeChromiumMac_h
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index 23201c9..bcfcd57 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -1,7 +1,6 @@
 /*
- * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Google, Inc.
- * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,25 +18,16 @@
  * Boston, MA 02110-1301, USA.
  */
 
-// FIXME: we still need to figure out if passing a null view to the cell
-// drawing routines will work. I expect not, and if that's the case we'll have
-// to figure out something else. For now, at least leave the lines commented
-// in, but the procurement of the view if 0'd.
-
 #import "config.h"
 #import "RenderThemeChromiumMac.h"
 
-#import <Carbon/Carbon.h>
-#import <Cocoa/Cocoa.h>
-#import <math.h>
-
 #import "BitmapImage.h"
 #import "ChromiumBridge.h"
 #import "ColorMac.h"
 #import "CSSStyleSelector.h"
 #import "CSSValueKeywords.h"
+#import "Document.h"
 #import "Element.h"
-#import "FoundationExtras.h"
 #import "FrameView.h"
 #import "GraphicsContext.h"
 #import "HTMLInputElement.h"
@@ -47,11 +37,18 @@
 #import "LocalCurrentGraphicsContext.h"
 #import "MediaControlElements.h"
 #import "RenderMedia.h"
+#import "RenderMediaControlsChromium.h"
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
+#import "UserAgentStyleSheets.h"
 #import "WebCoreSystemInterface.h"
+#import "UserAgentStyleSheets.h"
+#import <Carbon/Carbon.h>
+#import <Cocoa/Cocoa.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/StdLibExtras.h>
+#import <math.h>
 
 #ifdef BUILDING_ON_TIGER
 typedef int NSInteger;
@@ -60,6 +57,25 @@ typedef unsigned NSUInteger;
 
 using std::min;
 
+// This file (and its associated .h file) is a clone of RenderThemeMac.mm.
+// Because the original file is designed to run in-process inside a Cocoa view,
+// we must maintain a fork. Please maintain this file by performing parallel
+// changes to it.
+//
+// The only changes from RenderThemeMac should be:
+// - The classname change from RenderThemeMac to RenderThemeChromiumMac.
+// - The introduction of RTCMFlippedView and FlippedView() and its use as the
+//   parent view for cell rendering.
+// - In platformFocusRingColor(), the use of ChromiumBridge to determine if
+//   we're in layout test mode.
+// - updateActiveState() and its use to update the cells' visual appearance.
+// - All the paintMedia*() functions and extraMediaControlsStyleSheet()
+//   are forked from RenderThemeChromiumSkia instead of RenderThemeMac.
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
 // The methods in this file are specific to the Mac OS X platform.
 
 // FIXME: The platform-independent code in this class should be factored out and merged with RenderThemeSafari. 
@@ -84,48 +100,66 @@ using std::min;
     return self;
 }
 
-- (void)systemColorsDidChange:(NSNotification *)notification
+- (void)systemColorsDidChange:(NSNotification *)unusedNotification
 {
-    ASSERT([[notification name] isEqualToString:NSSystemColorsDidChangeNotification]);
+    ASSERT_UNUSED(unusedNotification, [[unusedNotification name] isEqualToString:NSSystemColorsDidChangeNotification]);
     _theme->platformColorsDidChange();
 }
 
 @end
 
+@interface RTCMFlippedView : NSView
+{}
+
+- (BOOL)isFlipped;
+- (NSText *)currentEditor;
+
+@end
+
+@implementation RTCMFlippedView
+
+- (BOOL)isFlipped {
+    return [[NSGraphicsContext currentContext] isFlipped];
+}
+
+- (NSText *)currentEditor {
+    return nil;
+}
+
+@end
+
 namespace WebCore {
 
 using namespace HTMLNames;
 
 enum {
-    TopMargin,
-    RightMargin,
-    BottomMargin,
-    LeftMargin
+    topMargin,
+    rightMargin,
+    bottomMargin,
+    leftMargin
 };
 
 enum {
-    TopPadding,
-    RightPadding,
-    BottomPadding,
-    LeftPadding
+    topPadding,
+    rightPadding,
+    bottomPadding,
+    leftPadding
 };
 
-// In our Mac port, we don't define PLATFORM(MAC) and thus don't pick up the
-// |operator NSRect()| on WebCore::IntRect and FloatRect. This substitues for
-// that missing conversion operator.
-NSRect IntRectToNSRect(const IntRect & rect)
+// In Snow Leopard, many cells only check to see if the view they're passed is
+// flipped, and if a nil view is passed, neglect to check if the current
+// graphics context is flipped. Thus we pass a sham view to them, one whose
+// flipped state just reflects the state of the context.
+NSView* FlippedView()
 {
-    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
+    static NSView* view = [[RTCMFlippedView alloc] init];
+    return view;
 }
 
-NSRect FloatRectToNSRect(const FloatRect & rect)
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page*)
 {
-    return NSMakeRect(rect.x(), rect.y(), rect.width(), rect.height());
-}
-
-IntRect NSRectToIntRect(const NSRect & rect)
-{
-    return IntRect(rect.origin.x, rect.origin.y, rect.size.width, rect.size.height);
+    static RenderTheme* rt = RenderThemeChromiumMac::create().releaseRef();
+    return rt;
 }
 
 PassRefPtr<RenderTheme> RenderThemeChromiumMac::create()
@@ -133,12 +167,6 @@ PassRefPtr<RenderTheme> RenderThemeChromiumMac::create()
     return adoptRef(new RenderThemeChromiumMac);
 }
 
-PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
-{
-    static RenderTheme* rt = RenderThemeChromiumMac::create().releaseRef();
-    return rt;
-}
-
 RenderThemeChromiumMac::RenderThemeChromiumMac()
     : m_isSliderThumbHorizontalPressed(false)
     , m_isSliderThumbVerticalPressed(false)
@@ -173,6 +201,16 @@ Color RenderThemeChromiumMac::platformActiveListBoxSelectionBackgroundColor() co
     return Color(static_cast<int>(255.0 * [color redComponent]), static_cast<int>(255.0 * [color greenComponent]), static_cast<int>(255.0 * [color blueComponent]));
 }
 
+Color RenderThemeChromiumMac::platformActiveListBoxSelectionForegroundColor() const
+{
+    return Color::white;
+}
+
+Color RenderThemeChromiumMac::platformInactiveListBoxSelectionForegroundColor() const
+{
+    return Color::black;
+}
+
 Color RenderThemeChromiumMac::platformFocusRingColor() const
 {
     if (ChromiumBridge::layoutTestMode())
@@ -181,6 +219,11 @@ Color RenderThemeChromiumMac::platformFocusRingColor() const
     return systemColor(CSSValueWebkitFocusRingColor);
 }
 
+Color RenderThemeChromiumMac::platformInactiveListBoxSelectionBackgroundColor() const
+{
+    return platformInactiveSelectionBackgroundColor();
+}
+
 static FontWeight toFontWeight(NSInteger appKitFontWeight)
 {
     ASSERT(appKitFontWeight > 0 && appKitFontWeight < 15);
@@ -210,51 +253,51 @@ static FontWeight toFontWeight(NSInteger appKitFontWeight)
 
 void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDescription) const
 {
-    static FontDescription systemFont;
-    static FontDescription smallSystemFont;
-    static FontDescription menuFont;
-    static FontDescription labelFont;
-    static FontDescription miniControlFont;
-    static FontDescription smallControlFont;
-    static FontDescription controlFont;
+    DEFINE_STATIC_LOCAL(FontDescription, systemFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, smallSystemFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, menuFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, labelFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, miniControlFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, smallControlFont, ());
+    DEFINE_STATIC_LOCAL(FontDescription, controlFont, ());
 
     FontDescription* cachedDesc;
     NSFont* font = nil;
     switch (cssValueId) {
-    case CSSValueSmallCaption:
-        cachedDesc = &smallSystemFont;
-        if (!smallSystemFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
-        break;
-    case CSSValueMenu:
-        cachedDesc = &menuFont;
-        if (!menuFont.isAbsoluteSize())
-            font = [NSFont menuFontOfSize:[NSFont systemFontSize]];
-        break;
-    case CSSValueStatusBar:
-        cachedDesc = &labelFont;
-        if (!labelFont.isAbsoluteSize())
-            font = [NSFont labelFontOfSize:[NSFont labelFontSize]];
-        break;
-    case CSSValueWebkitMiniControl:
-        cachedDesc = &miniControlFont;
-        if (!miniControlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSMiniControlSize]];
-        break;
-    case CSSValueWebkitSmallControl:
-        cachedDesc = &smallControlFont;
-        if (!smallControlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSSmallControlSize]];
-        break;
-    case CSSValueWebkitControl:
-        cachedDesc = &controlFont;
-        if (!controlFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSRegularControlSize]];
-        break;
-    default:
-        cachedDesc = &systemFont;
-        if (!systemFont.isAbsoluteSize())
-            font = [NSFont systemFontOfSize:[NSFont systemFontSize]];
+        case CSSValueSmallCaption:
+            cachedDesc = &smallSystemFont;
+            if (!smallSystemFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont smallSystemFontSize]];
+            break;
+        case CSSValueMenu:
+            cachedDesc = &menuFont;
+            if (!menuFont.isAbsoluteSize())
+                font = [NSFont menuFontOfSize:[NSFont systemFontSize]];
+            break;
+        case CSSValueStatusBar:
+            cachedDesc = &labelFont;
+            if (!labelFont.isAbsoluteSize())
+                font = [NSFont labelFontOfSize:[NSFont labelFontSize]];
+            break;
+        case CSSValueWebkitMiniControl:
+            cachedDesc = &miniControlFont;
+            if (!miniControlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSMiniControlSize]];
+            break;
+        case CSSValueWebkitSmallControl:
+            cachedDesc = &smallControlFont;
+            if (!smallControlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSSmallControlSize]];
+            break;
+        case CSSValueWebkitControl:
+            cachedDesc = &controlFont;
+            if (!controlFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSizeForControlSize:NSRegularControlSize]];
+            break;
+        default:
+            cachedDesc = &systemFont;
+            if (!systemFont.isAbsoluteSize())
+                font = [NSFont systemFontOfSize:[NSFont systemFontSize]];
     }
 
     if (font) {
@@ -271,7 +314,7 @@ void RenderThemeChromiumMac::systemFont(int cssValueId, FontDescription& fontDes
 
 static RGBA32 convertNSColorToColor(NSColor *color)
 {
-    NSColor *colorInColorSpace = [color colorUsingColorSpaceName:NSCalibratedRGBColorSpace];
+    NSColor *colorInColorSpace = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
     if (colorInColorSpace) {
         static const double scaleFactor = nextafter(256.0, 0.0);
         return makeRGB(static_cast<int>(scaleFactor * [colorInColorSpace redComponent]),
@@ -291,7 +334,7 @@ static RGBA32 convertNSColorToColor(NSColor *color)
                                                                         samplesPerPixel:4
                                                                                hasAlpha:YES
                                                                                isPlanar:NO
-                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                         colorSpaceName:NSDeviceRGBColorSpace
                                                                             bytesPerRow:4
                                                                            bitsPerPixel:32];
 
@@ -318,7 +361,7 @@ static RGBA32 menuBackgroundColor()
                                                                         samplesPerPixel:4
                                                                                hasAlpha:YES
                                                                                isPlanar:NO
-                                                                         colorSpaceName:NSCalibratedRGBColorSpace
+                                                                         colorSpaceName:NSDeviceRGBColorSpace
                                                                             bytesPerRow:4
                                                                            bitsPerPixel:32];
 
@@ -350,101 +393,101 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
     
     Color color;
     switch (cssValueId) {
-    case CSSValueActiveborder:
-        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
-        break;
-    case CSSValueActivecaption:
-        color = convertNSColorToColor([NSColor windowFrameTextColor]);
-        break;
-    case CSSValueAppworkspace:
-        color = convertNSColorToColor([NSColor headerColor]);
-        break;
-    case CSSValueBackground:
-        // Use theme independent default
-        break;
-    case CSSValueButtonface:
-        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
-        // We may want to change this to use the NSColor in future.
-        color = 0xFFC0C0C0;
-        break;
-    case CSSValueButtonhighlight:
-        color = convertNSColorToColor([NSColor controlHighlightColor]);
-        break;
-    case CSSValueButtonshadow:
-        color = convertNSColorToColor([NSColor controlShadowColor]);
-        break;
-    case CSSValueButtontext:
-        color = convertNSColorToColor([NSColor controlTextColor]);
-        break;
-    case CSSValueCaptiontext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueGraytext:
-        color = convertNSColorToColor([NSColor disabledControlTextColor]);
-        break;
-    case CSSValueHighlight:
-        color = convertNSColorToColor([NSColor selectedTextBackgroundColor]);
-        break;
-    case CSSValueHighlighttext:
-        color = convertNSColorToColor([NSColor selectedTextColor]);
-        break;
-    case CSSValueInactiveborder:
-        color = convertNSColorToColor([NSColor controlBackgroundColor]);
-        break;
-    case CSSValueInactivecaption:
-        color = convertNSColorToColor([NSColor controlBackgroundColor]);
-        break;
-    case CSSValueInactivecaptiontext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueInfobackground:
-        // There is no corresponding NSColor for this so we use a hard coded value.
-        color = 0xFFFBFCC5;
-        break;
-    case CSSValueInfotext:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueMenu:
-        color = menuBackgroundColor();
-        break;
-    case CSSValueMenutext:
-        color = convertNSColorToColor([NSColor selectedMenuItemTextColor]);
-        break;
-    case CSSValueScrollbar:
-        color = convertNSColorToColor([NSColor scrollBarColor]);
-        break;
-    case CSSValueText:
-        color = convertNSColorToColor([NSColor textColor]);
-        break;
-    case CSSValueThreeddarkshadow:
-        color = convertNSColorToColor([NSColor controlDarkShadowColor]);
-        break;
-    case CSSValueThreedshadow:
-        color = convertNSColorToColor([NSColor shadowColor]);
-        break;
-    case CSSValueThreedface:
-        // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
-        // We may want to change this to use the NSColor in future.
-        color = 0xFFC0C0C0;
-        break;
-    case CSSValueThreedhighlight:
-        color = convertNSColorToColor([NSColor highlightColor]);
-        break;
-    case CSSValueThreedlightshadow:
-        color = convertNSColorToColor([NSColor controlLightHighlightColor]);
-        break;
-    case CSSValueWebkitFocusRingColor:
-        color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
-        break;
-    case CSSValueWindow:
-        color = convertNSColorToColor([NSColor windowBackgroundColor]);
-        break;
-    case CSSValueWindowframe:
-        color = convertNSColorToColor([NSColor windowFrameColor]);
-        break;
-    case CSSValueWindowtext:
-        color = convertNSColorToColor([NSColor windowFrameTextColor]);
-        break;
+        case CSSValueActiveborder:
+            color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+            break;
+        case CSSValueActivecaption:
+            color = convertNSColorToColor([NSColor windowFrameTextColor]);
+            break;
+        case CSSValueAppworkspace:
+            color = convertNSColorToColor([NSColor headerColor]);
+            break;
+        case CSSValueBackground:
+            // Use theme independent default
+            break;
+        case CSSValueButtonface:
+            // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+            // We may want to change this to use the NSColor in future.
+            color = 0xFFC0C0C0;
+            break;
+        case CSSValueButtonhighlight:
+            color = convertNSColorToColor([NSColor controlHighlightColor]);
+            break;
+        case CSSValueButtonshadow:
+            color = convertNSColorToColor([NSColor controlShadowColor]);
+            break;
+        case CSSValueButtontext:
+            color = convertNSColorToColor([NSColor controlTextColor]);
+            break;
+        case CSSValueCaptiontext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueGraytext:
+            color = convertNSColorToColor([NSColor disabledControlTextColor]);
+            break;
+        case CSSValueHighlight:
+            color = convertNSColorToColor([NSColor selectedTextBackgroundColor]);
+            break;
+        case CSSValueHighlighttext:
+            color = convertNSColorToColor([NSColor selectedTextColor]);
+            break;
+        case CSSValueInactiveborder:
+            color = convertNSColorToColor([NSColor controlBackgroundColor]);
+            break;
+        case CSSValueInactivecaption:
+            color = convertNSColorToColor([NSColor controlBackgroundColor]);
+            break;
+        case CSSValueInactivecaptiontext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueInfobackground:
+            // There is no corresponding NSColor for this so we use a hard coded value.
+            color = 0xFFFBFCC5;
+            break;
+        case CSSValueInfotext:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueMenu:
+            color = menuBackgroundColor();
+            break;
+        case CSSValueMenutext:
+            color = convertNSColorToColor([NSColor selectedMenuItemTextColor]);
+            break;
+        case CSSValueScrollbar:
+            color = convertNSColorToColor([NSColor scrollBarColor]);
+            break;
+        case CSSValueText:
+            color = convertNSColorToColor([NSColor textColor]);
+            break;
+        case CSSValueThreeddarkshadow:
+            color = convertNSColorToColor([NSColor controlDarkShadowColor]);
+            break;
+        case CSSValueThreedshadow:
+            color = convertNSColorToColor([NSColor shadowColor]);
+            break;
+        case CSSValueThreedface:
+            // We use this value instead of NSColor's controlColor to avoid website incompatibilities.
+            // We may want to change this to use the NSColor in future.
+            color = 0xFFC0C0C0;
+            break;
+        case CSSValueThreedhighlight:
+            color = convertNSColorToColor([NSColor highlightColor]);
+            break;
+        case CSSValueThreedlightshadow:
+            color = convertNSColorToColor([NSColor controlLightHighlightColor]);
+            break;
+        case CSSValueWebkitFocusRingColor:
+            color = convertNSColorToColor([NSColor keyboardFocusIndicatorColor]);
+            break;
+        case CSSValueWindow:
+            color = convertNSColorToColor([NSColor windowBackgroundColor]);
+            break;
+        case CSSValueWindowframe:
+            color = convertNSColorToColor([NSColor windowFrameColor]);
+            break;
+        case CSSValueWindowtext:
+            color = convertNSColorToColor([NSColor windowFrameTextColor]);
+            break;
     }
 
     if (!color.isValid())
@@ -457,7 +500,7 @@ Color RenderThemeChromiumMac::systemColor(int cssValueId) const
 }
 
 bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const BorderData& border,
-                                             const FillLayer& background, const Color& backgroundColor) const
+                                     const FillLayer& background, const Color& backgroundColor) const
 {
     if (style->appearance() == TextFieldPart || style->appearance() == TextAreaPart || style->appearance() == ListboxPart)
         return style->border() != border;
@@ -472,62 +515,32 @@ bool RenderThemeChromiumMac::isControlStyled(const RenderStyle* style, const Bor
     return RenderTheme::isControlStyled(style, border, background, backgroundColor);
 }
 
-// FIXME: Use the code from the old upstream version, before it was converted to the new theme API in r37731.
 void RenderThemeChromiumMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
 {
-    float zoomLevel = o->style()->effectiveZoom();
-
-    switch (o->style()->appearance()) {
-    case CheckboxPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setCheckboxCellState(o, r);
-
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        IntSize size = checkboxSizes()[[checkbox() controlSize]];
-        size.setHeight(size.height() * zoomLevel);
-        size.setWidth(size.width() * zoomLevel);
-        r = inflateRect(r, size, checkboxMargins(), zoomLevel);
-        break;
+    ControlPart part = o->style()->appearance();
+    
+#if USE(NEW_THEME)
+    switch (part) {
+        case CheckboxPart:
+        case RadioPart:
+        case PushButtonPart:
+        case SquareButtonPart:
+        case DefaultButtonPart:
+        case ButtonPart:
+            return RenderTheme::adjustRepaintRect(o, r);
+        default:
+            break;
     }
-    case RadioPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setRadioCellState(o, r);
+#endif
 
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        IntSize size = radioSizes()[[radio() controlSize]];
-        size.setHeight(size.height() * zoomLevel);
-        size.setWidth(size.width() * zoomLevel);
-        r = inflateRect(r, size, radioMargins(), zoomLevel);
-        break;
-    }
-    case PushButtonPart:
-    case DefaultButtonPart:
-    case ButtonPart: {
-        // Since we query the prototype cell, we need to update its state to match.
-        setButtonCellState(o, r);
-
-        // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-        // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-        if ([button() bezelStyle] == NSRoundedBezelStyle) {
-            IntSize size = buttonSizes()[[button() controlSize]];
-            size.setHeight(size.height() * zoomLevel);
-            size.setWidth(r.width());
-            r = inflateRect(r, size, buttonMargins(), zoomLevel);
-        }
-        break;
-    }
-    case MenulistPart: {
+    float zoomLevel = o->style()->effectiveZoom();
+
+    if (part == MenulistPart) {
         setPopupButtonCellState(o, r);
         IntSize size = popupButtonSizes()[[popupButton() controlSize]];
         size.setHeight(size.height() * zoomLevel);
         size.setWidth(r.width());
         r = inflateRect(r, size, popupButtonMargins(), zoomLevel);
-        break;
-    }
-    default:
-        break;
     }
 }
 
@@ -535,20 +548,61 @@ IntRect RenderThemeChromiumMac::inflateRect(const IntRect& r, const IntSize& siz
 {
     // Only do the inflation if the available width/height are too small.  Otherwise try to
     // fit the glow/check space into the available box's width/height.
-    int widthDelta = r.width() - (size.width() + margins[LeftMargin] * zoomLevel + margins[RightMargin] * zoomLevel);
-    int heightDelta = r.height() - (size.height() + margins[TopMargin] * zoomLevel + margins[BottomMargin] * zoomLevel);
+    int widthDelta = r.width() - (size.width() + margins[leftMargin] * zoomLevel + margins[rightMargin] * zoomLevel);
+    int heightDelta = r.height() - (size.height() + margins[topMargin] * zoomLevel + margins[bottomMargin] * zoomLevel);
     IntRect result(r);
     if (widthDelta < 0) {
-        result.setX(result.x() - margins[LeftMargin] * zoomLevel);
+        result.setX(result.x() - margins[leftMargin] * zoomLevel);
         result.setWidth(result.width() - widthDelta);
     }
     if (heightDelta < 0) {
-        result.setY(result.y() - margins[TopMargin] * zoomLevel);
+        result.setY(result.y() - margins[topMargin] * zoomLevel);
         result.setHeight(result.height() - heightDelta);
     }
     return result;
 }
 
+FloatRect RenderThemeChromiumMac::convertToPaintingRect(const RenderObject* inputRenderer, const RenderObject* partRenderer, const FloatRect& inputRect, const IntRect& r) const
+{
+    FloatRect partRect(inputRect);
+    
+    // Compute an offset between the part renderer and the input renderer
+    FloatSize offsetFromInputRenderer;
+    const RenderObject* renderer = partRenderer;
+    while (renderer && renderer != inputRenderer) {
+        RenderObject* containingRenderer = renderer->container();
+        offsetFromInputRenderer -= renderer->offsetFromContainer(containingRenderer);
+        renderer = containingRenderer;
+    }
+    // If the input renderer was not a container, something went wrong
+    ASSERT(renderer == inputRenderer);
+    // Move the rect into partRenderer's coords
+    partRect.move(offsetFromInputRenderer);
+    // Account for the local drawing offset (tx, ty)
+    partRect.move(r.x(), r.y());
+
+    return partRect;
+}
+
+// Updates the control tint (a.k.a. active state) of |cell| (from |o|).
+// In the Chromium port, the renderer runs as a background process and controls'
+// NSCell(s) lack a parent NSView. Therefore controls don't have their tint
+// color updated correctly when the application is activated/deactivated.
+// FocusController's setActive() is called when the application is
+// activated/deactivated, which causes a repaint at which time this code is
+// called.
+// This function should be called before drawing any NSCell-derived controls,
+// unless you're sure it isn't needed.
+void RenderThemeChromiumMac::updateActiveState(NSCell* cell, const RenderObject* o)
+{
+    NSControlTint oldTint = [cell controlTint];
+    NSControlTint tint = isActive(o) ? [NSColor currentControlTint] :
+                                       NSClearControlTint;
+
+    if (tint != oldTint)
+        [cell setControlTint:tint];
+}
+
 void RenderThemeChromiumMac::updateCheckedState(NSCell* cell, const RenderObject* o)
 {
     bool oldIndeterminate = [cell state] == NSMixedState;
@@ -589,19 +643,6 @@ void RenderThemeChromiumMac::updatePressedState(NSCell* cell, const RenderObject
         [cell setHighlighted:pressed];
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-int RenderThemeChromiumMac::baselinePosition(const RenderObject* o) const
-{
-    if (!o->isBox())
-        return 0;
-
-    if (o->style()->appearance() == CheckboxPart || o->style()->appearance() == RadioPart) {
-        const RenderBox* box = toRenderBox(o);
-        return box->marginTop() + box->height() - 2 * o->style()->effectiveZoom(); // The baseline is 2px up from the bottom of the checkbox/radio in AppKit.
-    }
-    return RenderTheme::baselinePosition(o);
-}
-
 bool RenderThemeChromiumMac::controlSupportsTints(const RenderObject* o) const
 {
     // An alternate way to implement this would be to get the appropriate cell object
@@ -673,7 +714,7 @@ void RenderThemeChromiumMac::setSizeFromFont(RenderStyle* style, const IntSize*
         style->setHeight(Length(size.height(), Fixed));
 }
 
-void RenderThemeChromiumMac::setFontFromControlSize(CSSStyleSelector* selector, RenderStyle* style, NSControlSize controlSize) const
+void RenderThemeChromiumMac::setFontFromControlSize(CSSStyleSelector*, RenderStyle* style, NSControlSize controlSize) const
 {
     FontDescription fontDescription;
     fontDescription.setIsAbsoluteSize(true);
@@ -701,349 +742,10 @@ NSControlSize RenderThemeChromiumMac::controlSizeForSystemFont(RenderStyle* styl
     return NSMiniControlSize;
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setCheckboxCellState(o, r);
-
-    paintInfo.context->save();
-
-    float zoomLevel = o->style()->effectiveZoom();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-    NSButtonCell* checkbox = this->checkbox();
-    IntSize size = checkboxSizes()[[checkbox controlSize]];
-    size.setWidth(size.width() * zoomLevel);
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = inflateRect(r, size, checkboxMargins(), zoomLevel);
-    
-    if (zoomLevel != 1.0f) {
-        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-    }
-    
-    [checkbox drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
-    [checkbox setControlView:nil];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::checkboxSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(14, 14), IntSize(12, 12), IntSize(10, 10) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::checkboxMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 3, 4, 4, 2 },
-        { 4, 3, 3, 3 },
-        { 4, 3, 3, 3 },
-    };
-    return margins[[checkbox() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setCheckboxCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* checkbox = this->checkbox();
-
-    // Set the control size based off the rectangle we're painting into.
-    setControlSize(checkbox, checkboxSizes(), r.size(), o->style()->effectiveZoom());
-
-    // Update the various states we respond to.
-    updateCheckedState(checkbox, o);
-    updateEnabledState(checkbox, o);
-    updatePressedState(checkbox, o);
-    updateFocusedState(checkbox, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setCheckboxSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, checkboxSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintRadio(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setRadioCellState(o, r);
-
-    paintInfo.context->save();
-
-    float zoomLevel = o->style()->effectiveZoom();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the checkbox
-    // shadow" and the check.  We don't consider this part of the bounds of the control in WebKit.
-    NSButtonCell* radio = this->radio();
-    IntSize size = radioSizes()[[radio controlSize]];
-    size.setWidth(size.width() * zoomLevel);
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = inflateRect(r, size, radioMargins(), zoomLevel);
-    
-    if (zoomLevel != 1.0f) {
-        inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-        inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-        paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-        paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-        paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-    }
-
-    [radio drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:nil];
-    [radio setControlView:nil];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::radioSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(14, 15), IntSize(12, 13), IntSize(10, 10) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::radioMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 2, 2, 4, 2 },
-        { 3, 2, 3, 2 },
-        { 1, 0, 2, 0 },
-    };
-    return margins[[radio() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setRadioCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* radio = this->radio();
-
-    // Set the control size based off the rectangle we're painting into.
-    setControlSize(radio, radioSizes(), r.size(), o->style()->effectiveZoom());
-
-    // Update the various states we respond to.
-    updateCheckedState(radio, o);
-    updateEnabledState(radio, o);
-    updatePressedState(radio, o);
-    updateFocusedState(radio, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setRadioSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, radioSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonPaddingFromControlSize(RenderStyle* style, NSControlSize size) const
-{
-    // Just use 8px.  AppKit wants to use 11px for mini buttons, but that padding is just too large
-    // for real-world Web sites (creating a huge necessary minimum width for buttons whose space is
-    // by definition constrained, since we select mini only for small cramped environments.
-    // This also guarantees the HTML4 <button> will match our rendering by default, since we're using a consistent
-    // padding.
-    const int padding = 8 * style->effectiveZoom();
-    style->setPaddingLeft(Length(padding, Fixed));
-    style->setPaddingRight(Length(padding, Fixed));
-    style->setPaddingTop(Length(0, Fixed));
-    style->setPaddingBottom(Length(0, Fixed));
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
-{
-    // There are three appearance constants for buttons.
-    // (1) Push-button is the constant for the default Aqua system button.  Push buttons will not scale vertically and will not allow
-    // custom fonts or colors.  <input>s use this constant.  This button will allow custom colors and font weights/variants but won't
-    // scale vertically.
-    // (2) square-button is the constant for the square button.  This button will allow custom fonts and colors and will scale vertically.
-    // (3) Button is the constant that means "pick the best button as appropriate."  <button>s use this constant.  This button will
-    // also scale vertically and allow custom fonts and colors.  It will attempt to use Aqua if possible and will make this determination
-    // solely on the rectangle of the control.
-
-    // Determine our control size based off our font.
-    NSControlSize controlSize = controlSizeForFont(style);
-
-    if (style->appearance() == PushButtonPart) {
-        // Ditch the border.
-        style->resetBorder();
-
-        // Height is locked to auto.
-        style->setHeight(Length(Auto));
-
-        // White-space is locked to pre
-        style->setWhiteSpace(PRE);
-
-        // Set the button's vertical size.
-        setButtonSize(style);
-
-        // Add in the padding that we'd like to use.
-        setButtonPaddingFromControlSize(style, controlSize);
-
-        // Our font is locked to the appropriate system font size for the control.  To clarify, we first use the CSS-specified font to figure out
-        // a reasonable control size, but once that control size is determined, we throw that font away and use the appropriate
-        // system font for the control size instead.
-        setFontFromControlSize(selector, style, controlSize);
-    } else {
-        // Set a min-height so that we can't get smaller than the mini button.
-        style->setMinHeight(Length(static_cast<int>(15 * style->effectiveZoom()), Fixed));
-
-        // Reset the top and bottom borders.
-        style->resetBorderTop();
-        style->resetBorderBottom();
-    }
-
-    style->setBoxShadow(0);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const IntSize* RenderThemeChromiumMac::buttonSizes() const
-{
-    static const IntSize sizes[3] = { IntSize(0, 21), IntSize(0, 18), IntSize(0, 15) };
-    return sizes;
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-const int* RenderThemeChromiumMac::buttonMargins() const
-{
-    static const int margins[3][4] =
-    {
-        { 4, 6, 7, 6 },
-        { 4, 5, 6, 5 },
-        { 0, 1, 1, 1 },
-    };
-    return margins[[button() controlSize]];
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonSize(RenderStyle* style) const
-{
-    // If the width and height are both specified, then we have nothing to do.
-    if (!style->width().isIntrinsicOrAuto() && !style->height().isAuto())
-        return;
-
-    // Use the font size to determine the intrinsic width of the control.
-    setSizeFromFont(style, buttonSizes());
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-void RenderThemeChromiumMac::setButtonCellState(const RenderObject* o, const IntRect& r)
-{
-    NSButtonCell* button = this->button();
-
-    // Set the control size based off the rectangle we're painting into.
-    if (o->style()->appearance() == SquareButtonPart ||
-        r.height() > buttonSizes()[NSRegularControlSize].height() * o->style()->effectiveZoom()) {
-        // Use the square button
-        if ([button bezelStyle] != NSShadowlessSquareBezelStyle)
-            [button setBezelStyle:NSShadowlessSquareBezelStyle];
-    } else if ([button bezelStyle] != NSRoundedBezelStyle)
-        [button setBezelStyle:NSRoundedBezelStyle];
-
-    setControlSize(button, buttonSizes(), r.size(), o->style()->effectiveZoom());
-
-    NSWindow *window = [nil window];
-    BOOL isDefaultButton = (isDefault(o) && [window isKeyWindow]);
-    [button setKeyEquivalent:(isDefaultButton ? @"\r" : @"")];
-
-    // Update the various states we respond to.
-    updateCheckedState(button, o);
-    updateEnabledState(button, o);
-    updatePressedState(button, o);
-    updateFocusedState(button, o);
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-bool RenderThemeChromiumMac::paintButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
-{
-    NSButtonCell* button = this->button();
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
-    // Determine the width and height needed for the control and prepare the cell for painting.
-    setButtonCellState(o, r);
-
-    paintInfo.context->save();
-
-    // We inflate the rect as needed to account for padding included in the cell to accommodate the button
-    // shadow.  We don't consider this part of the bounds of the control in WebKit.
-    float zoomLevel = o->style()->effectiveZoom();
-    IntSize size = buttonSizes()[[button controlSize]];
-    size.setWidth(r.width());
-    size.setHeight(size.height() * zoomLevel);
-    IntRect inflatedRect = r;
-    if ([button bezelStyle] == NSRoundedBezelStyle) {
-        // Center the button within the available space.
-        if (inflatedRect.height() > size.height()) {
-            inflatedRect.setY(inflatedRect.y() + (inflatedRect.height() - size.height()) / 2);
-            inflatedRect.setHeight(size.height());
-        }
-
-        // Now inflate it to account for the shadow.
-        inflatedRect = inflateRect(inflatedRect, size, buttonMargins(), zoomLevel);
-
-        if (zoomLevel != 1.0f) {
-            inflatedRect.setWidth(inflatedRect.width() / zoomLevel);
-            inflatedRect.setHeight(inflatedRect.height() / zoomLevel);
-            paintInfo.context->translate(inflatedRect.x(), inflatedRect.y());
-            paintInfo.context->scale(FloatSize(zoomLevel, zoomLevel));
-            paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
-        }
-    } 
-
-    NSView *view = nil;
-    NSWindow *window = [view window];
-    NSButtonCell *previousDefaultButtonCell = [window defaultButtonCell];
-
-    if (isDefault(o) && [window isKeyWindow]) {
-        [window setDefaultButtonCell:button];
-        wkAdvanceDefaultButtonPulseAnimation(button);
-    } else if ([previousDefaultButtonCell isEqual:button])
-        [window setDefaultButtonCell:nil];
-
-    [button drawWithFrame:NSRect(IntRectToNSRect(inflatedRect)) inView:view];
-    [button setControlView:nil];
-
-    if (![previousDefaultButtonCell isEqual:button])
-        [window setDefaultButtonCell:previousDefaultButtonCell];
-
-    paintInfo.context->restore();
-
-    return false;
-}
-
 bool RenderThemeChromiumMac::paintTextField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawBezeledTextFieldCell(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    wkDrawBezeledTextFieldCell(r, isEnabled(o) && !isReadOnlyControl(o));
     return false;
 }
 
@@ -1051,7 +753,7 @@ void RenderThemeChromiumMac::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle
 {
 }
 
-bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     if (paintInfo.context->paintingDisabled())
         return true;
@@ -1065,7 +767,7 @@ bool RenderThemeChromiumMac::paintCapsLockIndicator(RenderObject* o, const Rende
 bool RenderThemeChromiumMac::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawBezeledTextArea(IntRectToNSRect(r), isEnabled(o) && !isReadOnlyControl(o));
+    wkDrawBezeledTextArea(r, isEnabled(o) && !isReadOnlyControl(o));
     return false;
 }
 
@@ -1103,8 +805,6 @@ const int* RenderThemeChromiumMac::popupButtonPadding(NSControlSize size) const
 
 bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     setPopupButtonCellState(o, r);
 
     NSPopUpButtonCell* popupButton = this->popupButton();
@@ -1134,7 +834,7 @@ bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::
         paintInfo.context->translate(-inflatedRect.x(), -inflatedRect.y());
     }
 
-    [popupButton drawWithFrame:IntRectToNSRect(inflatedRect) inView:nil];
+    [popupButton drawWithFrame:inflatedRect inView:FlippedView()];
     [popupButton setControlView:nil];
 
     paintInfo.context->restore();
@@ -1142,19 +842,19 @@ bool RenderThemeChromiumMac::paintMenuList(RenderObject* o, const RenderObject::
     return false;
 }
 
-static const float baseFontSize = 11.0f;
-static const float baseArrowHeight = 4.0f;
-static const float baseArrowWidth = 5.0f;
-static const float baseSpaceBetweenArrows = 2.0f;
-static const int arrowPaddingLeft = 6;
-static const int arrowPaddingRight = 6;
-static const int paddingBeforeSeparator = 4;
-static const int baseBorderRadius = 5;
-static const int styledPopupPaddingLeft = 8;
-static const int styledPopupPaddingTop = 1;
-static const int styledPopupPaddingBottom = 2;
+const float baseFontSize = 11.0f;
+const float baseArrowHeight = 4.0f;
+const float baseArrowWidth = 5.0f;
+const float baseSpaceBetweenArrows = 2.0f;
+const int arrowPaddingLeft = 6;
+const int arrowPaddingRight = 6;
+const int paddingBeforeSeparator = 4;
+const int baseBorderRadius = 5;
+const int styledPopupPaddingLeft = 8;
+const int styledPopupPaddingTop = 1;
+const int styledPopupPaddingBottom = 2;
 
-static void TopGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void TopGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.4f };
     static float light[4] = { 1.0f, 1.0f, 1.0f, 0.15f };
@@ -1164,7 +864,7 @@ static void TopGradientInterpolate(void* info, const CGFloat* inData, CGFloat* o
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void BottomGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void BottomGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 1.0f, 1.0f, 1.0f, 0.0f };
     static float light[4] = { 1.0f, 1.0f, 1.0f, 0.3f };
@@ -1174,7 +874,7 @@ static void BottomGradientInterpolate(void* info, const CGFloat* inData, CGFloat
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void MainGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void MainGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.15f };
     static float light[4] = { 0.0f, 0.0f, 0.0f, 0.0f };
@@ -1184,7 +884,7 @@ static void MainGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat* outData)
+static void TrackGradientInterpolate(void*, const CGFloat* inData, CGFloat* outData)
 {
     static float dark[4] = { 0.0f, 0.0f, 0.0f, 0.678f };
     static float light[4] = { 0.0f, 0.0f, 0.0f, 0.13f };
@@ -1196,11 +896,21 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
 
 void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -1223,33 +933,27 @@ void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -1259,8 +963,6 @@ void RenderThemeChromiumMac::paintMenuListButtonGradients(RenderObject* o, const
 
 bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -1279,6 +981,8 @@ bool RenderThemeChromiumMac::paintMenuListButton(RenderObject* o, const RenderOb
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
         return false;
     
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeStyle(NoStroke);
 
@@ -1357,7 +1061,7 @@ void RenderThemeChromiumMac::adjustMenuListStyle(CSSStyleSelector* selector, Ren
 int RenderThemeChromiumMac::popupInternalPaddingLeft(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[LeftPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[leftPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingLeft * style->effectiveZoom();
     return 0;
@@ -1366,7 +1070,7 @@ int RenderThemeChromiumMac::popupInternalPaddingLeft(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingRight(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[RightPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[rightPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart) {
         float fontScale = style->fontSize() / baseFontSize;
         float arrowWidth = baseArrowWidth * fontScale;
@@ -1378,7 +1082,7 @@ int RenderThemeChromiumMac::popupInternalPaddingRight(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingTop(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[TopPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[topPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingTop * style->effectiveZoom();
     return 0;
@@ -1387,13 +1091,13 @@ int RenderThemeChromiumMac::popupInternalPaddingTop(RenderStyle* style) const
 int RenderThemeChromiumMac::popupInternalPaddingBottom(RenderStyle* style) const
 {
     if (style->appearance() == MenulistPart)
-        return popupButtonPadding(controlSizeForFont(style))[BottomPadding] * style->effectiveZoom();
+        return popupButtonPadding(controlSizeForFont(style))[bottomPadding] * style->effectiveZoom();
     if (style->appearance() == MenulistButtonPart)
         return styledPopupPaddingBottom * style->effectiveZoom();
     return 0;
 }
 
-void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     float fontScale = style->fontSize() / baseFontSize;
 
@@ -1414,6 +1118,7 @@ void RenderThemeChromiumMac::setPopupButtonCellState(const RenderObject* o, cons
     setControlSize(popupButton, popupButtonSizes(), r.size(), o->style()->effectiveZoom());
 
     // Update the various states we respond to.
+    updateActiveState(popupButton, o);
     updateCheckedState(popupButton, o);
     updateEnabledState(popupButton, o);
     updatePressedState(popupButton, o);
@@ -1431,16 +1136,16 @@ int RenderThemeChromiumMac::minimumMenuListSize(RenderStyle* style) const
     return sizeForSystemFont(style, menuListSizes()).width();
 }
 
-static const int trackWidth = 5;
-static const int trackRadius = 2;
-
-void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBoxShadow(0);
 }
 
 bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    static const int trackWidth = 5;
+    static const int trackRadius = 2;
+  
     IntRect bounds = r;
     float zoomLevel = o->style()->effectiveZoom();
     float zoomedTrackWidth = trackWidth * zoomLevel;
@@ -1478,12 +1183,12 @@ bool RenderThemeChromiumMac::paintSliderTrack(RenderObject* o, const RenderObjec
     return false;
 }
 
-void RenderThemeChromiumMac::adjustSliderThumbStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     style->setBoxShadow(0);
 }
 
-static const float verticalSliderHeightPadding = 0.1f;
+const float verticalSliderHeightPadding = 0.1f;
 
 bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
@@ -1496,6 +1201,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     LocalCurrentGraphicsContext localContext(paintInfo.context);
 
     // Update the various states we respond to.
+    updateActiveState(sliderThumbCell, o);
     updateEnabledState(sliderThumbCell, o->parent());
     updateFocusedState(sliderThumbCell, o->parent());
 
@@ -1537,7 +1243,7 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [sliderThumbCell drawWithFrame:FloatRectToNSRect(unzoomedRect) inView:nil];
+    [sliderThumbCell drawWithFrame:unzoomedRect inView:FlippedView()];
     [sliderThumbCell setControlView:nil];
 
     paintInfo.context->restore();
@@ -1545,21 +1251,20 @@ bool RenderThemeChromiumMac::paintSliderThumb(RenderObject* o, const RenderObjec
     return false;
 }
 
-const int sliderThumbWidth = 15;
-const int sliderThumbHeight = 15;
-const int mediaSliderThumbWidth = 13;
-const int mediaSliderThumbHeight = 14;
-
 void RenderThemeChromiumMac::adjustSliderThumbSize(RenderObject* o) const
 {
+    static const int sliderThumbWidth = 15;
+    static const int sliderThumbHeight = 15;
+
     float zoomLevel = o->style()->effectiveZoom();
     if (o->style()->appearance() == SliderThumbHorizontalPart || o->style()->appearance() == SliderThumbVerticalPart) {
         o->style()->setWidth(Length(static_cast<int>(sliderThumbWidth * zoomLevel), Fixed));
         o->style()->setHeight(Length(static_cast<int>(sliderThumbHeight * zoomLevel), Fixed));
-    } else if (o->style()->appearance() == MediaSliderThumbPart) {
-        o->style()->setWidth(Length(mediaSliderThumbWidth, Fixed));
-        o->style()->setHeight(Length(mediaSliderThumbHeight, Fixed));
     }
+
+#if ENABLE(VIDEO)
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(o);
+#endif
 }
 
 bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
@@ -1586,7 +1291,7 @@ bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObjec
     // Set the search button to nil before drawing.  Then reset it so we can draw it later.
     [search setSearchButtonCell:nil];
 
-    [search drawWithFrame:NSRect(IntRectToNSRect(unzoomedRect)) inView:nil];
+    [search drawWithFrame:NSRect(unzoomedRect) inView:FlippedView()];
 #ifdef BUILDING_ON_TIGER
     if ([search showsFirstResponder])
         wkDrawTextFieldCellFocusRing(search, NSRect(unzoomedRect));
@@ -1600,13 +1305,14 @@ bool RenderThemeChromiumMac::paintSearchField(RenderObject* o, const RenderObjec
     return false;
 }
 
-void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect& r)
+void RenderThemeChromiumMac::setSearchCellState(RenderObject* o, const IntRect&)
 {
     NSSearchFieldCell* search = this->search();
 
     [search setControlSize:controlSizeForFont(o->style())];
 
     // Update the various states we respond to.
+    updateActiveState(search, o);
     updateEnabledState(search, o);
     updateFocusedState(search, o);
 }
@@ -1627,7 +1333,7 @@ void RenderThemeChromiumMac::setSearchFieldSize(RenderStyle* style) const
     setSizeFromFont(style, searchFieldSizes());
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderStyle* style, Element*) const
 {
     // Override border.
     style->resetBorder();
@@ -1660,22 +1366,25 @@ void RenderThemeChromiumMac::adjustSearchFieldStyle(CSSStyleSelector* selector,
 
 bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search cancelButtonCell], o);
     updatePressedState([search cancelButtonCell], o);
 
     paintInfo.context->save();
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search cancelButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
-    
-    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    FloatRect localBounds = [search cancelButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    FloatRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1684,7 +1393,7 @@ bool RenderThemeChromiumMac::paintSearchFieldCancelButton(RenderObject* o, const
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [[search cancelButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search cancelButtonCell] drawWithFrame:unzoomedRect inView:FlippedView()];
     [[search cancelButtonCell] setControlView:nil];
 
     paintInfo.context->restore();
@@ -1697,7 +1406,7 @@ const IntSize* RenderThemeChromiumMac::cancelButtonSizes() const
     return sizes;
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, cancelButtonSizes());
     style->setWidth(Length(size.width(), Fixed));
@@ -1711,8 +1420,8 @@ const IntSize* RenderThemeChromiumMac::resultsButtonSizes() const
     return sizes;
 }
 
-static const int emptyResultsOffset = 9;
-void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+const int emptyResultsOffset = 9;
+void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width() - emptyResultsOffset, Fixed));
@@ -1720,12 +1429,12 @@ void RenderThemeChromiumMac::adjustSearchFieldDecorationStyle(CSSStyleSelector*
     style->setBoxShadow(0);
 }
 
-bool RenderThemeChromiumMac::paintSearchFieldDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
 {
     return false;
 }
 
-void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width(), Fixed));
@@ -1735,24 +1444,29 @@ void RenderThemeChromiumMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSel
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if ([search searchMenuTemplate] != nil)
         [search setSearchMenuTemplate:nil];
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
-    [[search searchButtonCell] drawWithFrame:bounds inView:nil];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
+
+    [[search searchButtonCell] drawWithFrame:localBounds inView:FlippedView()];
     [[search searchButtonCell] setControlView:nil];
     return false;
 }
 
-static const int resultsArrowWidth = 5;
-void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+const int resultsArrowWidth = 5;
+void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
     IntSize size = sizeForSystemFont(style, resultsButtonSizes());
     style->setWidth(Length(size.width() + resultsArrowWidth, Fixed));
@@ -1762,13 +1476,16 @@ void RenderThemeChromiumMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelecto
 
 bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-
     Node* input = o->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+
     setSearchCellState(input->renderer(), r);
 
     NSSearchFieldCell* search = this->search();
 
+    updateActiveState([search searchButtonCell], o);
+
     if (![search searchMenuTemplate])
         [search setSearchMenuTemplate:searchMenuTemplate()];
 
@@ -1776,9 +1493,10 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 
     float zoomLevel = o->style()->effectiveZoom();
 
-    NSRect bounds = [search searchButtonRectForBounds:NSRect(IntRectToNSRect(input->renderer()->absoluteBoundingBoxRect()))];
+    FloatRect localBounds = [search searchButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+    localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
     
-    IntRect unzoomedRect(NSRectToIntRect(bounds));
+    IntRect unzoomedRect(localBounds);
     if (zoomLevel != 1.0f) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
@@ -1787,7 +1505,7 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
         paintInfo.context->translate(-unzoomedRect.x(), -unzoomedRect.y());
     }
 
-    [[search searchButtonCell] drawWithFrame:IntRectToNSRect(unzoomedRect) inView:nil];
+    [[search searchButtonCell] drawWithFrame:unzoomedRect inView:FlippedView()];
     [[search searchButtonCell] setControlView:nil];
     
     paintInfo.context->restore();
@@ -1796,179 +1514,53 @@ bool RenderThemeChromiumMac::paintSearchFieldResultsButton(RenderObject* o, cons
 }
 
 #if ENABLE(VIDEO)
-// FIXME: This enum is lifted from RenderThemeMac.mm  We need to decide which theme to use for the default controls, or decide to avoid wkDrawMediaUIPart and render our own.
-typedef enum {
-    MediaControllerThemeClassic   = 1,
-    MediaControllerThemeQT        = 2
-} MediaControllerThemeStyle;
-
-enum WKMediaControllerThemeState {
-    MediaUIPartDisabledFlag = 1 << 0,
-    MediaUIPartPressedFlag = 1 << 1,
-    MediaUIPartDrawEndCapsFlag = 1 << 3,
-};
-#endif
-
-bool RenderThemeChromiumMac::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaFullscreenButton, MediaControllerThemeClassic,  paintInfo.context->platformContext(), r, 
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 
-bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-    
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->muted() ? MediaUnMuteButton : MediaMuteButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(mediaElement->canPlay() ? MediaPlayButton : MediaPauseButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekBackButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSeekForwardButton, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    Node* mediaNode = node ? node->shadowAncestorNode() : 0;
-    if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
-        return false;
-
-    HTMLMediaElement* mediaElement = static_cast<HTMLMediaElement*>(mediaNode);
-    if (!mediaElement)
-        return false;
-
-    float timeLoaded = 0;
-    float currentTime = 0;
-    float duration = 0;
-    if (MediaPlayer* player = mediaElement->player()) {
-        duration = player->duration();
-        timeLoaded = player->maxTimeBuffered();
-        currentTime = player->currentTime();
-    }
-
-    bool shouldDrawEndCaps = !toRenderMedia(mediaElement->renderer())->shouldShowTimeDisplayControls();
-    wkDrawMediaSliderTrack(MediaControllerThemeClassic, paintInfo.context->platformContext(), r, timeLoaded, currentTime, duration, shouldDrawEndCaps ? MediaUIPartDrawEndCapsFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-#if ENABLE(VIDEO)
-    Node* node = o->node();
-    if (!node)
-        return false;
-
-    LocalCurrentGraphicsContext localContext(paintInfo.context);
-    wkDrawMediaUIPart(MediaSliderThumb, MediaControllerThemeClassic, paintInfo.context->platformContext(), r,
-        node->active() ? MediaUIPartPressedFlag : 0);
-#endif
-    return false;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 }
 
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::checkbox() const
+bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
-    if (!m_checkbox) {
-        m_checkbox.adoptNS([[NSButtonCell alloc] init]);
-        [m_checkbox.get() setButtonType:NSSwitchButton];
-        [m_checkbox.get() setTitle:nil];
-        [m_checkbox.get() setAllowsMixedState:YES];
-        [m_checkbox.get() setFocusRingType:NSFocusRingTypeExterior];
-    }
-    
-    return m_checkbox.get();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::radio() const
-{
-    if (!m_radio) {
-        m_radio.adoptNS([[NSButtonCell alloc] init]);
-        [m_radio.get() setButtonType:NSRadioButton];
-        [m_radio.get() setTitle:nil];
-        [m_radio.get() setFocusRingType:NSFocusRingTypeExterior];
-    }
     
-    return m_radio.get();
-}
-
-// FIXME: This used to be in the upstream version until it was converted to the new theme API in r37731.
-NSButtonCell* RenderThemeChromiumMac::button() const
+String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
 {
-    if (!m_button) {
-        m_button.adoptNS([[NSButtonCell alloc] init]);
-        [m_button.get() setTitle:nil];
-        [m_button.get() setButtonType:NSMomentaryPushInButton];
-    }
-    
-    return m_button.get();
+    return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
 }
 
+#endif
+
 NSPopUpButtonCell* RenderThemeChromiumMac::popupButton() const
 {
     if (!m_popupButton) {
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index 79804ac..3a39423 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -33,8 +33,11 @@
 #include "MediaControlElements.h"
 #include "PlatformContextSkia.h"
 #include "RenderBox.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
+#include "RenderSlider.h"
 #include "ScrollbarTheme.h"
+#include "TimeRanges.h"
 #include "TransformationMatrix.h"
 #include "UserAgentStyleSheets.h"
 
@@ -70,19 +73,29 @@ static void setSizeIfAuto(RenderStyle* style, const IntSize& size)
         style->setHeight(Length(size.height(), Fixed));
 }
 
-#if ENABLE(VIDEO)
-// Attempt to retrieve a HTMLMediaElement from a Node. Returns NULL if one cannot be found.
-static HTMLMediaElement* mediaElementParent(Node* node)
+static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
 {
-    if (!node)
-        return 0;
-    Node* mediaNode = node->shadowAncestorNode();
-    if (!mediaNode || (!mediaNode->hasTagName(HTMLNames::videoTag) && !mediaNode->hasTagName(HTMLNames::audioTag)))
-        return 0;
+    SkIRect skrect;
+    skrect.set(x, y1, x + 1, y2 + 1);
+    canvas->drawIRect(skrect, paint);
+}
 
-    return static_cast<HTMLMediaElement*>(mediaNode);
+static void drawHorizLine(SkCanvas* canvas, int x1, int x2, int y, const SkPaint& paint)
+{
+    SkIRect skrect;
+    skrect.set(x1, y, x2 + 1, y + 1);
+    canvas->drawIRect(skrect, paint);
+}
+
+static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
+{
+    const int right = rect.x() + rect.width() - 1;
+    const int bottom = rect.y() + rect.height() - 1;
+    drawHorizLine(canvas, rect.x(), right, rect.y(), paint);
+    drawVertLine(canvas, right, rect.y(), bottom, paint);
+    drawHorizLine(canvas, rect.x(), right, bottom, paint);
+    drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
 }
-#endif
 
 // We aim to match IE here.
 // -IE uses a font based on the encoding as the default font for form controls.
@@ -302,7 +315,7 @@ static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObj
     canvas->drawLine(rect.x() + 1, bottom - 1, right - 1, bottom - 1, paint);
     canvas->drawLine(rect.x(), rect.y() + 1, rect.x(), bottom - 1, paint);
 
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     SkPoint p[2];
     const int lightEnd = theme->isPressed(o) ? 1 : 0;
     const int darkEnd = !lightEnd;
@@ -460,42 +473,10 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* o, con
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintMediaButtonInternal(GraphicsContext* context, const IntRect& rect, Image* image)
-{
-    // Create a destination rectangle for the image that is centered in the drawing rectangle, rounded left, and down.
-    IntRect imageRect = image->rect();
-    imageRect.setY(rect.y() + (rect.height() - image->height() + 1) / 2);
-    imageRect.setX(rect.x() + (rect.width() - image->width() + 1) / 2);
-
-    context->drawImage(image, imageRect);
-    return true;
-}
-
 bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    if (!rect.isEmpty())
-    {
-        SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-        SkPaint paint;
-
-        // Draws the left border, it is always 1px wide.
-        paint.setColor(object->style()->borderLeftColor().rgb());
-        canvas->drawLine(rect.x() + 1, rect.y(),
-                         rect.x() + 1, rect.y() + rect.height(),
-                         paint);
-
-        // Draws the right border, it is always 1px wide.
-        paint.setColor(object->style()->borderRightColor().rgb());
-        canvas->drawLine(rect.x() + rect.width() - 1, rect.y(),
-                         rect.x() + rect.width() - 1, rect.y() + rect.height(),
-                         paint);
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -507,62 +488,7 @@ bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object,
 bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    SkCanvas* canvas = paintInfo.context->platformContext()->canvas();
-    SkRect backgroundRect;
-    backgroundRect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-
-    SkPaint paint;
-    paint.setAntiAlias(true);
-
-    // Draw the border of the time bar. The border only has one single color,
-    // width and radius. So use the property of the left border.
-    SkColor borderColor = object->style()->borderLeftColor().rgb();
-    int borderWidth = object->style()->borderLeftWidth();
-    IntSize borderRadius = object->style()->borderTopLeftRadius();
-    paint.setStyle(SkPaint::kStroke_Style);
-    paint.setStrokeWidth(borderWidth);
-    paint.setColor(borderColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    // Draw the background of the time bar.
-    SkColor backgroundColor = object->style()->backgroundColor().rgb();
-    paint.setStyle(SkPaint::kFill_Style);
-    paint.setColor(backgroundColor);
-    canvas->drawRoundRect(backgroundRect, borderRadius.width(), borderRadius.height(), paint);
-
-    if (backgroundRect.width() >= 3 && backgroundRect.height() >= 3)
-    {
-        // Draw the buffered ranges.
-        // FIXME: Draw multiple ranges if there are multiple buffered ranges.
-        SkRect bufferedRect;
-        bufferedRect.set(backgroundRect.fLeft + 2, backgroundRect.fTop + 2,
-                         backgroundRect.fRight - 1, backgroundRect.fBottom - 1);
-        int width = static_cast<int>(bufferedRect.width() * mediaElement->percentLoaded());
-        bufferedRect.fRight = bufferedRect.fLeft + width;
-
-        SkPoint points[2] = { { 0, bufferedRect.fTop }, { 0, bufferedRect.fBottom } };
-        SkColor startColor = object->style()->color().rgb();
-        SkColor endColor = SkColorSetRGB(SkColorGetR(startColor) / 2,
-                                         SkColorGetG(startColor) / 2,
-                                         SkColorGetB(startColor) / 2);
-        SkColor colors[2] = { startColor, endColor };
-        SkShader* gradient = SkGradientShader::CreateLinear(points, colors, 0,
-                                                            sizeof(points) / sizeof(points[0]),
-                                                            SkShader::kMirror_TileMode, 0);
-
-        paint.reset();
-        paint.setShader(gradient);
-        paint.setAntiAlias(true);
-        // Check for round rect with zero width or height, otherwise Skia will assert
-        if (bufferedRect.width() > 0 && bufferedRect.height() > 0)
-            canvas->drawRoundRect(bufferedRect, borderRadius.width(), borderRadius.height(), paint);
-        gradient->unref();
-    }
-    return true;
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -571,14 +497,22 @@ bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const
 #endif
 }
 
-void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const {
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
 #if ENABLE(VIDEO)
-    if (object->style()->appearance() == MediaSliderThumbPart) {
-        static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
 
-        object->style()->setWidth(Length(mediaSliderThumb->width(), Fixed));
-        object->style()->setHeight(Length(mediaSliderThumb->height(), Fixed));
-    }
+void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
+{
+#if ENABLE(VIDEO)
+    RenderMediaControlsChromium::adjustMediaSliderThumbSize(object);
 #else
     UNUSED_PARAM(object);
 #endif
@@ -587,12 +521,19 @@ void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    if (!object->parent()->isSlider())
-        return false;
-
-    static Image* mediaSliderThumb = Image::loadPlatformResource("mediaSliderThumb").releaseRef();
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
 
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaSliderThumb);
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -604,14 +545,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const
 bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* mediaPlay = Image::loadPlatformResource("mediaPlay").releaseRef();
-    static Image* mediaPause = Image::loadPlatformResource("mediaPause").releaseRef();
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->paused() ? mediaPlay : mediaPause);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -623,14 +557,7 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
-    HTMLMediaElement* mediaElement = mediaElementParent(object->node());
-    if (!mediaElement)
-        return false;
-
-    static Image* soundFull = Image::loadPlatformResource("mediaSoundFull").releaseRef();
-    static Image* soundNone = Image::loadPlatformResource("mediaSoundNone").releaseRef();
-
-    return paintMediaButtonInternal(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 #else
     UNUSED_PARAM(object);
     UNUSED_PARAM(paintInfo);
@@ -654,7 +581,7 @@ bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject:
     paintButtonLike(this, o, i, rect);
 
     SkPaint paint;
-    paint.setARGB(0xff, 0, 0, 0);
+    paint.setColor(SK_ColorBLACK);
     paint.setAntiAlias(true);
     paint.setStyle(SkPaint::kFill_Style);
 
@@ -679,6 +606,69 @@ bool RenderThemeChromiumSkia::paintMenuListButton(RenderObject* o, const RenderO
     return paintMenuList(o, i, rect);
 }
 
+bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Just paint a grey box for now (matches the color of a scrollbar background.
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+    int verticalCenter = rect.y() + rect.height() / 2;
+    int top = std::max(rect.y(), verticalCenter - 2);
+    int bottom = std::min(rect.y() + rect.height(), verticalCenter + 2);
+
+    SkPaint paint;
+    const SkColor grey = SkColorSetARGB(0xff, 0xe3, 0xdd, 0xd8);
+    paint.setColor(grey);
+
+    SkRect skrect;
+    skrect.set(rect.x(), top, rect.x() + rect.width(), bottom);
+    canvas->drawRect(skrect, paint);
+
+    return false;
+}
+
+bool RenderThemeChromiumSkia::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+{
+    // Make a thumb similar to the scrollbar thumb.
+    const bool hovered = isHovered(o) || toRenderSlider(o->parent())->inDragMode();
+    const int midx = rect.x() + rect.width() / 2;
+    const int midy = rect.y() + rect.height() / 2;
+    const bool vertical = (o->style()->appearance() == SliderThumbVerticalPart);
+    SkCanvas* const canvas = i.context->platformContext()->canvas();
+
+    const SkColor thumbLightGrey = SkColorSetARGB(0xff, 0xf4, 0xf2, 0xef);
+    const SkColor thumbDarkGrey = SkColorSetARGB(0xff, 0xea, 0xe5, 0xe0);
+    SkPaint paint;
+    paint.setColor(hovered ? SK_ColorWHITE : thumbLightGrey);
+
+    SkIRect skrect;
+    if (vertical)
+        skrect.set(rect.x(), rect.y(), midx + 1, rect.bottom());
+    else
+        skrect.set(rect.x(), rect.y(), rect.right(), midy + 1);
+
+    canvas->drawIRect(skrect, paint);
+
+    paint.setColor(hovered ? thumbLightGrey : thumbDarkGrey);
+
+    if (vertical)
+        skrect.set(midx + 1, rect.y(), rect.right(), rect.bottom());
+    else
+        skrect.set(rect.x(), midy + 1, rect.right(), rect.bottom());
+
+    canvas->drawIRect(skrect, paint);
+
+    const SkColor borderDarkGrey = SkColorSetARGB(0xff, 0x9d, 0x96, 0x8e);
+    paint.setColor(borderDarkGrey);
+    drawBox(canvas, rect, paint);
+
+    if (rect.height() > 10 && rect.width() > 10) {
+        drawHorizLine(canvas, midx - 2, midx + 2, midy, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy - 3, paint);
+        drawHorizLine(canvas, midx - 2, midx + 2, midy + 3, paint);
+    }
+
+    return false;
+}
+
 int RenderThemeChromiumSkia::popupInternalPaddingLeft(RenderStyle* style) const
 {
     return menuListInternalPadding(style, LeftPadding);
@@ -719,6 +709,13 @@ int RenderThemeChromiumSkia::buttonInternalPaddingBottom() const
     return 1;
 }
 
+#if ENABLE(VIDEO)
+bool RenderThemeChromiumSkia::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
+}
+#endif
+
 // static
 void RenderThemeChromiumSkia::setDefaultFontSize(int fontSize)
 {
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
index 7544c22..98e3a35 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -91,8 +91,10 @@ namespace WebCore {
 
         virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual void adjustSliderThumbSize(RenderObject*) const;
         virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
         virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
@@ -110,6 +112,9 @@ namespace WebCore {
         virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
         virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
 
+        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+
         // These methods define the padding for the MenuList's inner block.
         virtual int popupInternalPaddingLeft(RenderStyle*) const;
         virtual int popupInternalPaddingRight(RenderStyle*) const;
@@ -121,6 +126,11 @@ namespace WebCore {
         virtual int buttonInternalPaddingTop() const;
         virtual int buttonInternalPaddingBottom() const;
 
+#if ENABLE(VIDEO)
+        // Media controls
+        virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
+#endif
+
         // Provide a way to pass the default font size from the Settings object
         // to the render theme.  FIXME: http://b/1129186 A cleaner way would be
         // to remove the default font size from this object and have callers
diff --git a/WebCore/rendering/RenderThemeChromiumWin.cpp b/WebCore/rendering/RenderThemeChromiumWin.cpp
index 35d1580..20503f3 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -311,6 +311,52 @@ void RenderThemeChromiumWin::systemFont(int propId, FontDescription& fontDescrip
     fontDescription = *cachedDesc;
 }
 
+// Map a CSSValue* system color to an index understood by GetSysColor().
+static int cssValueIdToSysColorIndex(int cssValueId)
+{
+    switch (cssValueId) {
+    case CSSValueActiveborder: return COLOR_ACTIVEBORDER;
+    case CSSValueActivecaption: return COLOR_ACTIVECAPTION;
+    case CSSValueAppworkspace: return COLOR_APPWORKSPACE;
+    case CSSValueBackground: return COLOR_BACKGROUND;
+    case CSSValueButtonface: return COLOR_BTNFACE;
+    case CSSValueButtonhighlight: return COLOR_BTNHIGHLIGHT;
+    case CSSValueButtonshadow: return COLOR_BTNSHADOW;
+    case CSSValueButtontext: return COLOR_BTNTEXT;
+    case CSSValueCaptiontext: return COLOR_CAPTIONTEXT;
+    case CSSValueGraytext: return COLOR_GRAYTEXT;
+    case CSSValueHighlight: return COLOR_HIGHLIGHT;
+    case CSSValueHighlighttext: return COLOR_HIGHLIGHTTEXT;
+    case CSSValueInactiveborder: return COLOR_INACTIVEBORDER;
+    case CSSValueInactivecaption: return COLOR_INACTIVECAPTION;
+    case CSSValueInactivecaptiontext: return COLOR_INACTIVECAPTIONTEXT;
+    case CSSValueInfobackground: return COLOR_INFOBK;
+    case CSSValueInfotext: return COLOR_INFOTEXT;
+    case CSSValueMenu: return COLOR_MENU;
+    case CSSValueMenutext: return COLOR_MENUTEXT;
+    case CSSValueScrollbar: return COLOR_SCROLLBAR;
+    case CSSValueThreeddarkshadow: return COLOR_3DDKSHADOW;
+    case CSSValueThreedface: return COLOR_3DFACE;
+    case CSSValueThreedhighlight: return COLOR_3DHIGHLIGHT;
+    case CSSValueThreedlightshadow: return COLOR_3DLIGHT;
+    case CSSValueThreedshadow: return COLOR_3DSHADOW;
+    case CSSValueWindow: return COLOR_WINDOW;
+    case CSSValueWindowframe: return COLOR_WINDOWFRAME;
+    case CSSValueWindowtext: return COLOR_WINDOWTEXT;
+    default: return -1; // Unsupported CSSValue
+    }
+}
+
+Color RenderThemeChromiumWin::systemColor(int cssValueId) const
+{
+    int sysColorIndex = cssValueIdToSysColorIndex(cssValueId);
+    if (ChromiumBridge::layoutTestMode() || (sysColorIndex == -1))
+        return RenderTheme::systemColor(cssValueId);
+
+    COLORREF color = GetSysColor(sysColorIndex);
+    return Color(GetRValue(color), GetGValue(color), GetBValue(color));
+}
+
 void RenderThemeChromiumWin::adjustSliderThumbSize(RenderObject* o) const
 {
     // These sizes match what WinXP draws for various menus.
@@ -475,14 +521,36 @@ unsigned RenderThemeChromiumWin::determineSliderThumbState(RenderObject* o)
 unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o)
 {
     unsigned result = 0;
-    if (!isEnabled(o))
-        result = DFCS_INACTIVE;
-    else if (isPressed(o)) // Active supersedes hover
-        result = DFCS_PUSHED;
-    else if (isHovered(o))
-        result = DFCS_HOT;
-    if (isChecked(o))
-        result |= DFCS_CHECKED;
+
+    ControlPart part = o->style()->appearance();
+
+    // Sliders are always in the normal state.
+    if (part == SliderHorizontalPart || part == SliderVerticalPart)
+        return result;
+
+    // So are readonly text fields.
+    if (isReadOnlyControl(o) && (part == TextFieldPart || part == TextAreaPart || part == SearchFieldPart))
+        return result;   
+
+    if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
+        if (!isEnabled(o->parent()))
+            result = DFCS_INACTIVE;
+        else if (toRenderSlider(o->parent())->inDragMode()) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+    } else {
+        if (!isEnabled(o))
+            result = DFCS_INACTIVE;
+        else if (isPressed(o)) // Active supersedes hover
+            result = DFCS_PUSHED;
+        else if (supportsFocus(part) && isFocused(o)) // So does focused
+            result = 0;
+        else if (isHovered(o))
+            result = DFCS_HOT;
+        if (isChecked(o))
+            result |= DFCS_CHECKED;
+    }
     return result;
 }
 
@@ -524,6 +592,7 @@ ThemeData RenderThemeChromiumWin::getThemeData(RenderObject* o)
         break;
     case ListboxPart:
     case MenulistPart:
+    case MenulistButtonPart:
     case SearchFieldPart:
     case TextFieldPart:
     case TextAreaPart:
diff --git a/WebCore/rendering/RenderThemeChromiumWin.h b/WebCore/rendering/RenderThemeChromiumWin.h
index 5e98c9b..3b86980 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/WebCore/rendering/RenderThemeChromiumWin.h
@@ -59,6 +59,7 @@ namespace WebCore {
 
         // System fonts.
         virtual void systemFont(int propId, FontDescription&) const;
+        virtual Color systemColor(int cssValueId) const;

 
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 85f141f..1d68c63 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -132,6 +132,8 @@ protected:
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
+
+    virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
 #endif
 
 private:
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 6315f9f..03e39a0 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -38,6 +38,7 @@
 #import "RenderSlider.h"
 #import "RenderView.h"
 #import "SharedBuffer.h"
+#import "TimeRanges.h"
 #import "WebCoreSystemInterface.h"
 #import "UserAgentStyleSheets.h"
 #import <Carbon/Carbon.h>
@@ -472,6 +473,7 @@ void RenderThemeMac::adjustRepaintRect(const RenderObject* o, IntRect& r)
         case RadioPart:
         case PushButtonPart:
         case SquareButtonPart:
+        case ListButtonPart:
         case DefaultButtonPart:
         case ButtonPart:
             return RenderTheme::adjustRepaintRect(o, r);
@@ -824,11 +826,21 @@ static void TrackGradientInterpolate(void*, const CGFloat* inData, CGFloat* outD
 
 void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -851,33 +863,27 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderO
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -887,8 +893,6 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderO
 
 bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -907,6 +911,8 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::Pa
     if (bounds.width() < arrowWidth + arrowPaddingLeft * o->style()->effectiveZoom())
         return false;
     
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeStyle(NoStroke);
 
@@ -1416,7 +1422,7 @@ bool RenderThemeMac::paintSearchFieldResultsButton(RenderObject* o, const Render
 #if ENABLE(VIDEO)
 typedef enum {
     MediaControllerThemeClassic   = 1,
-    MediaControllerThemeQT        = 2
+    MediaControllerThemeQuickTime = 2
 } MediaControllerThemeStyle;
 
 static int mediaControllerTheme()
@@ -1450,7 +1456,7 @@ static int mediaControllerTheme()
         return controllerTheme;
 #endif
 
-    controllerTheme = MediaControllerThemeQT;
+    controllerTheme = MediaControllerThemeQuickTime;
     return controllerTheme;
 }
 #endif
@@ -1473,10 +1479,10 @@ void RenderThemeMac::adjustSliderThumbSize(RenderObject* o) const
         int width = mediaSliderThumbWidth;
         int height = mediaSliderThumbHeight;
         
-        if (mediaControllerTheme() == MediaControllerThemeQT) {
+        if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
             CGSize  size;
             
-            wkMeasureMediaUIPart(MediaSliderThumb, MediaControllerThemeQT, NULL, &size);
+            wkMeasureMediaUIPart(MediaSliderThumb, MediaControllerThemeQuickTime, NULL, &size);
             width = size.width;
             height = size.height;
         }
@@ -1500,7 +1506,9 @@ static unsigned getMediaUIPartStateFlags(Node* node)
 {
     unsigned flags = 0;
 
-    if (node->active())
+    if (node->disabled())
+        flags |= MediaUIPartDisabledFlag;
+    else if (node->active())
         flags |= MediaUIPartPressedFlag;
     return flags;
 }
@@ -1510,7 +1518,7 @@ static FloatRect getUnzoomedRectAndAdjustCurrentContext(RenderObject* o, const R
 {
     float zoomLevel = o->style()->effectiveZoom();
     FloatRect unzoomedRect(originalRect);
-    if (zoomLevel != 1.0f && mediaControllerTheme() == MediaControllerThemeQT) {
+    if (zoomLevel != 1.0f && mediaControllerTheme() == MediaControllerThemeQuickTime) {
         unzoomedRect.setWidth(unzoomedRect.width() / zoomLevel);
         unzoomedRect.setHeight(unzoomedRect.height() / zoomLevel);
         paintInfo.context->translate(unzoomedRect.x(), unzoomedRect.y());
@@ -1539,7 +1547,7 @@ bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const RenderObject::P
     if (!mediaNode || (!mediaNode->hasTagName(videoTag) && !mediaNode->hasTagName(audioTag)))
         return false;
 
-    if (MediaControlPlayButtonElement* btn = static_cast<MediaControlPlayButtonElement*>(node)) {
+    if (MediaControlMuteButtonElement* btn = static_cast<MediaControlMuteButtonElement*>(node)) {
         LocalCurrentGraphicsContext localContext(paintInfo.context);
         wkDrawMediaUIPart(btn->displayType(), mediaControllerTheme(), paintInfo.context->platformContext(), r, getMediaUIPartStateFlags(node));
 
@@ -1594,14 +1602,13 @@ bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::
     if (!mediaElement)
         return false;
 
-    float timeLoaded = 0;
-    float currentTime = 0;
-    float duration = 0;
-    if (MediaPlayer* player = mediaElement->player()) {
-        duration = player->duration();
-        timeLoaded = player->maxTimeBuffered();
-        currentTime = player->currentTime();
-    }
+    RefPtr<TimeRanges> timeRanges = mediaElement->buffered();
+    ExceptionCode ignoredException;
+    float timeLoaded = timeRanges->length() ? timeRanges->end(0, ignoredException) : 0;
+    float currentTime = mediaElement->currentTime();
+    float duration = mediaElement->duration();
+    if (isnan(duration))
+        duration = 0;
  
     paintInfo.context->save();
     FloatRect unzoomedRect = getUnzoomedRectAndAdjustCurrentContext(o, paintInfo, r);
@@ -1685,12 +1692,21 @@ bool RenderThemeMac::paintMediaTimeRemaining(RenderObject* o, const RenderObject
 
 String RenderThemeMac::extraMediaControlsStyleSheet()
 {
-    if (mediaControllerTheme() == MediaControllerThemeQT) 
-        return String(mediaControlsQTUserAgentStyleSheet, sizeof(mediaControlsQTUserAgentStyleSheet));
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime)
+        return String(mediaControlsQuickTimeUserAgentStyleSheet, sizeof(mediaControlsQuickTimeUserAgentStyleSheet));
     else
         return String();
 }
-#endif
+
+bool RenderThemeMac::shouldRenderMediaControlPart(ControlPart part, Element* e)
+{
+    if (part == MediaFullscreenButtonPart)
+        return mediaControllerTheme() == MediaControllerThemeQuickTime;
+
+    return RenderTheme::shouldRenderMediaControlPart(part, e);
+}
+
+#endif // ENABLE(VIDEO)
 
 NSPopUpButtonCell* RenderThemeMac::popupButton() const
 {
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 23998d4..8e53088 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc.
  * Copyright (C) 2009 Kenneth Rohde Christiansen
  *
  * This library is free software; you can redistribute it and/or
@@ -744,11 +744,21 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
 
 void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
+    if (r.isEmpty())
+        return;
+
     CGContextRef context = paintInfo.context->platformContext();
 
     paintInfo.context->save();
 
-    int radius = o->style()->borderTopLeftRadius().width();
+    IntSize topLeftRadius;
+    IntSize topRightRadius;
+    IntSize bottomLeftRadius;
+    IntSize bottomRightRadius;
+
+    o->style()->getBorderRadiiForRect(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    int radius = topLeftRadius.width();
 
     RetainPtr<CGColorSpaceRef> cspace(AdoptCF, CGColorSpaceCreateDeviceRGB());
 
@@ -771,33 +781,27 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
     RetainPtr<CGShadingRef> rightShading(AdoptCF, CGShadingCreateAxial(cspace.get(), CGPointMake(r.right(),  r.y()), CGPointMake(r.right() - radius, r.y()), mainFunction.get(), false, false));
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, mainShading.get());
     paintInfo.context->restore();
 
     paintInfo.context->save();
     CGContextClipToRect(context, topGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient),
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        IntSize(), IntSize());
+    paintInfo.context->addRoundedRectClip(enclosingIntRect(topGradient), topLeftRadius, topRightRadius, IntSize(), IntSize());
     CGContextDrawShading(context, topShading.get());
     paintInfo.context->restore();
 
-    paintInfo.context->save();
-    CGContextClipToRect(context, bottomGradient);
-    paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient),
-        IntSize(), IntSize(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
-    CGContextDrawShading(context, bottomShading.get());
-    paintInfo.context->restore();
+    if (!bottomGradient.isEmpty()) {
+        paintInfo.context->save();
+        CGContextClipToRect(context, bottomGradient);
+        paintInfo.context->addRoundedRectClip(enclosingIntRect(bottomGradient), IntSize(), IntSize(), bottomLeftRadius, bottomRightRadius);
+        CGContextDrawShading(context, bottomShading.get());
+        paintInfo.context->restore();
+    }
 
     paintInfo.context->save();
     CGContextClipToRect(context, r);
-    paintInfo.context->addRoundedRectClip(r,
-        o->style()->borderTopLeftRadius(), o->style()->borderTopRightRadius(),
-        o->style()->borderBottomLeftRadius(), o->style()->borderBottomRightRadius());
+    paintInfo.context->addRoundedRectClip(r, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
     CGContextDrawShading(context, leftShading.get());
     CGContextDrawShading(context, rightShading.get());
     paintInfo.context->restore();
@@ -807,8 +811,6 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
 
 bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
 {
-    paintInfo.context->save();
-
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
                              r.width() - o->style()->borderLeftWidth() - o->style()->borderRightWidth(),
@@ -826,6 +828,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject:
     if (bounds.width() < arrowWidth + arrowPaddingLeft)
         return false;
 
+    paintInfo.context->save();
+
     paintInfo.context->setFillColor(o->style()->color());
     paintInfo.context->setStrokeColor(NoStroke);
 
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index 584e38a..c4a666f 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -133,12 +133,10 @@ void RenderView::layout()
     if (needsLayout())
         RenderBlock::layout();
 
-    // Reset overflowWidth and overflowHeight, since they act as a lower bound for docWidth() and docHeight().
-    setOverflowWidth(width());
-    setOverflowHeight(height());
-    
-    setOverflowWidth(docWidth());
-    setOverflowHeight(docHeight());
+    // Reset overflow and then replace it with docWidth and docHeight.
+    m_overflow.clear();
+    addLayoutOverflow(IntRect(0, 0, docWidth(), docHeight()));
+
 
     ASSERT(layoutDelta() == IntSize());
     ASSERT(m_layoutStateDisableCount == 0);
@@ -472,6 +470,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         return;
     }
 
+    m_frameView->beginDeferredRepaints();
+
     // Have any of the old selected objects changed compared to the new selection?
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i) {
         RenderObject* obj = i->first;
@@ -523,6 +523,8 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
         newInfo->repaint();
         delete newInfo;
     }
+
+    m_frameView->endDeferredRepaints();
 }
 
 void RenderView::clearSelection()
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 36f4fed..5a5c9f1 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -28,6 +28,7 @@
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
 #include "RenderView.h"
+#include "RenderWidgetProtector.h"
 
 using namespace std;
 
@@ -60,6 +61,15 @@ void RenderWidget::destroy()
     // So the code below includes copied and pasted contents of
     // both RenderBox::destroy() and RenderObject::destroy().
     // Fix originally made for <rdar://problem/4228818>.
+
+    // <rdar://problem/6937089> suggests that node() can be null by the time we call renderArena()
+    // in the end of this function. One way this might happen is if this function was invoked twice
+    // in a row, so bail out and turn a crash into an assertion failure in debug builds and a leak
+    // in release builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     animation()->cancelAnimations(this);
 
     if (RenderView* v = view())
@@ -90,6 +100,14 @@ void RenderWidget::destroy()
         destroyLayer();
     }
 
+    // <rdar://problem/6937089> suggests that node() can be null here. One way this might happen is
+    // if this function was re-entered (and therefore the null check at the beginning did not fail),
+    // so bail out and turn a crash into an assertion failure in debug builds and a leak in release
+    // builds.
+    ASSERT(node());
+    if (!node())
+        return;
+
     // Grab the arena from node()->document()->renderArena() before clearing the node pointer.
     // Clear the node before deref-ing, as this may be deleted when deref is called.
     RenderArena* arena = renderArena();
@@ -106,10 +124,9 @@ RenderWidget::~RenderWidget()
 void RenderWidget::setWidgetGeometry(const IntRect& frame)
 {
     if (node() && m_widget->frameRect() != frame) {
-        RenderArena* arena = ref();
-        RefPtr<Node> protectedElement(node());
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(frame);
-        deref(arena);
     }
 }
 
@@ -158,6 +175,12 @@ void RenderWidget::styleDidChange(StyleDifference diff, const RenderStyle* oldSt
     }
 }
 
+void RenderWidget::showSubstituteImage(PassRefPtr<Image> prpImage)
+{
+    m_substituteImage = prpImage;
+    repaint();
+}
+
 void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (!shouldPaint(paintInfo, tx, ty))
@@ -183,11 +206,15 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 #endif
 
     if (style()->hasBorderRadius()) {
+        IntRect borderRect = IntRect(tx, ty, width(), height());
+
+        if (borderRect.isEmpty())
+            return;
+
         // Push a clip if we have a border radius, since we want to round the foreground content that gets painted.
         paintInfo.context->save();
         
         IntSize topLeft, topRight, bottomLeft, bottomRight;
-        IntRect borderRect = IntRect(tx, ty, width(), height());
         style()->getBorderRadiiForRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
 
         paintInfo.context->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
@@ -201,7 +228,10 @@ void RenderWidget::paint(PaintInfo& paintInfo, int tx, int ty)
 
         // Tell the widget to paint now.  This is the only time the widget is allowed
         // to paint itself.  That way it will composite properly with z-indexed layers.
-        m_widget->paint(paintInfo.context, paintInfo.rect);
+        if (m_substituteImage)
+            paintInfo.context->drawImage(m_substituteImage.get(), m_widget->frameRect());
+        else
+            m_widget->paint(paintInfo.context, paintInfo.rect);
 
         if (m_widget->isFrameView() && paintInfo.overlapTestRequests && !static_cast<FrameView*>(m_widget.get())->useSlowRepaints()) {
             ASSERT(!paintInfo.overlapTestRequests->contains(this));
@@ -248,11 +278,9 @@ void RenderWidget::updateWidgetPosition()
     IntRect oldBounds(m_widget->frameRect());
     bool boundsChanged = newBounds != oldBounds;
     if (boundsChanged) {
-        RenderArena* arena = ref();
-        node()->ref();
+        RenderWidgetProtector protector(this);
+        RefPtr<Node> protectedNode(node());
         m_widget->setFrameRect(newBounds);
-        node()->deref();
-        deref(arena);
     }
     
 #ifndef FLATTEN_IFRAME
diff --git a/WebCore/rendering/RenderWidget.h b/WebCore/rendering/RenderWidget.h
index bb68143..78537fd 100644
--- a/WebCore/rendering/RenderWidget.h
+++ b/WebCore/rendering/RenderWidget.h
@@ -40,6 +40,8 @@ public:
 
     void updateWidgetPosition();
 
+    void showSubstituteImage(PassRefPtr<Image>);
+
 protected:
     RenderWidget(Node*);
 
@@ -61,10 +63,12 @@ private:
 
     void setWidgetGeometry(const IntRect&);
 
+    friend class RenderWidgetProtector;
     RenderArena* ref() { ++m_refCount; return renderArena(); }
     void deref(RenderArena*);
 
     RefPtr<Widget> m_widget;
+    RefPtr<Image> m_substituteImage;
     FrameView* m_frameView;
     int m_refCount;
 };
diff --git a/WebCore/rendering/RenderWidgetProtector.h b/WebCore/rendering/RenderWidgetProtector.h
new file mode 100644
index 0000000..788304c
--- /dev/null
+++ b/WebCore/rendering/RenderWidgetProtector.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderWidgetProtector_h
+#define RenderWidgetProtector_h
+
+#include "RenderWidget.h"
+
+namespace WebCore {
+
+class RenderWidgetProtector : private Noncopyable {
+public:
+    RenderWidgetProtector(RenderWidget* object)
+        : m_object(object)
+        , m_arena(object->ref())
+    {
+    }
+
+    ~RenderWidgetProtector()
+    {
+        m_object->deref(m_arena);
+    }
+
+private:
+    RenderWidget* m_object;
+    RenderArena* m_arena;
+};
+
+}
+
+#endif // RenderWidgetProtector_h
diff --git a/WebCore/rendering/RootInlineBox.cpp b/WebCore/rendering/RootInlineBox.cpp
index e8f04da..c8e072e 100644
--- a/WebCore/rendering/RootInlineBox.cpp
+++ b/WebCore/rendering/RootInlineBox.cpp
@@ -38,28 +38,8 @@ namespace WebCore {
 typedef WTF::HashMap<const RootInlineBox*, EllipsisBox*> EllipsisBoxMap;
 static EllipsisBoxMap* gEllipsisBoxMap = 0;
 
-void* RootInlineBox::Overflow::operator new(size_t sz, RenderArena* renderArena) throw()
-{
-    return renderArena->allocate(sz);
-}
-
-void RootInlineBox::Overflow::operator delete(void* ptr, size_t sz)
-{
-    // Stash size where destroy can find it.
-    *(size_t *)ptr = sz;
-}
-
-void RootInlineBox::Overflow::destroy(RenderArena* renderArena)
-{
-    delete this;
-    // Recover the size left there for us by operator delete and free the memory.
-    renderArena->free(*(size_t *)this, this);
-}
-
 void RootInlineBox::destroy(RenderArena* arena)
 {
-    if (m_overflow)
-        m_overflow->destroy(arena);
     detachEllipsisBox(arena);
     InlineFlowBox::destroy(arena);
 }
@@ -155,8 +135,8 @@ void RootInlineBox::addHighlightOverflow()
     // Highlight acts as a selection inflation.
     FloatRect rootRect(0, selectionTop(), width(), selectionHeight());
     IntRect inflatedRect = enclosingIntRect(page->chrome()->client()->customHighlightRect(renderer()->node(), renderer()->style()->highlight(), rootRect));
-    setHorizontalOverflowPositions(min(leftOverflow(), inflatedRect.x()), max(rightOverflow(), inflatedRect.right()));
-    setVerticalOverflowPositions(min(topOverflow(), inflatedRect.y()), max(bottomOverflow(), inflatedRect.bottom()));
+    setHorizontalOverflowPositions(leftLayoutOverflow(), rightLayoutOverflow(), min(leftVisualOverflow(), inflatedRect.x()), max(rightVisualOverflow(), inflatedRect.right()));
+    setVerticalOverflowPositions(topLayoutOverflow(), bottomLayoutOverflow(), min(topVisualOverflow(), inflatedRect.y()), max(bottomVisualOverflow(), inflatedRect.bottom()), height());
 }
 
 void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
@@ -205,12 +185,8 @@ bool RootInlineBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 void RootInlineBox::adjustPosition(int dx, int dy)
 {
     InlineFlowBox::adjustPosition(dx, dy);
-    if (m_overflow) {
-        m_overflow->m_topOverflow += dy;
-        m_overflow->m_bottomOverflow += dy;
-        m_overflow->m_selectionTop += dy;
-        m_overflow->m_selectionBottom += dy;
-    }
+    m_lineTop += dy;
+    m_lineBottom += dy;
     m_blockHeight += dy;
 }
 
@@ -225,6 +201,37 @@ void RootInlineBox::childRemoved(InlineBox* box)
     }
 }
 
+int RootInlineBox::verticallyAlignBoxes(int heightOfBlock)
+{
+    int maxPositionTop = 0;
+    int maxPositionBottom = 0;
+    int maxAscent = 0;
+    int maxDescent = 0;
+
+    // Figure out if we're in strict mode.  Note that we can't simply use !style()->htmlHacks(),
+    // because that would match almost strict mode as well.
+    RenderObject* curr = renderer();
+    while (curr && !curr->node())
+        curr = curr->container();
+    bool strictMode = (curr && curr->document()->inStrictMode());
+
+    computeLogicalBoxHeights(maxPositionTop, maxPositionBottom, maxAscent, maxDescent, strictMode);
+
+    if (maxAscent + maxDescent < max(maxPositionTop, maxPositionBottom))
+        adjustMaxAscentAndDescent(maxAscent, maxDescent, maxPositionTop, maxPositionBottom);
+
+    int maxHeight = maxAscent + maxDescent;
+    int lineTop = heightOfBlock;
+    int lineBottom = heightOfBlock;
+    placeBoxesVertically(heightOfBlock, maxHeight, maxAscent, strictMode, lineTop, lineBottom);
+    computeVerticalOverflow(lineTop, lineBottom, strictMode);
+    setLineTopBottomPositions(lineTop, lineBottom);
+    
+    heightOfBlock += maxHeight;
+    
+    return heightOfBlock;
+}
+
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
                                              const RenderObject::PaintInfo* paintInfo)
 {
@@ -321,9 +328,9 @@ InlineBox* RootInlineBox::lastSelectedBox()
     return 0;
 }
 
-int RootInlineBox::selectionTop()
+int RootInlineBox::selectionTop() const
 {
-    int selectionTop = m_overflow ? m_overflow->m_selectionTop : m_y;
+    int selectionTop = m_lineTop;
     if (!prevRootBox())
         return selectionTop;
 
@@ -407,18 +414,6 @@ EllipsisBox* RootInlineBox::ellipsisBox() const
     return gEllipsisBoxMap->get(this);
 }
 
-void RootInlineBox::setVerticalOverflowPositions(int top, int bottom) 
-{ 
-    if (!m_overflow) {
-        const Font& font = renderer()->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (renderer()->renderArena()) Overflow(this);
-    }
-    m_overflow->m_topOverflow = top; 
-    m_overflow->m_bottomOverflow = bottom; 
-}
-
 void RootInlineBox::removeLineBoxFromRenderObject()
 {
     block()->lineBoxes()->removeLineBox(this);
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index 171be9d..b0b0e15 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -38,31 +38,33 @@ class RootInlineBox : public InlineFlowBox {
 public:
     RootInlineBox(RenderObject* obj)
         : InlineFlowBox(obj)
-        , m_overflow(0)
         , m_lineBreakObj(0)
         , m_lineBreakPos(0)
+        , m_lineTop(0)
+        , m_lineBottom(0)
     {
     }
 
+    virtual void destroy(RenderArena*);
+
     virtual bool isRootInlineBox() const { return true; }
 
-    virtual void destroy(RenderArena*);
     void detachEllipsisBox(RenderArena*);
 
-    RootInlineBox* nextRootBox() { return static_cast<RootInlineBox*>(m_nextLine); }
-    RootInlineBox* prevRootBox() { return static_cast<RootInlineBox*>(m_prevLine); }
+    RootInlineBox* nextRootBox() const { return static_cast<RootInlineBox*>(m_nextLine); }
+    RootInlineBox* prevRootBox() const { return static_cast<RootInlineBox*>(m_prevLine); }
 
     virtual void adjustPosition(int dx, int dy);
 
-    virtual int topOverflow() const { return m_overflow ? m_overflow->m_topOverflow : m_y; }
-    virtual int bottomOverflow() const { return m_overflow ? m_overflow->m_bottomOverflow : m_y + m_renderer->style(m_firstLine)->font().height(); }
-    virtual int leftOverflow() const { return m_overflow ? m_overflow->m_leftOverflow : m_x; }
-    virtual int rightOverflow() const { return m_overflow ? m_overflow->m_rightOverflow : m_x + m_width; }
+    int lineTop() const { return m_lineTop; }
+    int lineBottom() const { return m_lineBottom; }
 
-    virtual void setVerticalOverflowPositions(int top, int bottom);
-    void setHorizontalOverflowPositions(int left, int right);
+    int selectionTop() const;
+    int selectionBottom() const { return lineBottom(); }
+    int selectionHeight() const { return max(0, selectionBottom() - selectionTop()); }
 
-    virtual void setVerticalSelectionPositions(int top, int bottom);
+    virtual int verticallyAlignBoxes(int heightOfBlock);
+    void setLineTopBottomPositions(int top, int bottom);
 
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
@@ -116,68 +118,36 @@ public:
 
     RenderBlock* block() const;
 
-    int selectionTop();
-    int selectionBottom() { return m_overflow ? m_overflow->m_selectionBottom : m_y + height(); }
-    int selectionHeight() { return max(0, selectionBottom() - selectionTop()); }
-
     InlineBox* closestLeafChildForXPos(int x, bool onlyEditableLeaves = false);
 
     Vector<RenderBox*>& floats()
     {
         ASSERT(!isDirty());
-        if (!m_overflow)
-            m_overflow = new (m_renderer->renderArena()) Overflow(this);
-        return m_overflow->floats;
+        if (!m_floats)
+            m_floats.set(new Vector<RenderBox*>());
+        return *m_floats;
     }
 
-    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_overflow ? &m_overflow->floats : 0; }
+    Vector<RenderBox*>* floatsPtr() { ASSERT(!isDirty()); return m_floats.get(); }
 
     virtual void extractLineBoxFromRenderObject();
     virtual void attachLineBoxToRenderObject();
     virtual void removeLineBoxFromRenderObject();
 
 protected:
-    // Normally we are only as tall as the style on our block dictates, but we might have content
-    // that spills out above the height of our font (e.g, a tall image), or something that extends further
-    // below our line (e.g., a child whose font has a huge descent).
-        
-    // Allocated only when some of these fields have non-default values
-    struct Overflow {
-        Overflow(RootInlineBox* box) 
-            : m_topOverflow(box->m_y)
-            , m_bottomOverflow(box->m_y + box->height())
-            , m_leftOverflow(box->m_x)
-            , m_rightOverflow(box->m_x + box->m_width)
-            , m_selectionTop(box->m_y)
-            , m_selectionBottom(box->m_y + box->height())
-        {
-        }
-
-        void destroy(RenderArena*);
-        void* operator new(size_t, RenderArena*) throw();
-        void operator delete(void*, size_t);
-        
-        int m_topOverflow;
-        int m_bottomOverflow;
-        int m_leftOverflow;
-        int m_rightOverflow;
-        int m_selectionTop;
-        int m_selectionBottom;
-        // Floats hanging off the line are pushed into this vector during layout. It is only
-        // good for as long as the line has not been marked dirty.
-        Vector<RenderBox*> floats;
-    private:
-        void* operator new(size_t) throw();
-    };
-    
-    Overflow* m_overflow;
-
     // Where this line ended.  The exact object and the position within that object are stored so that
     // we can create an InlineIterator beginning just after the end of this line.
     RenderObject* m_lineBreakObj;
     unsigned m_lineBreakPos;
     RefPtr<BidiContext> m_lineBreakContext;
 
+    int m_lineTop;
+    int m_lineBottom;
+
+    // Floats hanging off the line are pushed into this vector during layout. It is only
+    // good for as long as the line has not been marked dirty.
+    OwnPtr<Vector<RenderBox*> > m_floats;
+
     // The height of the block at the end of this line.  This is where the next line starts.
     int m_blockHeight;
 
@@ -186,27 +156,10 @@ protected:
     WTF::Unicode::Direction m_lineBreakBidiStatusLast : 5;
 };
 
-inline void RootInlineBox::setHorizontalOverflowPositions(int left, int right) 
-{ 
-    if (!m_overflow) {
-        if (left == m_x && right == m_x + m_width)
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);       
-    }
-    m_overflow->m_leftOverflow = left; 
-    m_overflow->m_rightOverflow = right; 
-}
-
-inline void RootInlineBox::setVerticalSelectionPositions(int top, int bottom) 
+inline void RootInlineBox::setLineTopBottomPositions(int top, int bottom) 
 { 
-    if (!m_overflow) {
-        const Font& font = m_renderer->style(m_firstLine)->font();
-        if (top == m_y && bottom == m_y + font.height())
-            return;
-        m_overflow = new (m_renderer->renderArena()) Overflow(this);
-    }
-    m_overflow->m_selectionTop = top; 
-    m_overflow->m_selectionBottom = bottom; 
+    m_lineTop = top; 
+    m_lineBottom = bottom; 
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/SVGRootInlineBox.cpp b/WebCore/rendering/SVGRootInlineBox.cpp
index 8319e7c..5829742 100644
--- a/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/WebCore/rendering/SVGRootInlineBox.cpp
@@ -1087,8 +1087,8 @@ void SVGRootInlineBox::layoutInlineBoxes(InlineFlowBox* start, Vector<SVGChar>::
         start->setWidth(highX - lowX);
         static_cast<SVGRootInlineBox*>(start)->setHeight(highY - lowY);
 
-        start->setVerticalOverflowPositions(top, bottom);
-        start->setVerticalSelectionPositions(top, bottom);
+        start->computeVerticalOverflow(top, bottom, true);
+        static_cast<SVGRootInlineBox*>(start)->setLineTopBottomPositions(top, bottom);
     }
 }
 
diff --git a/WebCore/rendering/style/FillLayer.cpp b/WebCore/rendering/style/FillLayer.cpp
index 9c491aa..ec910c9 100644
--- a/WebCore/rendering/style/FillLayer.cpp
+++ b/WebCore/rendering/style/FillLayer.cpp
@@ -31,18 +31,20 @@ FillLayer::FillLayer(EFillLayerType type)
     , m_attachment(FillLayer::initialFillAttachment(type))
     , m_clip(FillLayer::initialFillClip(type))
     , m_origin(FillLayer::initialFillOrigin(type))
-    , m_repeat(FillLayer::initialFillRepeat(type))
+    , m_repeatX(FillLayer::initialFillRepeatX(type))
+    , m_repeatY(FillLayer::initialFillRepeatY(type))
     , m_composite(FillLayer::initialFillComposite(type))
-    , m_size(FillLayer::initialFillSize(type))
+    , m_sizeType(SizeNone)
+    , m_sizeLength(FillLayer::initialFillSizeLength(type))
     , m_imageSet(false)
     , m_attachmentSet(false)
     , m_clipSet(false)
     , m_originSet(false)
-    , m_repeatSet(false)
+    , m_repeatXSet(false)
+    , m_repeatYSet(false)
     , m_xPosSet(false)
     , m_yPosSet(false)
     , m_compositeSet(type == MaskFillLayer)
-    , m_sizeSet(false)
     , m_type(type)
     , m_next(0)
 {
@@ -55,18 +57,20 @@ FillLayer::FillLayer(const FillLayer& o)
     , m_attachment(o.m_attachment)
     , m_clip(o.m_clip)
     , m_origin(o.m_origin)
-    , m_repeat(o.m_repeat)
+    , m_repeatX(o.m_repeatX)
+    , m_repeatY(o.m_repeatY)
     , m_composite(o.m_composite)
-    , m_size(o.m_size)
+    , m_sizeType(o.m_sizeType)
+    , m_sizeLength(o.m_sizeLength)
     , m_imageSet(o.m_imageSet)
     , m_attachmentSet(o.m_attachmentSet)
     , m_clipSet(o.m_clipSet)
     , m_originSet(o.m_originSet)
-    , m_repeatSet(o.m_repeatSet)
+    , m_repeatXSet(o.m_repeatXSet)
+    , m_repeatYSet(o.m_repeatYSet)
     , m_xPosSet(o.m_xPosSet)
     , m_yPosSet(o.m_yPosSet)
     , m_compositeSet(o.m_compositeSet)
-    , m_sizeSet(o.m_sizeSet)
     , m_type(o.m_type)
     , m_next(o.m_next ? new FillLayer(*o.m_next) : 0)
 {
@@ -91,18 +95,20 @@ FillLayer& FillLayer::operator=(const FillLayer& o)
     m_clip = o.m_clip;
     m_composite = o.m_composite;
     m_origin = o.m_origin;
-    m_repeat = o.m_repeat;
-    m_size = o.m_size;
+    m_repeatX = o.m_repeatX;
+    m_repeatY = o.m_repeatY;
+    m_sizeType = o.m_sizeType;
+    m_sizeLength = o.m_sizeLength;
 
     m_imageSet = o.m_imageSet;
     m_attachmentSet = o.m_attachmentSet;
     m_clipSet = o.m_clipSet;
     m_compositeSet = o.m_compositeSet;
     m_originSet = o.m_originSet;
-    m_repeatSet = o.m_repeatSet;
+    m_repeatXSet = o.m_repeatXSet;
+    m_repeatYSet = o.m_repeatYSet;
     m_xPosSet = o.m_xPosSet;
     m_yPosSet = o.m_yPosSet;
-    m_sizeSet = o.m_sizeSet;
     
     m_type = o.m_type;
 
@@ -115,9 +121,9 @@ bool FillLayer::operator==(const FillLayer& o) const
     // to propagate patterns into layers.  All layer comparisons happen after values have all been filled in anyway.
     return StyleImage::imagesEquivalent(m_image.get(), o.m_image.get()) && m_xPosition == o.m_xPosition && m_yPosition == o.m_yPosition &&
            m_attachment == o.m_attachment && m_clip == o.m_clip && 
-           m_composite == o.m_composite && m_origin == o.m_origin && m_repeat == o.m_repeat &&
-           m_size == o.m_size && m_type == o.m_type &&
-           ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
+           m_composite == o.m_composite && m_origin == o.m_origin && m_repeatX == o.m_repeatX &&
+           m_repeatY == o.m_repeatY && m_sizeType == o.m_sizeType && m_sizeLength == o.m_sizeLength && 
+           m_type == o.m_type && ((m_next && o.m_next) ? *m_next == *o.m_next : m_next == o.m_next);
 }
 
 void FillLayer::fillUnsetProperties()
@@ -200,11 +206,22 @@ void FillLayer::fillUnsetProperties()
         }
     }
 
-    for (curr = this; curr && curr->isRepeatSet(); curr = curr->next()) { }
+    for (curr = this; curr && curr->isRepeatXSet(); curr = curr->next()) { }
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_repeat = pattern->m_repeat;
+            curr->m_repeatX = pattern->m_repeatX;
+            pattern = pattern->next();
+            if (pattern == curr || !pattern)
+                pattern = this;
+        }
+    }
+
+    for (curr = this; curr && curr->isRepeatYSet(); curr = curr->next()) { }
+    if (curr && curr != this) {
+        // We need to fill in the remaining values with the pattern specified.
+        for (FillLayer* pattern = this; curr; curr = curr->next()) {
+            curr->m_repeatY = pattern->m_repeatY;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -215,7 +232,8 @@ void FillLayer::fillUnsetProperties()
     if (curr && curr != this) {
         // We need to fill in the remaining values with the pattern specified.
         for (FillLayer* pattern = this; curr; curr = curr->next()) {
-            curr->m_size = pattern->m_size;
+            curr->m_sizeType = pattern->m_sizeType;
+            curr->m_sizeLength = pattern->m_sizeLength;
             pattern = pattern->next();
             if (pattern == curr || !pattern)
                 pattern = this;
@@ -232,7 +250,8 @@ void FillLayer::cullEmptyLayers()
             !next->isXPositionSet() && !next->isYPositionSet() &&
             !next->isAttachmentSet() && !next->isClipSet() &&
             !next->isCompositeSet() && !next->isOriginSet() &&
-            !next->isRepeatSet() && !next->isSizeSet()) {
+            !next->isRepeatXSet() && !next->isRepeatYSet()
+            && !next->isSizeSet()) {
             delete next;
             p->m_next = 0;
             break;
diff --git a/WebCore/rendering/style/FillLayer.h b/WebCore/rendering/style/FillLayer.h
index c3944ad..fb928b6 100644
--- a/WebCore/rendering/style/FillLayer.h
+++ b/WebCore/rendering/style/FillLayer.h
@@ -34,6 +34,31 @@
 
 namespace WebCore {
 
+struct FillSize {
+    FillSize()
+        : type(SizeLength)
+    {
+    }
+
+    FillSize(EFillSizeType t, LengthSize l)
+        : type(t)
+        , size(l)
+    {
+    }
+
+    bool operator==(const FillSize& o) const
+    {
+        return type == o.type && size == o.size;
+    }
+    bool operator!=(const FillSize& o) const
+    {
+        return !(*this == o);
+    }
+
+    EFillSizeType type;
+    LengthSize size;
+};
+
 struct FillLayer {
 public:
     FillLayer(EFillLayerType);
@@ -45,9 +70,11 @@ public:
     EFillAttachment attachment() const { return static_cast<EFillAttachment>(m_attachment); }
     EFillBox clip() const { return static_cast<EFillBox>(m_clip); }
     EFillBox origin() const { return static_cast<EFillBox>(m_origin); }
-    EFillRepeat repeat() const { return static_cast<EFillRepeat>(m_repeat); }
+    EFillRepeat repeatX() const { return static_cast<EFillRepeat>(m_repeatX); }
+    EFillRepeat repeatY() const { return static_cast<EFillRepeat>(m_repeatY); }
     CompositeOperator composite() const { return static_cast<CompositeOperator>(m_composite); }
-    LengthSize size() const { return m_size; }
+    LengthSize sizeLength() const { return m_sizeLength; }
+    FillSize size() const { return FillSize(static_cast<EFillSizeType>(m_sizeType), m_sizeLength); }
 
     const FillLayer* next() const { return m_next; }
     FillLayer* next() { return m_next; }
@@ -58,19 +85,23 @@ public:
     bool isAttachmentSet() const { return m_attachmentSet; }
     bool isClipSet() const { return m_clipSet; }
     bool isOriginSet() const { return m_originSet; }
-    bool isRepeatSet() const { return m_repeatSet; }
+    bool isRepeatXSet() const { return m_repeatXSet; }
+    bool isRepeatYSet() const { return m_repeatYSet; }
     bool isCompositeSet() const { return m_compositeSet; }
-    bool isSizeSet() const { return m_sizeSet; }
+    bool isSizeSet() const { return m_sizeType != SizeNone; }
     
     void setImage(StyleImage* i) { m_image = i; m_imageSet = true; }
-    void setXPosition(const Length& l) { m_xPosition = l; m_xPosSet = true; }
-    void setYPosition(const Length& l) { m_yPosition = l; m_yPosSet = true; }
+    void setXPosition(Length l) { m_xPosition = l; m_xPosSet = true; }
+    void setYPosition(Length l) { m_yPosition = l; m_yPosSet = true; }
     void setAttachment(EFillAttachment attachment) { m_attachment = attachment; m_attachmentSet = true; }
     void setClip(EFillBox b) { m_clip = b; m_clipSet = true; }
     void setOrigin(EFillBox b) { m_origin = b; m_originSet = true; }
-    void setRepeat(EFillRepeat r) { m_repeat = r; m_repeatSet = true; }
+    void setRepeatX(EFillRepeat r) { m_repeatX = r; m_repeatXSet = true; }
+    void setRepeatY(EFillRepeat r) { m_repeatY = r; m_repeatYSet = true; }
     void setComposite(CompositeOperator c) { m_composite = c; m_compositeSet = true; }
-    void setSize(const LengthSize& b) { m_size = b; m_sizeSet = true; }
+    void setSizeType(EFillSizeType b) { m_sizeType = b; }
+    void setSizeLength(LengthSize l) { m_sizeLength = l; }
+    void setSize(FillSize f) { m_sizeType = f.type; m_sizeLength = f.size; }
     
     void clearImage() { m_imageSet = false; }
     void clearXPosition() { m_xPosSet = false; }
@@ -78,9 +109,10 @@ public:
     void clearAttachment() { m_attachmentSet = false; }
     void clearClip() { m_clipSet = false; }
     void clearOrigin() { m_originSet = false; }
-    void clearRepeat() { m_repeatSet = false; }
+    void clearRepeatX() { m_repeatXSet = false; }
+    void clearRepeatY() { m_repeatYSet = false; }
     void clearComposite() { m_compositeSet = false; }
-    void clearSize() { m_sizeSet = false; }
+    void clearSize() { m_sizeType = SizeNone; }
 
     void setNext(FillLayer* n) { if (m_next != n) { delete m_next; m_next = n; } }
 
@@ -117,9 +149,12 @@ public:
     static EFillAttachment initialFillAttachment(EFillLayerType) { return ScrollBackgroundAttachment; }
     static EFillBox initialFillClip(EFillLayerType) { return BorderFillBox; }
     static EFillBox initialFillOrigin(EFillLayerType type) { return type == BackgroundFillLayer ? PaddingFillBox : BorderFillBox; }
-    static EFillRepeat initialFillRepeat(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatX(EFillLayerType) { return RepeatFill; }
+    static EFillRepeat initialFillRepeatY(EFillLayerType) { return RepeatFill; }
     static CompositeOperator initialFillComposite(EFillLayerType) { return CompositeSourceOver; }
-    static LengthSize initialFillSize(EFillLayerType) { return LengthSize(); }
+    static EFillSizeType initialFillSizeType(EFillLayerType) { return SizeLength; }
+    static LengthSize initialFillSizeLength(EFillLayerType) { return LengthSize(); }
+    static FillSize initialFillSize(EFillLayerType) { return FillSize(); }
     static Length initialFillXPosition(EFillLayerType) { return Length(0.0, Percent); }
     static Length initialFillYPosition(EFillLayerType) { return Length(0.0, Percent); }
     static StyleImage* initialFillImage(EFillLayerType) { return 0; }
@@ -136,20 +171,22 @@ public:
     unsigned m_attachment : 2; // EFillAttachment
     unsigned m_clip : 2; // EFillBox
     unsigned m_origin : 2; // EFillBox
-    unsigned m_repeat : 2; // EFillRepeat
+    unsigned m_repeatX : 3; // EFillRepeat
+    unsigned m_repeatY : 3; // EFillRepeat
     unsigned m_composite : 4; // CompositeOperator
-
-    LengthSize m_size;
+    unsigned m_sizeType : 2; // EFillSizeType
+    
+    LengthSize m_sizeLength;
 
     bool m_imageSet : 1;
     bool m_attachmentSet : 1;
     bool m_clipSet : 1;
     bool m_originSet : 1;
-    bool m_repeatSet : 1;
+    bool m_repeatXSet : 1;
+    bool m_repeatYSet : 1;
     bool m_xPosSet : 1;
     bool m_yPosSet : 1;
     bool m_compositeSet : 1;
-    bool m_sizeSet : 1;
     
     unsigned m_type : 1; // EFillLayerType
 
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index 0e258c8..a861fea 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -324,6 +324,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
             *rareNonInheritedData->flexibleBox.get() != *other->rareNonInheritedData->flexibleBox.get())
             return StyleDifferenceLayout;
 
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
         if (!rareNonInheritedData->shadowDataEquivalent(*other->rareNonInheritedData.get()))
             return StyleDifferenceLayout;
 
@@ -453,6 +454,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     if (inherited->m_effectiveZoom != other->inherited->m_effectiveZoom)
         return StyleDifferenceLayout;
 
+    if (rareNonInheritedData->opacity == 1 && other->rareNonInheritedData->opacity < 1 ||
+        rareNonInheritedData->opacity < 1 && other->rareNonInheritedData->opacity == 1) {
+        // FIXME: We should add an optimized form of layout that just recomputes visual overflow.
+        return StyleDifferenceLayout;
+    }
+
     // Make sure these left/top/right/bottom checks stay below all layout checks and above
     // all visible checks.
     if (position() != StaticPosition) {
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 720bc8d..f1591de 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -521,26 +521,29 @@ public:
 
     const Color& backgroundColor() const { return background->m_color; }
     StyleImage* backgroundImage() const { return background->m_background.m_image.get(); }
-    EFillRepeat backgroundRepeat() const { return static_cast<EFillRepeat>(background->m_background.m_repeat); }
+    EFillRepeat backgroundRepeatX() const { return static_cast<EFillRepeat>(background->m_background.m_repeatX); }
+    EFillRepeat backgroundRepeatY() const { return static_cast<EFillRepeat>(background->m_background.m_repeatY); }
     CompositeOperator backgroundComposite() const { return static_cast<CompositeOperator>(background->m_background.m_composite); }
     EFillAttachment backgroundAttachment() const { return static_cast<EFillAttachment>(background->m_background.m_attachment); }
     EFillBox backgroundClip() const { return static_cast<EFillBox>(background->m_background.m_clip); }
     EFillBox backgroundOrigin() const { return static_cast<EFillBox>(background->m_background.m_origin); }
     Length backgroundXPosition() const { return background->m_background.m_xPosition; }
     Length backgroundYPosition() const { return background->m_background.m_yPosition; }
-    LengthSize backgroundSize() const { return background->m_background.m_size; }
+    EFillSizeType backgroundSizeType() const { return static_cast<EFillSizeType>(background->m_background.m_sizeType); }
+    LengthSize backgroundSizeLength() const { return background->m_background.m_sizeLength; }
     FillLayer* accessBackgroundLayers() { return &(background.access()->m_background); }
     const FillLayer* backgroundLayers() const { return &(background->m_background); }
 
     StyleImage* maskImage() const { return rareNonInheritedData->m_mask.m_image.get(); }
-    EFillRepeat maskRepeat() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeat); }
+    EFillRepeat maskRepeatX() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatX); }
+    EFillRepeat maskRepeatY() const { return static_cast<EFillRepeat>(rareNonInheritedData->m_mask.m_repeatY); }
     CompositeOperator maskComposite() const { return static_cast<CompositeOperator>(rareNonInheritedData->m_mask.m_composite); }
     EFillAttachment maskAttachment() const { return static_cast<EFillAttachment>(rareNonInheritedData->m_mask.m_attachment); }
     EFillBox maskClip() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_clip); }
     EFillBox maskOrigin() const { return static_cast<EFillBox>(rareNonInheritedData->m_mask.m_origin); }
     Length maskXPosition() const { return rareNonInheritedData->m_mask.m_xPosition; }
     Length maskYPosition() const { return rareNonInheritedData->m_mask.m_yPosition; }
-    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_size; }
+    LengthSize maskSize() const { return rareNonInheritedData->m_mask.m_sizeLength; }
     FillLayer* accessMaskLayers() { return &(rareNonInheritedData.access()->m_mask); }
     const FillLayer* maskLayers() const { return &(rareNonInheritedData->m_mask); }
     const NinePieceImage& maskBoxImage() const { return rareNonInheritedData->m_maskBoxImage; }
@@ -755,7 +758,8 @@ public:
 
     void setBackgroundXPosition(Length l) { SET_VAR(background, m_background.m_xPosition, l) }
     void setBackgroundYPosition(Length l) { SET_VAR(background, m_background.m_yPosition, l) }
-    void setBackgroundSize(LengthSize l) { SET_VAR(background, m_background.m_size, l) }
+    void setBackgroundSize(EFillSizeType b) { SET_VAR(background, m_background.m_sizeType, b) }
+    void setBackgroundSizeLength(LengthSize l) { SET_VAR(background, m_background.m_sizeLength, l) }
     
     void setBorderImage(const NinePieceImage& b) { SET_VAR(surround, border.image, b) }
 
@@ -868,7 +872,7 @@ public:
     void setMaskBoxImage(const NinePieceImage& b) { SET_VAR(rareNonInheritedData, m_maskBoxImage, b) }
     void setMaskXPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_xPosition, l) }
     void setMaskYPosition(Length l) { SET_VAR(rareNonInheritedData, m_mask.m_yPosition, l) }
-    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_size, l) }
+    void setMaskSize(LengthSize l) { SET_VAR(rareNonInheritedData, m_mask.m_sizeLength, l) }
 
     void setBorderCollapse(bool collapse) { inherited_flags._border_collapse = collapse; }
     void setHorizontalBorderSpacing(short v) { SET_VAR(inherited, horizontal_border_spacing, v) }
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index c491816..3010947 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -4,6 +4,7 @@
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Graham Dennis (graham.dennis@gmail.com)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -68,10 +69,10 @@ enum PseudoId {
     NOPSEUDO, FIRST_LINE, FIRST_LETTER, BEFORE, AFTER, SELECTION, FIRST_LINE_INHERITED, SCROLLBAR, FILE_UPLOAD_BUTTON, INPUT_PLACEHOLDER,
     SLIDER_THUMB, SEARCH_CANCEL_BUTTON, SEARCH_DECORATION, SEARCH_RESULTS_DECORATION, SEARCH_RESULTS_BUTTON, MEDIA_CONTROLS_PANEL,
     MEDIA_CONTROLS_PLAY_BUTTON, MEDIA_CONTROLS_MUTE_BUTTON, MEDIA_CONTROLS_TIMELINE, MEDIA_CONTROLS_TIMELINE_CONTAINER,
-    MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON, 
-    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON,
-    MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON, MEDIA_CONTROLS_STATUS_DISPLAY,
-    SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    MEDIA_CONTROLS_VOLUME_SLIDER, MEDIA_CONTROLS_VOLUME_SLIDER_CONTAINER, MEDIA_CONTROLS_CURRENT_TIME_DISPLAY, MEDIA_CONTROLS_TIME_REMAINING_DISPLAY, MEDIA_CONTROLS_SEEK_BACK_BUTTON,
+    MEDIA_CONTROLS_SEEK_FORWARD_BUTTON, MEDIA_CONTROLS_FULLSCREEN_BUTTON, MEDIA_CONTROLS_REWIND_BUTTON, MEDIA_CONTROLS_RETURN_TO_REALTIME_BUTTON,
+    MEDIA_CONTROLS_STATUS_DISPLAY, SCROLLBAR_THUMB, SCROLLBAR_BUTTON, SCROLLBAR_TRACK, SCROLLBAR_TRACK_PIECE, SCROLLBAR_CORNER, RESIZER,
+    INPUT_LIST_BUTTON,
 
     FIRST_INTERNAL_PSEUDOID = FILE_UPLOAD_BUTTON
 };
@@ -131,13 +132,16 @@ enum EFillBox {
 };
 
 enum EFillRepeat {
-    RepeatFill, RepeatXFill, RepeatYFill, NoRepeatFill
+    RepeatFill, NoRepeatFill, RoundFill, SpaceFill
 };
 
 enum EFillLayerType {
     BackgroundFillLayer, MaskFillLayer
 };
 
+// CSS3 Background Values
+enum EFillSizeType { Contain, Cover, SizeLength, SizeNone };
+
 // CSS3 Marquee Properties
 
 enum EMarqueeBehavior { MNONE, MSCROLL, MSLIDE, MALTERNATE };
@@ -298,7 +302,11 @@ enum EDisplay {
     TABLE, INLINE_TABLE, TABLE_ROW_GROUP,
     TABLE_HEADER_GROUP, TABLE_FOOTER_GROUP, TABLE_ROW,
     TABLE_COLUMN_GROUP, TABLE_COLUMN, TABLE_CELL,
-    TABLE_CAPTION, BOX, INLINE_BOX, NONE
+    TABLE_CAPTION, BOX, INLINE_BOX, 
+#if ENABLE(WCSS)
+    WAP_MARQUEE,
+#endif
+    NONE
 };
 
 enum EPointerEvents {
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index 0e9dae4..e50d349 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -65,7 +65,6 @@ namespace WebCore {
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(LineJoin, JoinStyle, joinStyle, MiterJoin)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EShapeRendering, ShapeRendering, shapeRendering, SR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextAnchor, TextAnchor, textAnchor, TA_START)
-        SVG_RS_DEFINE_ATTRIBUTE_INHERITED(ETextRendering, TextRendering, textRendering, TR_AUTO)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EWritingMode, WritingMode, writingMode, WM_LRTB)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationHorizontal, glyphOrientationHorizontal, GO_0DEG)
         SVG_RS_DEFINE_ATTRIBUTE_INHERITED(EGlyphOrientation, GlyphOrientationVertical, glyphOrientationVertical, GO_AUTO)
@@ -113,7 +112,6 @@ namespace WebCore {
                 return (_colorRendering == other._colorRendering) &&
                        (_imageRendering == other._imageRendering) &&
                        (_shapeRendering == other._shapeRendering) &&
-                       (_textRendering == other._textRendering) &&
                        (_clipRule == other._clipRule) &&
                        (_fillRule == other._fillRule) &&
                        (_capStyle == other._capStyle) &&
@@ -134,7 +132,6 @@ namespace WebCore {
             unsigned _colorRendering : 2; // EColorRendering
             unsigned _imageRendering : 2; // EImageRendering 
             unsigned _shapeRendering : 2; // EShapeRendering 
-            unsigned _textRendering : 2; // ETextRendering
             unsigned _clipRule : 1; // WindRule
             unsigned _fillRule : 1; // WindRule
             unsigned _capStyle : 2; // LineCap
@@ -190,7 +187,6 @@ namespace WebCore {
             svg_inherited_flags._fillRule = initialFillRule();
             svg_inherited_flags._imageRendering = initialImageRendering();
             svg_inherited_flags._shapeRendering = initialShapeRendering();
-            svg_inherited_flags._textRendering = initialTextRendering();
             svg_inherited_flags._textAnchor = initialTextAnchor();
             svg_inherited_flags._capStyle = initialCapStyle();
             svg_inherited_flags._joinStyle = initialJoinStyle();
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index b7bf026..c0f5d4e 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -95,10 +95,6 @@ namespace WebCore {
         SR_AUTO, SR_OPTIMIZESPEED, SR_CRISPEDGES, SR_GEOMETRICPRECISION
     };
 
-    enum ETextRendering {
-        TR_AUTO, TR_OPTIMIZESPEED, TR_OPTIMIZELEGIBILITY, TR_GEOMETRICPRECISION
-    };
-
     enum EWritingMode {
         WM_LRTB, WM_LR, WM_RLTB, WM_RL, WM_TBRL, WM_TB
     };
diff --git a/WebCore/storage/ChangeVersionWrapper.cpp b/WebCore/storage/ChangeVersionWrapper.cpp
index a2be615..17a9407 100644
--- a/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/WebCore/storage/ChangeVersionWrapper.cpp
@@ -34,29 +34,29 @@
 namespace WebCore {
 
 ChangeVersionWrapper::ChangeVersionWrapper(const String& oldVersion, const String& newVersion)
-    : m_oldVersion(oldVersion.copy())
-    , m_newVersion(newVersion.copy())
+    : m_oldVersion(oldVersion.crossThreadString())
+    , m_newVersion(newVersion.crossThreadString())
 {
 }
 
 bool ChangeVersionWrapper::performPreflight(SQLTransaction* transaction)
 {
     ASSERT(transaction && transaction->database());
-    
+
     String actualVersion;
-    
+
     if (!transaction->database()->getVersionFromDatabase(actualVersion)) {
         LOG_ERROR("Unable to retrieve actual current version from database");
         m_sqlError = SQLError::create(0, "unable to verify current version of database");
         return false;
     }
-    
+
     if (actualVersion != m_oldVersion) {
         LOG_ERROR("Old version doesn't match actual version");
         m_sqlError = SQLError::create(2, "current version of the database and `oldVersion` argument do not match");
         return false;
     }
-    
+
     return true;
 }
 
@@ -71,10 +71,10 @@ bool ChangeVersionWrapper::performPostflight(SQLTransaction* transaction)
     }
 
     transaction->database()->setExpectedVersion(m_newVersion);
-    
+
     return true;
 }
-    
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index 8118e76..8b0b432 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -50,6 +50,8 @@
 #include "SQLiteFileSystem.h"
 #include "SQLiteStatement.h"
 #include "SQLResultSet.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include <wtf/MainThread.h>
 #endif
 
@@ -102,7 +104,11 @@ static inline void updateGuidVersionMap(int guid, String newVersion)
     // FIXME: This is a quite-awkward restriction to have to program with.
 
     // Map null string to empty string (see comment above).
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.copy());
+=======
+    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/storage/Database.cpp
 }
 
 typedef HashMap<int, HashSet<Database*>*> GuidDatabaseMap;
@@ -127,20 +133,22 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
         LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), document->securityOrigin()->toString().ascii().data());
         return 0;
     }
-    
+
     RefPtr<Database> database = adoptRef(new Database(document, name, expectedVersion));
 
     if (!database->openAndVerifyVersion(e)) {
        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
        return 0;
     }
-    
+
     DatabaseTracker::tracker().setDatabaseDetails(document->securityOrigin(), name, displayName, estimatedSize);
 
     document->setHasOpenDatabases();
 
+#if ENABLE(INSPECTOR)
     if (Page* page = document->frame()->page())
         page->inspectorController()->didOpenDatabase(database.get(), document->securityOrigin()->host(), name, expectedVersion);
+#endif
 
     return database;
 }
@@ -148,7 +156,7 @@ PassRefPtr<Database> Database::openDatabase(Document* document, const String& na
 Database::Database(Document* document, const String& name, const String& expectedVersion)
     : m_transactionInProgress(false)
     , m_document(document)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_guid(0)
     , m_expectedVersion(expectedVersion)
     , m_deleted(false)
@@ -163,11 +171,14 @@ Database::Database(Document* document, const String& name, const String& expecte
 
 #if USE(JSC)
     JSC::initializeThreading();
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     // Database code violates the normal JSCore contract by calling jsUnprotect from a secondary thread, and thus needs additional locking.
     JSDOMWindow::commonJSGlobalData()->heap.setGCProtectNeedsLocking();
 #elif USE(V8)
     // TODO(benm): do we need the extra locking in V8 too? (See JSC comment above)
     V8::initializeThreading();
+=======
+>>>>>>> webkit.org at 49305:WebCore/storage/Database.cpp
 #endif
 
     m_guid = guidForOriginAndName(m_securityOrigin->toString(), name);
@@ -248,7 +259,7 @@ bool Database::getVersionFromDatabase(String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.copy(), version);
+    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
 
@@ -286,7 +297,7 @@ bool Database::setVersionInDatabase(const String& version)
 
     m_databaseAuthorizer->disable();
 
-    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.copy(), version);
+    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
     if (!result)
         LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
 
@@ -301,7 +312,7 @@ bool Database::versionMatchesExpected() const
         MutexLocker locker(guidMutex());
         return m_expectedVersion == guidToVersionMap().get(m_guid);
     }
-    
+
     return true;
 }
 
@@ -357,8 +368,8 @@ void Database::stop()
     // FIXME: The net effect of the following code is to remove all pending transactions and statements, but allow the current statement
     // to run to completion.  In the future we can use the sqlite3_progress_handler or sqlite3_interrupt interfaces to cancel the current
     // statement in response to close(), as well.
-    
-    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of 
+
+    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of
     // a page load or closing the page
     m_stopped = true;
 
@@ -378,10 +389,10 @@ unsigned long long Database::maximumSize() const
 {
     // The maximum size for this database is the full quota for this origin, minus the current usage within this origin,
     // except for the current usage of this database
-    
+
     OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
     Locker<OriginQuotaManager> locker(manager);
-    
+
     return DatabaseTracker::tracker().quotaForOrigin(m_securityOrigin.get()) - manager.diskUsage(m_securityOrigin.get()) + databaseSize();
 }
 
@@ -464,14 +475,6 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
     m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
 
-    if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
-        if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
-            LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
-            e = INVALID_STATE_ERR;
-            return false;
-        }
-    }
-
     String currentVersion;
     {
         MutexLocker locker(guidMutex());
@@ -483,6 +486,15 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
             LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
         } else {
             LOG(StorageAPI, "No cached version for guid %i", m_guid);
+
+            if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
+                if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
+                    LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
+                    e = INVALID_STATE_ERR;
+                    return false;
+                }
+            }
+
             if (!getVersionFromDatabase(currentVersion)) {
                 LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
                 e = INVALID_STATE_ERR;
@@ -523,7 +535,7 @@ bool Database::performOpenAndVerify(ExceptionCode& e)
     return true;
 }
 
-void Database::changeVersion(const String& oldVersion, const String& newVersion, 
+void Database::changeVersion(const String& oldVersion, const String& newVersion,
                              PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                              PassRefPtr<VoidCallback> successCallback)
 {
@@ -534,9 +546,9 @@ void Database::changeVersion(const String& oldVersion, const String& newVersion,
 }
 
 void Database::transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                           PassRefPtr<VoidCallback> successCallback)
+                           PassRefPtr<VoidCallback> successCallback, bool readOnly)
 {
-    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0));
+    m_transactionQueue.append(SQLTransaction::create(this, callback, errorCallback, successCallback, 0, readOnly));
     MutexLocker locker(m_transactionInProgressMutex);
     if (!m_transactionInProgress)
         scheduleTransaction();
@@ -555,13 +567,17 @@ void Database::scheduleTransaction()
         m_transactionInProgress = false;
 }
 
-void Database::scheduleTransactionStep(SQLTransaction* transaction)
+void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (m_document->databaseThread()) {
-        RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
-        LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (!m_document->databaseThread())
+        return;
+
+    RefPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
+    LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
+    if (immediately)
+        m_document->databaseThread()->scheduleImmediateTask(task.release());
+    else
         m_document->databaseThread()->scheduleTask(task.release());
-    }
 }
 
 void Database::scheduleTransactionCallback(SQLTransaction* transaction)
@@ -599,12 +615,22 @@ Vector<String> Database::performGetTableNames()
     return tableNames;
 }
 
+SQLTransactionClient* Database::transactionClient() const
+{
+    return m_document->databaseThread()->transactionClient();
+}
+
+SQLTransactionCoordinator* Database::transactionCoordinator() const
+{
+    return m_document->databaseThread()->transactionCoordinator();
+}
+
 String Database::version() const
 {
     if (m_deleted)
         return String();
     MutexLocker locker(guidMutex());
-    return guidToVersionMap().get(m_guid).copy();
+    return guidToVersionMap().get(m_guid).threadsafeCopy();
 }
 
 void Database::deliverPendingCallback(void* context)
@@ -629,7 +655,11 @@ Vector<String> Database::tableNames()
 
 void Database::setExpectedVersion(const String& version)
 {
+<<<<<<< HEAD:WebCore/storage/Database.cpp
     m_expectedVersion = version.copy();
+=======
+    m_expectedVersion = version.threadsafeCopy();
+>>>>>>> Merge webkit.org at R49305 : Automatic merge by git.:WebCore/storage/Database.cpp
     // Update the in memory database version map.
     MutexLocker locker(guidMutex());
     updateGuidVersionMap(m_guid, version);
@@ -637,13 +667,13 @@ void Database::setExpectedVersion(const String& version)
 
 PassRefPtr<SecurityOrigin> Database::securityOriginCopy() const
 {
-    return m_securityOrigin->copy();
+    return m_securityOrigin->threadsafeCopy();
 }
 
 String Database::stringIdentifier() const
 {
     // Return a deep copy for ref counting thread safety
-    return m_name.copy();
+    return m_name.threadsafeCopy();
 }
 
 #endif
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index 0bdb37b..b850686 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -41,7 +41,6 @@
 
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Deque.h>
@@ -57,9 +56,11 @@ class DatabaseThread;
 class Document;
 class SQLResultSet;
 class SQLTransactionCallback;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
 class SQLValue;
-    
+
 typedef int ExceptionCode;
 
 class Database : public ThreadSafeShared<Database> {
@@ -72,12 +73,12 @@ public:
 // Direct support for the DOM API
     static PassRefPtr<Database> openDatabase(Document* document, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
     String version() const;
-    void changeVersion(const String& oldVersion, const String& newVersion, 
+    void changeVersion(const String& oldVersion, const String& newVersion,
                        PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
                        PassRefPtr<VoidCallback> successCallback);
     void transaction(PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
-                     PassRefPtr<VoidCallback> successCallback);
-    
+                     PassRefPtr<VoidCallback> successCallback, bool readOnly);
+
 // Internal engine support
     static const String& databaseInfoTableName();
 
@@ -90,7 +91,7 @@ public:
     Document* document() const { return m_document.get(); }
     PassRefPtr<SecurityOrigin> securityOriginCopy() const;
     String stringIdentifier() const;
-    
+
     bool getVersionFromDatabase(String&);
     bool setVersionInDatabase(const String&);
     void setExpectedVersion(const String&);
@@ -101,7 +102,7 @@ public:
 
     void close();
     bool opened() const { return m_opened; }
-    
+
     void stop();
     bool stopped() const { return m_stopped; }
 
@@ -116,6 +117,9 @@ public:
 
     Vector<String> performGetTableNames();
 
+    SQLTransactionClient* transactionClient() const;
+    SQLTransactionCoordinator* transactionCoordinator() const;
+
 private:
     Database(Document* document, const String& name, const String& expectedVersion);
 
@@ -123,8 +127,8 @@ private:
 
     void scheduleTransaction();
     void scheduleTransactionCallback(SQLTransaction*);
-    void scheduleTransactionStep(SQLTransaction* transaction);
-    
+    void scheduleTransactionStep(SQLTransaction* transaction, bool immediately = false);
+
     MessageQueue<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
@@ -139,7 +143,7 @@ private:
     String m_filename;
 
     bool m_deleted;
-    
+
     bool m_stopped;
 
     bool m_opened;
diff --git a/WebCore/storage/Database.idl b/WebCore/storage/Database.idl
index 1e4b316..6ca9c95 100644
--- a/WebCore/storage/Database.idl
+++ b/WebCore/storage/Database.idl
@@ -34,6 +34,7 @@ module storage {
         readonly attribute DOMString version;
         [Custom] void changeVersion(in DOMString oldVersion, in DOMString newVersion, in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
         [Custom] void transaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
+        [Custom] void readTransaction(in SQLTransactionCallback callback, in SQLTransactionErrorCallback errorCallback, in VoidCallback successCallback);
     };
 
 }
diff --git a/WebCore/storage/DatabaseAuthorizer.cpp b/WebCore/storage/DatabaseAuthorizer.cpp
index 2d182ce..93f9106 100644
--- a/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/WebCore/storage/DatabaseAuthorizer.cpp
@@ -58,6 +58,12 @@ int DatabaseAuthorizer::createTable(const String& tableName)
 
 int DatabaseAuthorizer::createTempTable(const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TABLE results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -71,6 +77,12 @@ int DatabaseAuthorizer::dropTable(const String& tableName)
 
 int DatabaseAuthorizer::dropTempTable(const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TABLE results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TABLE in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -94,6 +106,12 @@ int DatabaseAuthorizer::createIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_INDEX should result in a UPDATE or INSERT operation,
+    // which is not allowed in read-only transactions or private browsing,
+    // so we might as well disallow SQLITE_CREATE_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -107,6 +125,12 @@ int DatabaseAuthorizer::dropIndex(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempIndex(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_INDEX should result in a DELETE operation, which is
+    // not allowed in read-only transactions or private browsing, so we might
+    // as well disallow SQLITE_DROP_TEMP_INDEX in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -121,6 +145,12 @@ int DatabaseAuthorizer::createTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::createTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_CREATE_TEMP_TRIGGER results in a INSERT operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
@@ -134,9 +164,41 @@ int DatabaseAuthorizer::dropTrigger(const String&, const String& tableName)
 
 int DatabaseAuthorizer::dropTempTrigger(const String&, const String& tableName)
 {
+    // SQLITE_DROP_TEMP_TRIGGER results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_TRIGGER in these cases
+    if (m_readOnly && m_securityEnabled)
+        return SQLAuthDeny;
+
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::createView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::createTempView(const String&)
+{
+    // SQLITE_CREATE_TEMP_VIEW results in a UPDATE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_CREATE_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropView(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
+int DatabaseAuthorizer::dropTempView(const String&)
+{
+    // SQLITE_DROP_TEMP_VIEW results in a DELETE operation, which is not
+    // allowed in read-only transactions or private browsing, so we might as
+    // well disallow SQLITE_DROP_TEMP_VIEW in these cases
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::createVTable(const String&, const String&)
 {
     if (m_readOnly && m_securityEnabled)
@@ -191,6 +253,11 @@ int DatabaseAuthorizer::allowRead(const String& tableName, const String&)
     return denyBasedOnTableName(tableName);
 }
 
+int DatabaseAuthorizer::allowReindex(const String&)
+{
+    return (m_readOnly && m_securityEnabled ? SQLAuthDeny : SQLAuthAllow);
+}
+
 int DatabaseAuthorizer::allowAnalyze(const String& tableName)
 {
     return denyBasedOnTableName(tableName);
diff --git a/WebCore/storage/DatabaseAuthorizer.h b/WebCore/storage/DatabaseAuthorizer.h
index e53ea50..248b659 100644
--- a/WebCore/storage/DatabaseAuthorizer.h
+++ b/WebCore/storage/DatabaseAuthorizer.h
@@ -59,10 +59,10 @@ public:
     int dropTrigger(const String& triggerName, const String& tableName);
     int dropTempTrigger(const String& triggerName, const String& tableName);
 
-    int createView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int createTempView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropView(const String& /*viewName*/) { return SQLAuthAllow; }
-    int dropTempView(const String& /*viewName*/) { return SQLAuthAllow; }
+    int createView(const String& viewName);
+    int createTempView(const String& viewName);
+    int dropView(const String& viewName);
+    int dropTempView(const String& viewName);
 
     int createVTable(const String& tableName, const String& moduleName);
     int dropVTable(const String& tableName, const String& moduleName);
@@ -75,7 +75,7 @@ public:
     int allowSelect() { return SQLAuthAllow; }
     int allowRead(const String& tableName, const String& columnName);
 
-    int allowReindex(const String& /*indexName*/) { return SQLAuthAllow; }
+    int allowReindex(const String& indexName);
     int allowAnalyze(const String& tableName);
     int allowFunction(const String& functionName);
     int allowPragma(const String& pragmaName, const String& firstArgument);
diff --git a/WebCore/storage/DatabaseDetails.h b/WebCore/storage/DatabaseDetails.h
index a4d85fd..9b0f506 100644
--- a/WebCore/storage/DatabaseDetails.h
+++ b/WebCore/storage/DatabaseDetails.h
@@ -60,7 +60,7 @@ private:
     String m_name;
     String m_displayName;
     unsigned long long m_expectedUsage;
-    unsigned long long m_currentUsage; 
+    unsigned long long m_currentUsage;
 
 };
 
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index b6c9b5d..9e3afdd 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -35,11 +35,15 @@
 #include "Database.h"
 #include "DatabaseTask.h"
 #include "Logging.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 
 namespace WebCore {
 
 DatabaseThread::DatabaseThread()
     : m_threadID(0)
+    , m_transactionClient(new SQLTransactionClient())
+    , m_transactionCoordinator(new SQLTransactionCoordinator())
 {
     m_selfRef = this;
 }
@@ -97,6 +101,9 @@ void* DatabaseThread::databaseThread()
         pool.cycle();
     }
 
+    // Clean up the list of all pending transactions on this database thread
+    m_transactionCoordinator->shutdown();
+
     LOG(StorageAPI, "About to detach thread %i and clear the ref to DatabaseThread %p, which currently has %i ref(s)", m_threadID, this, refCount());
 
     // Close the databases that we ran transactions on. This ensures that if any transactions are still open, they are rolled back and we don't leave the database in an
@@ -119,7 +126,7 @@ void* DatabaseThread::databaseThread()
     return 0;
 }
 
-void DatabaseThread::recordDatabaseOpen(Database* database) 
+void DatabaseThread::recordDatabaseOpen(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
@@ -127,7 +134,7 @@ void DatabaseThread::recordDatabaseOpen(Database* database)
     m_openDatabaseSet.add(database);
 }
 
-void DatabaseThread::recordDatabaseClosed(Database* database) 
+void DatabaseThread::recordDatabaseClosed(Database* database)
 {
     ASSERT(currentThread() == m_threadID);
     ASSERT(database);
diff --git a/WebCore/storage/DatabaseThread.h b/WebCore/storage/DatabaseThread.h
index 5aab5fd..83b1baf 100644
--- a/WebCore/storage/DatabaseThread.h
+++ b/WebCore/storage/DatabaseThread.h
@@ -33,6 +33,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/MessageQueue.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -42,6 +43,8 @@ namespace WebCore {
 class Database;
 class DatabaseTask;
 class Document;
+class SQLTransactionClient;
+class SQLTransactionCoordinator;
 
 class DatabaseThread : public ThreadSafeShared<DatabaseThread> {
 public:
@@ -60,6 +63,9 @@ public:
     void recordDatabaseClosed(Database*);
     ThreadIdentifier getThreadID() { return m_threadID; }
 
+    SQLTransactionClient* transactionClient() { return m_transactionClient.get(); }
+    SQLTransactionCoordinator* transactionCoordinator() { return m_transactionCoordinator.get(); }
+
 private:
     DatabaseThread();
 
@@ -75,6 +81,9 @@ private:
     // This set keeps track of the open databases that have been used on this thread.
     typedef HashSet<RefPtr<Database> > DatabaseSet;
     DatabaseSet m_openDatabaseSet;
+
+    OwnPtr<SQLTransactionClient> m_transactionClient;
+    OwnPtr<SQLTransactionCoordinator> m_transactionCoordinator;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseTracker.cpp b/WebCore/storage/DatabaseTracker.cpp
index e7c9485..265cd0d 100644
--- a/WebCore/storage/DatabaseTracker.cpp
+++ b/WebCore/storage/DatabaseTracker.cpp
@@ -131,7 +131,7 @@ bool DatabaseTracker::canEstablishDatabase(Document* document, const String& nam
     // Since we're imminently opening a database within this Document's origin, make sure this origin is being tracked by the QuotaTracker
     // by fetching it's current usage now
     unsigned long long usage = usageForOrigin(origin);
-    
+
     // If a database already exists, ignore the passed-in estimated size and say it's OK.
     if (hasEntryForDatabase(origin, name))
         return true;
@@ -197,11 +197,11 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
 
     String originIdentifier = origin->databaseIdentifier();
     String originPath = this->originPath(origin);
-    
+
     // Make sure the path for this SecurityOrigin exists
     if (createIfNotExists && !SQLiteFileSystem::ensureDatabaseDirectoryExists(originPath))
         return String();
-    
+
     // See if we have a path for this database yet
     openTrackerDatabase(false);
     if (!m_database.isOpen())
@@ -220,14 +220,14 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         return SQLiteFileSystem::appendDatabaseFileNameToPath(originPath, statement.getColumnText(0));
     if (!createIfNotExists)
         return String();
-        
+
     if (result != SQLResultDone) {
         LOG_ERROR("Failed to retrieve filename from Database Tracker for origin %s, name %s", origin->databaseIdentifier().ascii().data(), name.ascii().data());
         return String();
     }
     statement.finalize();
-    
-    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, origin->databaseIdentifier(), name, &m_database);
+
+    String fileName = SQLiteFileSystem::getFileNameForNewDatabase(originPath, name, origin->databaseIdentifier(), &m_database);
     if (!addDatabase(origin, name, fileName))
         return String();
 
@@ -239,7 +239,7 @@ String DatabaseTracker::fullPathForDatabase(SecurityOrigin* origin, const String
         if (originQuotaManager().tracksOrigin(origin))
             originQuotaManager().addDatabase(origin, name, fullFilePath);
     }
-    
+
     return fullFilePath;
 }
 
@@ -321,19 +321,19 @@ DatabaseDetails DatabaseTracker::detailsForNameAndOrigin(const String& name, Sec
     SQLiteStatement statement(m_database, "SELECT displayName, estimatedSize FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return DatabaseDetails();
-   
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultDone)
         return DatabaseDetails();
-    
+
     if (result != SQLResultRow) {
         LOG_ERROR("Error retrieving details for database %s in origin %s from tracker database", name.ascii().data(), originIdentifier.ascii().data());
         return DatabaseDetails();
     }
-    
+
     return DatabaseDetails(name, statement.getColumnText(0), statement.getColumnInt64(1), usageForDatabase(name, origin));
 }
 
@@ -343,17 +343,17 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
 
     String originIdentifier = origin->databaseIdentifier();
     int64_t guid = 0;
-    
+
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return;
     SQLiteStatement statement(m_database, "SELECT guid FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk)
         return;
-        
+
     statement.bindText(1, originIdentifier);
     statement.bindText(2, name);
-    
+
     int result = statement.step();
     if (result == SQLResultRow)
         guid = statement.getColumnInt64(0);
@@ -371,20 +371,20 @@ void DatabaseTracker::setDatabaseDetails(SecurityOrigin* origin, const String& n
         }
         return;
     }
-    
+
     SQLiteStatement updateStatement(m_database, "UPDATE Databases SET displayName=?, estimatedSize=? WHERE guid=?");
     if (updateStatement.prepare() != SQLResultOk)
         return;
-    
+
     updateStatement.bindText(1, displayName);
     updateStatement.bindInt64(2, estimatedSize);
     updateStatement.bindInt64(3, guid);
-    
+
     if (updateStatement.step() != SQLResultDone) {
         LOG_ERROR("Failed to update details for database %s in origin %s", name.ascii().data(), originIdentifier.ascii().data());
-        return;  
+        return;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyDatabase(origin, name);
 }
@@ -395,7 +395,7 @@ unsigned long long DatabaseTracker::usageForDatabase(const String& name, Securit
     String path = fullPathForDatabase(origin, name, false);
     if (path.isEmpty())
         return 0;
-        
+
     return SQLiteFileSystem::getDatabaseFileSize(path);
 }
 
@@ -481,16 +481,16 @@ unsigned long long DatabaseTracker::usageForOrigin(SecurityOrigin* origin)
     // Use the OriginQuotaManager mechanism to calculate the usage
     if (originQuotaManager().tracksOrigin(origin))
         return originQuotaManager().diskUsage(origin);
-    
+
     // If the OriginQuotaManager doesn't track this origin already, prime it to do so
     originQuotaManager().trackOrigin(origin);
-    
+
     Vector<String> names;
     databaseNamesForOrigin(origin, names);
 
     for (unsigned i = 0; i < names.size(); ++i)
         originQuotaManager().addDatabase(origin, names[i], fullPathForDatabase(origin, names[i], false));
-    
+
     if (!originQuotaManager().tracksOrigin(origin))
         return 0;
     return originQuotaManager().diskUsage(origin);
@@ -529,7 +529,7 @@ void DatabaseTracker::setQuota(SecurityOrigin* origin, unsigned long long quota)
                     LOG_ERROR("Unable to establish origin %s in the tracker", origin->databaseIdentifier().ascii().data());
             }
         } else {
-            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");        
+            SQLiteStatement statement(m_database, "UPDATE Origins SET quota=? WHERE origin=?");
             bool error = statement.prepare() != SQLResultOk;
             if (!error) {
                 statement.bindInt64(1, quota);
@@ -556,7 +556,7 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
     openTrackerDatabase(true);
     if (!m_database.isOpen())
         return false;
-        
+
     // New database should never be added until the origin has been established
     ASSERT(hasEntryForOrigin(origin));
 
@@ -573,10 +573,10 @@ bool DatabaseTracker::addDatabase(SecurityOrigin* origin, const String& name, co
         LOG_ERROR("Failed to add database %s to origin %s: %s\n", name.ascii().data(), origin->databaseIdentifier().ascii().data(), m_database.lastErrorMsg());
         return false;
     }
-    
+
     if (m_client)
         m_client->dispatchDidModifyOrigin(origin);
-    
+
     return true;
 }
 
@@ -603,27 +603,27 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
         LOG_ERROR("Unable to retrieve list of database names for origin %s", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     for (unsigned i = 0; i < databaseNames.size(); ++i) {
         if (!deleteDatabaseFile(origin, databaseNames[i])) {
+            // Even if the file can't be deleted, we want to try and delete the rest, don't return early here.
             LOG_ERROR("Unable to delete file for database %s in origin %s", databaseNames[i].ascii().data(), origin->databaseIdentifier().ascii().data());
-            return;
         }
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement originStatement(m_database, "DELETE FROM Origins WHERE origin=?");
     if (originStatement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of origin %s from tracker", origin->databaseIdentifier().ascii().data());
@@ -631,7 +631,7 @@ void DatabaseTracker::deleteOrigin(SecurityOrigin* origin)
     }
 
     originStatement.bindText(1, origin->databaseIdentifier());
-    
+
     if (!originStatement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of databases from origin %s from tracker", origin->databaseIdentifier().ascii().data());
         return;
@@ -674,26 +674,26 @@ void DatabaseTracker::deleteDatabase(SecurityOrigin* origin, const String& name)
         LOG_ERROR("Unable to delete file for database %s in origin %s", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     SQLiteStatement statement(m_database, "DELETE FROM Databases WHERE origin=? AND name=?");
     if (statement.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to prepare deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-        
+
     statement.bindText(1, origin->databaseIdentifier());
     statement.bindText(2, name);
-    
+
     if (!statement.executeCommand()) {
         LOG_ERROR("Unable to execute deletion of database %s from origin %s from tracker", name.ascii().data(), origin->databaseIdentifier().ascii().data());
         return;
     }
-    
+
     {
         Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
         originQuotaManager().removeDatabase(origin, name);
     }
-    
+
     if (m_client) {
         m_client->dispatchDidModifyOrigin(origin);
         m_client->dispatchDidModifyDatabase(origin, name);
@@ -762,7 +762,7 @@ void DatabaseTracker::scheduleNotifyDatabaseChanged(SecurityOrigin* origin, cons
 {
     MutexLocker locker(notificationMutex());
 
-    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.copy()));
+    notificationQueue().append(pair<SecurityOrigin*, String>(origin, name.crossThreadString()));
     scheduleForNotification();
 }
 
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index dc50965..2f6e06d 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -70,18 +70,18 @@ public:
     unsigned long long usageForOrigin(SecurityOrigin*);
     unsigned long long quotaForOrigin(SecurityOrigin*);
     void setQuota(SecurityOrigin*, unsigned long long);
-    
+
     void deleteAllDatabases();
     void deleteOrigin(SecurityOrigin*);
     void deleteDatabase(SecurityOrigin*, const String& name);
 
     void setClient(DatabaseTrackerClient*);
-    
+
     // From a secondary thread, must be thread safe with its data
     void scheduleNotifyDatabaseChanged(SecurityOrigin*, const String& name);
-    
+
     OriginQuotaManager& originQuotaManager();
-    
+
     static DatabaseTracker& tracker();
 
     bool hasEntryForOrigin(SecurityOrigin*);
@@ -93,12 +93,12 @@ private:
     void openTrackerDatabase(bool createIfDoesNotExist);
 
     String originPath(SecurityOrigin*) const;
-    
+
     bool hasEntryForDatabase(SecurityOrigin*, const String& databaseIdentifier);
-    
+
     bool addDatabase(SecurityOrigin*, const String& name, const String& path);
     void populateOrigins();
-    
+
     bool deleteDatabaseFile(SecurityOrigin*, const String& name);
 
     SQLiteDatabase m_database;
@@ -117,7 +117,7 @@ private:
     OwnPtr<OriginQuotaManager> m_quotaManager;
 
     String m_databaseDirectoryPath;
-    
+
     DatabaseTrackerClient* m_client;
 
     std::pair<SecurityOrigin*, DatabaseDetails>* m_proposedDatabase;
diff --git a/WebCore/storage/LocalStorageTask.cpp b/WebCore/storage/LocalStorageTask.cpp
index f5d4890..12cc083 100644
--- a/WebCore/storage/LocalStorageTask.cpp
+++ b/WebCore/storage/LocalStorageTask.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -33,16 +33,18 @@
 
 namespace WebCore {
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<StorageAreaSync> area)
+LocalStorageTask::LocalStorageTask(Type type, StorageAreaSync* area)
     : m_type(type)
     , m_area(area)
+    , m_thread(0)
 {
     ASSERT(m_area);
     ASSERT(m_type == AreaImport || m_type == AreaSync);
 }
 
-LocalStorageTask::LocalStorageTask(Type type, PassRefPtr<LocalStorageThread> thread)
+LocalStorageTask::LocalStorageTask(Type type, LocalStorageThread* thread)
     : m_type(type)
+    , m_area(0)
     , m_thread(thread)
 {
     ASSERT(m_thread);
@@ -57,11 +59,9 @@ void LocalStorageTask::performTask()
 {
     switch (m_type) {
         case AreaImport:
-            ASSERT(m_area);
             m_area->performImport();
             break;
         case AreaSync:
-            ASSERT(m_area);
             m_area->performSync();
             break;
         case TerminateThread:
@@ -73,4 +73,3 @@ void LocalStorageTask::performTask()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/LocalStorageTask.h b/WebCore/storage/LocalStorageTask.h
index b12a26b..f03d851 100644
--- a/WebCore/storage/LocalStorageTask.h
+++ b/WebCore/storage/LocalStorageTask.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageTask_h
@@ -44,19 +44,19 @@ namespace WebCore {
 
         ~LocalStorageTask();
 
-        static PassRefPtr<LocalStorageTask> createImport(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
-        static PassRefPtr<LocalStorageTask> createSync(PassRefPtr<StorageAreaSync> area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
-        static PassRefPtr<LocalStorageTask> createTerminate(PassRefPtr<LocalStorageThread> thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
+        static PassRefPtr<LocalStorageTask> createImport(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaImport, area)); }
+        static PassRefPtr<LocalStorageTask> createSync(StorageAreaSync* area) { return adoptRef(new LocalStorageTask(AreaSync, area)); }
+        static PassRefPtr<LocalStorageTask> createTerminate(LocalStorageThread* thread) { return adoptRef(new LocalStorageTask(TerminateThread, thread)); }
 
         void performTask();
 
     private:
-        LocalStorageTask(Type, PassRefPtr<StorageAreaSync>);
-        LocalStorageTask(Type, PassRefPtr<LocalStorageThread>);
+        LocalStorageTask(Type, StorageAreaSync*);
+        LocalStorageTask(Type, LocalStorageThread*);
 
         Type m_type;
-        RefPtr<StorageAreaSync> m_area;
-        RefPtr<LocalStorageThread> m_thread;
+        StorageAreaSync* m_area;
+        LocalStorageThread* m_thread;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/LocalStorageThread.cpp b/WebCore/storage/LocalStorageThread.cpp
index 2da5934..78640a9 100644
--- a/WebCore/storage/LocalStorageThread.cpp
+++ b/WebCore/storage/LocalStorageThread.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -86,13 +86,13 @@ void* LocalStorageThread::localStorageThread()
     return 0;
 }
 
-void LocalStorageThread::scheduleImport(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleImport(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createImport(area));
 }
 
-void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
+void LocalStorageThread::scheduleSync(StorageAreaSync* area)
 {
     ASSERT(!m_queue.killed() && m_threadID);
     m_queue.append(LocalStorageTask::createSync(area));
@@ -101,7 +101,7 @@ void LocalStorageThread::scheduleSync(PassRefPtr<StorageAreaSync> area)
 void LocalStorageThread::terminate()
 {
     ASSERT(isMainThread());
-    
+
     // Ideally we'd never be killing a thread that wasn't live, so ASSERT it.
     // But if we do in a release build, make sure to not wait on a condition that will never get signalled
     ASSERT(!m_queue.killed() && m_threadID);
@@ -109,9 +109,9 @@ void LocalStorageThread::terminate()
         return;
 
     MutexLocker locker(m_terminateLock);
-    
+
     m_queue.append(LocalStorageTask::createTerminate(this));
-    
+
     m_terminateCondition.wait(m_terminateLock);
 }
 
@@ -120,7 +120,7 @@ void LocalStorageThread::performTerminate()
     ASSERT(!isMainThread());
 
     m_queue.kill();
-        
+
     MutexLocker locker(m_terminateLock);
     m_terminateCondition.signal();
 }
@@ -128,4 +128,3 @@ void LocalStorageThread::performTerminate()
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/LocalStorageThread.h b/WebCore/storage/LocalStorageThread.h
index 3d58427..e9e2b58 100644
--- a/WebCore/storage/LocalStorageThread.h
+++ b/WebCore/storage/LocalStorageThread.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef LocalStorageThread_h
@@ -45,8 +45,8 @@ namespace WebCore {
 
         bool start();
 
-        void scheduleImport(PassRefPtr<StorageAreaSync>);
-        void scheduleSync(PassRefPtr<StorageAreaSync>);
+        void scheduleImport(StorageAreaSync*);
+        void scheduleSync(StorageAreaSync*);
 
         // Called from the main thread to synchronously shut down this thread
         void terminate();
@@ -64,7 +64,7 @@ namespace WebCore {
         RefPtr<LocalStorageThread> m_selfRef;
 
         MessageQueue<RefPtr<LocalStorageTask> > m_queue;
-        
+
         Mutex m_terminateLock;
         ThreadCondition m_terminateCondition;
     };
diff --git a/WebCore/storage/OriginQuotaManager.cpp b/WebCore/storage/OriginQuotaManager.cpp
index 2b98ab7..20bb34d 100644
--- a/WebCore/storage/OriginQuotaManager.cpp
+++ b/WebCore/storage/OriginQuotaManager.cpp
@@ -75,25 +75,25 @@ bool OriginQuotaManager::tracksOrigin(SecurityOrigin* origin) const
 void OriginQuotaManager::addDatabase(SecurityOrigin* origin, const String& databaseIdentifier, const String& fullPath)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
-    usageRecord->addDatabase(databaseIdentifier.copy(), fullPath.copy());
+
+    usageRecord->addDatabase(databaseIdentifier.threadsafeCopy(), fullPath.threadsafeCopy());
 }
 
 void OriginQuotaManager::removeDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
-    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))    
+
+    if (OriginUsageRecord* usageRecord = m_usageMap.get(origin))
         usageRecord->removeDatabase(databaseIdentifier);
 }
 
 void OriginQuotaManager::removeOrigin(SecurityOrigin* origin)
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     if (OriginUsageRecord* usageRecord = m_usageMap.get(origin)) {
         m_usageMap.remove(origin);
         delete usageRecord;
@@ -107,21 +107,20 @@ void OriginQuotaManager::markDatabase(Database* database)
     RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     usageRecord->markDatabase(database->stringIdentifier());
 }
 
 unsigned long long OriginQuotaManager::diskUsage(SecurityOrigin* origin) const
 {
     ASSERT(m_usageRecordGuardLocked);
-    
+
     OriginUsageRecord* usageRecord = m_usageMap.get(origin);
     ASSERT(usageRecord);
-    
+
     return usageRecord->diskUsage();
 }
 
-
 }
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/storage/OriginUsageRecord.cpp b/WebCore/storage/OriginUsageRecord.cpp
index 5f4957f..684df53 100644
--- a/WebCore/storage/OriginUsageRecord.cpp
+++ b/WebCore/storage/OriginUsageRecord.cpp
@@ -44,10 +44,10 @@ void OriginUsageRecord::addDatabase(const String& identifier, const String& full
     ASSERT(!m_databaseMap.contains(identifier));
     ASSERT_ARG(identifier, identifier.impl()->refCount() == 1);
     ASSERT_ARG(fullPath, fullPath.impl()->refCount() == 1);
-    
+
     m_databaseMap.set(identifier, DatabaseEntry(fullPath));
     m_unknownSet.add(identifier);
-     
+
     m_cachedDiskUsageIsValid = false;
 }
 
@@ -81,13 +81,13 @@ unsigned long long OriginUsageRecord::diskUsage()
     for (; iUnknown != endUnknown; ++iUnknown) {
         const String& path = m_databaseMap.get(*iUnknown).filename;
         ASSERT(!path.isEmpty());
-                
+
         // When we can't determine the file size, we'll just have to assume the file is missing/inaccessible.
         long long size = SQLiteFileSystem::getDatabaseFileSize(path);
         m_databaseMap.set(*iUnknown, DatabaseEntry(path, size));
     }
     m_unknownSet.clear();
-    
+
     // Recalculate the cached usage value.
     m_cachedDiskUsage = 0;
     HashMap<String, DatabaseEntry>::iterator iDatabase = m_databaseMap.begin();
@@ -98,7 +98,7 @@ unsigned long long OriginUsageRecord::diskUsage()
     m_cachedDiskUsageIsValid = true;
     return m_cachedDiskUsage;
 }
-    
+
 }
 
 #endif
diff --git a/WebCore/storage/OriginUsageRecord.h b/WebCore/storage/OriginUsageRecord.h
index 3442ae1..609a793 100644
--- a/WebCore/storage/OriginUsageRecord.h
+++ b/WebCore/storage/OriginUsageRecord.h
@@ -68,4 +68,4 @@ private:
 
 #endif
 
-#endif 
+#endif
diff --git a/WebCore/storage/SQLError.h b/WebCore/storage/SQLError.h
index b6ebb5c..4414e6b 100644
--- a/WebCore/storage/SQLError.h
+++ b/WebCore/storage/SQLError.h
@@ -41,10 +41,10 @@ public:
     static PassRefPtr<SQLError> create(unsigned code, const String& message) { return adoptRef(new SQLError(code, message)); }
 
     unsigned code() const { return m_code; }
-    String message() const { return m_message.copy(); }
-    
+    String message() const { return m_message.threadsafeCopy(); }
+
 private:
-    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.copy()) { }
+    SQLError(unsigned code, const String& message) : m_code(code), m_message(message.threadsafeCopy()) { }
     unsigned m_code;
     String m_message;
 };
diff --git a/WebCore/storage/SQLResultSetRowList.h b/WebCore/storage/SQLResultSetRowList.h
index 96a6aa1..92b5ec0 100644
--- a/WebCore/storage/SQLResultSetRowList.h
+++ b/WebCore/storage/SQLResultSetRowList.h
@@ -39,7 +39,7 @@ namespace WebCore {
 class SQLResultSetRowList : public RefCounted<SQLResultSetRowList> {
 public:
     static PassRefPtr<SQLResultSetRowList> create() { return adoptRef(new SQLResultSetRowList); }
-    
+
     const Vector<String>& columnNames() const { return m_columns; }
     const Vector<SQLValue>& values() const { return m_result; }
 
@@ -50,7 +50,7 @@ public:
 
 private:
     SQLResultSetRowList() { }
-    
+
     Vector<String> m_columns;
     Vector<SQLValue> m_result;
 };
diff --git a/WebCore/storage/SQLStatement.cpp b/WebCore/storage/SQLStatement.cpp
index 38ca75d..b4eb9ef 100644
--- a/WebCore/storage/SQLStatement.cpp
+++ b/WebCore/storage/SQLStatement.cpp
@@ -50,31 +50,31 @@ PassRefPtr<SQLStatement> SQLStatement::create(const String& statement, const Vec
 }
 
 SQLStatement::SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly)
-    : m_statement(statement.copy())
+    : m_statement(statement.crossThreadString())
     , m_arguments(arguments)
     , m_statementCallback(callback)
     , m_statementErrorCallback(errorCallback)
     , m_readOnly(readOnly)
 {
 }
-   
+
 bool SQLStatement::execute(Database* db)
 {
     ASSERT(!m_resultSet);
-        
+
     // If we're re-running this statement after a quota violation, we need to clear that error now
     clearFailureDueToQuota();
 
-    // This transaction might have been marked bad while it was being set up on the main thread, 
+    // This transaction might have been marked bad while it was being set up on the main thread,
     // so if there is still an error, return false.
     if (m_error)
         return false;
-        
+
     if (m_readOnly)
         db->setAuthorizerReadOnly();
-    
+
     SQLiteDatabase* database = &db->m_sqliteDatabase;
-    
+
     SQLiteStatement statement(*database, m_statement);
     int result = statement.prepare();
 
@@ -98,7 +98,7 @@ bool SQLStatement::execute(Database* db)
             setFailureDueToQuota();
             return false;
         }
-        
+
         if (result != SQLResultOk) {
             LOG(StorageAPI, "Failed to bind value index %i to statement for query '%s'", i + 1, m_statement.ascii().data());
             m_error = SQLError::create(1, database->lastErrorMsg());
@@ -165,9 +165,9 @@ void SQLStatement::setVersionMismatchedError()
 bool SQLStatement::performCallback(SQLTransaction* transaction)
 {
     ASSERT(transaction);
-    
+
     bool callbackError = false;
-    
+
     // Call the appropriate statement callback and track if it resulted in an error,
     // because then we need to jump to the transaction error callback.
     if (m_error) {
@@ -195,9 +195,9 @@ void SQLStatement::clearFailureDueToQuota()
         m_error = 0;
 }
 
-bool SQLStatement::lastExecutionFailedDueToQuota() const 
-{ 
-    return m_error && m_error->code() == 4; 
+bool SQLStatement::lastExecutionFailedDueToQuota() const
+{
+    return m_error && m_error->code() == 4;
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLStatement.h b/WebCore/storage/SQLStatement.h
index 831aecc..f01f7bf 100644
--- a/WebCore/storage/SQLStatement.h
+++ b/WebCore/storage/SQLStatement.h
@@ -52,10 +52,10 @@ class String;
 class SQLStatement : public ThreadSafeShared<SQLStatement> {
 public:
     static PassRefPtr<SQLStatement> create(const String&, const Vector<SQLValue>&, PassRefPtr<SQLStatementCallback>, PassRefPtr<SQLStatementErrorCallback>, bool readOnly);
-    
+
     bool execute(Database*);
     bool lastExecutionFailedDueToQuota() const;
-    
+
     bool hasStatementCallback() const { return m_statementCallback; }
     bool hasStatementErrorCallback() const { return m_statementErrorCallback; }
 
@@ -63,22 +63,22 @@ public:
     void setVersionMismatchedError();
 
     bool performCallback(SQLTransaction*);
-    
+
     SQLError* sqlError() const { return m_error.get(); }
 private:
     SQLStatement(const String& statement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> errorCallback, bool readOnly);
 
     void setFailureDueToQuota();
     void clearFailureDueToQuota();
-    
+
     String m_statement;
     Vector<SQLValue> m_arguments;
     RefPtr<SQLStatementCallback> m_statementCallback;
     RefPtr<SQLStatementErrorCallback> m_statementErrorCallback;
-    
+
     RefPtr<SQLError> m_error;
     RefPtr<SQLResultSet> m_resultSet;
-    
+
     bool m_readOnly;
 };
 
diff --git a/WebCore/storage/SQLStatementCallback.h b/WebCore/storage/SQLStatementCallback.h
index 14d19bb..31f5c0c 100644
--- a/WebCore/storage/SQLStatementCallback.h
+++ b/WebCore/storage/SQLStatementCallback.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLResultSet;
-    
+
 class SQLStatementCallback : public ThreadSafeShared<SQLStatementCallback> {
 public:
     virtual ~SQLStatementCallback() { }
diff --git a/WebCore/storage/SQLStatementErrorCallback.h b/WebCore/storage/SQLStatementErrorCallback.h
index ef0c328..29127ce 100644
--- a/WebCore/storage/SQLStatementErrorCallback.h
+++ b/WebCore/storage/SQLStatementErrorCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLStatementErrorCallback : public ThreadSafeShared<SQLStatementErrorCallback> {
 public:
     virtual ~SQLStatementErrorCallback() { }
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index 3331e6e..149b384 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -35,11 +35,9 @@
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
 #include "DatabaseDetails.h"
-#include "DatabaseTracker.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
-#include "OriginQuotaManager.h"
 #include "Page.h"
 #include "PlatformString.h"
 #include "SecurityOrigin.h"
@@ -50,24 +48,26 @@
 #include "SQLStatement.h"
 #include "SQLStatementCallback.h"
 #include "SQLStatementErrorCallback.h"
+#include "SQLTransactionClient.h"
+#include "SQLTransactionCoordinator.h"
 #include "SQLValue.h"
 
-// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.  
+// There's no way of knowing exactly how much more space will be required when a statement hits the quota limit.
 // For now, we'll arbitrarily choose currentQuota + 1mb.
 // In the future we decide to track if a size increase wasn't enough, and ask for larger-and-larger increases until its enough.
 static const int DefaultQuotaSizeIncrease = 1048576;
 
 namespace WebCore {
 
-PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, 
-                                           PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper)
+PassRefPtr<SQLTransaction> SQLTransaction::create(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback,
+                                                  PassRefPtr<VoidCallback> successCallback, PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
 {
-    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper));
+    return adoptRef(new SQLTransaction(db, callback, errorCallback, successCallback, wrapper, readOnly));
 }
 
-SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback, 
-                               PassRefPtr<SQLTransactionWrapper> wrapper)
-    : m_nextStep(&SQLTransaction::openTransactionAndPreflight)
+SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback> callback, PassRefPtr<SQLTransactionErrorCallback> errorCallback, PassRefPtr<VoidCallback> successCallback,
+                               PassRefPtr<SQLTransactionWrapper> wrapper, bool readOnly)
+    : m_nextStep(&SQLTransaction::acquireLock)
     , m_executeSqlAllowed(false)
     , m_database(db)
     , m_wrapper(wrapper)
@@ -76,6 +76,8 @@ SQLTransaction::SQLTransaction(Database* db, PassRefPtr<SQLTransactionCallback>
     , m_errorCallback(errorCallback)
     , m_shouldRetryCurrentStatement(false)
     , m_modifiedDatabase(false)
+    , m_lockAcquired(false)
+    , m_readOnly(readOnly)
 {
     ASSERT(m_database);
 }
@@ -91,11 +93,13 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
         return;
     }
 
-    bool readOnlyMode = false;
-    Page* page = m_database->document()->page();
-    if (!page || page->settings()->privateBrowsingEnabled())
-        readOnlyMode = true;
-    
+    bool readOnlyMode = m_readOnly;
+    if (!readOnlyMode) {
+        Page* page = m_database->document()->page();
+        if (!page || page->settings()->privateBrowsingEnabled())
+            readOnlyMode = true;
+    }
+
     RefPtr<SQLStatement> statement = SQLStatement::create(sqlStatement, arguments, callback, callbackError, readOnlyMode);
 
     if (m_database->deleted())
@@ -116,7 +120,9 @@ void SQLTransaction::enqueueStatement(PassRefPtr<SQLStatement> statement)
 #ifndef NDEBUG
 const char* SQLTransaction::debugStepName(SQLTransaction::TransactionStepMethod step)
 {
-    if (step == &SQLTransaction::openTransactionAndPreflight)
+    if (step == &SQLTransaction::acquireLock)
+        return "acquireLock";
+    else if (step == &SQLTransaction::openTransactionAndPreflight)
         return "openTransactionAndPreflight";
     else if (step == &SQLTransaction::runStatements)
         return "runStatements";
@@ -145,18 +151,21 @@ void SQLTransaction::checkAndHandleClosedDatabase()
 {
     if (!m_database->stopped())
         return;
-        
+
     // If the database was stopped, don't do anything and cancel queued work
     LOG(StorageAPI, "Database was stopped - cancelling work for this transaction");
     MutexLocker locker(m_statementMutex);
     m_statementQueue.clear();
     m_nextStep = 0;
-    
+
     // The current SQLite transaction should be stopped, as well
     if (m_sqliteTransaction) {
         m_sqliteTransaction->stop();
         m_sqliteTransaction.clear();
     }
+
+    if (m_lockAcquired)
+        m_database->transactionCoordinator()->releaseLock(this);
 }
 
 
@@ -164,14 +173,15 @@ bool SQLTransaction::performNextStep()
 {
     LOG(StorageAPI, "Step %s\n", debugStepName(m_nextStep));
 
-    ASSERT(m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
+    ASSERT(m_nextStep == &SQLTransaction::acquireLock ||
+           m_nextStep == &SQLTransaction::openTransactionAndPreflight ||
            m_nextStep == &SQLTransaction::runStatements ||
            m_nextStep == &SQLTransaction::postflightAndCommit ||
            m_nextStep == &SQLTransaction::cleanupAfterSuccessCallback ||
            m_nextStep == &SQLTransaction::cleanupAfterTransactionErrorCallback);
-    
+
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 
@@ -190,14 +200,28 @@ void SQLTransaction::performPendingCallback()
            m_nextStep == &SQLTransaction::deliverSuccessCallback);
 
     checkAndHandleClosedDatabase();
-    
+
     if (m_nextStep)
         (this->*m_nextStep)();
 }
 
+void SQLTransaction::acquireLock()
+{
+    m_database->transactionCoordinator()->acquireLock(this);
+}
+
+void SQLTransaction::lockAcquired()
+{
+    m_lockAcquired = true;
+    m_nextStep = &SQLTransaction::openTransactionAndPreflight;
+    LOG(StorageAPI, "Scheduling openTransactionAndPreflight immediately for transaction %p\n", this);
+    m_database->scheduleTransactionStep(this, true);
+}
+
 void SQLTransaction::openTransactionAndPreflight()
 {
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
+    ASSERT(m_lockAcquired);
 
     LOG(StorageAPI, "Opening and preflighting transaction %p", this);
 
@@ -208,16 +232,17 @@ void SQLTransaction::openTransactionAndPreflight()
         return;
     }
 
-    // Set the maximum usage for this transaction
-    m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
-    
+    // Set the maximum usage for this transaction if this transactions is not read-only
+    if (!m_readOnly)
+        m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
+
     ASSERT(!m_sqliteTransaction);
-    m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase));
-    
+    m_sqliteTransaction.set(new SQLiteTransaction(m_database->m_sqliteDatabase, m_readOnly));
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->begin();
-    m_database->m_databaseAuthorizer->enable();    
-    
+    m_database->m_databaseAuthorizer->enable();
+
     // Transaction Steps 1+2 - Open a transaction to the database, jumping to the error callback if that fails
     if (!m_sqliteTransaction->inProgress()) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -226,7 +251,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Steps 3 - Peform preflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPreflight(this)) {
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -238,7 +263,7 @@ void SQLTransaction::openTransactionAndPreflight()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transaction Step 4 - Invoke the transaction callback with the new SQLTransaction object
     m_nextStep = &SQLTransaction::deliverTransactionCallback;
     LOG(StorageAPI, "Scheduling deliverTransactionCallback for transaction %p\n", this);
@@ -273,6 +298,8 @@ void SQLTransaction::scheduleToRunStatements()
 
 void SQLTransaction::runStatements()
 {
+    ASSERT(m_lockAcquired);
+
     // If there is a series of statements queued up that are all successful and have no associated
     // SQLStatementCallback objects, then we can burn through the queue
     do {
@@ -280,8 +307,11 @@ void SQLTransaction::runStatements()
             m_shouldRetryCurrentStatement = false;
             // FIXME - Another place that needs fixing up after <rdar://problem/5628468> is addressed.
             // See ::openTransactionAndPreflight() for discussion
-            
-            // Reset the maximum size here, as it was increased to allow us to retry this statement
+
+            // Reset the maximum size here, as it was increased to allow us to retry this statement.
+            // m_shouldRetryCurrentStatement is set to true only when a statement exceeds
+            // the quota, which can happen only in a read-write transaction. Therefore, there
+            // is no need to check here if the transaction is read-write.
             m_database->m_sqliteDatabase.setMaximumSize(m_database->maximumSize());
         } else {
             // If the current statement has already been run, failed due to quota constraints, and we're not retrying it,
@@ -290,14 +320,14 @@ void SQLTransaction::runStatements()
                 handleCurrentStatementError();
                 break;
             }
-            
+
             // Otherwise, advance to the next statement
             getNextStatement();
         }
     } while (runCurrentStatement());
-    
+
     // If runCurrentStatement() returned false, that means either there was no current statement to run,
-    // or the current statement requires a callback to complete.  In the later case, it also scheduled 
+    // or the current statement requires a callback to complete.  In the later case, it also scheduled
     // the callback or performed any other additional work so we can return
     if (!m_currentStatement)
         postflightAndCommit();
@@ -306,7 +336,7 @@ void SQLTransaction::runStatements()
 void SQLTransaction::getNextStatement()
 {
     m_currentStatement = 0;
-    
+
     MutexLocker locker(m_statementMutex);
     if (!m_statementQueue.isEmpty()) {
         m_currentStatement = m_statementQueue.first();
@@ -318,20 +348,17 @@ bool SQLTransaction::runCurrentStatement()
 {
     if (!m_currentStatement)
         return false;
-        
+
     m_database->m_databaseAuthorizer->reset();
-    
+
     if (m_currentStatement->execute(m_database.get())) {
         if (m_database->m_databaseAuthorizer->lastActionChangedDatabase()) {
             // Flag this transaction as having changed the database for later delegate notification
             m_modifiedDatabase = true;
             // Also dirty the size of this database file for calculating quota usage
-            OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
-            Locker<OriginQuotaManager> locker(manager);
-            
-            manager.markDatabase(m_database.get());
+            m_database->transactionClient()->didExecuteStatement(this);
         }
-            
+
         if (m_currentStatement->hasStatementCallback()) {
             m_nextStep = &SQLTransaction::deliverStatementCallback;
             LOG(StorageAPI, "Scheduling deliverStatementCallback for transaction %p\n", this);
@@ -340,16 +367,16 @@ bool SQLTransaction::runCurrentStatement()
         }
         return true;
     }
-    
+
     if (m_currentStatement->lastExecutionFailedDueToQuota()) {
         m_nextStep = &SQLTransaction::deliverQuotaIncreaseCallback;
         LOG(StorageAPI, "Scheduling deliverQuotaIncreaseCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
         return false;
     }
-    
+
     handleCurrentStatementError();
-    
+
     return false;
 }
 
@@ -372,7 +399,7 @@ void SQLTransaction::handleCurrentStatementError()
 void SQLTransaction::deliverStatementCallback()
 {
     ASSERT(m_currentStatement);
-    
+
     // Transaction Step 6.6 and 6.3(error) - If the statement callback went wrong, jump to the transaction error callback
     // Otherwise, continue to loop through the statement queue
     m_executeSqlAllowed = true;
@@ -390,27 +417,18 @@ void SQLTransaction::deliverQuotaIncreaseCallback()
 {
     ASSERT(m_currentStatement);
     ASSERT(!m_shouldRetryCurrentStatement);
-    
-    Page* page = m_database->document()->page();
-    ASSERT(page);
-    
-    RefPtr<SecurityOrigin> origin = m_database->securityOriginCopy();
-    
-    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    page->chrome()->client()->exceededDatabaseQuota(m_database->document()->frame(), m_database->stringIdentifier());
-    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
-    
-    // If the new quota ended up being larger than the old quota, we will retry the statement.
-    if (newQuota > currentQuota)
-        m_shouldRetryCurrentStatement = true;
-        
+
+    m_shouldRetryCurrentStatement = m_database->transactionClient()->didExceedQuota(this);
+
     m_nextStep = &SQLTransaction::runStatements;
     LOG(StorageAPI, "Scheduling runStatements for transaction %p\n", this);
     m_database->scheduleTransactionStep(this);
 }
 
 void SQLTransaction::postflightAndCommit()
-{    
+{
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 7 - Peform postflight steps, jumping to the error callback if they fail
     if (m_wrapper && !m_wrapper->performPostflight(this)) {
         m_transactionError = m_wrapper->sqlError();
@@ -419,10 +437,10 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // Transacton Step 8+9 - Commit the transaction, jumping to the error callback if that fails
     ASSERT(m_sqliteTransaction);
-    
+
     m_database->m_databaseAuthorizer->disable();
     m_sqliteTransaction->commit();
     m_database->m_databaseAuthorizer->enable();
@@ -433,21 +451,21 @@ void SQLTransaction::postflightAndCommit()
         handleTransactionError(false);
         return;
     }
-    
+
     // The commit was successful, notify the delegates if the transaction modified this database
     if (m_modifiedDatabase)
-        DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(m_database->m_securityOrigin.get(), m_database->m_name);
-    
+        m_database->transactionClient()->didCommitTransaction(this);
+
     // Now release our unneeded callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
-    
+
     // Transaction Step 10 - Deliver success callback, if there is one
     if (m_successCallback) {
         m_nextStep = &SQLTransaction::deliverSuccessCallback;
         LOG(StorageAPI, "Scheduling deliverSuccessCallback for transaction %p\n", this);
         m_database->scheduleTransactionCallback(this);
-    } else 
+    } else
         cleanupAfterSuccessCallback();
 }
 
@@ -456,7 +474,7 @@ void SQLTransaction::deliverSuccessCallback()
     // Transaction Step 10 - Deliver success callback
     ASSERT(m_successCallback);
     m_successCallback->handleEvent();
-    
+
     // Release the last callback to break reference cycle
     m_successCallback = 0;
 
@@ -469,11 +487,16 @@ void SQLTransaction::deliverSuccessCallback()
 
 void SQLTransaction::cleanupAfterSuccessCallback()
 {
+    ASSERT(m_lockAcquired);
+
     // Transaction Step 11 - End transaction steps
     // There is no next step
     LOG(StorageAPI, "Transaction %p is complete\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
     m_nextStep = 0;
+
+    // Release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 void SQLTransaction::handleTransactionError(bool inCallback)
@@ -488,7 +511,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
         }
         return;
     }
-    
+
     // No error callback, so fast-forward to:
     // Transaction Step 12 - Rollback the transaction.
     if (inCallback) {
@@ -503,7 +526,7 @@ void SQLTransaction::handleTransactionError(bool inCallback)
 void SQLTransaction::deliverTransactionErrorCallback()
 {
     ASSERT(m_transactionError);
-    
+
     // Transaction Step 12 - If exists, invoke error callback with the last
     // error to have occurred in this transaction.
     if (m_errorCallback)
@@ -516,22 +539,24 @@ void SQLTransaction::deliverTransactionErrorCallback()
 
 void SQLTransaction::cleanupAfterTransactionErrorCallback()
 {
+    ASSERT(m_lockAcquired);
+
     m_database->m_databaseAuthorizer->disable();
     if (m_sqliteTransaction) {
         // Transaction Step 12 - Rollback the transaction.
         m_sqliteTransaction->rollback();
-        
+
         ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
         m_sqliteTransaction.clear();
     }
     m_database->m_databaseAuthorizer->enable();
-    
+
     // Transaction Step 12 - Any still-pending statements in the transaction are discarded.
     {
         MutexLocker locker(m_statementMutex);
         m_statementQueue.clear();
     }
-    
+
     // Transaction is complete!  There is no next step
     LOG(StorageAPI, "Transaction %p is complete with an error\n", this);
     ASSERT(!m_database->m_sqliteDatabase.transactionInProgress());
@@ -540,6 +565,9 @@ void SQLTransaction::cleanupAfterTransactionErrorCallback()
     // Now release our callbacks, to break reference cycles.
     m_callback = 0;
     m_errorCallback = 0;
+
+    // Now release the lock on this database
+    m_database->transactionCoordinator()->releaseLock(this);
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/SQLTransaction.h b/WebCore/storage/SQLTransaction.h
index e77c183..6d6a8d7 100644
--- a/WebCore/storage/SQLTransaction.h
+++ b/WebCore/storage/SQLTransaction.h
@@ -60,34 +60,39 @@ public:
     virtual ~SQLTransactionWrapper() { }
     virtual bool performPreflight(SQLTransaction*) = 0;
     virtual bool performPostflight(SQLTransaction*) = 0;
-    
+
     virtual SQLError* sqlError() const = 0;
 };
 
 class SQLTransaction : public ThreadSafeShared<SQLTransaction> {
 public:
-    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    static PassRefPtr<SQLTransaction> create(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                                             PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly = false);
 
     ~SQLTransaction();
-    
-    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments, 
+
+    void executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments,
                     PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> callbackError, ExceptionCode& e);
-                                        
+
+    void lockAcquired();
     bool performNextStep();
     void performPendingCallback();
-    
+
     Database* database() { return m_database.get(); }
+    bool isReadOnly() { return m_readOnly; }
 
 private:
-    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>);
+    SQLTransaction(Database*, PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
+                   PassRefPtr<VoidCallback>, PassRefPtr<SQLTransactionWrapper>, bool readOnly);
 
     typedef void (SQLTransaction::*TransactionStepMethod)();
     TransactionStepMethod m_nextStep;
-    
+
     void enqueueStatement(PassRefPtr<SQLStatement>);
-    
+
     void checkAndHandleClosedDatabase();
-    
+
+    void acquireLock();
     void openTransactionAndPreflight();
     void deliverTransactionCallback();
     void scheduleToRunStatements();
@@ -109,9 +114,9 @@ private:
 #endif
 
     RefPtr<SQLStatement> m_currentStatement;
-    
+
     bool m_executeSqlAllowed;
-    
+
     RefPtr<Database> m_database;
     RefPtr<SQLTransactionWrapper> m_wrapper;
     RefPtr<SQLTransactionCallback> m_callback;
@@ -120,13 +125,15 @@ private:
     RefPtr<SQLError> m_transactionError;
     bool m_shouldRetryCurrentStatement;
     bool m_modifiedDatabase;
-    
+    bool m_lockAcquired;
+    bool m_readOnly;
+
     Mutex m_statementMutex;
     Deque<RefPtr<SQLStatement> > m_statementQueue;
 
     OwnPtr<SQLiteTransaction> m_sqliteTransaction;
 };
-    
+
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/storage/SQLTransactionCallback.h b/WebCore/storage/SQLTransactionCallback.h
index a4cd940..de3e85dc 100644
--- a/WebCore/storage/SQLTransactionCallback.h
+++ b/WebCore/storage/SQLTransactionCallback.h
@@ -37,7 +37,7 @@ namespace WebCore {
 
 class SQLTransaction;
 class SQLError;
-    
+
 class SQLTransactionCallback : public ThreadSafeShared<SQLTransactionCallback> {
 public:
     virtual ~SQLTransactionCallback() { }
diff --git a/WebCore/storage/SQLTransactionClient.cpp b/WebCore/storage/SQLTransactionClient.cpp
new file mode 100644
index 0000000..e72f5ed
--- /dev/null
+++ b/WebCore/storage/SQLTransactionClient.cpp
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionClient.h"
+
+#include "ChromeClient.h"
+#include "Database.h"
+#include "DatabaseThread.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "OriginQuotaManager.h"
+#include "Page.h"
+#include "SQLTransaction.h"
+
+namespace WebCore {
+
+void SQLTransactionClient::didCommitTransaction(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    Database* database = transaction->database();
+    DatabaseTracker::tracker().scheduleNotifyDatabaseChanged(
+        database->document()->securityOrigin(), database->stringIdentifier());
+}
+
+void SQLTransactionClient::didExecuteStatement(SQLTransaction* transaction)
+{
+    ASSERT(currentThread() == transaction->database()->document()->databaseThread()->getThreadID());
+    OriginQuotaManager& manager(DatabaseTracker::tracker().originQuotaManager());
+    Locker<OriginQuotaManager> locker(manager);
+    manager.markDatabase(transaction->database());
+}
+
+bool SQLTransactionClient::didExceedQuota(SQLTransaction* transaction)
+{
+    ASSERT(isMainThread());
+    Database* database = transaction->database();
+    Page* page = database->document()->page();
+    ASSERT(page);
+
+    RefPtr<SecurityOrigin> origin = database->securityOriginCopy();
+
+    unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    page->chrome()->client()->exceededDatabaseQuota(database->document()->frame(), database->stringIdentifier());
+    unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(origin.get());
+    return (newQuota > currentQuota);
+}
+
+}
diff --git a/WebCore/storage/SQLTransactionClient.h b/WebCore/storage/SQLTransactionClient.h
new file mode 100644
index 0000000..941c163
--- /dev/null
+++ b/WebCore/storage/SQLTransactionClient.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionClient_h
+#define SQLTransactionClient_h
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    // A client to the SQLTransaction class. Allows SQLTransaction to notify interested
+    // parties that certain things have happened in a transaction.
+    class SQLTransactionClient {
+    public:
+        void didCommitTransaction(SQLTransaction*);
+        void didExecuteStatement(SQLTransaction*);
+        bool didExceedQuota(SQLTransaction*);
+    };
+}
+
+#endif // SQLTransactionClient_h
diff --git a/WebCore/storage/SQLTransactionCoordinator.cpp b/WebCore/storage/SQLTransactionCoordinator.cpp
new file mode 100644
index 0000000..30b0c4a
--- /dev/null
+++ b/WebCore/storage/SQLTransactionCoordinator.cpp
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "SQLTransactionCoordinator.h"
+
+#include "CString.h"
+#include "Database.h"
+#include "SQLTransaction.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static String getDatabaseIdentifier(SQLTransaction* transaction)
+{
+    Database* database = transaction->database();
+    ASSERT(database);
+    return database->stringIdentifier();
+}
+
+void SQLTransactionCoordinator::processPendingTransactions(CoordinationInfo& info)
+{
+    if (info.activeWriteTransaction || info.pendingTransactions.isEmpty())
+        return;
+
+    RefPtr<SQLTransaction> firstPendingTransaction = info.pendingTransactions.first();
+    if (firstPendingTransaction->isReadOnly()) {
+        do {
+            firstPendingTransaction = info.pendingTransactions.first();
+            info.pendingTransactions.removeFirst();
+            info.activeReadTransactions.add(firstPendingTransaction);
+            firstPendingTransaction->lockAcquired();
+        } while (!info.pendingTransactions.isEmpty() && info.pendingTransactions.first()->isReadOnly());
+    } else if (info.activeReadTransactions.isEmpty()) {
+        info.pendingTransactions.removeFirst();
+        info.activeWriteTransaction = firstPendingTransaction;
+        firstPendingTransaction->lockAcquired();
+    }
+}
+
+void SQLTransactionCoordinator::acquireLock(SQLTransaction* transaction)
+{
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    CoordinationInfoMap::iterator coordinationInfoIterator = m_coordinationInfoMap.find(dbIdentifier);
+    if (coordinationInfoIterator == m_coordinationInfoMap.end()) {
+        // No pending transactions for this DB
+        coordinationInfoIterator = m_coordinationInfoMap.add(dbIdentifier, CoordinationInfo()).first;
+    }
+
+    CoordinationInfo& info = coordinationInfoIterator->second;
+    info.pendingTransactions.append(transaction);
+    processPendingTransactions(info);
+}
+
+void SQLTransactionCoordinator::releaseLock(SQLTransaction* transaction)
+{
+    if (m_coordinationInfoMap.isEmpty())
+        return;
+
+    String dbIdentifier = getDatabaseIdentifier(transaction);
+
+    CoordinationInfoMap::iterator coordinationInfoIterator = m_coordinationInfoMap.find(dbIdentifier);
+    ASSERT(coordinationInfoIterator != m_coordinationInfoMap.end());
+    CoordinationInfo& info = coordinationInfoIterator->second;
+
+    if (transaction->isReadOnly()) {
+        ASSERT(info.activeReadTransactions.contains(transaction));
+        info.activeReadTransactions.remove(transaction);
+    } else {
+        ASSERT(info.activeWriteTransaction == transaction);
+        info.activeWriteTransaction = 0;
+    }
+
+    processPendingTransactions(info);
+}
+
+void SQLTransactionCoordinator::shutdown()
+{
+    // Clean up all pending transactions for all databases
+    m_coordinationInfoMap.clear();
+}
+
+}
diff --git a/WebCore/storage/SQLTransactionCoordinator.h b/WebCore/storage/SQLTransactionCoordinator.h
new file mode 100644
index 0000000..20cc863
--- /dev/null
+++ b/WebCore/storage/SQLTransactionCoordinator.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SQLTransactionCoordinator_h
+#define SQLTransactionCoordinator_h
+
+#include "CString.h"
+#include "StringHash.h"
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class SQLTransaction;
+
+    class SQLTransactionCoordinator {
+    public:
+        void acquireLock(SQLTransaction*);
+        void releaseLock(SQLTransaction*);
+        void shutdown();
+    private:
+        typedef Deque<RefPtr<SQLTransaction> > TransactionsQueue;
+        struct CoordinationInfo {
+            TransactionsQueue pendingTransactions;
+            HashSet<RefPtr<SQLTransaction> > activeReadTransactions;
+            RefPtr<SQLTransaction> activeWriteTransaction;
+        };
+        // Maps database names to information about pending transactions
+        typedef HashMap<String, CoordinationInfo> CoordinationInfoMap;
+        CoordinationInfoMap m_coordinationInfoMap;
+
+        void processPendingTransactions(CoordinationInfo& info);
+    };
+}
+
+#endif // SQLTransactionCoordinator_h
diff --git a/WebCore/storage/SQLTransactionErrorCallback.h b/WebCore/storage/SQLTransactionErrorCallback.h
index 9dd3fd3..de99212 100644
--- a/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/WebCore/storage/SQLTransactionErrorCallback.h
@@ -34,19 +34,17 @@
 #include <wtf/Threading.h>
 
 namespace WebCore {
-    
+
     class SQLError;
-    
+
     class SQLTransactionErrorCallback : public ThreadSafeShared<SQLTransactionErrorCallback> {
     public:
         virtual ~SQLTransactionErrorCallback() { }
         virtual void handleEvent(SQLError*) = 0;
     };
-    
+
 }
 
 #endif
 
 #endif // SQLTransactionErrorCallback_h
-
-
diff --git a/WebCore/storage/Storage.cpp b/WebCore/storage/Storage.cpp
index d5fc065..0a8eed7 100644
--- a/WebCore/storage/Storage.cpp
+++ b/WebCore/storage/Storage.cpp
@@ -20,9 +20,9 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
- 
+
 #include "config.h"
 #include "Storage.h"
 
@@ -111,4 +111,3 @@ bool Storage::contains(const String& key) const
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/Storage.h b/WebCore/storage/Storage.h
index d68e9bc..06cc97b 100644
--- a/WebCore/storage/Storage.h
+++ b/WebCore/storage/Storage.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Storage_h
@@ -53,11 +53,12 @@ namespace WebCore {
 
         bool contains(const String& key) const;
 
+        Frame* frame() { return m_frame; }
         void disconnectFrame() { m_frame = 0; }
 
     private:
         Storage(Frame*, PassRefPtr<StorageArea>);
-            
+
         Frame* m_frame;
         RefPtr<StorageArea> m_storageArea;
     };
diff --git a/WebCore/storage/StorageArea.h b/WebCore/storage/StorageArea.h
index f74405a..a64d44a 100644
--- a/WebCore/storage/StorageArea.h
+++ b/WebCore/storage/StorageArea.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageArea_h
@@ -31,7 +31,7 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
@@ -42,7 +42,7 @@ namespace WebCore {
     enum StorageType { LocalStorage, SessionStorage };
 
     // This interface is required for Chromium since these actions need to be proxied between processes.
-    class StorageArea : public ThreadSafeShared<StorageArea> {
+    class StorageArea : public RefCounted<StorageArea> {
     public:
         virtual ~StorageArea() { }
 
diff --git a/WebCore/storage/StorageAreaImpl.cpp b/WebCore/storage/StorageAreaImpl.cpp
index f53edd3..612cb5f 100644
--- a/WebCore/storage/StorageAreaImpl.cpp
+++ b/WebCore/storage/StorageAreaImpl.cpp
@@ -28,16 +28,11 @@
 
 #if ENABLE(DOM_STORAGE)
 
-#include "DOMWindow.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
-#include "Page.h"
-#include "PageGroup.h"
-#include "SecurityOrigin.h"
 #include "Settings.h"
-#include "StorageEvent.h"
 #include "StorageAreaSync.h"
+#include "StorageEventDispatcher.h"
 #include "StorageMap.h"
 #include "StorageSyncManager.h"
 
@@ -45,17 +40,24 @@ namespace WebCore {
 
 StorageAreaImpl::~StorageAreaImpl()
 {
+    ASSERT(isMainThread());
 }
 
-StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager)
+PassRefPtr<StorageAreaImpl> StorageAreaImpl::create(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
+{
+    return adoptRef(new StorageAreaImpl(storageType, origin, syncManager, quota));
+}
+
+StorageAreaImpl::StorageAreaImpl(StorageType storageType, PassRefPtr<SecurityOrigin> origin, PassRefPtr<StorageSyncManager> syncManager, unsigned quota)
     : m_storageType(storageType)
     , m_securityOrigin(origin)
-    , m_storageMap(StorageMap::create())
+    , m_storageMap(StorageMap::create(quota))
     , m_storageSyncManager(syncManager)
 #ifndef NDEBUG
     , m_isShutdown(false)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
 
@@ -82,6 +84,7 @@ StorageAreaImpl::StorageAreaImpl(StorageAreaImpl* area)
     , m_isShutdown(area->m_isShutdown)
 #endif
 {
+    ASSERT(isMainThread());
     ASSERT(m_securityOrigin);
     ASSERT(m_storageMap);
     ASSERT(!m_isShutdown);
@@ -132,15 +135,14 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
         return;
     }
 
-    // FIXME: For LocalStorage where a disk quota will be enforced, here is where we need to do quota checking.
-    //        If we decide to enforce a memory quota for SessionStorage, this is where we'd do that, also.
-    // if (<over quota>) {
-    //     ec = QUOTA_EXCEEDED_ERR;
-    //     return;
-    // }
-
     String oldValue;
-    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue);
+    bool quotaException;
+    RefPtr<StorageMap> newMap = m_storageMap->setItem(key, value, oldValue, quotaException);
+
+    if (quotaException) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
 
     if (newMap)
         m_storageMap = newMap.release();
@@ -149,7 +151,7 @@ void StorageAreaImpl::setItem(const String& key, const String& value, ExceptionC
     if (oldValue != value) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, value);
-        dispatchStorageEvent(key, oldValue, value, frame);
+        StorageEventDispatcher::dispatch(key, oldValue, value, m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -170,7 +172,7 @@ void StorageAreaImpl::removeItem(const String& key, Frame* frame)
     if (!oldValue.isNull()) {
         if (m_storageAreaSync)
             m_storageAreaSync->scheduleItemForSync(key, String());
-        dispatchStorageEvent(key, oldValue, String(), frame);
+        StorageEventDispatcher::dispatch(key, oldValue, String(), m_storageType, m_securityOrigin.get(), frame);
     }
 }
 
@@ -182,11 +184,12 @@ void StorageAreaImpl::clear(Frame* frame)
     if (privateBrowsingEnabled(frame))
         return;
 
-    m_storageMap = StorageMap::create();
+    unsigned quota = m_storageMap->quota();
+    m_storageMap = StorageMap::create(quota);
 
     if (m_storageAreaSync)
         m_storageAreaSync->scheduleClear();
-    dispatchStorageEvent(String(), String(), String(), frame);
+    StorageEventDispatcher::dispatch(String(), String(), String(), m_storageType, m_securityOrigin.get(), frame);
 }
 
 bool StorageAreaImpl::contains(const String& key) const
@@ -224,46 +227,6 @@ void StorageAreaImpl::blockUntilImportComplete() const
         m_storageAreaSync->blockUntilImportComplete();
 }
 
-void StorageAreaImpl::dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame)
-{
-#if PLATFORM(CHROMIUM)
-    // FIXME: Events are currently broken in Chromium.
-    return;
-#endif
-
-    Page* page = sourceFrame->page();
-    if (!page)
-        return;
-
-    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
-    // of any given page in the group or mutate the page group itself.
-    Vector<RefPtr<Frame> > frames;
-    if (m_storageType == SessionStorage) {
-        // Send events only to our page.
-        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-            if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                frames.append(frame);
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
-    } else {
-        // Send events to every page.
-        const HashSet<Page*>& pages = page->group().pages();
-        HashSet<Page*>::const_iterator end = pages.end();
-        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (frame->document()->securityOrigin()->equal(securityOrigin()))
-                    frames.append(frame);
-            }
-        }
-
-        for (unsigned i = 0; i < frames.size(); ++i)
-            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
-    }
-}
-
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageAreaImpl.h b/WebCore/storage/StorageAreaImpl.h
index ef93d98..fe21a45 100644
--- a/WebCore/storage/StorageAreaImpl.h
+++ b/WebCore/storage/StorageAreaImpl.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaImpl_h
@@ -30,6 +30,7 @@
 
 #include "StorageArea.h"
 
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -40,7 +41,7 @@ namespace WebCore {
 
     class StorageAreaImpl : public StorageArea {
     public:
-        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>);
+        static PassRefPtr<StorageAreaImpl> create(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         virtual ~StorageAreaImpl();
 
         // The HTML5 DOM Storage API (and contains)
@@ -60,12 +61,11 @@ namespace WebCore {
         SecurityOrigin* securityOrigin();
 
     private:
+        StorageAreaImpl(StorageType, PassRefPtr<SecurityOrigin>, PassRefPtr<StorageSyncManager>, unsigned quota);
         StorageAreaImpl(StorageAreaImpl*);
 
         void blockUntilImportComplete() const;
 
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-
         StorageType m_storageType;
         RefPtr<SecurityOrigin> m_securityOrigin;
         RefPtr<StorageMap> m_storageMap;
diff --git a/WebCore/storage/StorageAreaSync.cpp b/WebCore/storage/StorageAreaSync.cpp
index 01d2a65..ad41e28 100644
--- a/WebCore/storage/StorageAreaSync.cpp
+++ b/WebCore/storage/StorageAreaSync.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -57,6 +57,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
     , m_syncScheduled(false)
     , m_importComplete(false)
 {
+    ASSERT(isMainThread());
     ASSERT(m_storageArea);
     ASSERT(m_syncManager);
 
@@ -68,6 +69,7 @@ StorageAreaSync::StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManag
 
 StorageAreaSync::~StorageAreaSync()
 {
+    ASSERT(isMainThread());
     ASSERT(!m_syncTimer.isActive());
 }
 
@@ -76,7 +78,7 @@ void StorageAreaSync::scheduleFinalSync()
     ASSERT(isMainThread());
     // FIXME: We do this to avoid races, but it'd be better to make things safe without blocking.
     blockUntilImportComplete();
-    
+
     if (m_syncTimer.isActive())
         m_syncTimer.stop();
     else {
@@ -127,7 +129,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
 
     HashMap<String, String>::iterator it = m_changedItems.begin();
     HashMap<String, String>::iterator end = m_changedItems.end();
-    
+
     {
         MutexLocker locker(m_syncLock);
 
@@ -138,7 +140,7 @@ void StorageAreaSync::syncTimerFired(Timer<StorageAreaSync>*)
         }
 
         for (; it != end; ++it)
-            m_itemsPendingSync.set(it->first.copy(), it->second.copy());
+            m_itemsPendingSync.set(it->first.crossThreadString(), it->second.crossThreadString());
 
         if (!m_syncScheduled) {
             m_syncScheduled = true;
@@ -182,14 +184,14 @@ void StorageAreaSync::performImport()
         markImported();
         return;
     }
-    
+
     SQLiteStatement query(m_database, "SELECT key, value FROM ItemTable");
     if (query.prepare() != SQLResultOk) {
         LOG_ERROR("Unable to select items from ItemTable for local storage");
         markImported();
         return;
     }
-    
+
     HashMap<String, String> itemMap;
 
     int result = query.step();
@@ -205,13 +207,13 @@ void StorageAreaSync::performImport()
     }
 
     MutexLocker locker(m_importLock);
-    
+
     HashMap<String, String>::iterator it = itemMap.begin();
     HashMap<String, String>::iterator end = itemMap.end();
-    
+
     for (; it != end; ++it)
         m_storageArea->importItem(it->first, it->second);
-    
+
     // Break the (ref count) cycle.
     m_storageArea = 0;
     m_importComplete = true;
@@ -265,7 +267,7 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
             LOG_ERROR("Failed to prepare clear statement - cannot write to local storage database");
             return;
         }
-        
+
         int result = clear.step();
         if (result != SQLResultDone) {
             LOG_ERROR("Failed to clear all items in the local storage database - %i", result);
@@ -289,11 +291,11 @@ void StorageAreaSync::sync(bool clearItems, const HashMap<String, String>& items
 
     for (HashMap<String, String>::const_iterator it = items.begin(); it != end; ++it) {
         // Based on the null-ness of the second argument, decide whether this is an insert or a delete.
-        SQLiteStatement& query = it->second.isNull() ? remove : insert;        
+        SQLiteStatement& query = it->second.isNull() ? remove : insert;
 
         query.bindText(1, it->first);
 
-        // If the second argument is non-null, we're doing an insert, so bind it as the value. 
+        // If the second argument is non-null, we're doing an insert, so bind it as the value.
         if (!it->second.isNull())
             query.bindText(2, it->second);
 
@@ -335,4 +337,3 @@ void StorageAreaSync::performSync()
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageAreaSync.h b/WebCore/storage/StorageAreaSync.h
index e436bef..9d6436f 100644
--- a/WebCore/storage/StorageAreaSync.h
+++ b/WebCore/storage/StorageAreaSync.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageAreaSync_h
@@ -39,7 +39,7 @@ namespace WebCore {
     class Frame;
     class StorageAreaImpl;
     class StorageSyncManager;
-    
+
     class StorageAreaSync : public RefCounted<StorageAreaSync> {
     public:
         static PassRefPtr<StorageAreaSync> create(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
@@ -50,16 +50,16 @@ namespace WebCore {
 
         void scheduleItemForSync(const String& key, const String& value);
         void scheduleClear();
-        
+
     private:
         StorageAreaSync(PassRefPtr<StorageSyncManager> storageSyncManager, PassRefPtr<StorageAreaImpl> storageArea);
 
         void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
 
-        Timer<StorageAreaSync> m_syncTimer;        
+        Timer<StorageAreaSync> m_syncTimer;
         HashMap<String, String> m_changedItems;
         bool m_itemsCleared;
-        
+
         bool m_finalSyncScheduled;
 
         RefPtr<StorageAreaImpl> m_storageArea;
diff --git a/WebCore/storage/StorageEvent.cpp b/WebCore/storage/StorageEvent.cpp
index 2e620d5..f3b3b70 100644
--- a/WebCore/storage/StorageEvent.cpp
+++ b/WebCore/storage/StorageEvent.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -76,4 +76,3 @@ void StorageEvent::initStorageEvent(const AtomicString& type, bool canBubble, bo
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageEvent.h b/WebCore/storage/StorageEvent.h
index 703fb5a..7e2bcff 100644
--- a/WebCore/storage/StorageEvent.h
+++ b/WebCore/storage/StorageEvent.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageEvent_h
@@ -55,16 +55,16 @@ namespace WebCore {
 
         virtual bool isStorageEvent() const { return true; }
 
-    private:    
+    private:
         StorageEvent();
         StorageEvent(const AtomicString& type, const String& key, const String& oldValue, const String& newValue, const String& uri, PassRefPtr<DOMWindow> source, Storage* storageArea);
-        
+
         String m_key;
         String m_oldValue;
         String m_newValue;
         String m_uri;
         RefPtr<DOMWindow> m_source;
-        RefPtr<Storage> m_storageArea;        
+        RefPtr<Storage> m_storageArea;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageEventDispatcher.cpp b/WebCore/storage/StorageEventDispatcher.cpp
new file mode 100644
index 0000000..496ff6d
--- /dev/null
+++ b/WebCore/storage/StorageEventDispatcher.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StorageEventDispatcher.h"
+
+#if ENABLE(DOM_STORAGE)
+
+#include "DOMWindow.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "Page.h"
+#include "PageGroup.h"
+#include "SecurityOrigin.h"
+#include "StorageEvent.h"
+
+namespace WebCore {
+
+void StorageEventDispatcher::dispatch(const String& key, const String& oldValue, const String& newValue, StorageType storageType, SecurityOrigin* securityOrigin, Frame* sourceFrame)
+{
+    Page* page = sourceFrame->page();
+    if (!page)
+        return;
+
+    // We need to copy all relevant frames from every page to a vector since sending the event to one frame might mutate the frame tree
+    // of any given page in the group or mutate the page group itself.
+    Vector<RefPtr<Frame> > frames;
+    if (storageType == SessionStorage) {
+        // Send events only to our page.
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->document()->securityOrigin()->equal(securityOrigin))
+                frames.append(frame);
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->sessionStorage()));
+    } else {
+        // Send events to every page.
+        const HashSet<Page*>& pages = page->group().pages();
+        HashSet<Page*>::const_iterator end = pages.end();
+        for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+            for (Frame* frame = (*it)->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+                if (frame->document()->securityOrigin()->equal(securityOrigin))
+                    frames.append(frame);
+            }
+        }
+
+        for (unsigned i = 0; i < frames.size(); ++i)
+            frames[i]->document()->dispatchWindowEvent(StorageEvent::create(eventNames().storageEvent, key, oldValue, newValue, sourceFrame->document()->documentURI(), sourceFrame->domWindow(), frames[i]->domWindow()->localStorage()));
+    }
+}
+
+}
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/loader/UserStyleSheetLoader.h b/WebCore/storage/StorageEventDispatcher.h
index 6e7a1ba..f4a98ef 100644
--- a/WebCore/loader/UserStyleSheetLoader.h
+++ b/WebCore/storage/StorageEventDispatcher.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,32 +27,28 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef UserStyleSheetLoader_h
-#define UserStyleSheetLoader_h
+#ifndef StorageEventDispatcher_h
+#define StorageEventDispatcher_h
 
-#include "CachedResourceClient.h"
-#include "CachedResourceHandle.h"
+#if ENABLE(DOM_STORAGE)
 
-#include "Document.h"
+#include "PlatformString.h"
+#include "StorageArea.h"
 
 namespace WebCore {
-    class CachedCSSStyleSheet;
-    class String;
 
-    // This class is deprecated and should not be used in any new code. User
-    // stylesheet loading should instead happen through Page.
-    class UserStyleSheetLoader : CachedResourceClient {
+    // This is in its own class since Chromium must override it.
+    class StorageEventDispatcher {
     public:
-        UserStyleSheetLoader(PassRefPtr<Document>, const String& url);
-        ~UserStyleSheetLoader();
+        static void dispatch(const String& key, const String& oldValue, const String& newValue, StorageType, SecurityOrigin*, Frame* sourceFrame);
 
     private:
-        virtual void setCSSStyleSheet(const String& URL, const String& charset, const CachedCSSStyleSheet* sheet);
-
-        RefPtr<Document> m_document;
-        CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
+        // Do not instantiate.
+        StorageEventDispatcher();
     };
 
 } // namespace WebCore
 
-#endif // UserStyleSheetLoader_h
+#endif // ENABLE(DOM_STORAGE)
+
+#endif // StorageEventDispatcher_h
diff --git a/WebCore/storage/StorageMap.cpp b/WebCore/storage/StorageMap.cpp
index 32eb350..5498d9e 100644
--- a/WebCore/storage/StorageMap.cpp
+++ b/WebCore/storage/StorageMap.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -30,20 +30,22 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageMap> StorageMap::create()
+PassRefPtr<StorageMap> StorageMap::create(unsigned quota)
 {
-    return adoptRef(new StorageMap);
+    return adoptRef(new StorageMap(quota));
 }
-    
-StorageMap::StorageMap()
+
+StorageMap::StorageMap(unsigned quota)
     : m_iterator(m_map.end())
     , m_iteratorIndex(UINT_MAX)
+    , m_quotaSize(quota)  // quota measured in bytes
+    , m_currentLength(0)
 {
 }
 
 PassRefPtr<StorageMap> StorageMap::copy()
 {
-    RefPtr<StorageMap> newMap = create();
+    RefPtr<StorageMap> newMap = create(m_quotaSize);
     newMap->m_map = m_map;
     return newMap.release();
 }
@@ -54,22 +56,22 @@ void StorageMap::invalidateIterator()
     m_iteratorIndex = UINT_MAX;
 }
 
-void StorageMap::setIteratorToIndex(unsigned index) const
+void StorageMap::setIteratorToIndex(unsigned index)
 {
     // FIXME: Once we have bidirectional iterators for HashMap we can be more intelligent about this.
-    // The requested index will be closest to begin(), our current iterator, or end(), and we 
+    // The requested index will be closest to begin(), our current iterator, or end(), and we
     // can take the shortest route.
     // Until that mechanism is available, we'll always increment our iterator from begin() or current.
-    
+
     if (m_iteratorIndex == index)
         return;
-    
+
     if (index < m_iteratorIndex) {
         m_iteratorIndex = 0;
         m_iterator = m_map.begin();
         ASSERT(m_iterator != m_map.end());
     }
-    
+
     while (m_iteratorIndex < index) {
         ++m_iteratorIndex;
         ++m_iterator;
@@ -82,11 +84,11 @@ unsigned StorageMap::length() const
     return m_map.size();
 }
 
-String StorageMap::key(unsigned index) const
+String StorageMap::key(unsigned index)
 {
     if (index >= length())
         return String();
-    
+
     setIteratorToIndex(index);
     return m_iterator->first;
 }
@@ -96,27 +98,34 @@ String StorageMap::getItem(const String& key) const
     return m_map.get(key);
 }
 
-PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue)
+PassRefPtr<StorageMap> StorageMap::setItem(const String& key, const String& value, String& oldValue, bool& quotaException)
 {
     ASSERT(!value.isNull());
-    
+    quotaException = false;
+
     // Implement copy-on-write semantics here.  We're guaranteed that the only refs of StorageMaps belong to Storage objects
     // so if more than one Storage object refs this map, copy it before mutating it.
     if (refCount() > 1) {
         RefPtr<StorageMap> newStorageMap = copy();
-        newStorageMap->setItem(key, value, oldValue);
+        newStorageMap->setItem(key, value, oldValue, quotaException);
         return newStorageMap.release();
     }
 
-    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    // Quota tracking.  If the quota is enabled and this would go over it, bail.
+    oldValue = m_map.get(key);
+    unsigned newLength = m_currentLength + value.length() - oldValue.length();
+    bool overQuota = newLength > m_quotaSize / sizeof(UChar);
+    bool overflow = (newLength > m_currentLength) != (value.length() > oldValue.length());
+    ASSERT(!overflow);  // If we're debugging, make a fuss.  But it's still worth checking this in the following if statement.
+    if (m_quotaSize != noQuota && (overflow || overQuota)) {
+        quotaException = true;
+        return 0;
+    }
+    m_currentLength = newLength;
 
-    if (addResult.second) {
-        // There was no "oldValue" so null it out.
-        oldValue = String();
-    } else {
-        oldValue = addResult.first->second;
+    pair<HashMap<String, String>::iterator, bool> addResult = m_map.add(key, value);
+    if (!addResult.second)
         addResult.first->second = value;
-    }
 
     invalidateIterator();
 
@@ -137,6 +146,10 @@ PassRefPtr<StorageMap> StorageMap::removeItem(const String& key, String& oldValu
     if (!oldValue.isNull())
         invalidateIterator();
 
+    // Update quota.
+    ASSERT(m_currentLength - oldValue.length() <= m_currentLength);
+    m_currentLength -= oldValue.length();
+
     return 0;
 }
 
@@ -145,17 +158,20 @@ bool StorageMap::contains(const String& key) const
     return m_map.contains(key);
 }
 
-void StorageMap::importItem(const String& key, const String& value) const
+void StorageMap::importItem(const String& key, const String& value)
 {
     // Be sure to copy the keys/values as items imported on a background thread are destined
     // to cross a thread boundary
-    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.copy(), String());
+    pair<HashMap<String, String>::iterator, bool> result = m_map.add(key.threadsafeCopy(), String());
 
     if (result.second)
-        result.first->second = value.copy();
+        result.first->second = value.threadsafeCopy();
+
+    // Update quota.
+    ASSERT(m_currentLength + value.length() >= m_currentLength);
+    m_currentLength += value.length();
 }
 
 }
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageMap.h b/WebCore/storage/StorageMap.h
index 95b4047..fa5f46c 100644
--- a/WebCore/storage/StorageMap.h
+++ b/WebCore/storage/StorageMap.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageMap_h
@@ -39,27 +39,35 @@ namespace WebCore {
 
     class StorageMap : public RefCounted<StorageMap> {
     public:
-        static PassRefPtr<StorageMap> create();
+        // Quota size mesured in bytes.
+        static PassRefPtr<StorageMap> create(unsigned quotaSize);
 
         unsigned length() const;
-        String key(unsigned index) const;
+        String key(unsigned index);
         String getItem(const String&) const;
-        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue);
+        PassRefPtr<StorageMap> setItem(const String& key, const String& value, String& oldValue, bool& quota_exception);
         PassRefPtr<StorageMap> removeItem(const String&, String& oldValue);
 
         bool contains(const String& key) const;
 
-        void importItem(const String& key, const String& value) const;
+        void importItem(const String& key, const String& value);
+
+        unsigned quota() const { return m_quotaSize; }
+
+        static const unsigned noQuota = UINT_MAX;
 
     private:
-        StorageMap();
+        StorageMap(unsigned quota);
         PassRefPtr<StorageMap> copy();
         void invalidateIterator();
-        void setIteratorToIndex(unsigned) const;
+        void setIteratorToIndex(unsigned);
+
+        HashMap<String, String> m_map;
+        HashMap<String, String>::iterator m_iterator;
+        unsigned m_iteratorIndex;
 
-        mutable HashMap<String, String> m_map;
-        mutable HashMap<String, String>::iterator m_iterator;
-        mutable unsigned m_iteratorIndex;
+        unsigned m_quotaSize;  // Measured in bytes.
+        unsigned m_currentLength;  // Measured in UChars.
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageNamespace.cpp b/WebCore/storage/StorageNamespace.cpp
index 6fcae63..6b8caeb 100644
--- a/WebCore/storage/StorageNamespace.cpp
+++ b/WebCore/storage/StorageNamespace.cpp
@@ -36,9 +36,9 @@
 
 namespace WebCore {
 
-PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespace::localStorageNamespace(const String& path, unsigned quota)
 {
-    return StorageNamespaceImpl::localStorageNamespace(path);
+    return StorageNamespaceImpl::localStorageNamespace(path, quota);
 }
 
 PassRefPtr<StorageNamespace> StorageNamespace::sessionStorageNamespace()
diff --git a/WebCore/storage/StorageNamespace.h b/WebCore/storage/StorageNamespace.h
index edbe339..0ac5f86 100644
--- a/WebCore/storage/StorageNamespace.h
+++ b/WebCore/storage/StorageNamespace.h
@@ -41,13 +41,14 @@ namespace WebCore {
     // This interface is required for Chromium since these actions need to be proxied between processes.
     class StorageNamespace : public RefCounted<StorageNamespace> {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespace() { }
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*) = 0;
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>) = 0;
         virtual PassRefPtr<StorageNamespace> copy() = 0;
         virtual void close() = 0;
+        virtual void unlock() = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/storage/StorageNamespaceImpl.cpp b/WebCore/storage/StorageNamespaceImpl.cpp
index b4caaeb..19ff6b4 100644
--- a/WebCore/storage/StorageNamespaceImpl.cpp
+++ b/WebCore/storage/StorageNamespaceImpl.cpp
@@ -31,6 +31,7 @@
 #include "SecurityOriginHash.h"
 #include "StringHash.h"
 #include "StorageAreaImpl.h"
+#include "StorageMap.h"
 #include "StorageSyncManager.h"
 #include <wtf/StdLibExtras.h>
 
@@ -44,12 +45,12 @@ static LocalStorageNamespaceMap& localStorageNamespaceMap()
     return localStorageNamespaceMap;
 }
 
-PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path)
+PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const String& path, unsigned quota)
 {
     const String lookupPath = path.isNull() ? String("") : path;
     LocalStorageNamespaceMap::iterator it = localStorageNamespaceMap().find(lookupPath);
     if (it == localStorageNamespaceMap().end()) {
-        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath));
+        RefPtr<StorageNamespace> storageNamespace = adoptRef(new StorageNamespaceImpl(LocalStorage, lookupPath, quota));
         localStorageNamespaceMap().set(lookupPath, storageNamespace.get());
         return storageNamespace.release();
     }
@@ -59,13 +60,14 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::localStorageNamespace(const S
 
 PassRefPtr<StorageNamespace> StorageNamespaceImpl::sessionStorageNamespace()
 {
-    return adoptRef(new StorageNamespaceImpl(SessionStorage, String()));
+    return adoptRef(new StorageNamespaceImpl(SessionStorage, String(), StorageMap::noQuota));
 }
 
-StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path)
+StorageNamespaceImpl::StorageNamespaceImpl(StorageType storageType, const String& path, unsigned quota)
     : m_storageType(storageType)
-    , m_path(path.copy())  // Copy makes it safe for our other thread to access the path.
+    , m_path(path.crossThreadString())
     , m_syncManager(0)
+    , m_quota(quota)
     , m_isShutdown(false)
 {
     if (m_storageType == LocalStorage && !m_path.isEmpty())
@@ -80,7 +82,7 @@ StorageNamespaceImpl::~StorageNamespaceImpl()
         ASSERT(localStorageNamespaceMap().get(m_path) == this);
         localStorageNamespaceMap().remove(m_path);
     }
-    
+
     if (!m_isShutdown)
         close();
 }
@@ -91,7 +93,7 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     ASSERT(!m_isShutdown);
     ASSERT(m_storageType == SessionStorage);
 
-    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path);
+    StorageNamespaceImpl* newNamespace = new StorageNamespaceImpl(m_storageType, m_path, m_quota);
 
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator i = m_storageAreaMap.begin(); i != end; ++i)
@@ -99,17 +101,18 @@ PassRefPtr<StorageNamespace> StorageNamespaceImpl::copy()
     return adoptRef(newNamespace);
 }
 
-PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(SecurityOrigin* origin)
+PassRefPtr<StorageArea> StorageNamespaceImpl::storageArea(PassRefPtr<SecurityOrigin> prpOrigin)
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
 
+    RefPtr<SecurityOrigin> origin = prpOrigin;
     RefPtr<StorageAreaImpl> storageArea;
     if (storageArea = m_storageAreaMap.get(origin))
         return storageArea.release();
 
-    storageArea = adoptRef(new StorageAreaImpl(m_storageType, origin, m_syncManager));
-    m_storageAreaMap.set(origin, storageArea);
+    storageArea = StorageAreaImpl::create(m_storageType, origin, m_syncManager, m_quota);
+    m_storageAreaMap.set(origin.release(), storageArea);
     return storageArea.release();
 }
 
@@ -117,7 +120,7 @@ void StorageNamespaceImpl::close()
 {
     ASSERT(isMainThread());
     ASSERT(!m_isShutdown);
-    
+
     // If we're session storage, we shouldn't need to do any work here.
     if (m_storageType == SessionStorage) {
         ASSERT(!m_syncManager);
@@ -127,13 +130,18 @@ void StorageNamespaceImpl::close()
     StorageAreaMap::iterator end = m_storageAreaMap.end();
     for (StorageAreaMap::iterator it = m_storageAreaMap.begin(); it != end; ++it)
         it->second->close();
-    
+
     if (m_syncManager)
         m_syncManager->close();
 
     m_isShutdown = true;
 }
 
+void StorageNamespaceImpl::unlock()
+{
+    // Because there's a single event loop per-process, this is a no-op.
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
diff --git a/WebCore/storage/StorageNamespaceImpl.h b/WebCore/storage/StorageNamespaceImpl.h
index 0b15e43..b81b55a 100644
--- a/WebCore/storage/StorageNamespaceImpl.h
+++ b/WebCore/storage/StorageNamespaceImpl.h
@@ -42,16 +42,17 @@ namespace WebCore {
 
     class StorageNamespaceImpl : public StorageNamespace {
     public:
-        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path);
+        static PassRefPtr<StorageNamespace> localStorageNamespace(const String& path, unsigned quota);
         static PassRefPtr<StorageNamespace> sessionStorageNamespace();
 
         virtual ~StorageNamespaceImpl();
-        virtual PassRefPtr<StorageArea> storageArea(SecurityOrigin*);
+        virtual PassRefPtr<StorageArea> storageArea(PassRefPtr<SecurityOrigin>);
         virtual PassRefPtr<StorageNamespace> copy();
         virtual void close();
+        virtual void unlock();
 
     private:
-        StorageNamespaceImpl(StorageType, const String& path);
+        StorageNamespaceImpl(StorageType, const String& path, unsigned quota);
 
         typedef HashMap<RefPtr<SecurityOrigin>, RefPtr<StorageAreaImpl>, SecurityOriginHash> StorageAreaMap;
         StorageAreaMap m_storageAreaMap;
@@ -62,6 +63,7 @@ namespace WebCore {
         String m_path;
         RefPtr<StorageSyncManager> m_syncManager;
 
+        unsigned m_quota;  // The default quota for each new storage area.
         bool m_isShutdown;
     };
 
diff --git a/WebCore/storage/StorageSyncManager.cpp b/WebCore/storage/StorageSyncManager.cpp
index a935242..f9276dd 100644
--- a/WebCore/storage/StorageSyncManager.cpp
+++ b/WebCore/storage/StorageSyncManager.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -48,8 +48,9 @@ PassRefPtr<StorageSyncManager> StorageSyncManager::create(const String& path)
 }
 
 StorageSyncManager::StorageSyncManager(const String& path)
-    : m_path(path.copy())
+    : m_path(path.crossThreadString())
 {
+    ASSERT(isMainThread());
     ASSERT(!m_path.isEmpty());
     m_thread = LocalStorageThread::create();
     m_thread->start();
@@ -57,6 +58,7 @@ StorageSyncManager::StorageSyncManager(const String& path)
 
 StorageSyncManager::~StorageSyncManager()
 {
+    ASSERT(isMainThread());
 }
 
 String StorageSyncManager::fullDatabaseFilename(SecurityOrigin* origin)
@@ -85,7 +87,7 @@ bool StorageSyncManager::scheduleImport(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleImport(area);
+        m_thread->scheduleImport(area.get());
 
     return m_thread;
 }
@@ -95,10 +97,9 @@ void StorageSyncManager::scheduleSync(PassRefPtr<StorageAreaSync> area)
     ASSERT(isMainThread());
 
     if (m_thread)
-        m_thread->scheduleSync(area);
+        m_thread->scheduleSync(area.get());
 }
 
 } // namespace WebCore
 
 #endif // ENABLE(DOM_STORAGE)
-
diff --git a/WebCore/storage/StorageSyncManager.h b/WebCore/storage/StorageSyncManager.h
index 4c5e821..fe35e3d 100644
--- a/WebCore/storage/StorageSyncManager.h
+++ b/WebCore/storage/StorageSyncManager.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef StorageSyncManager_h
@@ -31,8 +31,8 @@
 #include "PlatformString.h"
 
 #include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
-#include <wtf/Threading.h>
 
 namespace WebCore {
 
@@ -40,7 +40,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageAreaSync;
 
-    class StorageSyncManager : public ThreadSafeShared<StorageSyncManager> {
+    class StorageSyncManager : public RefCounted<StorageSyncManager> {
     public:
         static PassRefPtr<StorageSyncManager> create(const String& path);
         ~StorageSyncManager();
diff --git a/WebCore/svg/ElementTimeControl.h b/WebCore/svg/ElementTimeControl.h
index 4c185b9..4800cb1 100644
--- a/WebCore/svg/ElementTimeControl.h
+++ b/WebCore/svg/ElementTimeControl.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,10 +36,10 @@ namespace WebCore {
     class ElementTimeControl {
     public:
         virtual ~ElementTimeControl() {}
-        virtual bool beginElement(ExceptionCode&) = 0;
-        virtual bool beginElementAt(float offset, ExceptionCode&) = 0;
-        virtual bool endElement(ExceptionCode&) = 0;
-        virtual bool endElementAt(float offset, ExceptionCode&) = 0;
+        virtual void beginElement() = 0;
+        virtual void beginElementAt(float offset) = 0;
+        virtual void endElement() = 0;
+        virtual void endElementAt(float offset) = 0;
     };
         
 }
diff --git a/WebCore/svg/ElementTimeControl.idl b/WebCore/svg/ElementTimeControl.idl
index 569fefa..e8ca615 100644
--- a/WebCore/svg/ElementTimeControl.idl
+++ b/WebCore/svg/ElementTimeControl.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,14 +27,10 @@
 module svg {
 
     interface [Conditional=SVG, ObjCProtocol] ElementTimeControl { 
-        boolean beginElement()
-                      raises(DOMException);
-        boolean beginElementAt(in float offset)
-                      raises(DOMException);
-        boolean endElement()
-                      raises(DOMException);
-        boolean endElementAt(in float offset)
-                      raises(DOMException);
+        void beginElement();
+        void beginElementAt(in float offset);
+        void endElement();
+        void endElementAt(in float offset);
     };
 
 }
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index 9919702..639e3e0 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -53,6 +53,7 @@ SVGAElement::SVGAElement(const QualifiedName& tagName, Document *doc)
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_target(this, SVGNames::targetAttr)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -165,20 +166,15 @@ bool SVGAElement::supportsFocus() const
 {
     if (isContentEditable())
         return SVGStyledTransformableElement::supportsFocus();
-    return isFocusable() || (document() && !document()->haveStylesheetsLoaded());
+    return true;
 }
 
 bool SVGAElement::isFocusable() const
 {
-    if (isContentEditable())
-        return SVGStyledTransformableElement::isFocusable();
-    
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!renderer() || !(renderer()->style()->visibility() == VISIBLE))
+    if (renderer() && renderer()->absoluteClippedOverflowRect().isEmpty())
         return false;
     
-    return !renderer()->absoluteClippedOverflowRect().isEmpty();
+    return SVGElement::isFocusable();
 }
 
 bool SVGAElement::isMouseFocusable() const
diff --git a/WebCore/svg/SVGAElement.h b/WebCore/svg/SVGAElement.h
index 8890ca4..77cec67 100644
--- a/WebCore/svg/SVGAElement.h
+++ b/WebCore/svg/SVGAElement.h
@@ -65,6 +65,9 @@ namespace WebCore {
 
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGNames::aTagString, SVGNames::targetAttrString, String, Target, target)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGAllInOne.cpp b/WebCore/svg/SVGAllInOne.cpp
index 2e34ee3..6ca4539 100644
--- a/WebCore/svg/SVGAllInOne.cpp
+++ b/WebCore/svg/SVGAllInOne.cpp
@@ -41,7 +41,6 @@
 #include "SVGColor.cpp"
 #include "SVGComponentTransferFunctionElement.cpp"
 #include "SVGCursorElement.cpp"
-#include "SVGDefinitionSrcElement.cpp"
 #include "SVGDefsElement.cpp"
 #include "SVGDescElement.cpp"
 #include "SVGDocument.cpp"
diff --git a/WebCore/svg/SVGAltGlyphElement.cpp b/WebCore/svg/SVGAltGlyphElement.cpp
index d9da3f6..f13edf5 100644
--- a/WebCore/svg/SVGAltGlyphElement.cpp
+++ b/WebCore/svg/SVGAltGlyphElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 
 SVGAltGlyphElement::SVGAltGlyphElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGAltGlyphElement.h b/WebCore/svg/SVGAltGlyphElement.h
index 91c99e3..7c67a71 100644
--- a/WebCore/svg/SVGAltGlyphElement.h
+++ b/WebCore/svg/SVGAltGlyphElement.h
@@ -49,6 +49,10 @@ namespace WebCore {
 
     protected:
         virtual const SVGElement* contextElement() const { return this; }
+
+    private:    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGAltGlyphElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGAnimationElement.cpp b/WebCore/svg/SVGAnimationElement.cpp
index b817ad8..cf945f8 100644
--- a/WebCore/svg/SVGAnimationElement.cpp
+++ b/WebCore/svg/SVGAnimationElement.cpp
@@ -3,6 +3,7 @@
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -156,29 +157,24 @@ float SVGAnimationElement::getSimpleDuration(ExceptionCode&) const
     return narrowPrecisionToFloat(simpleDuration().value());
 }    
     
-bool SVGAnimationElement::beginElement(ExceptionCode& ec)
+void SVGAnimationElement::beginElement()
 {
-    return beginElementAt(0, ec);
+    beginElementAt(0);
 }
 
-bool SVGAnimationElement::beginElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::beginElementAt(float offset)
 {
     addBeginTime(elapsed() + offset);
-    return true;
 }
 
-bool SVGAnimationElement::endElement(ExceptionCode& ec)
+void SVGAnimationElement::endElement()
 {
-    return endElementAt(0, ec);
+    endElementAt(0);
 }
 
-bool SVGAnimationElement::endElementAt(float offset, ExceptionCode&)
+void SVGAnimationElement::endElementAt(float offset)
 {
-    if (offset < 0)
-        return false;
-    
     addEndTime(elapsed() + offset);
-    return true;
 }
 
 SVGAnimationElement::AnimationMode SVGAnimationElement::animationMode() const
diff --git a/WebCore/svg/SVGAnimationElement.h b/WebCore/svg/SVGAnimationElement.h
index d43ed57..1835a8d 100644
--- a/WebCore/svg/SVGAnimationElement.h
+++ b/WebCore/svg/SVGAnimationElement.h
@@ -3,6 +3,7 @@
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
     Copyright (C) 2007 Eric Seidel <eric@webkit.org>
     Copyright (C) 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2008 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -57,10 +58,10 @@ namespace WebCore {
         float getSimpleDuration(ExceptionCode&) const;
         
         // ElementTimeControl
-        virtual bool beginElement(ExceptionCode&);
-        virtual bool beginElementAt(float offset, ExceptionCode&);
-        virtual bool endElement(ExceptionCode&);
-        virtual bool endElementAt(float offset, ExceptionCode&);
+        virtual void beginElement();
+        virtual void beginElementAt(float offset);
+        virtual void endElement();
+        virtual void endElementAt(float offset);
         
         static bool attributeIsCSS(const String& attributeName);
 
diff --git a/WebCore/svg/SVGColor.cpp b/WebCore/svg/SVGColor.cpp
index f939ef0..d819ebf 100644
--- a/WebCore/svg/SVGColor.cpp
+++ b/WebCore/svg/SVGColor.cpp
@@ -62,9 +62,9 @@ unsigned short SVGColor::colorType() const
     return m_colorType;
 }
 
-RGBColor* SVGColor::rgbColor() const
+PassRefPtr<RGBColor> SVGColor::rgbColor() const
 {
-    return RGBColor::create(m_color.rgb()).releaseRef();
+    return RGBColor::create(m_color.rgb());
 }
 
 void SVGColor::setRGBColor(const String& rgbColor, ExceptionCode& ec)
diff --git a/WebCore/svg/SVGColor.h b/WebCore/svg/SVGColor.h
index 5dfb694..406166b 100644
--- a/WebCore/svg/SVGColor.h
+++ b/WebCore/svg/SVGColor.h
@@ -57,8 +57,8 @@ namespace WebCore {
         // 'SVGColor' functions
         unsigned short colorType() const;
 
-        RGBColor* rgbColor() const;
-        
+        PassRefPtr<RGBColor> rgbColor() const;
+
         static Color colorFromRGBColorString(const String&);
 
         void setRGBColor(const String& rgbColor) { ExceptionCode ignored = 0; setRGBColor(rgbColor, ignored); }
diff --git a/WebCore/svg/SVGComponentTransferFunctionElement.h b/WebCore/svg/SVGComponentTransferFunctionElement.h
index 82d57b4..a26c953 100644
--- a/WebCore/svg/SVGComponentTransferFunctionElement.h
+++ b/WebCore/svg/SVGComponentTransferFunctionElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 #include "SVGNumberList.h"
 #include "FEComponentTransfer.h"
 
diff --git a/WebCore/svg/SVGCursorElement.cpp b/WebCore/svg/SVGCursorElement.cpp
index 12e9e5d..5b408f8 100644
--- a/WebCore/svg/SVGCursorElement.cpp
+++ b/WebCore/svg/SVGCursorElement.cpp
@@ -40,6 +40,7 @@ SVGCursorElement::SVGCursorElement(const QualifiedName& tagName, Document* doc)
     , SVGURIReference()
     , m_x(this, SVGNames::xAttr, LengthModeWidth)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGCursorElement.h b/WebCore/svg/SVGCursorElement.h
index ddafb76..71963b6 100644
--- a/WebCore/svg/SVGCursorElement.h
+++ b/WebCore/svg/SVGCursorElement.h
@@ -57,6 +57,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::xAttrString, SVGLength, X, x)
         ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGNames::cursorTagString, SVGNames::yAttrString, SVGLength, Y, y)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGCursorElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         HashSet<SVGElement*> m_clients;
     };
 
diff --git a/WebCore/svg/SVGDefinitionSrcElement.cpp b/WebCore/svg/SVGDefinitionSrcElement.cpp
deleted file mode 100644
index 1419ec0..0000000
--- a/WebCore/svg/SVGDefinitionSrcElement.cpp
+++ /dev/null
@@ -1,45 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG_FONTS)
-#include "SVGDefinitionSrcElement.h"
-
-#include "SVGFontFaceElement.h"
-#include "SVGNames.h"
-
-namespace WebCore {
-    
-SVGDefinitionSrcElement::SVGDefinitionSrcElement(const QualifiedName& tagName, Document* doc)
-    : SVGElement(tagName, doc)
-{
-}
-
-void SVGDefinitionSrcElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
-{
-    SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-    if (parentNode() && parentNode()->hasTagName(SVGNames::font_faceTag))
-        static_cast<SVGFontFaceElement*>(parentNode())->rebuildFontFace();
-}
-
-}
-
-#endif // ENABLE(SVG_FONTS)
-
diff --git a/WebCore/svg/SVGDefinitionSrcElement.h b/WebCore/svg/SVGDefinitionSrcElement.h
deleted file mode 100644
index aaefd05..0000000
--- a/WebCore/svg/SVGDefinitionSrcElement.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
-   Copyright (C) 2007 Eric Seidel <eric@webkit.org>
-
-   This library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public
-   License as published by the Free Software Foundation; either
-   version 2 of the License, or (at your option) any later version.
-
-   This library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
-
-   You should have received a copy of the GNU Library General Public License
-   along with this library; see the file COPYING.LIB.  If not, write to
-   the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.
- */
-
-#ifndef SVGDefinitionSrcElement_h
-#define SVGDefinitionSrcElement_h
-
-#if ENABLE(SVG_FONTS)
-#include "SVGElement.h"
-
-namespace WebCore {
-    class SVGDefinitionSrcElement : public SVGElement {
-    public:
-        SVGDefinitionSrcElement(const QualifiedName&, Document*);
-    
-        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    };
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG_FONTS)
-#endif
-
-// vim:ts=4:noet
diff --git a/WebCore/svg/SVGDocument.h b/WebCore/svg/SVGDocument.h
index 02e3649..c7006f9 100644
--- a/WebCore/svg/SVGDocument.h
+++ b/WebCore/svg/SVGDocument.h
@@ -35,13 +35,11 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGDocument> create(Frame* frame)
         {
-            return new SVGDocument(frame);
+            return adoptRef(new SVGDocument(frame));
         }
 
         virtual ~SVGDocument();
         
-        virtual bool isSVGDocument() const { return true; }
-
         SVGSVGElement* rootElement() const;
         
         void dispatchZoomEvent(float prevScale, float newScale);
@@ -52,11 +50,13 @@ namespace WebCore {
         void startPan(const FloatPoint& start);
         void updatePan(const FloatPoint& pos) const;
 
-        virtual bool childShouldCreateRenderer(Node*) const;
-
     private:
         SVGDocument(Frame*);
 
+        virtual bool isSVGDocument() const { return true; }
+
+        virtual bool childShouldCreateRenderer(Node*) const;
+
         FloatPoint m_translate;
     };
 
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index 3a7d3d4..d455717 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -51,14 +51,19 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-SVGElement::SVGElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+SVGElement::SVGElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
     , m_shadowParent(0)
     , m_cursorElement(0)
     , m_cursorImageValue(0)
 {
 }
 
+PassRefPtr<SVGElement> SVGElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new SVGElement(tagName, document);
+}
+
 SVGElement::~SVGElement()
 {
     if (m_cursorElement)
@@ -185,18 +190,17 @@ bool SVGElement::haveLoadedRequiredResources()
     return true;
 }
 
-static bool hasLoadListener(SVGElement* node)
+static bool hasLoadListener(Node* node)
 {
-    Node* currentNode = node;
-    while (currentNode && currentNode->isElementNode()) {
-        const RegisteredEventListenerVector& listeners = static_cast<Element*>(currentNode)->eventListeners();
-        size_t size = listeners.size();
-        for (size_t i = 0; i < size; ++i) {
-            const RegisteredEventListener& r = *listeners[i];
-            if (r.eventType() == eventNames().loadEvent && r.useCapture() || currentNode == node)
+    if (node->hasEventListeners(eventNames().loadEvent))
+        return true;
+
+    for (node = node->parentNode(); node && node->isElementNode(); node = node->parentNode()) {
+        const EventListenerVector& entry = node->getEventListeners(eventNames().loadEvent);
+        for (size_t i = 0; i < entry.size(); ++i) {
+            if (entry[i].useCapture)
                 return true;
         }
-        currentNode = currentNode->parentNode();
     }
 
     return false;
diff --git a/WebCore/svg/SVGElement.h b/WebCore/svg/SVGElement.h
index aed7e59..3a17567 100644
--- a/WebCore/svg/SVGElement.h
+++ b/WebCore/svg/SVGElement.h
@@ -1,8 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
-
-    This file is part of the KDE project
+    Copyright (C) 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,25 +25,22 @@
 #if ENABLE(SVG)
 #include "StyledElement.h"
 #include "SVGAnimatedProperty.h"
-#include "SVGNames.h"
 
 namespace WebCore {
 
-    class TransformationMatrix;
     class CSSCursorImageValue;
     class Document;
     class SVGCursorElement;
     class SVGDocumentExtensions;
     class SVGElementInstance;
     class SVGSVGElement;
+    class TransformationMatrix;
 
     class SVGElement : public StyledElement {
     public:
-        SVGElement(const QualifiedName&, Document*);
+        static PassRefPtr<SVGElement> create(const QualifiedName&, Document*);
         virtual ~SVGElement();
-        virtual bool isSVGElement() const { return true; }
-        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
-        
+
         String id() const;
         void setId(const String&, ExceptionCode&);
         String xmlbase() const;
@@ -52,6 +48,7 @@ namespace WebCore {
 
         SVGSVGElement* ownerSVGElement() const;
         SVGElement* viewportElement() const;
+
         SVGDocumentExtensions* accessDocumentSVGExtensions() const;
 
         virtual void parseMappedAttribute(MappedAttribute*);
@@ -64,33 +61,53 @@ namespace WebCore {
         virtual bool isGradientStop() const { return false; }
         virtual bool isTextContent() const { return false; }
 
-        virtual bool isShadowNode() const { return m_shadowParent; }
-        virtual Node* shadowParentNode() { return m_shadowParent; }
         void setShadowParentNode(ContainerNode* node) { m_shadowParent = node; }
-        virtual ContainerNode* eventParentNode();
 
         // For SVGTests
         virtual bool isValid() const { return true; }
-  
-        virtual void finishParsingChildren();
+
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
         virtual bool childShouldCreateRenderer(Node*) const;
 
-        virtual void insertedIntoDocument();
-        virtual void buildPendingResource() { }
-
         virtual void svgAttributeChanged(const QualifiedName&) { }
-        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
         void sendSVGLoadEventIfPossible(bool sendParentLoadEvents = false);
         
         virtual TransformationMatrix* supplementalTransform() { return 0; }
 
-        virtual void updateAnimatedSVGAttribute(const String&) const;
         virtual void setSynchronizedSVGAttributes(bool) const;
 
         HashSet<SVGElementInstance*> instancesForElement() const;
- 
+
+        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
+        {
+            m_svgPropertyMap.set(attrName.localName(), &base);
+        }
+
+        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
+        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
+
+    protected:
+        SVGElement(const QualifiedName&, Document*);
+
+        virtual void finishParsingChildren();
+        virtual void insertedIntoDocument();
+        virtual void attributeChanged(Attribute*, bool preserveDecls = false);
+        virtual void updateAnimatedSVGAttribute(const String&) const;
+
+    private:
+        friend class SVGElementInstance;
+
+        virtual bool isSVGElement() const { return true; }
+
+        virtual bool isSupported(StringImpl* feature, StringImpl* version) const;
+        
+        virtual bool isShadowNode() const { return m_shadowParent; }
+        virtual Node* shadowParentNode() { return m_shadowParent; }
+        virtual ContainerNode* eventParentNode();
+
+        virtual void buildPendingResource() { }
+
         // Inlined methods handling SVG property synchronization
         void invokeSVGPropertySynchronizer(const String& name) const
         {
@@ -114,17 +131,6 @@ namespace WebCore {
             }
         }
 
-        void addSVGPropertySynchronizer(const QualifiedName& attrName, const SVGAnimatedPropertyBase& base) const
-        {
-            m_svgPropertyMap.set(attrName.localName(), &base);
-        }
-
-        void setCursorElement(SVGCursorElement* cursorElement) { m_cursorElement = cursorElement; }
-        void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
-
-    private:
-        friend class SVGElementInstance;
-
         void mapInstanceToElement(SVGElementInstance*);
         void removeInstanceMapping(SVGElementInstance*);
 
diff --git a/WebCore/svg/SVGElementInstance.cpp b/WebCore/svg/SVGElementInstance.cpp
index 01555fc..46e8221 100644
--- a/WebCore/svg/SVGElementInstance.cpp
+++ b/WebCore/svg/SVGElementInstance.cpp
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -25,7 +23,6 @@
 #include "SVGElementInstance.h"
 
 #include "ContainerNodeAlgorithms.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
@@ -46,7 +43,14 @@ namespace WebCore {
 static WTF::RefCountedLeakCounter instanceCounter("WebCoreSVGElementInstance");
 #endif
 
-SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, SVGElement* originalElement)
+static EventTargetData& dummyEventTargetData()
+{
+    DEFINE_STATIC_LOCAL(EventTargetData, dummyEventTargetData, ());
+    dummyEventTargetData.eventListenerMap.clear();
+    return dummyEventTargetData;
+}
+
+SVGElementInstance::SVGElementInstance(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
     : m_needsUpdate(false)
     , m_useElement(useElement)
     , m_element(originalElement)
@@ -140,438 +144,52 @@ ScriptExecutionContext* SVGElementInstance::scriptExecutionContext() const
     return 0;
 }
 
-void SVGElementInstance::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    if (SVGElement* element = correspondingElement())
-        element->addEventListener(eventType, listener, useCapture);
-}
-
-void SVGElementInstance::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+bool SVGElementInstance::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    if (SVGElement* element = correspondingElement())
-        element->removeEventListener(eventType, listener, useCapture);
-}
-
-bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
-    }
-
-    // The event has to be dispatched to the shadowTreeElement(), not the correspondingElement()!
-    SVGElement* element = shadowTreeElement();
-    if (!element)
+    if (!correspondingElement())
         return false;
-
-    evt->setTarget(this);
-
-    RefPtr<FrameView> view = element->document()->view();
-    return element->dispatchGenericEvent(evt.release());
-}
-
-EventListener* SVGElementInstance::onabort() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().abortEvent);
-}
-
-void SVGElementInstance::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().abortEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onblur() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().blurEvent);
-}
-
-void SVGElementInstance::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().blurEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onchange() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().changeEvent);
-}
-
-void SVGElementInstance::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().changeEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onclick() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().clickEvent);
-}
-
-void SVGElementInstance::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().clickEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncontextmenu() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().contextmenuEvent);
-}
-
-void SVGElementInstance::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondblclick() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dblclickEvent);
-}
-
-void SVGElementInstance::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onerror() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().errorEvent);
-}
-
-void SVGElementInstance::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().errorEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onfocus() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().focusEvent);
-}
-
-void SVGElementInstance::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().focusEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oninput() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().inputEvent);
-}
-
-void SVGElementInstance::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().inputEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeydown() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keydownEvent);
-}
-
-void SVGElementInstance::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeypress() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keypressEvent);
-}
-
-void SVGElementInstance::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onkeyup() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().keyupEvent);
-}
-
-void SVGElementInstance::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onload() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().loadEvent);
-}
-
-void SVGElementInstance::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().loadEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousedown() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousedownEvent);
-}
-
-void SVGElementInstance::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousemove() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousemoveEvent);
-}
-
-void SVGElementInstance::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseout() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseoutEvent);
-}
-
-void SVGElementInstance::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseover() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseoverEvent);
-}
-
-void SVGElementInstance::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmouseup() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mouseupEvent);
+    return correspondingElement()->addEventListener(eventType, listener, useCapture);
 }
 
-void SVGElementInstance::setOnmouseup(PassRefPtr<EventListener> eventListener)
+bool SVGElementInstance::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
 {
-    correspondingElement()->setAttributeEventListener(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onmousewheel() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().mousewheelEvent);
-}
-
-void SVGElementInstance::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforecut() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforecutEvent);
-}
-
-void SVGElementInstance::setOnbeforecut(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforecutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncut() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().cutEvent);
-}
-
-void SVGElementInstance::setOncut(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().cutEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforecopy() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforecopyEvent);
-}
-
-void SVGElementInstance::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::oncopy() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().copyEvent);
-}
-
-void SVGElementInstance::setOncopy(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().copyEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onbeforepaste() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().beforepasteEvent);
-}
-
-void SVGElementInstance::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onpaste() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().pasteEvent);
-}
-
-void SVGElementInstance::setOnpaste(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().pasteEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragenter() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragenterEvent);
-}
-
-void SVGElementInstance::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragover() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragoverEvent);
-}
-
-void SVGElementInstance::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragleave() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragleaveEvent);
-}
-
-void SVGElementInstance::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondrop() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dropEvent);
-}
-
-void SVGElementInstance::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dropEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragstart() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragstartEvent);
-}
-
-void SVGElementInstance::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondrag() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragEvent);
-}
-
-void SVGElementInstance::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::ondragend() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().dragendEvent);
-}
-
-void SVGElementInstance::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onreset() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().resetEvent);
-}
-
-void SVGElementInstance::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().resetEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onresize() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().resizeEvent);
-}
-
-void SVGElementInstance::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onscroll() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().scrollEvent);
-}
-
-void SVGElementInstance::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onsearch() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().searchEvent);
-}
-
-void SVGElementInstance::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().searchEvent, eventListener);
-}
-
-EventListener* SVGElementInstance::onselect() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().selectEvent);
+    if (!correspondingElement())
+        return false;
+    return correspondingElement()->removeEventListener(eventType, listener, useCapture);
 }
 
-void SVGElementInstance::setOnselect(PassRefPtr<EventListener> eventListener)
+void SVGElementInstance::removeAllEventListeners()
 {
-    correspondingElement()->setAttributeEventListener(eventNames().selectEvent, eventListener);
+    if (!correspondingElement())
+        return;
+    correspondingElement()->removeAllEventListeners();
 }
 
-EventListener* SVGElementInstance::onselectstart() const
+bool SVGElementInstance::dispatchEvent(PassRefPtr<Event> prpEvent)
 {
-    return correspondingElement()->getAttributeEventListener(eventNames().selectstartEvent);
-}
+    RefPtr<EventTarget> protect = this;
+    RefPtr<Event> event = prpEvent;
 
-void SVGElementInstance::setOnselectstart(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().selectstartEvent, eventListener);
-}
+    event->setTarget(this);
 
-EventListener* SVGElementInstance::onsubmit() const
-{
-    return correspondingElement()->getAttributeEventListener(eventNames().submitEvent);
-}
+    SVGElement* element = shadowTreeElement();
+    if (!element)
+        return false;
 
-void SVGElementInstance::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    correspondingElement()->setAttributeEventListener(eventNames().submitEvent, eventListener);
+    RefPtr<FrameView> view = element->document()->view();
+    return element->dispatchGenericEvent(event.release());
 }
 
-EventListener* SVGElementInstance::onunload() const
+EventTargetData* SVGElementInstance::eventTargetData()
 {
-    return correspondingElement()->getAttributeEventListener(eventNames().unloadEvent);
+    return correspondingElement() ? correspondingElement()->eventTargetData() : 0;
 }
 
-void SVGElementInstance::setOnunload(PassRefPtr<EventListener> eventListener)
+EventTargetData* SVGElementInstance::ensureEventTargetData()
 {
-    correspondingElement()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+    return &dummyEventTargetData(); // return something, so we don't crash
 }
 
-}
+} // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGElementInstance.h b/WebCore/svg/SVGElementInstance.h
index c477718..3cdc761 100644
--- a/WebCore/svg/SVGElementInstance.h
+++ b/WebCore/svg/SVGElementInstance.h
@@ -1,8 +1,6 @@
 /*
     Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -27,9 +25,6 @@
 #include "SVGElement.h"
 #include "TreeShared.h"
 
-#include <wtf/RefPtr.h>
-#include <wtf/PassRefPtr.h>
-
 namespace WebCore {
 
     namespace Private { 
@@ -37,8 +32,6 @@ namespace WebCore {
         void addChildNodesToDeletionQueue(GenericNode*& head, GenericNode*& tail, GenericNodeContainer* container);
     };
 
-    class EventListener;
-    class Frame;
     class SVGUseElement;
     class SVGElementInstanceList;
 
@@ -46,7 +39,11 @@ namespace WebCore {
     class SVGElementInstance : public TreeShared<SVGElementInstance>,
                                public EventTarget {
     public:
-        SVGElementInstance(SVGUseElement*, SVGElement* originalElement);
+        static PassRefPtr<SVGElementInstance> create(SVGUseElement* useElement, PassRefPtr<SVGElement> originalElement)
+        {
+            return adoptRef(new SVGElementInstance(useElement, originalElement));
+        }
+
         virtual ~SVGElementInstance();
 
         bool needsUpdate() const { return m_needsUpdate; }
@@ -54,13 +51,11 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        virtual Node* toNode() { return shadowTreeElement(); }
-        virtual SVGElementInstance* toSVGElementInstance() { return this; }
-
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-        const RegisteredEventListenerVector& eventListeners() const { return correspondingElement()->eventListeners(); }
+        virtual bool addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual bool removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual void removeAllEventListeners();
+        using EventTarget::dispatchEvent;
+        virtual bool dispatchEvent(PassRefPtr<Event>);
 
         SVGElement* correspondingElement() const { return m_element.get(); }
         SVGUseElement* correspondingUseElement() const { return m_useElement; }
@@ -83,90 +78,55 @@ namespace WebCore {
         using TreeShared<SVGElementInstance>::deref;
 
         // EventTarget API
-        EventListener* onabort() const;
-        void setOnabort(PassRefPtr<EventListener>);
-        EventListener* onblur() const;
-        void setOnblur(PassRefPtr<EventListener>);
-        EventListener* onchange() const;
-        void setOnchange(PassRefPtr<EventListener>);
-        EventListener* onclick() const;
-        void setOnclick(PassRefPtr<EventListener>);
-        EventListener* oncontextmenu() const;
-        void setOncontextmenu(PassRefPtr<EventListener>);
-        EventListener* ondblclick() const;
-        void setOndblclick(PassRefPtr<EventListener>);
-        EventListener* onerror() const;
-        void setOnerror(PassRefPtr<EventListener>);
-        EventListener* onfocus() const;
-        void setOnfocus(PassRefPtr<EventListener>);
-        EventListener* oninput() const;
-        void setOninput(PassRefPtr<EventListener>);
-        EventListener* onkeydown() const;
-        void setOnkeydown(PassRefPtr<EventListener>);
-        EventListener* onkeypress() const;
-        void setOnkeypress(PassRefPtr<EventListener>);
-        EventListener* onkeyup() const;
-        void setOnkeyup(PassRefPtr<EventListener>);
-        EventListener* onload() const;
-        void setOnload(PassRefPtr<EventListener>);
-        EventListener* onmousedown() const;
-        void setOnmousedown(PassRefPtr<EventListener>);
-        EventListener* onmousemove() const;
-        void setOnmousemove(PassRefPtr<EventListener>);
-        EventListener* onmouseout() const;
-        void setOnmouseout(PassRefPtr<EventListener>);
-        EventListener* onmouseover() const;
-        void setOnmouseover(PassRefPtr<EventListener>);
-        EventListener* onmouseup() const;
-        void setOnmouseup(PassRefPtr<EventListener>);
-        EventListener* onmousewheel() const;
-        void setOnmousewheel(PassRefPtr<EventListener>);
-        EventListener* onbeforecut() const;
-        void setOnbeforecut(PassRefPtr<EventListener>);
-        EventListener* oncut() const;
-        void setOncut(PassRefPtr<EventListener>);
-        EventListener* onbeforecopy() const;
-        void setOnbeforecopy(PassRefPtr<EventListener>);
-        EventListener* oncopy() const;
-        void setOncopy(PassRefPtr<EventListener>);
-        EventListener* onbeforepaste() const;
-        void setOnbeforepaste(PassRefPtr<EventListener>);
-        EventListener* onpaste() const;
-        void setOnpaste(PassRefPtr<EventListener>);
-        EventListener* ondragenter() const;
-        void setOndragenter(PassRefPtr<EventListener>);
-        EventListener* ondragover() const;
-        void setOndragover(PassRefPtr<EventListener>);
-        EventListener* ondragleave() const;
-        void setOndragleave(PassRefPtr<EventListener>);
-        EventListener* ondrop() const;
-        void setOndrop(PassRefPtr<EventListener>);
-        EventListener* ondragstart() const;
-        void setOndragstart(PassRefPtr<EventListener>);
-        EventListener* ondrag() const;
-        void setOndrag(PassRefPtr<EventListener>);
-        EventListener* ondragend() const;
-        void setOndragend(PassRefPtr<EventListener>);
-        EventListener* onreset() const;
-        void setOnreset(PassRefPtr<EventListener>);
-        EventListener* onresize() const;
-        void setOnresize(PassRefPtr<EventListener>);
-        EventListener* onscroll() const;
-        void setOnscroll(PassRefPtr<EventListener>);
-        EventListener* onsearch() const;
-        void setOnsearch(PassRefPtr<EventListener>);
-        EventListener* onselect() const;
-        void setOnselect(PassRefPtr<EventListener>);
-        EventListener* onselectstart() const;
-        void setOnselectstart(PassRefPtr<EventListener>);
-        EventListener* onsubmit() const;
-        void setOnsubmit(PassRefPtr<EventListener>);
-        EventListener* onunload() const;
-        void setOnunload(PassRefPtr<EventListener>);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), abort);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), blur);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), change);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), click);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), contextmenu);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dblclick);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), error);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), focus);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), input);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keydown);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keypress);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), keyup);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), load);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousedown);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousemove);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseout);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseover);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mouseup);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), mousewheel);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforecut);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), cut);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforecopy);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), copy);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), beforepaste);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), paste);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragenter);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragover);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragleave);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), drop);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragstart);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), drag);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), dragend);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), reset);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), resize);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), scroll);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), search);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), select);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), selectstart);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), submit);
+        DEFINE_FORWARDING_ATTRIBUTE_EVENT_LISTENER(correspondingElement(), unload);
 
     private:
         friend class SVGUseElement;
 
+        SVGElementInstance(SVGUseElement*, PassRefPtr<SVGElement> originalElement);
+
+        virtual Node* toNode() { return shadowTreeElement(); }
+        virtual SVGElementInstance* toSVGElementInstance() { return this; }
+
         void appendChild(PassRefPtr<SVGElementInstance> child);
         void setShadowTreeElement(SVGElement*);
         void forgetWrapper();
@@ -190,8 +150,9 @@ namespace WebCore {
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
-    private:
         bool m_needsUpdate : 1;
 
         SVGUseElement* m_useElement;
diff --git a/WebCore/svg/SVGExternalResourcesRequired.h b/WebCore/svg/SVGExternalResourcesRequired.h
index 0ab6dc9..e491e4b 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/WebCore/svg/SVGExternalResourcesRequired.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 8122960..fade0f7 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -43,6 +43,7 @@ SVGFEImageElement::SVGFEImageElement(const QualifiedName& tagName, Document* doc
     , SVGLangSpace()
     , SVGExternalResourcesRequired()
     , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGFEImageElement.h b/WebCore/svg/SVGFEImageElement.h
index 67f3bd5..0393c66 100644
--- a/WebCore/svg/SVGFEImageElement.h
+++ b/WebCore/svg/SVGFEImageElement.h
@@ -55,6 +55,9 @@ namespace WebCore {
     private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGNames::feImageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFEImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         CachedResourceHandle<CachedImage> m_cachedImage;
     };
 
diff --git a/WebCore/svg/SVGFELightElement.h b/WebCore/svg/SVGFELightElement.h
index a66ccf5..f6e79fb 100644
--- a/WebCore/svg/SVGFELightElement.h
+++ b/WebCore/svg/SVGFELightElement.h
@@ -25,6 +25,7 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
 #include "SVGLightSource.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFEMergeNodeElement.h b/WebCore/svg/SVGFEMergeNodeElement.h
index e2af642..4633f98 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/WebCore/svg/SVGFEMergeNodeElement.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGElement.h"
+#include "SVGNames.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index 7703b6f..bc39475 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -54,6 +54,7 @@ SVGFilterElement::SVGFilterElement(const QualifiedName& tagName, Document* doc)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
     , m_filterResX(this, SVGNames::filterResAttr)
     , m_filterResY(this, SVGNames::filterResAttr)
+    , m_href(this, XLinkNames::hrefAttr)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
diff --git a/WebCore/svg/SVGFilterElement.h b/WebCore/svg/SVGFilterElement.h
index 541ec14..64b21f6 100644
--- a/WebCore/svg/SVGFilterElement.h
+++ b/WebCore/svg/SVGFilterElement.h
@@ -64,6 +64,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResXIdentifier, long, FilterResX, filterResX)
         ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGNames::filterTagString, SVGFilterResYIdentifier, long, FilterResY, filterResY)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGFilterElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         RefPtr<SVGResourceFilter> m_filter;
     };
 
diff --git a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
index fa82f6a..3cdbb37 100644
--- a/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
+++ b/WebCore/svg/SVGFilterPrimitiveStandardAttributes.h
@@ -25,6 +25,7 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilterBuilder.h"
+#include "SVGNames.h"
 #include "SVGResourceFilter.h"
 #include "SVGStyledElement.h"
 
diff --git a/WebCore/svg/SVGFontFaceElement.cpp b/WebCore/svg/SVGFontFaceElement.cpp
index 1e5a0fe..aa0b6d8 100644
--- a/WebCore/svg/SVGFontFaceElement.cpp
+++ b/WebCore/svg/SVGFontFaceElement.cpp
@@ -37,7 +37,6 @@
 #include "Document.h"
 #include "Font.h"
 #include "MappedAttribute.h"
-#include "SVGDefinitionSrcElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceSrcElement.h"
 #include "SVGGlyphElement.h"
@@ -277,21 +276,12 @@ void SVGFontFaceElement::rebuildFontFace()
 
     // we currently ignore all but the first src element, alternatively we could concat them
     SVGFontFaceSrcElement* srcElement = 0;
-    SVGDefinitionSrcElement* definitionSrc = 0;
 
-    for (Node* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->hasTagName(font_face_srcTag) && !srcElement)
+    for (Node* child = firstChild(); child && !srcElement; child = child->nextSibling()) {
+        if (child->hasTagName(font_face_srcTag))
             srcElement = static_cast<SVGFontFaceSrcElement*>(child);
-        else if (child->hasTagName(definition_srcTag) && !definitionSrc)
-            definitionSrc = static_cast<SVGDefinitionSrcElement*>(child);
     }
 
-#if 0
-    // @font-face (CSSFontFace) does not yet support definition-src, as soon as it does this code should do the trick!
-    if (definitionSrc)
-        m_styleDeclaration->setProperty(CSSPropertyDefinitionSrc, definitionSrc->getAttribute(XLinkNames::hrefAttr), false);
-#endif
-
     bool describesParentFont = parentNode()->hasTagName(fontTag);
     RefPtr<CSSValueList> list;
 
diff --git a/WebCore/svg/SVGForeignObjectElement.cpp b/WebCore/svg/SVGForeignObjectElement.cpp
index 5cfca8a..b93ddeb 100644
--- a/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/svg/SVGForeignObjectElement.cpp
@@ -43,6 +43,7 @@ SVGForeignObjectElement::SVGForeignObjectElement(const QualifiedName& tagName, D
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGForeignObjectElement.h b/WebCore/svg/SVGForeignObjectElement.h
index 14dbe68..7b93bb6 100644
--- a/WebCore/svg/SVGForeignObjectElement.h
+++ b/WebCore/svg/SVGForeignObjectElement.h
@@ -56,6 +56,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::yAttrString, SVGLength, Y, y)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGNames::foreignObjectTagString, SVGNames::heightAttrString, SVGLength, Height, height)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGForeignObjectElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 8034286..29bbcac 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -48,6 +48,7 @@ SVGGradientElement::SVGGradientElement(const QualifiedName& tagName, Document* d
     , m_spreadMethod(this, SVGNames::spreadMethodAttr)
     , m_gradientUnits(this, SVGNames::gradientUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_gradientTransform(this, SVGNames::gradientTransformAttr, SVGTransformList::create(SVGNames::gradientTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGGradientElement.h b/WebCore/svg/SVGGradientElement.h
index 2027258..3c8a760 100644
--- a/WebCore/svg/SVGGradientElement.h
+++ b/WebCore/svg/SVGGradientElement.h
@@ -66,6 +66,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::spreadMethodAttrString, int, SpreadMethod, spreadMethod)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientUnitsAttrString, int, GradientUnits, gradientUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGGradientElementIdentifier, SVGNames::gradientTransformAttrString, SVGTransformList, GradientTransform, gradientTransform)
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGGradientElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index 299828f..5b7dee2 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -45,7 +45,8 @@ SVGImageElement::SVGImageElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
-    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create())
+    , m_preserveAspectRatio(this, SVGNames::preserveAspectRatioAttr, SVGPreserveAspectRatio::create()) 
+    , m_href(this, XLinkNames::hrefAttr)
     , m_imageLoader(this)
 {
 }
diff --git a/WebCore/svg/SVGImageElement.h b/WebCore/svg/SVGImageElement.h
index 1d242b5..7840fc5 100644
--- a/WebCore/svg/SVGImageElement.h
+++ b/WebCore/svg/SVGImageElement.h
@@ -70,6 +70,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::heightAttrString, SVGLength, Height, height)
         ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGNames::imageTagString, SVGNames::preserveAspectRatioAttrString, SVGPreserveAspectRatio, PreserveAspectRatio, preserveAspectRatio)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGImageElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         SVGImageLoader m_imageLoader;
     };
 
diff --git a/WebCore/svg/SVGImageLoader.cpp b/WebCore/svg/SVGImageLoader.cpp
index f8380f5..5d5d3bc 100644
--- a/WebCore/svg/SVGImageLoader.cpp
+++ b/WebCore/svg/SVGImageLoader.cpp
@@ -25,6 +25,7 @@
 #if ENABLE(SVG)
 #include "SVGImageLoader.h"
 
+#include "Event.h"
 #include "EventNames.h"
 #include "SVGImageElement.h"
 #include "RenderImage.h"
@@ -43,7 +44,7 @@ SVGImageLoader::~SVGImageLoader()
 void SVGImageLoader::dispatchLoadEvent()
 {
     if (image()->errorOccurred())
-        element()->dispatchEvent(eventNames().errorEvent, false, false);
+        element()->dispatchEvent(Event::create(eventNames().errorEvent, false, false));
     else {
         SVGImageElement* imageElement = static_cast<SVGImageElement*>(element());
         if (imageElement->externalResourcesRequiredBaseValue())
diff --git a/WebCore/svg/SVGMPathElement.cpp b/WebCore/svg/SVGMPathElement.cpp
index b3214ed..f19580c 100644
--- a/WebCore/svg/SVGMPathElement.cpp
+++ b/WebCore/svg/SVGMPathElement.cpp
@@ -31,6 +31,7 @@ namespace WebCore {
 
 SVGMPathElement::SVGMPathElement(const QualifiedName& qname, Document* doc)
     : SVGElement(qname, doc)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -47,7 +48,7 @@ void SVGMPathElement::parseMappedAttribute(MappedAttribute* attr)
 
 SVGPathElement* SVGMPathElement::pathElement()
 {
-    Element* target = document()->getElementById(getTarget(SVGURIReference::href()));
+    Element* target = document()->getElementById(getTarget(href()));
     if (target && target->hasTagName(SVGNames::pathTag))
         return static_cast<SVGPathElement*>(target);
     return 0;
diff --git a/WebCore/svg/SVGMPathElement.h b/WebCore/svg/SVGMPathElement.h
index 988cead..463542f 100644
--- a/WebCore/svg/SVGMPathElement.h
+++ b/WebCore/svg/SVGMPathElement.h
@@ -31,8 +31,8 @@ namespace WebCore {
     class SVGPathElement;
     
     class SVGMPathElement : public SVGElement,
-                                   SVGURIReference,
-                                   SVGExternalResourcesRequired {
+                            public SVGURIReference,
+                            public SVGExternalResourcesRequired {
     public:
         SVGMPathElement(const QualifiedName&, Document*);
         virtual ~SVGMPathElement();
@@ -43,6 +43,9 @@ namespace WebCore {
         
     protected:
         virtual const SVGElement* contextElement() const { return this; }
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href) 
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 6b75527..ea11b4a 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -55,6 +55,7 @@ SVGMaskElement::SVGMaskElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight, "-10%")
     , m_width(this, SVGNames::widthAttr, LengthModeWidth, "120%")
     , m_height(this, SVGNames::heightAttr, LengthModeHeight, "120%")
+    , m_href(this, XLinkNames::hrefAttr)
 {
     // Spec: If the x/y attribute is not specified, the effect is as if a value of "-10%" were specified.
     // Spec: If the width/height attribute is not specified, the effect is as if a value of "120%" were specified.
diff --git a/WebCore/svg/SVGMaskElement.h b/WebCore/svg/SVGMaskElement.h
index f2b7ae5..a152093 100644
--- a/WebCore/svg/SVGMaskElement.h
+++ b/WebCore/svg/SVGMaskElement.h
@@ -65,6 +65,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGNames::maskTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGMaskElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         RefPtr<SVGResourceMasker> m_masker;
     };
 
diff --git a/WebCore/svg/SVGNumberList.cpp b/WebCore/svg/SVGNumberList.cpp
index be1e895..4e904f4 100644
--- a/WebCore/svg/SVGNumberList.cpp
+++ b/WebCore/svg/SVGNumberList.cpp
@@ -41,6 +41,7 @@ SVGNumberList::~SVGNumberList()
 void SVGNumberList::parse(const String& value)
 {
     ExceptionCode ec = 0;
+    clear(ec);
 
     float number = 0.0f;
    
diff --git a/WebCore/svg/SVGParserUtilities.cpp b/WebCore/svg/SVGParserUtilities.cpp
index 6f696e6..c05e0f8 100644
--- a/WebCore/svg/SVGParserUtilities.cpp
+++ b/WebCore/svg/SVGParserUtilities.cpp
@@ -509,8 +509,8 @@ bool SVGPathParser::parseSVG(const String& s, bool process)
             return true;
 
         // Check for remaining coordinates in the current command.
-        if ((*ptr == '+' || *ptr == '-' || (*ptr >= '0' && *ptr <= '9')) &&
-            (command != 'z' && command != 'Z')) {
+        if ((*ptr == '+' || *ptr == '-' || *ptr == '.' || (*ptr >= '0' && *ptr <= '9'))
+            && (command != 'z' && command != 'Z')) {
             if (command == 'M')
                 command = 'L';
             else if (command == 'm')
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index befca85..ef2b29e 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -64,6 +64,7 @@ SVGPatternElement::SVGPatternElement(const QualifiedName& tagName, Document* doc
     , m_patternUnits(this, SVGNames::patternUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX)
     , m_patternContentUnits(this, SVGNames::patternContentUnitsAttr, SVGUnitTypes::SVG_UNIT_TYPE_USERSPACEONUSE)
     , m_patternTransform(this, SVGNames::patternTransformAttr, SVGTransformList::create(SVGNames::patternTransformAttr))
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGPatternElement.h b/WebCore/svg/SVGPatternElement.h
index 2e6399c..46b031e 100644
--- a/WebCore/svg/SVGPatternElement.h
+++ b/WebCore/svg/SVGPatternElement.h
@@ -70,6 +70,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternContentUnitsAttrString, int, PatternContentUnits, patternContentUnits)
         ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGNames::patternTagString, SVGNames::patternTransformAttrString, SVGTransformList, PatternTransform, patternTransform)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGPatternElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
         mutable RefPtr<SVGPaintServerPattern> m_resource;
 
     private:
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index fcecd8c..29e72b8 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -307,15 +307,14 @@ void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
         renderer()->setNeedsLayout(true);
 }
 
-unsigned long SVGSVGElement::suspendRedraw(unsigned long /* max_wait_milliseconds */)
+unsigned SVGSVGElement::suspendRedraw(unsigned /* maxWaitMilliseconds */)
 {
     // FIXME: Implement me (see bug 11275)
     return 0;
 }
 
-void SVGSVGElement::unsuspendRedraw(unsigned long /* suspend_handle_id */, ExceptionCode&)
+void SVGSVGElement::unsuspendRedraw(unsigned /* suspendHandleId */)
 {
-    // if suspend_handle_id is not found, throw exception
     // FIXME: Implement me (see bug 11275)
 }
 
diff --git a/WebCore/svg/SVGSVGElement.h b/WebCore/svg/SVGSVGElement.h
index f92ed72..223ebf6 100644
--- a/WebCore/svg/SVGSVGElement.h
+++ b/WebCore/svg/SVGSVGElement.h
@@ -94,8 +94,8 @@ namespace WebCore {
         float getCurrentTime() const;
         void setCurrentTime(float seconds);
 
-        unsigned long suspendRedraw(unsigned long max_wait_milliseconds);
-        void unsuspendRedraw(unsigned long suspend_handle_id, ExceptionCode&);
+        unsigned suspendRedraw(unsigned maxWaitMilliseconds);
+        void unsuspendRedraw(unsigned suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
 
diff --git a/WebCore/svg/SVGSVGElement.idl b/WebCore/svg/SVGSVGElement.idl
index 32b4e3c..b188894 100644
--- a/WebCore/svg/SVGSVGElement.idl
+++ b/WebCore/svg/SVGSVGElement.idl
@@ -56,8 +56,7 @@ module svg {
         readonly attribute SVGPoint currentTranslate;
 
         unsigned long suspendRedraw(in unsigned long maxWaitMilliseconds);
-        void unsuspendRedraw(in unsigned long suspendHandleId)
-            setter raises(DOMException);
+        void unsuspendRedraw(in unsigned long suspendHandleId);
         void unsuspendRedrawAll();
         void forceRedraw();
         void pauseAnimations();
diff --git a/WebCore/svg/SVGScriptElement.cpp b/WebCore/svg/SVGScriptElement.cpp
index 2ecf912..5e946ce 100644
--- a/WebCore/svg/SVGScriptElement.cpp
+++ b/WebCore/svg/SVGScriptElement.cpp
@@ -26,6 +26,7 @@
 #include "SVGScriptElement.h"
 
 #include "Document.h"
+#include "Event.h"
 #include "EventNames.h"
 #include "MappedAttribute.h"
 #include "SVGNames.h"
@@ -36,6 +37,7 @@ SVGScriptElement::SVGScriptElement(const QualifiedName& tagName, Document* doc,
     : SVGElement(tagName, doc)
     , SVGURIReference()
     , SVGExternalResourcesRequired()
+    , m_href(this, XLinkNames::hrefAttr)
     , m_data(this, this)
 {
     m_data.setCreatedByParser(createdByParser);
@@ -209,7 +211,7 @@ void SVGScriptElement::dispatchLoadEvent()
 
 void SVGScriptElement::dispatchErrorEvent()
 {
-    dispatchEvent(eventNames().errorEvent, true, false);
+    dispatchEvent(Event::create(eventNames().errorEvent, true, false));
 }
 
 }
diff --git a/WebCore/svg/SVGScriptElement.h b/WebCore/svg/SVGScriptElement.h
index f2efc8e..0fd85ff 100644
--- a/WebCore/svg/SVGScriptElement.h
+++ b/WebCore/svg/SVGScriptElement.h
@@ -73,6 +73,10 @@ namespace WebCore {
         virtual void dispatchErrorEvent();
 
     private:
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGScriptElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
+    private:
         ScriptElementData m_data;
         String m_type;
     };
diff --git a/WebCore/svg/SVGStopElement.h b/WebCore/svg/SVGStopElement.h
index bbfd770..5d14a40 100644
--- a/WebCore/svg/SVGStopElement.h
+++ b/WebCore/svg/SVGStopElement.h
@@ -2,8 +2,6 @@
     Copyright (C) 2004, 2005, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006 Rob Buis <buis@kde.org>
 
-    This file is part of the KDE project
-
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ -24,6 +22,7 @@
 #define SVGStopElement_h
 
 #if ENABLE(SVG)
+#include "SVGNames.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
@@ -33,13 +32,13 @@ namespace WebCore {
         SVGStopElement(const QualifiedName&, Document*);
         virtual ~SVGStopElement();
 
+    private:
         virtual bool isGradientStop() const { return true; }
 
         virtual void parseMappedAttribute(MappedAttribute*);
 
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
-    private:
         ANIMATED_PROPERTY_DECLARATIONS(SVGStopElement, SVGNames::stopTagString, SVGNames::offsetAttrString, float, Offset, offset)
     };
 
diff --git a/WebCore/svg/SVGStyleElement.cpp b/WebCore/svg/SVGStyleElement.cpp
index 72f70e6..31f5920 100644
--- a/WebCore/svg/SVGStyleElement.cpp
+++ b/WebCore/svg/SVGStyleElement.cpp
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005 Nikolas Zimmermann <wildfox@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
     Copyright (C) 2006 Apple Computer, Inc.
+    Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 
     This file is part of the KDE project
 
@@ -29,31 +30,21 @@
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "ExceptionCode.h"
-#include "HTMLNames.h"
 #include "MappedAttribute.h"
-#include "XMLNames.h"
+#include "SVGNames.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-using namespace HTMLNames;
+using namespace SVGNames;
 
 SVGStyleElement::SVGStyleElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
      : SVGElement(tagName, doc)
+     , SVGLangSpace()
      , m_createdByParser(createdByParser)
 {
 }
 
-const AtomicString& SVGStyleElement::xmlspace() const
-{
-    return getAttribute(XMLNames::spaceAttr);
-}
-
-void SVGStyleElement::setXmlspace(const AtomicString&, ExceptionCode& ec)
-{
-    ec = NO_MODIFICATION_ALLOWED_ERR;
-}
-
 const AtomicString& SVGStyleElement::type() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, defaultValue, ("text/css"));
@@ -61,9 +52,9 @@ const AtomicString& SVGStyleElement::type() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setType(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setType(const AtomicString& type, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(typeAttr, type, ec);
 }
 
 const AtomicString& SVGStyleElement::media() const
@@ -73,9 +64,9 @@ const AtomicString& SVGStyleElement::media() const
     return n.isNull() ? defaultValue : n;
 }
 
-void SVGStyleElement::setMedia(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setMedia(const AtomicString& media, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(mediaAttr, media, ec);
 }
 
 String SVGStyleElement::title() const
@@ -83,17 +74,20 @@ String SVGStyleElement::title() const
     return getAttribute(titleAttr);
 }
 
-void SVGStyleElement::setTitle(const AtomicString&, ExceptionCode& ec)
+void SVGStyleElement::setTitle(const AtomicString& title, ExceptionCode& ec)
 {
-    ec = NO_MODIFICATION_ALLOWED_ERR;
+    setAttribute(titleAttr, title, ec);
 }
 
 void SVGStyleElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
-    else
+    else {
+        if (SVGLangSpace::parseMappedAttribute(attr))
+            return;
         SVGElement::parseMappedAttribute(attr);
+    }
 }
 
 void SVGStyleElement::finishParsingChildren()
diff --git a/WebCore/svg/SVGStyleElement.h b/WebCore/svg/SVGStyleElement.h
index 48afdb1..3853fb3 100644
--- a/WebCore/svg/SVGStyleElement.h
+++ b/WebCore/svg/SVGStyleElement.h
@@ -25,11 +25,14 @@
 #if ENABLE(SVG)
 
 #include <SVGElement.h>
+#include "SVGLangSpace.h"
 #include "StyleElement.h"
 
 namespace WebCore {
 
-    class SVGStyleElement : public SVGElement, public StyleElement {
+    class SVGStyleElement : public SVGElement,
+                            public SVGLangSpace,
+                            public StyleElement {
     public:
         SVGStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
@@ -41,10 +44,6 @@ namespace WebCore {
 
         virtual void finishParsingChildren();
 
-        // 'SVGStyleElement' functions
-        const AtomicString& xmlspace() const;
-        void setXmlspace(const AtomicString&, ExceptionCode&);
-
         virtual bool sheetLoaded();
 
         virtual const AtomicString& type() const;
diff --git a/WebCore/svg/SVGStyleElement.idl b/WebCore/svg/SVGStyleElement.idl
index e87b79f..e47ed1d 100644
--- a/WebCore/svg/SVGStyleElement.idl
+++ b/WebCore/svg/SVGStyleElement.idl
@@ -26,9 +26,8 @@
 
 module svg {
 
-    interface [Conditional=SVG] SVGStyleElement : SVGElement {
-                 attribute core::DOMString xmlspace
-                     setter raises(DOMException);
+    interface [Conditional=SVG] SVGStyleElement : SVGElement,
+                                                  SVGLangSpace {
                  attribute core::DOMString type
                      setter raises(DOMException);
                  attribute core::DOMString media
diff --git a/WebCore/svg/SVGTRefElement.cpp b/WebCore/svg/SVGTRefElement.cpp
index 872e7c8..5b8640a 100644
--- a/WebCore/svg/SVGTRefElement.cpp
+++ b/WebCore/svg/SVGTRefElement.cpp
@@ -35,6 +35,7 @@ namespace WebCore {
 SVGTRefElement::SVGTRefElement(const QualifiedName& tagName, Document* doc)
     : SVGTextPositioningElement(tagName, doc)
     , SVGURIReference()
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGTRefElement.h b/WebCore/svg/SVGTRefElement.h
index 88eeef1..63f5fac 100644
--- a/WebCore/svg/SVGTRefElement.h
+++ b/WebCore/svg/SVGTRefElement.h
@@ -45,6 +45,9 @@ namespace WebCore {
 
     private:
         void updateReferencedText();
+
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTRefElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index 54a4aa2..ebbb628 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -41,6 +41,7 @@ SVGTextPathElement::SVGTextPathElement(const QualifiedName& tagName, Document* d
     , m_startOffset(this, SVGNames::startOffsetAttr, LengthModeOther)
     , m_method(this, SVGNames::methodAttr, SVG_TEXTPATH_METHODTYPE_ALIGN)
     , m_spacing(this, SVGNames::spacingAttr, SVG_TEXTPATH_SPACINGTYPE_EXACT)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGTextPathElement.h b/WebCore/svg/SVGTextPathElement.h
index 4e8899a..3266814 100644
--- a/WebCore/svg/SVGTextPathElement.h
+++ b/WebCore/svg/SVGTextPathElement.h
@@ -71,6 +71,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::startOffsetAttrString, SVGLength, StartOffset, startOffset)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::methodAttrString, int, Method, method)
         ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGNames::textPathTagString, SVGNames::spacingAttrString, int, Spacing, spacing)
+    
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGTextPathElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGURIReference.cpp b/WebCore/svg/SVGURIReference.cpp
index 8871229..24febc3 100644
--- a/WebCore/svg/SVGURIReference.cpp
+++ b/WebCore/svg/SVGURIReference.cpp
@@ -30,7 +30,6 @@ namespace WebCore {
 char SVGURIReferenceIdentifier[] = "SVGURIReference";
 
 SVGURIReference::SVGURIReference()
-    : m_href(this, XLinkNames::hrefAttr)
 {
 }
 
diff --git a/WebCore/svg/SVGURIReference.h b/WebCore/svg/SVGURIReference.h
index 35ac640..812fb59 100644
--- a/WebCore/svg/SVGURIReference.h
+++ b/WebCore/svg/SVGURIReference.h
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
+    Copyright (C) 2004, 2005, 2008, 2009 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
 
     This file is part of the KDE project
@@ -42,10 +42,8 @@ namespace WebCore {
 
         static String getTarget(const String& url);
 
-        virtual const SVGElement* contextElement() const = 0;
-
-    private:
-        ANIMATED_PROPERTY_DECLARATIONS(SVGURIReference, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+    protected:
+        virtual void setHrefBaseValue(SVGAnimatedTypeValue<String>::DecoratedType type) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index b73a692..8a2d65f 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -1,6 +1,7 @@
 /*
     Copyright (C) 2004, 2005, 2006, 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
+    Copyright (C) Research In Motion Limited 2009. All rights reserved.
 
     This file is part of the KDE project
 
@@ -64,6 +65,7 @@ SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* doc)
     , m_y(this, SVGNames::yAttr, LengthModeHeight)
     , m_width(this, SVGNames::widthAttr, LengthModeWidth)
     , m_height(this, SVGNames::heightAttr, LengthModeHeight)
+    , m_href(this, XLinkNames::hrefAttr)
 {
 }
 
@@ -158,6 +160,9 @@ void SVGUseElement::childrenChanged(bool changedByParser, Node* beforeChange, No
  
 static bool shadowTreeContainsChangedNodes(SVGElementInstance* target)
 {
+    if (!target)      // when use is referencing an non-existing element, there will be no Instance tree built
+        return false;
+
     if (target->needsUpdate())
         return true;
 
@@ -324,7 +329,7 @@ void SVGUseElement::buildPendingResource()
     // Spec: If the 'use' element references a simple graphics element such as a 'rect', then there is only a
     // single SVGElementInstance object, and the correspondingElement attribute on this SVGElementInstance object
     // is the SVGRectElement that corresponds to the referenced 'rect' element.
-    m_targetElementInstance = new SVGElementInstance(this, target);
+    m_targetElementInstance = SVGElementInstance::create(this, target);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
     bool foundProblem = false;
@@ -474,17 +479,17 @@ void SVGUseElement::buildInstanceTree(SVGElement* target, SVGElementInstance* ta
             continue;
 
         // Create SVGElementInstance object, for both container/non-container nodes.
-        SVGElementInstance* instancePtr = new SVGElementInstance(this, element);
-        targetInstance->appendChild(instancePtr);
+        RefPtr<SVGElementInstance> instancePtr = SVGElementInstance::create(this, element);
+        targetInstance->appendChild(instancePtr.get());
 
         // Enter recursion, appending new instance tree nodes to the "instance" object.
         if (element->hasChildNodes())
-            buildInstanceTree(element, instancePtr, foundProblem);
+            buildInstanceTree(element, instancePtr.get(), foundProblem);
 
         // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
         // object, the instance tree will contain recursive expansion of the indirect references to form a complete tree.
         if (element->hasTagName(SVGNames::useTag))
-            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr, foundProblem);
+            handleDeepUseReferencing(static_cast<SVGUseElement*>(element), instancePtr.get(), foundProblem);
     }
 
     // Spec: If the referenced object is itself a 'use', or if there are 'use' subelements within the referenced
@@ -524,11 +529,11 @@ void SVGUseElement::handleDeepUseReferencing(SVGUseElement* use, SVGElementInsta
     }
 
     // Create an instance object, even if we're dealing with a cycle
-    SVGElementInstance* newInstance = new SVGElementInstance(this, target);
+    RefPtr<SVGElementInstance> newInstance = SVGElementInstance::create(this, target);
     targetInstance->appendChild(newInstance);
 
     // Eventually enter recursion to build SVGElementInstance objects for the sub-tree children
-    buildInstanceTree(target, newInstance, foundProblem);
+    buildInstanceTree(target, newInstance.get(), foundProblem);
 }
 
 void SVGUseElement::alterShadowTreeForSVGTag(SVGElement* target)
@@ -768,18 +773,18 @@ void SVGUseElement::transferEventListenersToShadowTree(SVGElementInstance* targe
     ASSERT(originalElement);
 
     if (SVGElement* shadowTreeElement = target->shadowTreeElement()) {
-        const RegisteredEventListenerVector& listeners = originalElement->eventListeners();
-        size_t size = listeners.size();
-        for (size_t i = 0; i < size; ++i) {
-            const RegisteredEventListener& r = *listeners[i];
-            EventListener* listener = r.listener();
-            ASSERT(listener);
-
-            // Event listeners created from markup have already been transfered to the shadow tree during cloning!
-            if (listener->wasCreatedFromMarkup())
-                continue;
-
-            shadowTreeElement->addEventListener(r.eventType(), listener, r.useCapture());
+        if (EventTargetData* d = originalElement->eventTargetData()) {
+            EventListenerMap& map = d->eventListenerMap;
+            EventListenerMap::iterator end = map.end();
+            for (EventListenerMap::iterator it = map.begin(); it != end; ++it) {
+                EventListenerVector& entry = it->second;
+                for (size_t i = 0; i < entry.size(); ++i) {
+                    // Event listeners created from markup have already been transfered to the shadow tree during cloning.
+                    if (entry[i].listener->wasCreatedFromMarkup())
+                        continue;
+                    shadowTreeElement->addEventListener(it->first, entry[i].listener, entry[i].useCapture);
+                }
+            }
         }
     }
 
diff --git a/WebCore/svg/SVGUseElement.h b/WebCore/svg/SVGUseElement.h
index 1e5b81c..3eedf21 100644
--- a/WebCore/svg/SVGUseElement.h
+++ b/WebCore/svg/SVGUseElement.h
@@ -77,6 +77,9 @@ namespace WebCore {
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::widthAttrString, SVGLength, Width, width)
         ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGNames::useTagString, SVGNames::heightAttrString, SVGLength, Height, height)
 
+        // SVGURIReference
+        ANIMATED_PROPERTY_DECLARATIONS(SVGUseElement, SVGURIReferenceIdentifier, XLinkNames::hrefAttrString, String, Href, href)
+
     private:
         // Instance tree handling
         void buildInstanceTree(SVGElement* target, SVGElementInstance* targetInstance, bool& foundCycle);
diff --git a/WebCore/svg/animation/SVGSMILElement.cpp b/WebCore/svg/animation/SVGSMILElement.cpp
index 63a0d82..3957b81 100644
--- a/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/WebCore/svg/animation/SVGSMILElement.cpp
@@ -61,6 +61,15 @@ public:
         return adoptRef(new ConditionEventListener(animation, eventBase, condition));
     }
 
+    static const ConditionEventListener* cast(const EventListener* listener)
+    {
+        return listener->type() == ConditionEventListenerType
+            ? static_cast<const ConditionEventListener*>(listener)
+            : 0;
+    }
+
+    virtual bool operator==(const EventListener& other);
+
     void unregister()
     {
         // If this has only one ref then the event base is dead already and we don't need to remove ourself.
@@ -68,25 +77,37 @@ public:
             m_eventBase->removeEventListener(m_condition->m_name, this, false);
     }
 
-    virtual void handleEvent(Event* event, bool) 
-    {
-        m_animation->handleConditionEvent(event, m_condition);
-    }
-
 private:
     ConditionEventListener(SVGSMILElement* animation, Element* eventBase, SVGSMILElement::Condition* condition) 
-        : m_animation(animation)
+        : EventListener(ConditionEventListenerType)
+        , m_animation(animation)
         , m_condition(condition) 
         , m_eventBase(eventBase)
     {
         m_eventBase->addEventListener(m_condition->m_name, this, false);
     }
 
+    virtual void handleEvent(ScriptExecutionContext*, Event*);
+
     SVGSMILElement* m_animation;
     SVGSMILElement::Condition* m_condition;
     Element* m_eventBase;
 };
-    
+
+bool ConditionEventListener::operator==(const EventListener& listener)
+{
+    if (const ConditionEventListener* conditionEventListener = ConditionEventListener::cast(&listener))
+        return m_animation == conditionEventListener->m_animation
+               && m_condition == conditionEventListener->m_condition
+               && m_eventBase == conditionEventListener->m_eventBase;
+    return false;
+}
+
+void ConditionEventListener::handleEvent(ScriptExecutionContext*, Event* event) 
+{
+    m_animation->handleConditionEvent(event, m_condition);
+}
+
 SVGSMILElement::Condition::Condition(Type type, BeginOrEnd beginOrEnd, const String& baseID, const String& name, SMILTime offset, int repeats)
     : m_type(type)
     , m_beginOrEnd(beginOrEnd)
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 64eb0e7..dc63582 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -228,26 +228,35 @@ bool SVGImage::dataChanged(bool allDataReceived)
     if (allDataReceived) {
         static FrameLoaderClient* dummyFrameLoaderClient =  new EmptyFrameLoaderClient;
         static EditorClient* dummyEditorClient = new EmptyEditorClient;
+#if ENABLE(CONTEXT_MENUS)
         static ContextMenuClient* dummyContextMenuClient = new EmptyContextMenuClient;
+#else
+        static ContextMenuClient* dummyContextMenuClient = 0;
+#endif
+#if ENABLE(DRAG_SUPPORT)
         static DragClient* dummyDragClient = new EmptyDragClient;
+#else
+        static DragClient* dummyDragClient = 0;
+#endif
         static InspectorClient* dummyInspectorClient = new EmptyInspectorClient;
+        static PluginHalterClient* dummyPluginHalterClient = new EmptyPluginHalterClient;
 
         m_chromeClient.set(new SVGImageChromeClient(this));
         
         // FIXME: If this SVG ends up loading itself, we might leak the world.
-        // THe comment said that the Cache code does not know about CachedImages
+        // The comment said that the Cache code does not know about CachedImages
         // holding Frames and won't know to break the cycle. But 
-        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient));
+        m_page.set(new Page(m_chromeClient.get(), dummyContextMenuClient, dummyEditorClient, dummyDragClient, dummyInspectorClient, dummyPluginHalterClient));
         m_page->settings()->setJavaScriptEnabled(false);
         m_page->settings()->setPluginsEnabled(false);
 
         RefPtr<Frame> frame = Frame::create(m_page.get(), 0, dummyFrameLoaderClient);
         frame->setView(FrameView::create(frame.get()));
         frame->init();
-        ResourceRequest fakeRequest(KURL(""));
+        ResourceRequest fakeRequest(KURL(ParsedURLString, ""));
         FrameLoader* loader = frame->loader();
         loader->load(fakeRequest, false); // Make sure the DocumentLoader is created
-        loader->cancelContentPolicyCheck(); // cancel any policy checks
+        loader->policyChecker()->cancelCheck(); // cancel any policy checks
         loader->commitProvisionalLoad(0);
         loader->setResponseMIMEType("image/svg+xml");
         loader->begin(KURL()); // create the empty document
diff --git a/WebCore/svg/graphics/SVGResourceMasker.cpp b/WebCore/svg/graphics/SVGResourceMasker.cpp
index d6c401b..97467c1 100644
--- a/WebCore/svg/graphics/SVGResourceMasker.cpp
+++ b/WebCore/svg/graphics/SVGResourceMasker.cpp
@@ -76,8 +76,8 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
     if (!luminancedImage)
         return;
 
-    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getImageData(intImageRect)->data());
-    PassRefPtr<ImageData> destImageData(luminancedImage->getImageData(intImageRect));
+    PassRefPtr<CanvasPixelArray> srcPixelArray(m_mask->getUnmultipliedImageData(intImageRect)->data());
+    PassRefPtr<ImageData> destImageData(luminancedImage->getUnmultipliedImageData(intImageRect));
 
     for (unsigned pixelOffset = 0; pixelOffset < srcPixelArray->length(); pixelOffset++) {
         unsigned pixelByteOffset = pixelOffset * 4;
@@ -93,7 +93,7 @@ void SVGResourceMasker::applyMask(GraphicsContext* context, const FloatRect& bou
         destImageData->data()->set(pixelByteOffset + 3, luma);
     }
 
-    luminancedImage->putImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
+    luminancedImage->putUnmultipliedImageData(destImageData.get(), intImageRect, IntPoint(0, 0));
 
     context->clipToImageBuffer(m_maskRect, luminancedImage.get());
 }
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 6ac430d..471c77b 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -3,114 +3,111 @@ namespaceURI="http://www.w3.org/2000/svg"
 guardFactoryWith="ENABLE(SVG)"
 exportStrings
 
-a
+a createWithNew
 #if ENABLE_SVG_FONTS
-altGlyph
+altGlyph createWithNew
 #endif
 #if 0
-altGlyphDef
-altGlyphItem
+altGlyphDef createWithNew
+altGlyphItem createWithNew
 #endif
 #if ENABLE_SVG_ANIMATION
-animate
-animateColor
-animateMotion JSInterfaceName=SVGElement
-animateTransform
-set
+animate createWithNew
+animateColor createWithNew
+animateMotion JSInterfaceName=SVGElement, createWithNew
+animateTransform createWithNew
+set createWithNew
 #endif
-circle
-clipPath
+circle createWithNew
+clipPath createWithNew
 #if 0
-color_profile
+color_profile createWithNew
 #endif
-cursor
-#if ENABLE_SVG_FONTS
-definition_src
-#endif
-defs
-desc
-ellipse
+cursor createWithNew
+defs createWithNew
+desc createWithNew
+ellipse createWithNew
 #if ENABLE_FILTERS
-feBlend
-feColorMatrix
-feComponentTransfer
-feComposite
+feBlend createWithNew
+feColorMatrix createWithNew
+feComponentTransfer createWithNew
+feComposite createWithNew
 #if 0
-feConvolveMatrix
+feConvolveMatrix createWithNew
 #endif
-feDiffuseLighting
-feDisplacementMap
-feDistantLight
-feFlood
-feFuncA
-feFuncB
-feFuncG
-feFuncR
-feGaussianBlur
-feImage
-feMerge
-feMergeNode
+feDiffuseLighting createWithNew
+feDisplacementMap createWithNew
+feDistantLight createWithNew
+feFlood createWithNew
+feFuncA createWithNew
+feFuncB createWithNew
+feFuncG createWithNew
+feFuncR createWithNew
+feGaussianBlur createWithNew
+feImage createWithNew
+feMerge createWithNew
+feMergeNode createWithNew
 #if 0
-feMorphology
+feMorphology createWithNew
 #endif
-feOffset
-fePointLight
-feSpecularLighting
-feSpotLight
-feTile
-feTurbulence
-filter
+feOffset createWithNew
+fePointLight createWithNew
+feSpecularLighting createWithNew
+feSpotLight createWithNew
+feTile createWithNew
+feTurbulence createWithNew
+filter createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-font
-font_face
-font_face_format
-font_face_name
-font_face_src
-font_face_uri
+font createWithNew
+font_face createWithNew
+font_face_format createWithNew
+font_face_name createWithNew
+font_face_src createWithNew
+font_face_uri createWithNew
 #endif
 #if ENABLE_SVG_FOREIGN_OBJECT
-foreignObject
+foreignObject createWithNew
 #endif
-g
+g createWithNew
 #if ENABLE_SVG_FONTS
-glyph
+glyph createWithNew
 #endif
 #if 0
-glyphRef
+glyphRef createWithNew
 #endif
 #if ENABLE_SVG_FONTS
-hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement
+hkern interfaceName=SVGHKernElement, JSInterfaceName=SVGElement, createWithNew
 #endif
-image
-line
-linearGradient
-marker
-mask
-metadata
+image createWithNew
+line createWithNew
+linearGradient createWithNew
+marker createWithNew
+mask createWithNew
+metadata createWithNew
 #if ENABLE_SVG_FONTS
-missing_glyph
+missing_glyph createWithNew
 #endif
-mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement
-path
-pattern
-polygon
-polyline
-radialGradient
-rect
-script constructorNeedsCreatedByParser
-stop
-style constructorNeedsCreatedByParser
-svg interfaceName=SVGSVGElement
-switch
-symbol
-text
-textPath
-title
-tref interfaceName=SVGTRefElement
-tspan interfaceName=SVGTSpanElement
-use
-view
+mpath interfaceName=SVGMPathElement, JSInterfaceName=SVGElement, createWithNew
+path createWithNew
+pattern createWithNew
+polygon createWithNew
+polyline createWithNew
+radialGradient createWithNew
+rect createWithNew
+script constructorNeedsCreatedByParser, createWithNew
+stop createWithNew
+style constructorNeedsCreatedByParser, createWithNew
+svg interfaceName=SVGSVGElement, createWithNew
+switch createWithNew
+symbol createWithNew
+text createWithNew
+textPath createWithNew
+title createWithNew
+tref interfaceName=SVGTRefElement, createWithNew
+tspan interfaceName=SVGTSpanElement, createWithNew
+use createWithNew
+view createWithNew
 #if 0
-vkern interfaceName=SVGVKernElement
+vkern interfaceName=SVGVKernElement, createWithNew
 #endif
diff --git a/WebCore/webcore-wx.bkl b/WebCore/webcore-wx.bkl
index b31a178..35ea9d4 100644
--- a/WebCore/webcore-wx.bkl
+++ b/WebCore/webcore-wx.bkl
@@ -58,7 +58,6 @@ wxWebCore port Bakefile project file.
           platform/graphics/wx/GradientWx.cpp
           platform/graphics/wx/GraphicsContextWx.cpp
           platform/graphics/wx/ImageBufferWx.cpp
-          platform/graphics/wx/ImageSourceWx.cpp
           platform/graphics/wx/ImageWx.cpp
           platform/graphics/wx/IntPointWx.cpp
           platform/graphics/wx/IntRectWx.cpp
@@ -112,17 +111,20 @@ wxWebCore port Bakefile project file.
             <if cond="WX_PORT=='gtk2'">
                 platform/wx/wxcode/gtk/fontprops.cpp
                 platform/wx/wxcode/gtk/non-kerned-drawing.cpp
+                platform/wx/wxcode/gtk/scrollbar_render.cpp
                 platform/wx/SharedTimerWx.cpp
             </if>
             <if cond="PLATFORM_OS=='mac'">
                 platform/mac/PurgeableBufferMac.cpp
                 platform/wx/wxcode/mac/carbon/fontprops.cpp
                 platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+                platform/wx/wxcode/mac/carbon/scrollbar_render.cpp
                 platform/wx/SharedTimerWx.cpp
             </if>
             <if cond="WX_PORT=='msw'">
                 platform/wx/wxcode/win/fontprops.cpp
                 platform/wx/wxcode/win/non-kerned-drawing.cpp
+                platform/wx/wxcode/win/scrollbar_render.cpp
                 <!-- grab the windows port's SharedTimer implementation -->
                 platform/win/SharedTimerWin.cpp
                 page/win/PageWin.cpp
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 999c1ff..16211a7 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -34,13 +34,58 @@
 
 #include "WebSocket.h"
 
+#include "CString.h"
+#include "DOMWindow.h"
 #include "Event.h"
 #include "EventException.h"
 #include "EventListener.h"
+#include "EventNames.h"
+#include "Logging.h"
+#include "MessageEvent.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "WebSocketChannel.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+class ProcessWebSocketEventTask : public ScriptExecutionContext::Task {
+public:
+    typedef void (WebSocket::*Method)(Event*);
+    static PassRefPtr<ProcessWebSocketEventTask> create(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
+    {
+        return adoptRef(new ProcessWebSocketEventTask(webSocket, event));
+    }
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        ExceptionCode ec = 0;
+        m_webSocket->dispatchEvent(m_event.get(), ec);
+        ASSERT(!ec);
+    }
+
+  private:
+    ProcessWebSocketEventTask(PassRefPtr<WebSocket> webSocket, PassRefPtr<Event> event)
+        : m_webSocket(webSocket)
+        , m_event(event) { }
+
+    RefPtr<WebSocket> m_webSocket;
+    RefPtr<Event> m_event;
+};
+
+static bool isValidProtocolString(const WebCore::String& protocol)
+{
+    if (protocol.isNull())
+        return true;
+    if (protocol.isEmpty())
+        return false;
+    const UChar* characters = protocol.characters();
+    for (size_t i = 0; i < protocol.length(); i++) {
+        if (characters[i] < 0x21 || characters[i] > 0x7E)
+            return false;
+    }
+    return true;
+}
+
 WebSocket::WebSocket(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(CONNECTING)
@@ -59,39 +104,49 @@ void WebSocket::connect(const KURL& url, ExceptionCode& ec)
 
 void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode& ec)
 {
+    LOG(Network, "WebSocket %p connect to %s protocol=%s", this, url.string().utf8().data(), protocol.utf8().data());
     m_url = url;
     m_protocol = protocol;
 
     if (!m_url.protocolIs("ws") && !m_url.protocolIs("wss")) {
+        LOG_ERROR("Error: wrong url for WebSocket %s", url.string().utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    if (!m_protocol.isNull() && m_protocol.isEmpty()) {
+    if (!isValidProtocolString(m_protocol)) {
+        LOG_ERROR("Error: wrong protocol for WebSocket %s", m_protocol.utf8().data());
         m_state = CLOSED;
         ec = SYNTAX_ERR;
         return;
     }
-    // FIXME: Check protocol is valid form.
-    // FIXME: Connect WebSocketChannel.
+    // FIXME: if m_url.port() is blocking port, raise SECURITY_ERR.
+
+    m_channel = WebSocketChannel::create(scriptExecutionContext(), this, m_url, m_protocol);
+    m_channel->connect();
 }
 
-bool WebSocket::send(const String&, ExceptionCode& ec)
+bool WebSocket::send(const String& message, ExceptionCode& ec)
 {
-    if (m_state != OPEN) {
+    LOG(Network, "WebSocket %p send %s", this, message.utf8().data());
+    if (m_state == CONNECTING) {
         ec = INVALID_STATE_ERR;
         return false;
     }
-    // FIXME: send message on WebSocketChannel.
-    return false;
+    // No exception is raised if the connection was once established but has subsequently been closed.
+    if (m_state == CLOSED)
+        return false;
+    // FIXME: check message is valid utf8.
+    return m_channel->send(message);
 }
 
 void WebSocket::close()
 {
+    LOG(Network, "WebSocket %p close", this);
     if (m_state == CLOSED)
         return;
     m_state = CLOSED;
-    // FIXME: close WebSocketChannel.
+    m_channel->close();
 }
 
 const KURL& WebSocket::url() const
@@ -106,7 +161,8 @@ WebSocket::State WebSocket::readyState() const
 
 unsigned long WebSocket::bufferedAmount() const
 {
-    // FIXME: ask platform code to get buffered amount to be sent.
+    if (m_state == OPEN)
+        return m_channel->bufferedAmount();
     return 0;
 }
 
@@ -115,58 +171,43 @@ ScriptExecutionContext* WebSocket::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-void WebSocket::addEventListener(const AtomicString&, PassRefPtr<EventListener>, bool)
-{
-    // FIXME: implement this.
-}
-
-void WebSocket::removeEventListener(const AtomicString&, EventListener*, bool)
-{
-    // FIXME: implement this.
-}
-
-bool WebSocket::dispatchEvent(PassRefPtr<Event>, ExceptionCode&)
-{
-    // FIXME: implement this.
-    return false;
-}
-
 void WebSocket::didConnect()
 {
+    LOG(Network, "WebSocket %p didConnect", this);
     if (m_state != CONNECTING) {
         didClose();
         return;
     }
     m_state = OPEN;
-    dispatchOpenEvent();
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().openEvent, false, false)));
 }
 
 void WebSocket::didReceiveMessage(const String& msg)
 {
+    LOG(Network, "WebSocket %p didReceiveMessage %s", this, msg.utf8().data());
     if (m_state != OPEN)
         return;
-    dispatchMessageEvent(msg);
+    RefPtr<MessageEvent> evt = MessageEvent::create();
+    // FIXME: origin, lastEventId, source, messagePort.
+    evt->initMessageEvent(eventNames().messageEvent, false, false, SerializedScriptValue::create(msg), "", "", 0, 0);
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, evt));
 }
 
 void WebSocket::didClose()
 {
+    LOG(Network, "WebSocket %p didClose", this);
     m_state = CLOSED;
-    dispatchCloseEvent();
-}
-
-void WebSocket::dispatchOpenEvent()
-{
-    // FIXME: implement this.
+    scriptExecutionContext()->postTask(ProcessWebSocketEventTask::create(this, Event::create(eventNames().closeEvent, false, false)));
 }
 
-void WebSocket::dispatchMessageEvent(const String&)
+EventTargetData* WebSocket::eventTargetData()
 {
-    // FIXME: implement this.
+    return &m_eventTargetData;
 }
 
-void WebSocket::dispatchCloseEvent()
+EventTargetData* WebSocket::ensureEventTargetData()
 {
-    // FIXME: implement this.
+    return &m_eventTargetData;
 }
 
 }  // namespace WebCore
diff --git a/WebCore/websockets/WebSocket.h b/WebCore/websockets/WebSocket.h
index 485e2cc..c5b7ee7 100644
--- a/WebCore/websockets/WebSocket.h
+++ b/WebCore/websockets/WebSocket.h
@@ -31,93 +31,92 @@
 #ifndef WebSocket_h
 #define WebSocket_h
 
+#if ENABLE(WEB_SOCKETS)
+
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "KURL.h"
+#include "WebSocketChannelClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-class String;
-
-class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject {
-public:
-    static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
-    virtual ~WebSocket();
-
-    enum State {
-        CONNECTING = 0,
-        OPEN = 1,
-        CLOSED = 2
-    };
+    class String;
+    class WebSocketChannel;
 
-    void connect(const KURL& url, ExceptionCode&);
-    void connect(const KURL& url, const String& protocol, ExceptionCode&);
+    class WebSocket : public RefCounted<WebSocket>, public EventTarget, public ActiveDOMObject, public WebSocketChannelClient {
+    public:
+        static PassRefPtr<WebSocket> create(ScriptExecutionContext* context) { return adoptRef(new WebSocket(context)); }
+        virtual ~WebSocket();
 
-    bool send(const String& message, ExceptionCode&);
+        enum State {
+            CONNECTING = 0,
+            OPEN = 1,
+            CLOSED = 2
+        };
 
-    void close();
+        void connect(const KURL&, ExceptionCode&);
+        void connect(const KURL&, const String& protocol, ExceptionCode&);
 
-    const KURL& url() const;
-    State readyState() const;
-    unsigned long bufferedAmount() const;
+        bool send(const String& message, ExceptionCode&);
 
-    void setOnopen(PassRefPtr<EventListener> eventListener) { m_onopen = eventListener; }
-    EventListener* onopen() const { return m_onopen.get(); }
-    void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessage = eventListener; }
-    EventListener* onmessage() const { return m_onmessage.get(); }
-    void setOnclose(PassRefPtr<EventListener> eventListener) { m_onclose = eventListener; }
-    EventListener* onclose() const { return m_onclose.get(); }
+        void close();
 
-    // EventTarget
-    virtual WebSocket* toWebSocket() { return this; }
+        const KURL& url() const;
+        State readyState() const;
+        unsigned long bufferedAmount() const;
 
-    virtual ScriptExecutionContext* scriptExecutionContext() const;
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(open);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(close);
 
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+        // EventTarget
+        virtual WebSocket* toWebSocket() { return this; }
 
-    // ActiveDOMObject
-    // virtual bool hasPendingActivity() const;
-    // virtual void contextDestroyed();
-    // virtual bool canSuspend() const;
-    // virtual void suspend();
-    // virtual void resume();
-    // virtual void stop();
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-    using RefCounted<WebSocket>::ref;
-    using RefCounted<WebSocket>::deref;
+        // ActiveDOMObject
+        //  virtual bool hasPendingActivity() const;
+        // virtual void contextDestroyed();
+        // virtual bool canSuspend() const;
+        // virtual void suspend();
+        // virtual void resume();
+        // virtual void stop();
 
-private:
-    WebSocket(ScriptExecutionContext*);
+        using RefCounted<WebSocket>::ref;
+        using RefCounted<WebSocket>::deref;
 
-    virtual void refEventTarget() { ref(); }
-    virtual void derefEventTarget() { deref(); }
+        // WebSocketChannelClient
+        virtual void didConnect();
+        virtual void didReceiveMessage(const String& msg);
+        virtual void didClose();
 
-    // WebSocketChannelClient
-    void didConnect();
-    void didReceiveMessage(const String& msg);
-    void didClose();
+    private:
+        WebSocket(ScriptExecutionContext*);
 
-    void dispatchOpenEvent();
-    void dispatchMessageEvent(const String& msg);
-    void dispatchCloseEvent();
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
-    // FIXME: add WebSocketChannel.
+        void dispatchOpenEvent(Event*);
+        void dispatchMessageEvent(Event*);
+        void dispatchCloseEvent(Event*);
 
-    RefPtr<EventListener> m_onopen;
-    RefPtr<EventListener> m_onmessage;
-    RefPtr<EventListener> m_onclose;
+        RefPtr<WebSocketChannel> m_channel;
 
-    State m_state;
-    KURL m_url;
-    String m_protocol;
-};
+        State m_state;
+        KURL m_url;
+        String m_protocol;
+        EventTargetData m_eventTargetData;
+    };
 
 }  // namespace WebCore
 
+#endif  // ENABLE(WEB_SOCKETS)
+
 #endif  // WebSocket_h
diff --git a/WebCore/websockets/WebSocket.idl b/WebCore/websockets/WebSocket.idl
index cdb916f..04606fe 100644
--- a/WebCore/websockets/WebSocket.idl
+++ b/WebCore/websockets/WebSocket.idl
@@ -31,9 +31,9 @@
 module websockets {
 
     interface [
-        CustomMarkFunction,
-        NoStaticTables,
-        Conditional=WEB_SOCKETS
+        Conditional=WEB_SOCKETS,
+        EventTarget,
+        NoStaticTables
     ] WebSocket {
         readonly attribute DOMString URL;
 
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
new file mode 100644
index 0000000..145cd34
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketChannel.h"
+
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "Logging.h"
+#include "PlatformString.h"
+#include "ScriptExecutionContext.h"
+#include "SocketStreamError.h"
+#include "SocketStreamHandle.h"
+#include "StringHash.h"
+#include "WebSocketChannelClient.h"
+
+#include <wtf/Deque.h>
+#include <wtf/FastMalloc.h>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+WebSocketChannel::WebSocketChannel(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol)
+    : m_context(context)
+    , m_client(client)
+    , m_handshake(url, protocol, context)
+    , m_buffer(0)
+    , m_bufferSize(0)
+    , m_unhandledBufferSize(0)
+{
+}
+
+WebSocketChannel::~WebSocketChannel()
+{
+    fastFree(m_buffer);
+}
+
+void WebSocketChannel::connect()
+{
+    LOG(Network, "WebSocketChannel %p connect", this);
+    ASSERT(!m_handle.get());
+    m_handshake.reset();
+    m_handle = SocketStreamHandle::create(m_handshake.url(), this);
+}
+
+bool WebSocketChannel::send(const String& msg)
+{
+    LOG(Network, "WebSocketChannel %p send %s", this, msg.utf8().data());
+    Vector<char> buf;
+    buf.append('\0');  // frame type
+    buf.append(msg.utf8().data(), msg.utf8().length());
+    buf.append('\xff');  // frame end
+    if (!m_handle.get()) {
+        m_unhandledBufferSize += buf.size();
+        return false;
+    }
+    return m_handle->send(buf.data(), buf.size());
+}
+
+unsigned long WebSocketChannel::bufferedAmount() const
+{
+    LOG(Network, "WebSocketChannel %p bufferedAmount", this);
+    if (!m_handle.get())
+        return m_unhandledBufferSize;
+    return m_handle->bufferedAmount();
+}
+
+void WebSocketChannel::close()
+{
+    LOG(Network, "WebSocketChannel %p close", this);
+    if (m_handle.get())
+        m_handle->close();  // will call didClose()
+}
+
+void WebSocketChannel::willOpenStream(SocketStreamHandle*, const KURL&)
+{
+}
+
+void WebSocketChannel::willSendData(SocketStreamHandle*, const char*, int)
+{
+}
+
+void WebSocketChannel::didOpen(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didOpen", this);
+    ASSERT(handle == m_handle.get());
+    const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
+    if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
+        LOG(Network, "Error in sending handshake message.");
+        handle->close();
+    }
+}
+
+void WebSocketChannel::didClose(SocketStreamHandle* handle)
+{
+    LOG(Network, "WebSocketChannel %p didClose", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    if (!m_handle.get())
+        return;
+    m_unhandledBufferSize = handle->bufferedAmount();
+    WebSocketChannelClient* client = m_client;
+    m_client = 0;
+    m_handle = 0;
+    client->didClose();
+}
+
+void WebSocketChannel::didReceiveData(SocketStreamHandle* handle, const char* data, int len)
+{
+    LOG(Network, "WebSocketChannel %p didReceiveData %d", this, len);
+    ASSERT(handle == m_handle.get());
+    if (!appendToBuffer(data, len)) {
+        handle->close();
+        return;
+    }
+    if (m_handshake.mode() != WebSocketHandshake::Connected) {
+        int headerLength = m_handshake.readServerHandshake(m_buffer, m_bufferSize);
+        if (headerLength <= 0)
+            return;
+        switch (m_handshake.mode()) {
+        case WebSocketHandshake::Connected:
+            if (!m_handshake.serverSetCookie().isEmpty()) {
+                if (m_context->isDocument()) {
+                    Document* document = static_cast<Document*>(m_context);
+                    if (cookiesEnabled(document))
+                        document->setCookie(m_handshake.serverSetCookie());
+                }
+            }
+            // FIXME: handle set-cookie2.
+            LOG(Network, "WebSocketChannel %p connected", this);
+            m_client->didConnect();
+            break;
+        default:
+            LOG(Network, "WebSocketChannel %p connection failed", this);
+            handle->close();
+            return;
+        }
+        skipBuffer(headerLength);
+        if (!m_buffer)
+            return;
+        LOG(Network, "remaining in read buf %ul", m_bufferSize);
+    }
+
+    const char* nextFrame = m_buffer;
+    const char* p = m_buffer;
+    const char* end = p + m_bufferSize;
+    while (p < end) {
+        unsigned char frameByte = static_cast<unsigned char>(*p++);
+        if ((frameByte & 0x80) == 0x80) {
+            int length = 0;
+            while (p < end && (*p & 0x80) == 0x80) {
+                if (length > std::numeric_limits<int>::max() / 128) {
+                    LOG(Network, "frame length overflow %d", length);
+                    handle->close();
+                    return;
+                }
+                length = length * 128 + *p & 0x7f;
+                ++p;
+            }
+            if (p + length < end) {
+                p += length;
+                nextFrame = p;
+            }
+        } else {
+            const char* msgStart = p;
+            while (p < end && *p != '\xff')
+                ++p;
+            if (p < end && *p == '\xff') {
+                if (frameByte == 0x00)
+                    m_client->didReceiveMessage(String::fromUTF8(msgStart, p - msgStart));
+                ++p;
+                nextFrame = p;
+            }
+        }
+    }
+    skipBuffer(nextFrame - m_buffer);
+}
+
+void WebSocketChannel::didFail(SocketStreamHandle* handle, const SocketStreamError&)
+{
+    LOG(Network, "WebSocketChannel %p didFail", this);
+    ASSERT(handle == m_handle.get() || !m_handle.get());
+    handle->close();
+}
+
+bool WebSocketChannel::appendToBuffer(const char* data, int len)
+{
+    char* newBuffer = 0;
+    if (tryFastMalloc(m_bufferSize + len).getValue(newBuffer)) {
+        if (m_buffer)
+            memcpy(newBuffer, m_buffer, m_bufferSize);
+        memcpy(newBuffer + m_bufferSize, data, len);
+        fastFree(m_buffer);
+        m_buffer = newBuffer;
+        m_bufferSize += len;
+        return true;
+    }
+    LOG(Network, "Too long WebSocket frame %d", m_bufferSize + len);
+    return false;
+}
+
+void WebSocketChannel::skipBuffer(int len)
+{
+    ASSERT(len <= m_bufferSize);
+    m_bufferSize -= len;
+    if (!m_bufferSize) {
+        fastFree(m_buffer);
+        m_buffer = 0;
+        return;
+    }
+    memmove(m_buffer, m_buffer + len, m_bufferSize);
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/websockets/WebSocketChannel.h b/WebCore/websockets/WebSocketChannel.h
new file mode 100644
index 0000000..75f41f6
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannel.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannel_h
+#define WebSocketChannel_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "SocketStreamHandleClient.h"
+#include "WebSocketHandshake.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class String;
+    class SocketStreamHandle;
+    class SocketStreamError;
+    class WebSocketChannelClient;
+
+    class WebSocketChannel : public RefCounted<WebSocketChannel>, public SocketStreamHandleClient {
+    public:
+        static PassRefPtr<WebSocketChannel> create(ScriptExecutionContext* context, WebSocketChannelClient* client, const KURL& url, const String& protocol) { return new WebSocketChannel(context, client, url, protocol); }
+        virtual ~WebSocketChannel();
+
+        virtual void connect();
+
+        virtual bool send(const String& msg);
+        virtual unsigned long bufferedAmount() const;
+
+        virtual void close();
+
+        virtual void willOpenStream(SocketStreamHandle*, const KURL&);
+        virtual void willSendData(SocketStreamHandle*, const char*, int);
+        virtual void didOpen(SocketStreamHandle*);
+        virtual void didClose(SocketStreamHandle*);
+        virtual void didReceiveData(SocketStreamHandle*, const char*, int);
+        virtual void didFail(SocketStreamHandle*, const SocketStreamError&);
+
+    private:
+        WebSocketChannel(ScriptExecutionContext*, WebSocketChannelClient*, const KURL&, const String&);
+
+        bool appendToBuffer(const char* data, int len);
+        void skipBuffer(int len);
+
+        ScriptExecutionContext* m_context;
+        WebSocketChannelClient* m_client;
+        WebSocketHandshake m_handshake;
+        RefPtr<SocketStreamHandle> m_handle;
+        char* m_buffer;
+        int m_bufferSize;
+        unsigned long m_unhandledBufferSize;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannel_h
diff --git a/WebCore/websockets/WebSocketChannelClient.h b/WebCore/websockets/WebSocketChannelClient.h
new file mode 100644
index 0000000..463cada
--- /dev/null
+++ b/WebCore/websockets/WebSocketChannelClient.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketChannelClient_h
+#define WebSocketChannelClient_h
+
+#if ENABLE(WEB_SOCKETS)
+
+namespace WebCore {
+
+    class WebSocketChannelClient {
+    public:
+        virtual ~WebSocketChannelClient() { }
+        virtual void didConnect() { }
+        virtual void didReceiveMessage(const String&) { }
+        virtual void didClose() { }
+
+    protected:
+        WebSocketChannelClient() { }
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketChannelClient_h
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
new file mode 100644
index 0000000..691fa1c
--- /dev/null
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketHandshake.h"
+
+#include "AtomicString.h"
+#include "CString.h"
+#include "CookieJar.h"
+#include "Document.h"
+#include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "Logging.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "StringBuilder.h"
+#include <wtf/StringExtras.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+const char webSocketServerHandshakeHeader[] = "HTTP/1.1 101 Web Socket Protocol Handshake\r\n";
+const char webSocketUpgradeHeader[] = "Upgrade: WebSocket\r\n";
+const char webSocketConnectionHeader[] = "Connection: Upgrade\r\n";
+
+static String extractResponseCode(const char* header, int len)
+{
+    const char* space1 = 0;
+    const char* space2 = 0;
+    const char* p;
+    for (p = header; p - header < len; p++) {
+        if (*p == ' ') {
+            if (!space1)
+                space1 = p;
+            else if (!space2)
+                space2 = p;
+        } else if (*p == '\n')
+            break;
+    }
+    if (p - header == len)
+        return String();
+    if (!space1 || !space2)
+        return "";
+    return String(space1 + 1, space2 - space1 - 1);
+}
+
+WebSocketHandshake::WebSocketHandshake(const KURL& url, const String& protocol, ScriptExecutionContext* context)
+    : m_url(url)
+    , m_clientProtocol(protocol)
+    , m_secure(m_url.protocolIs("wss"))
+    , m_context(context)
+    , m_mode(Incomplete)
+{
+}
+
+WebSocketHandshake::~WebSocketHandshake()
+{
+}
+
+const KURL& WebSocketHandshake::url() const
+{
+    return m_url;
+}
+
+void WebSocketHandshake::setURL(const KURL& url)
+{
+    m_url = url.copy();
+}
+
+const String WebSocketHandshake::host() const
+{
+    return m_url.host().lower();
+}
+
+const String& WebSocketHandshake::clientProtocol() const
+{
+    return m_clientProtocol;
+}
+
+void WebSocketHandshake::setClientProtocol(const String& protocol)
+{
+    m_clientProtocol = protocol;
+}
+
+bool WebSocketHandshake::secure() const
+{
+    return m_secure;
+}
+
+void WebSocketHandshake::setSecure(bool secure)
+{
+    m_secure = secure;
+}
+
+String WebSocketHandshake::clientOrigin() const
+{
+    return m_context->securityOrigin()->toString();
+}
+
+String WebSocketHandshake::clientLocation() const
+{
+    StringBuilder builder;
+    builder.append(m_secure ? "wss" : "ws");
+    builder.append("://");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append(m_url.path());
+    return builder.toString();
+}
+
+CString WebSocketHandshake::clientHandshakeMessage() const
+{
+    StringBuilder builder;
+
+    builder.append("GET ");
+    builder.append(m_url.path());
+    if (!m_url.query().isEmpty()) {
+        builder.append("?");
+        builder.append(m_url.query());
+    }
+    builder.append(" HTTP/1.1\r\n");
+    builder.append("Upgrade: WebSocket\r\n");
+    builder.append("Connection: Upgrade\r\n");
+    builder.append("Host: ");
+    builder.append(m_url.host().lower());
+    if (m_url.port()) {
+        if ((!m_secure && m_url.port() != 80) || (m_secure && m_url.port() != 443)) {
+            builder.append(":");
+            builder.append(String::number(m_url.port()));
+        }
+    }
+    builder.append("\r\n");
+    builder.append("Origin: ");
+    builder.append(clientOrigin());
+    builder.append("\r\n");
+    if (!m_clientProtocol.isEmpty()) {
+        builder.append("WebSocket-Protocol: ");
+        builder.append(m_clientProtocol);
+        builder.append("\r\n");
+    }
+    KURL url = httpURLForAuthenticationAndCookies();
+    // FIXME: set authentication information or cookies for url.
+    // Set "Authorization: <credentials>" if authentication information exists for url.
+    if (m_context->isDocument()) {
+        Document* document = static_cast<Document*>(m_context);
+        String cookie = cookies(document, url);
+        if (!cookie.isEmpty()) {
+            builder.append("Cookie: ");
+            builder.append(cookie);
+            builder.append("\r\n");
+        }
+        // Set "Cookie2: <cookie>" if cookies 2 exists for url?
+    }
+    builder.append("\r\n");
+    return builder.toString().utf8();
+}
+
+void WebSocketHandshake::reset()
+{
+    m_mode = Incomplete;
+
+    m_wsOrigin = String();
+    m_wsLocation = String();
+    m_wsProtocol = String();
+    m_setCookie = String();
+    m_setCookie2 = String();
+}
+
+int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
+{
+    m_mode = Incomplete;
+    if (len < sizeof(webSocketServerHandshakeHeader) - 1) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    if (!memcmp(header, webSocketServerHandshakeHeader, sizeof(webSocketServerHandshakeHeader) - 1))
+        m_mode = Normal;
+    else {
+        const String& code = extractResponseCode(header, len);
+        if (code.isNull()) {
+            LOG(Network, "short server handshake: %s", header);
+            return -1;
+        }
+        if (code.isEmpty()) {
+            LOG(Network, "no response code found: %s", header);
+            return len;
+        }
+        LOG(Network, "response code: %s", code.utf8().data());
+        if (code == "401") {
+            LOG(Network, "Authentication required");
+            return len;
+        } else {
+            LOG(Network, "Mismatch server handshake: %s", header);
+            return len;
+        }
+    }
+    const char* p = header + sizeof(webSocketServerHandshakeHeader) - 1;
+    const char* end = header + len + 1;
+
+    if (m_mode == Normal) {
+        size_t headerSize = end - p;
+        if (headerSize < sizeof(webSocketUpgradeHeader) - 1)
+            return 0;
+        if (memcmp(p, webSocketUpgradeHeader, sizeof(webSocketUpgradeHeader) - 1)) {
+            LOG(Network, "Bad upgrade header: %s", p);
+            return p - header + sizeof(webSocketUpgradeHeader) - 1;
+        }
+        p += sizeof(webSocketUpgradeHeader) - 1;
+
+        headerSize = end - p;
+        if (headerSize < sizeof(webSocketConnectionHeader) - 1)
+            return -1;
+        if (memcmp(p, webSocketConnectionHeader, sizeof(webSocketConnectionHeader) - 1)) {
+            LOG(Network, "Bad connection header: %s", p);
+            return p - header + sizeof(webSocketConnectionHeader) - 1;
+        }
+        p += sizeof(webSocketConnectionHeader) - 1;
+    }
+
+    if (!strnstr(p, "\r\n\r\n", end - p)) {
+        // Just hasn't been received fully yet.
+        return -1;
+    }
+    HTTPHeaderMap headers;
+    p = readHTTPHeaders(p, end, &headers);
+    if (!p) {
+        LOG(Network, "readHTTPHeaders failed");
+        m_mode = Failed;
+        return len;
+    }
+    if (!processHeaders(headers)) {
+        LOG(Network, "header process failed");
+        m_mode = Failed;
+        return p - header;
+    }
+    switch (m_mode) {
+    case Normal:
+        checkResponseHeaders();
+        break;
+    default:
+        m_mode = Failed;
+        break;
+    }
+    return p - header;
+}
+
+WebSocketHandshake::Mode WebSocketHandshake::mode() const
+{
+    return m_mode;
+}
+
+const String& WebSocketHandshake::serverWebSocketOrigin() const
+{
+    return m_wsOrigin;
+}
+
+void WebSocketHandshake::setServerWebSocketOrigin(const String& webSocketOrigin)
+{
+    m_wsOrigin = webSocketOrigin;
+}
+
+const String& WebSocketHandshake::serverWebSocketLocation() const
+{
+    return m_wsLocation;
+}
+
+void WebSocketHandshake::setServerWebSocketLocation(const String& webSocketLocation)
+{
+    m_wsLocation = webSocketLocation;
+}
+
+const String& WebSocketHandshake::serverWebSocketProtocol() const
+{
+    return m_wsProtocol;
+}
+
+void WebSocketHandshake::setServerWebSocketProtocol(const String& webSocketProtocol)
+{
+    m_wsProtocol = webSocketProtocol;
+}
+
+const String& WebSocketHandshake::serverSetCookie() const
+{
+    return m_setCookie;
+}
+
+void WebSocketHandshake::setServerSetCookie(const String& setCookie)
+{
+    m_setCookie = setCookie;
+}
+
+const String& WebSocketHandshake::serverSetCookie2() const
+{
+    return m_setCookie2;
+}
+
+void WebSocketHandshake::setServerSetCookie2(const String& setCookie2)
+{
+    m_setCookie2 = setCookie2;
+}
+
+KURL WebSocketHandshake::httpURLForAuthenticationAndCookies() const
+{
+    KURL url = m_url.copy();
+    url.setProtocol(m_secure ? "https" : "http");
+    return url;
+}
+
+const char* WebSocketHandshake::readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers)
+{
+    Vector<char> name;
+    Vector<char> value;
+    for (const char* p = start; p < end; p++) {
+        name.clear();
+        value.clear();
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                if (name.isEmpty()) {
+                    if (p + 1 < end && *(p + 1) == '\n')
+                        return p + 2;
+                    LOG(Network, "CR doesn't follow LF p=%p end=%p", p, end);
+                    return 0;
+                }
+                LOG(Network, "Unexpected CR in name");
+                return 0;
+            case '\n':
+                LOG(Network, "Unexpected LF in name");
+                return 0;
+            case ':':
+                break;
+            default:
+                if (*p >= 0x41 && *p <= 0x5a)
+                    name.append(*p + 0x20);
+                else
+                    name.append(*p);
+                continue;
+            }
+            if (*p == ':') {
+                ++p;
+                break;
+            }
+        }
+
+        for (; p < end && *p == 0x20; p++) { }
+
+        for (; p < end; p++) {
+            switch (*p) {
+            case '\r':
+                break;
+            case '\n':
+                LOG(Network, "Unexpected LF in value");
+                return 0;
+            default:
+                value.append(*p);
+            }
+            if (*p == '\r') {
+                ++p;
+                break;
+            }
+        }
+        if (p >= end || *p != '\n') {
+            LOG(Network, "CR doesn't follow LF after value p=%p end=%p", p, end);
+            return 0;
+        }
+        AtomicString nameStr(String::fromUTF8(name.data(), name.size()));
+        String valueStr = String::fromUTF8(value.data(), value.size());
+        LOG(Network, "name=%s value=%s", nameStr.string().utf8().data(), valueStr.utf8().data());
+        headers->add(nameStr, valueStr);
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool WebSocketHandshake::processHeaders(const HTTPHeaderMap& headers)
+{
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != headers.end(); ++it) {
+        switch (m_mode) {
+        case Normal:
+            if (it->first == "websocket-origin")
+                m_wsOrigin = it->second;
+            else if (it->first == "websocket-location")
+                m_wsLocation = it->second;
+            else if (it->first == "websocket-protocol")
+                m_wsProtocol = it->second;
+            else if (it->first == "set-cookie")
+                m_setCookie = it->second;
+            else if (it->first == "set-cookie2")
+                m_setCookie2 = it->second;
+            continue;
+        case Incomplete:
+        case Failed:
+        case Connected:
+            ASSERT_NOT_REACHED();
+        }
+        ASSERT_NOT_REACHED();
+    }
+    return true;
+}
+
+void WebSocketHandshake::checkResponseHeaders()
+{
+    ASSERT(m_mode == Normal);
+    m_mode = Failed;
+    if (m_wsOrigin.isNull() || m_wsLocation.isNull())
+        return;
+
+    if (clientOrigin() != m_wsOrigin) {
+        LOG(Network, "Mismatch origin: %s != %s", clientOrigin().utf8().data(), m_wsOrigin.utf8().data());
+        return;
+    }
+    if (clientLocation() != m_wsLocation) {
+        LOG(Network, "Mismatch location: %s != %s", clientLocation().utf8().data(), m_wsLocation.utf8().data());
+        return;
+    }
+    if (!m_clientProtocol.isEmpty() && m_clientProtocol != m_wsProtocol) {
+        LOG(Network, "Mismatch protocol: %s != %s", m_clientProtocol.utf8().data(), m_wsProtocol.utf8().data());
+        return;
+    }
+    m_mode = Connected;
+    return;
+}
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
diff --git a/WebCore/websockets/WebSocketHandshake.h b/WebCore/websockets/WebSocketHandshake.h
new file mode 100644
index 0000000..d5dbe68
--- /dev/null
+++ b/WebCore/websockets/WebSocketHandshake.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketHandshake_h
+#define WebSocketHandshake_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+    class ScriptExecutionContext;
+    class HTTPHeaderMap;
+
+    class WebSocketHandshake : public Noncopyable {
+    public:
+        enum Mode {
+            Incomplete, Normal, Failed, Connected
+        };
+        WebSocketHandshake(const KURL&, const String& protocol, ScriptExecutionContext*);
+        ~WebSocketHandshake();
+
+        const KURL& url() const;
+        void setURL(const KURL&);
+        const String host() const;
+
+        const String& clientProtocol() const;
+        void setClientProtocol(const String& protocol);
+
+        bool secure() const;
+        void setSecure(bool secure);
+
+        String clientOrigin() const;
+        String clientLocation() const;
+
+        CString clientHandshakeMessage() const;
+
+        void reset();
+
+        int readServerHandshake(const char* header, size_t len);
+        Mode mode() const;
+
+        const String& serverWebSocketOrigin() const;
+        void setServerWebSocketOrigin(const String& webSocketOrigin);
+
+        const String& serverWebSocketLocation() const;
+        void setServerWebSocketLocation(const String& webSocketLocation);
+
+        const String& serverWebSocketProtocol() const;
+        void setServerWebSocketProtocol(const String& webSocketProtocol);
+
+        const String& serverSetCookie() const;
+        void setServerSetCookie(const String& setCookie);
+        const String& serverSetCookie2() const;
+        void setServerSetCookie2(const String& setCookie2);
+
+    private:
+        KURL httpURLForAuthenticationAndCookies() const;
+
+        // Reads all headers except for the two predefined ones.
+        const char* readHTTPHeaders(const char* start, const char* end, HTTPHeaderMap* headers);
+        bool processHeaders(const HTTPHeaderMap& headers);
+        void checkResponseHeaders();
+
+        KURL m_url;
+        String m_clientProtocol;
+        bool m_secure;
+        ScriptExecutionContext* m_context;
+
+        Mode m_mode;
+
+        String m_wsOrigin;
+        String m_wsLocation;
+        String m_wsProtocol;
+        String m_setCookie;
+        String m_setCookie2;
+    };
+
+}  // namespace WebCore
+
+#endif  // ENABLE(WEB_SOCKETS)
+
+#endif  // WebSocketHandshake_h
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index 9c84193..074c371 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -73,17 +73,7 @@ void WMLAElement::parseMappedAttribute(MappedAttribute* attr)
 
 bool WMLAElement::supportsFocus() const
 {
-    return isFocusable() || (isLink() && document() && !document()->haveStylesheetsLoaded());
-}
-
-bool WMLAElement::isFocusable() const
-{
-    // FIXME: Even if we are not visible, we might have a child that is visible.
-    // Dave wants to fix that some day with a "has visible content" flag or the like.
-    if (!(isLink() && renderer() && renderer()->style()->visibility() == VISIBLE))
-        return false;
-
-    return true;
+    return isLink() || WMLElement::supportsFocus();
 }
 
 bool WMLAElement::isMouseFocusable() const
diff --git a/WebCore/wml/WMLAElement.h b/WebCore/wml/WMLAElement.h
index 3eece4c..7b19081 100644
--- a/WebCore/wml/WMLAElement.h
+++ b/WebCore/wml/WMLAElement.h
@@ -36,7 +36,6 @@ public:
     WMLAElement(const QualifiedName& tagName, Document*);
 
     virtual bool supportsFocus() const;
-    virtual bool isFocusable() const;
     virtual bool isMouseFocusable() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
 
diff --git a/WebCore/wml/WMLAnchorElement.cpp b/WebCore/wml/WMLAnchorElement.cpp
index 91526b9..b9b3f53 100644
--- a/WebCore/wml/WMLAnchorElement.cpp
+++ b/WebCore/wml/WMLAnchorElement.cpp
@@ -54,7 +54,7 @@ void WMLAnchorElement::defaultEventHandler(Event* event)
         shouldHandle = static_cast<KeyboardEvent*>(event)->keyIdentifier() == "Enter";
 
     if (shouldHandle && m_task) {
-        m_task->executeTask(event);
+        m_task->executeTask();
         event->setDefaultHandled();
         return;
     }
@@ -71,7 +71,7 @@ void WMLAnchorElement::registerTask(WMLTaskElement* task)
 
 void WMLAnchorElement::deregisterTask(WMLTaskElement* task)
 {
-    ASSERT(m_task == task);
+    ASSERT_UNUSED(task, m_task == task);
     m_task = 0;
 }
 
diff --git a/WebCore/wml/WMLCardElement.cpp b/WebCore/wml/WMLCardElement.cpp
index 63240f3..818b818 100644
--- a/WebCore/wml/WMLCardElement.cpp
+++ b/WebCore/wml/WMLCardElement.cpp
@@ -339,8 +339,6 @@ WMLCardElement* WMLCardElement::determineActiveCard(Document* doc)
     // Update the document title
     doc->setTitle(activeCard->title());
 
-    // Set the active activeCard in the WMLPageState object
-    pageState->setActiveCard(activeCard);
     return activeCard;
 }
 
diff --git a/WebCore/wml/WMLDoElement.cpp b/WebCore/wml/WMLDoElement.cpp
index 34be6df..38ad5dd 100644
--- a/WebCore/wml/WMLDoElement.cpp
+++ b/WebCore/wml/WMLDoElement.cpp
@@ -70,14 +70,17 @@ void WMLDoElement::defaultEventHandler(Event* event)
 
     if (m_type == "accept" || m_type == "options") {
         if (m_task)
-            m_task->executeTask(event);
+            m_task->executeTask();
     } else if (m_type == "prev") {
-        WMLPageState* pageState = wmlPageStateForDocument(document());
+        ASSERT(document()->isWMLDocument());
+        WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+        WMLPageState* pageState = wmlPageStateForDocument(document);
         if (!pageState)
             return;
-
+    
         // Stop the timer of the current card if it is active
-        if (WMLCardElement* card = pageState->activeCard()) {
+        if (WMLCardElement* card = document->activeCard()) {
             if (WMLTimerElement* eventTimer = card->eventTimer())
                 eventTimer->stop();
         }
@@ -172,7 +175,7 @@ void WMLDoElement::registerTask(WMLTaskElement* task)
 
 void WMLDoElement::deregisterTask(WMLTaskElement* task)
 {
-    ASSERT(m_task == task);
+    ASSERT_UNUSED(task, m_task == task);
     m_task = 0;
 }
 
diff --git a/WebCore/wml/WMLDocument.cpp b/WebCore/wml/WMLDocument.cpp
index f2287be..ef0bfc8 100644
--- a/WebCore/wml/WMLDocument.cpp
+++ b/WebCore/wml/WMLDocument.cpp
@@ -79,10 +79,8 @@ void WMLDocument::finishedParsing()
         return;
     }
 
-    if (m_activeCard) {
+    if (m_activeCard)
         m_activeCard->handleIntrinsicEventIfNeeded();
-        m_activeCard = 0;
-    }
 }
 
 bool WMLDocument::initialize(bool aboutToFinishParsing)
diff --git a/WebCore/wml/WMLDocument.h b/WebCore/wml/WMLDocument.h
index fb3e62e..9053518 100644
--- a/WebCore/wml/WMLDocument.h
+++ b/WebCore/wml/WMLDocument.h
@@ -34,7 +34,7 @@ class WMLDocument : public Document {
 public:
     static PassRefPtr<WMLDocument> create(Frame* frame)
     {
-        return new WMLDocument(frame);
+        return adoptRef(new WMLDocument(frame));
     }
 
     virtual ~WMLDocument();
@@ -44,6 +44,8 @@ public:
 
     bool initialize(bool aboutToFinishParsing = false);
 
+    WMLCardElement* activeCard() const { return m_activeCard; }
+
 private:
     WMLDocument(Frame*);
     WMLCardElement* m_activeCard;
diff --git a/WebCore/wml/WMLElement.cpp b/WebCore/wml/WMLElement.cpp
index a9e4b5d..50b0fe4 100644
--- a/WebCore/wml/WMLElement.cpp
+++ b/WebCore/wml/WMLElement.cpp
@@ -38,11 +38,16 @@ namespace WebCore {
 
 using namespace WMLNames;
 
-WMLElement::WMLElement(const QualifiedName& tagName, Document* doc)
-    : StyledElement(tagName, doc)
+WMLElement::WMLElement(const QualifiedName& tagName, Document* document)
+    : StyledElement(tagName, document, CreateElementZeroRefCount)
 {
 }
 
+PassRefPtr<WMLElement> WMLElement::create(const QualifiedName& tagName, Document* document)
+{
+    return new WMLElement(tagName, document);
+}
+
 bool WMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == HTMLNames::alignAttr) {
diff --git a/WebCore/wml/WMLElement.h b/WebCore/wml/WMLElement.h
index 46b0ff4..0bfaceb 100644
--- a/WebCore/wml/WMLElement.h
+++ b/WebCore/wml/WMLElement.h
@@ -29,7 +29,7 @@ namespace WebCore {
 
 class WMLElement : public StyledElement {
 public:
-    WMLElement(const QualifiedName& tagName, Document*);
+    static PassRefPtr<WMLElement> create(const QualifiedName& tagName, Document*);
 
     virtual bool isWMLElement() const { return true; }
     virtual bool isWMLTaskElement() const { return false; }
@@ -43,6 +43,8 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 protected:
+    WMLElement(const QualifiedName& tagName, Document*);
+
     // Helper function for derived classes
     String parseValueSubstitutingVariableReferences(const AtomicString&, WMLErrorCode defaultErrorCode = WMLErrorInvalidVariableReference) const;
     String parseValueForbiddingVariableReferences(const AtomicString&) const;
diff --git a/WebCore/wml/WMLFormControlElement.cpp b/WebCore/wml/WMLFormControlElement.cpp
index f849ac8..93ffbda 100644
--- a/WebCore/wml/WMLFormControlElement.cpp
+++ b/WebCore/wml/WMLFormControlElement.cpp
@@ -39,6 +39,11 @@ WMLFormControlElement::~WMLFormControlElement()
 {
 }
 
+bool WMLFormControlElement::supportsFocus() const
+{
+    return true;
+}
+
 bool WMLFormControlElement::isFocusable() const
 {
     if (!renderer() || !renderer()->isBox())
@@ -46,14 +51,10 @@ bool WMLFormControlElement::isFocusable() const
 
     if (toRenderBox(renderer())->size().isEmpty())
         return false;
-
-    if (RenderStyle* style = renderer()->style()) {
-        if (style->visibility() != VISIBLE)
-            return false;
-    }
-
-    return true;
+    
+    return WMLElement::isFocusable();
 }
+    
 
 void WMLFormControlElement::attach()
 {
diff --git a/WebCore/wml/WMLFormControlElement.h b/WebCore/wml/WMLFormControlElement.h
index dde86ed..43f8dee 100644
--- a/WebCore/wml/WMLFormControlElement.h
+++ b/WebCore/wml/WMLFormControlElement.h
@@ -38,6 +38,7 @@ public:
     virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
     virtual void setFormControlValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
 
+    virtual bool supportsFocus() const;
     virtual bool isFocusable() const;
 
     virtual void attach();
diff --git a/WebCore/wml/WMLGoElement.cpp b/WebCore/wml/WMLGoElement.cpp
index 635302f..8076207 100644
--- a/WebCore/wml/WMLGoElement.cpp
+++ b/WebCore/wml/WMLGoElement.cpp
@@ -73,18 +73,20 @@ void WMLGoElement::parseMappedAttribute(MappedAttribute* attr)
         WMLTaskElement::parseMappedAttribute(attr);
 }
 
-void WMLGoElement::executeTask(Event*)
+void WMLGoElement::executeTask()
 {
-    Document* doc = document();
-    WMLPageState* pageState = wmlPageStateForDocument(doc);
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
-    Frame* frame = doc->frame();
+    Frame* frame = document->frame();
     if (!frame)
         return;
 
@@ -97,7 +99,7 @@ void WMLGoElement::executeTask(Event*)
         return;
 
     // Substitute variables within target url attribute value
-    KURL url = doc->completeURL(substituteVariableReferences(href, doc, WMLVariableEscapingEscape));
+    KURL url = document->completeURL(substituteVariableReferences(href, document, WMLVariableEscapingEscape));
     if (url.isEmpty())
         return;
 
@@ -108,9 +110,9 @@ void WMLGoElement::executeTask(Event*)
         eventTimer->stop();
 
     // FIXME: 'newcontext' handling not implemented for external cards
-    bool inSameDeck = doc->url().path() == url.path();
+    bool inSameDeck = document->url().path() == url.path();
     if (inSameDeck && url.hasFragmentIdentifier()) {
-        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(doc, url.fragmentIdentifier())) {
+        if (WMLCardElement* card = WMLCardElement::findNamedCardInDocument(document, url.fragmentIdentifier())) {
             if (card->isNewContext())
                 pageState->reset();
         }
diff --git a/WebCore/wml/WMLGoElement.h b/WebCore/wml/WMLGoElement.h
index 75c1858..36c7be2 100644
--- a/WebCore/wml/WMLGoElement.h
+++ b/WebCore/wml/WMLGoElement.h
@@ -39,7 +39,7 @@ public:
     void deregisterPostfieldElement(WMLPostfieldElement*);
 
     virtual void parseMappedAttribute(MappedAttribute*);
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 
 private:
     void preparePOSTRequest(ResourceRequest&, bool inSameDeck, const String& cacheControl);
diff --git a/WebCore/wml/WMLInputElement.cpp b/WebCore/wml/WMLInputElement.cpp
index d6fa79a..b027bf0 100644
--- a/WebCore/wml/WMLInputElement.cpp
+++ b/WebCore/wml/WMLInputElement.cpp
@@ -69,7 +69,7 @@ bool WMLInputElement::isMouseFocusable() const
 
 void WMLInputElement::dispatchFocusEvent()
 {
-    InputElement::dispatchFocusEvent(m_data, this, this);
+    InputElement::dispatchFocusEvent(this, this);
     WMLElement::dispatchFocusEvent();
 }
 
@@ -87,7 +87,7 @@ void WMLInputElement::dispatchBlurEvent()
     if (!nameVariable.isEmpty())
         wmlPageStateForDocument(document())->storeVariable(nameVariable, val); 
 
-    InputElement::dispatchBlurEvent(m_data, this, this);
+    InputElement::dispatchBlurEvent(this, this);
     WMLElement::dispatchBlurEvent();
 }
 
@@ -134,7 +134,6 @@ String WMLInputElement::value() const
 
 void WMLInputElement::setValue(const String& value)
 {
-    InputElement::updatePlaceholderVisibility(m_data, this, this);
     setFormControlValueMatchesRenderer(false);
     m_data.setValue(constrainValue(value));
     if (inDocument())
@@ -221,7 +220,7 @@ void WMLInputElement::copyNonAttributeProperties(const Element* source)
 
 RenderObject* WMLInputElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderTextControlSingleLine(this);
+    return new (arena) RenderTextControlSingleLine(this, false);
 }
 
 void WMLInputElement::detach()
@@ -295,7 +294,7 @@ void WMLInputElement::defaultEventHandler(Event* evt)
     }
 
     if (evt->isBeforeTextInsertedEvent())
-        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, this, evt);
 
     if (renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         toRenderTextControlSingleLine(renderer())->forwardEvent(evt);
@@ -309,7 +308,7 @@ void WMLInputElement::cacheSelection(int start, int end)
 
 String WMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
+    return InputElement::sanitizeUserInputValue(this, proposedValue, m_data.maxLength());
 }
 
 void WMLInputElement::documentDidBecomeActive()
@@ -318,11 +317,6 @@ void WMLInputElement::documentDidBecomeActive()
     reset();
 }
 
-bool WMLInputElement::placeholderShouldBeVisible() const
-{
-    return m_data.placeholderShouldBeVisible();
-}
-
 void WMLInputElement::willMoveToNewOwnerDocument()
 {
     // Always unregister for cache callbacks when leaving a document, even if we would otherwise like to be registered
diff --git a/WebCore/wml/WMLInputElement.h b/WebCore/wml/WMLInputElement.h
index 7529968..98ea13a 100644
--- a/WebCore/wml/WMLInputElement.h
+++ b/WebCore/wml/WMLInputElement.h
@@ -58,8 +58,6 @@ public:
     virtual const AtomicString& formControlName() const;
     virtual String value() const;
     virtual void setValue(const String&);
-    virtual String placeholder() const { return String(); }
-    virtual void setPlaceholder(const String&) { }
     virtual void setValueFromRenderer(const String&);
 
     virtual bool saveFormControlState(String& value) const;
@@ -79,10 +77,9 @@ public:
     virtual void defaultEventHandler(Event*);
     virtual void cacheSelection(int start, int end);
 
-    virtual String constrainValue(const String& proposedValue) const;
+    virtual String sanitizeValue(const String& proposedValue) const { return constrainValue(proposedValue); }
 
     virtual void documentDidBecomeActive();
-    virtual bool placeholderShouldBeVisible() const;
 
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
@@ -96,6 +93,7 @@ private:
 
     String validateInputMask(const String&);
     unsigned cursorPositionToMaskIndex(unsigned);
+    String constrainValue(const String&) const;
 
     InputElementData m_data;
     bool m_isPasswordField;
diff --git a/WebCore/wml/WMLIntrinsicEventHandler.cpp b/WebCore/wml/WMLIntrinsicEventHandler.cpp
index 67364d9..8e4c276 100644
--- a/WebCore/wml/WMLIntrinsicEventHandler.cpp
+++ b/WebCore/wml/WMLIntrinsicEventHandler.cpp
@@ -48,7 +48,7 @@ void WMLIntrinsicEventHandler::triggerIntrinsicEvent(WMLIntrinsicEventType type)
 {
     RefPtr<WMLIntrinsicEvent> event = m_events.get(type);
     ASSERT(event->taskElement());
-    event->taskElement()->executeTask(0);
+    event->taskElement()->executeTask();
 }
 
 bool WMLIntrinsicEventHandler::hasIntrinsicEvent(WMLIntrinsicEventType type) const
diff --git a/WebCore/wml/WMLOptionElement.cpp b/WebCore/wml/WMLOptionElement.cpp
index 764d3a1..61fa762 100644
--- a/WebCore/wml/WMLOptionElement.cpp
+++ b/WebCore/wml/WMLOptionElement.cpp
@@ -158,6 +158,10 @@ RenderStyle* WMLOptionElement::nonRendererRenderStyle() const
 
 void WMLOptionElement::handleIntrinsicEventIfNeeded()
 {
+    WMLSelectElement* select = ownerSelectElement(this);
+    if (!select || !select->initialized())
+        return;
+
     WMLIntrinsicEventHandler* eventHandler = this->eventHandler();
     if (!eventHandler)
         return;
diff --git a/WebCore/wml/WMLPageState.cpp b/WebCore/wml/WMLPageState.cpp
index 5f431bb..3e1863d 100644
--- a/WebCore/wml/WMLPageState.cpp
+++ b/WebCore/wml/WMLPageState.cpp
@@ -35,7 +35,6 @@ namespace WebCore {
 
 WMLPageState::WMLPageState(Page* page)
     : m_page(page)
-    , m_activeCard(0)
     , m_hasAccessControlData(false)
 {
 }
diff --git a/WebCore/wml/WMLPageState.h b/WebCore/wml/WMLPageState.h
index de0af91..a5d8b23 100644
--- a/WebCore/wml/WMLPageState.h
+++ b/WebCore/wml/WMLPageState.h
@@ -54,9 +54,6 @@ public:
 
     Page* page() const { return m_page; }
 
-    WMLCardElement* activeCard() const { return m_activeCard; }
-    void setActiveCard(WMLCardElement* card) { m_activeCard = card; }
-
     // Deck access control
     bool processAccessControlData(const String& dmain, const String& path);
     void resetAccessControlData();
@@ -70,7 +67,6 @@ private:
 private:
     Page* m_page;
     WMLVariableMap m_variables;
-    WMLCardElement* m_activeCard;
     String m_accessDomain;
     String m_accessPath;
     bool m_hasAccessControlData;
diff --git a/WebCore/wml/WMLPrevElement.cpp b/WebCore/wml/WMLPrevElement.cpp
index 2688d03..3d487ea 100644
--- a/WebCore/wml/WMLPrevElement.cpp
+++ b/WebCore/wml/WMLPrevElement.cpp
@@ -40,13 +40,16 @@ WMLPrevElement::~WMLPrevElement()
 {
 }
 
-void WMLPrevElement::executeTask(Event*)
+void WMLPrevElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
diff --git a/WebCore/wml/WMLPrevElement.h b/WebCore/wml/WMLPrevElement.h
index 232c1b0..ce8596e 100644
--- a/WebCore/wml/WMLPrevElement.h
+++ b/WebCore/wml/WMLPrevElement.h
@@ -31,7 +31,7 @@ public:
     WMLPrevElement(const QualifiedName& tagName, Document*);
     virtual ~WMLPrevElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/WebCore/wml/WMLRefreshElement.cpp b/WebCore/wml/WMLRefreshElement.cpp
index c05a2c9..bcf87ac 100644
--- a/WebCore/wml/WMLRefreshElement.cpp
+++ b/WebCore/wml/WMLRefreshElement.cpp
@@ -41,13 +41,16 @@ WMLRefreshElement::~WMLRefreshElement()
 {
 }
 
-void WMLRefreshElement::executeTask(Event*)
+void WMLRefreshElement::executeTask()
 {
-    WMLPageState* pageState = wmlPageStateForDocument(document());
+    ASSERT(document()->isWMLDocument());
+    WMLDocument* document = static_cast<WMLDocument*>(this->document());
+
+    WMLPageState* pageState = wmlPageStateForDocument(document);
     if (!pageState)
         return;
 
-    WMLCardElement* card = pageState->activeCard();
+    WMLCardElement* card = document->activeCard();
     if (!card)
         return;
 
@@ -62,7 +65,7 @@ void WMLRefreshElement::executeTask(Event*)
     storeVariableState(pageState);
 
     // Redisplay curremt card with current variable state
-    if (Frame* frame = document()->frame()) {
+    if (Frame* frame = document->frame()) {
         if (FrameLoader* loader = frame->loader())
             loader->reload();
     }
diff --git a/WebCore/wml/WMLRefreshElement.h b/WebCore/wml/WMLRefreshElement.h
index 7b1729e..43b71b5 100644
--- a/WebCore/wml/WMLRefreshElement.h
+++ b/WebCore/wml/WMLRefreshElement.h
@@ -31,7 +31,7 @@ public:
     WMLRefreshElement(const QualifiedName& tagName, Document*);
     virtual ~WMLRefreshElement();
 
-    virtual void executeTask(Event*);
+    virtual void executeTask();
 };
 
 }
diff --git a/WebCore/wml/WMLSelectElement.cpp b/WebCore/wml/WMLSelectElement.cpp
index 2d03a3f..03ca05a 100644
--- a/WebCore/wml/WMLSelectElement.cpp
+++ b/WebCore/wml/WMLSelectElement.cpp
@@ -39,6 +39,7 @@ using namespace WMLNames;
 
 WMLSelectElement::WMLSelectElement(const QualifiedName& tagName, Document* document)
     : WMLFormControlElement(tagName, document)
+    , m_initialized(false)
 {
 }
 
@@ -242,14 +243,17 @@ void WMLSelectElement::selectInitialOptions()
     // Spec: Step 1 - the default option index is determined using iname and ivalue
     calculateDefaultOptionIndices();
 
-    if (m_defaultOptionIndices.isEmpty())
+    if (m_defaultOptionIndices.isEmpty()) {
+        m_initialized = true;
         return;
+    }
 
     // Spec: Step 2 – initialise variables
     initializeVariables();
 
     // Spec: Step 3 – pre-select option(s) specified by the default option index 
     selectDefaultOptions();
+    m_initialized = true;
 }
 
 void WMLSelectElement::insertedIntoTree(bool deep)
diff --git a/WebCore/wml/WMLSelectElement.h b/WebCore/wml/WMLSelectElement.h
index 412a950..5ab7da6 100644
--- a/WebCore/wml/WMLSelectElement.h
+++ b/WebCore/wml/WMLSelectElement.h
@@ -85,6 +85,8 @@ public:
     void scrollToSelection();
     void selectInitialOptions();
 
+    bool initialized() const { return m_initialized; }
+
 private:
     virtual void insertedIntoTree(bool);
 
@@ -104,6 +106,7 @@ private:
     String ivalue() const;
 
     SelectElementData m_data;
+    bool m_initialized;
     Vector<unsigned> m_defaultOptionIndices;
 };
 
diff --git a/WebCore/wml/WMLTableElement.cpp b/WebCore/wml/WMLTableElement.cpp
index 92c7580..b589fe8 100644
--- a/WebCore/wml/WMLTableElement.cpp
+++ b/WebCore/wml/WMLTableElement.cpp
@@ -176,7 +176,7 @@ void WMLTableElement::joinSuperflousColumns(Vector<WMLElement*>& columnElements,
     ASSERT(lastColumn);
 
     // Merge superflous columns into a single one
-    RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+    RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
     transferAllChildrenOfElementToTargetElement(lastColumn, newCell.get(), 0);
 
     ExceptionCode ec = 0;
@@ -213,7 +213,7 @@ void WMLTableElement::padWithEmptyColumns(Vector<WMLElement*>& columnElements, W
     ExceptionCode ec = 0;
 
     for (unsigned i = columnElements.size(); i < m_columns; ++i) {
-        RefPtr<WMLElement> newCell = new WMLElement(tdTag, document());
+        RefPtr<WMLElement> newCell = WMLElement::create(tdTag, document());
         rowElement->appendChild(newCell.release(), ec);
         ASSERT(ec == 0);
     }
diff --git a/WebCore/wml/WMLTagNames.in b/WebCore/wml/WMLTagNames.in
index fd7c762..1c24f42 100644
--- a/WebCore/wml/WMLTagNames.in
+++ b/WebCore/wml/WMLTagNames.in
@@ -2,34 +2,34 @@ namespace="WML"
 namespaceURI="http://www.wapforum.org/DTD/wml_1.1.xml"
 guardFactoryWith="ENABLE(WML)"
 
-a
-access
-anchor
-br interfaceName=WMLBRElement
-card
-do
-fieldset interfaceName=WMLFieldSetElement
-go
+a createWithNew
+access createWithNew
+anchor createWithNew
+br interfaceName=WMLBRElement, createWithNew
+card createWithNew
+do createWithNew
+fieldset interfaceName=WMLFieldSetElement, createWithNew
+go createWithNew
 head interfaceName=WMLElement
-img interfaceName=WMLImageElement
-input
+img interfaceName=WMLImageElement, createWithNew
+input createWithNew
 #if 0
 # Note: 'insertedLegend' is not an official WML element - internal purpose only!
 #endif
-insertedLegend interfaceName=WMLInsertedLegendElement
-meta
-noop
-onevent interfaceName=WMLOnEventElement
-optgroup interfaceName=WMLOptGroupElement
-option
-p
-postfield
-prev
-refresh
-select
-setvar
-table
+insertedLegend interfaceName=WMLInsertedLegendElement, createWithNew
+meta createWithNew
+noop createWithNew
+onevent interfaceName=WMLOnEventElement, createWithNew
+optgroup interfaceName=WMLOptGroupElement, createWithNew
+option createWithNew
+p createWithNew
+postfield createWithNew
+prev createWithNew
+refresh createWithNew
+select createWithNew
+setvar createWithNew
+table createWithNew
 td interfaceName=WMLElement
-template
-timer
+template createWithNew
+timer createWithNew
 tr interfaceName=WMLElement
diff --git a/WebCore/wml/WMLTaskElement.h b/WebCore/wml/WMLTaskElement.h
index b5dab8c..b813285 100644
--- a/WebCore/wml/WMLTaskElement.h
+++ b/WebCore/wml/WMLTaskElement.h
@@ -40,7 +40,7 @@ public:
 
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
-    virtual void executeTask(Event*) = 0;
+    virtual void executeTask() = 0;
 
     void registerVariableSetter(WMLSetvarElement*);
     void deregisterVariableSetter(WMLSetvarElement*);
diff --git a/WebCore/workers/AbstractWorker.cpp b/WebCore/workers/AbstractWorker.cpp
index 2371e9d..6ba8922 100644
--- a/WebCore/workers/AbstractWorker.cpp
+++ b/WebCore/workers/AbstractWorker.cpp
@@ -52,90 +52,6 @@ AbstractWorker::~AbstractWorker()
 {
 }
 
-void AbstractWorker::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void AbstractWorker::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool AbstractWorker::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-
-    return !event->defaultPrevented();
-}
-
-void AbstractWorker::dispatchLoadErrorEvent()
-{
-    RefPtr<Event> evt = Event::create(eventNames().errorEvent, false, true);
-    if (m_onErrorListener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onErrorListener->handleEvent(evt.get(), true);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-bool AbstractWorker::dispatchScriptErrorEvent(const String& message, const String& sourceURL, int lineNumber)
-{
-    bool handled = false;
-    RefPtr<ErrorEvent> event = ErrorEvent::create(message, sourceURL, static_cast<unsigned>(lineNumber));
-    if (m_onErrorListener) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        m_onErrorListener->handleEvent(event.get(), true);
-        if (event->defaultPrevented())
-            handled = true;
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);
-
-    return handled;
-}
-
 KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
 {
     if (url.isEmpty()) {
@@ -157,6 +73,16 @@ KURL AbstractWorker::resolveURL(const String& url, ExceptionCode& ec)
     return scriptURL;
 }
 
+EventTargetData* AbstractWorker::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* AbstractWorker::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/AbstractWorker.h b/WebCore/workers/AbstractWorker.h
index a882542..2209856 100644
--- a/WebCore/workers/AbstractWorker.h
+++ b/WebCore/workers/AbstractWorker.h
@@ -36,6 +36,7 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -51,19 +52,7 @@ namespace WebCore {
         // EventTarget APIs
         virtual ScriptExecutionContext* scriptExecutionContext() const { return ActiveDOMObject::scriptExecutionContext(); }
 
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        // Utility routines to generate appropriate error events for loading and script exceptions.
-        void dispatchLoadErrorEvent();
-        bool dispatchScriptErrorEvent(const String& errorMessage, const String& sourceURL, int);
-
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-        EventListener* onerror() const { return m_onErrorListener.get(); }
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
         using RefCounted<AbstractWorker>::ref;
         using RefCounted<AbstractWorker>::deref;
@@ -78,9 +67,10 @@ namespace WebCore {
     private:
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        RefPtr<EventListener> m_onErrorListener;
-        EventListenersMap m_eventListeners;
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
+        
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/AbstractWorker.idl b/WebCore/workers/AbstractWorker.idl
index ae7ebc6..00b8fbb 100644
--- a/WebCore/workers/AbstractWorker.idl
+++ b/WebCore/workers/AbstractWorker.idl
@@ -32,8 +32,8 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         CustomToJS,
+        EventTarget,
         GenerateConstructor
     ] AbstractWorker {
 
diff --git a/WebCore/workers/DedicatedWorkerContext.cpp b/WebCore/workers/DedicatedWorkerContext.cpp
index ae5c547..82dc4b3 100644
--- a/WebCore/workers/DedicatedWorkerContext.cpp
+++ b/WebCore/workers/DedicatedWorkerContext.cpp
@@ -46,54 +46,29 @@ DedicatedWorkerContext::DedicatedWorkerContext(const KURL& url, const String& us
 {
 }
 
-DedicatedWorkerContext::~DedicatedWorkerContext()
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    ASSERT(currentThread() == thread()->threadID());
-    // Notify parent worker we are going away. This can free the WorkerThread object, so do not access it after this.
-    thread()->workerObjectProxy().workerContextDestroyed();
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void DedicatedWorkerContext::forwardException(const String& errorMessage, int lineNumber, const String& sourceURL)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
 {
-    thread()->workerObjectProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
 }
 
-void DedicatedWorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
-{
-    thread()->workerObjectProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
-}
-
-void DedicatedWorkerContext::postMessage(const String& message, ExceptionCode& ec)
-{
-    postMessage(message, 0, ec);
-}
-
-void DedicatedWorkerContext::postMessage(const String& message, MessagePort* port, ExceptionCode& ec)
+void DedicatedWorkerContext::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     if (isClosing())
         return;
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = port ? port->disentangle(ec) : 0;
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    thread()->workerObjectProxy().postMessageToWorkerObject(message, channel.release());
-}
-
-void DedicatedWorkerContext::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
-{
-    // Since close() stops the thread event loop, this should not ever get called while closing.
-    ASSERT(!isClosing());
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
-
-    if (m_onmessageListener.get()) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onmessageListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
+    thread()->workerObjectProxy().postMessageToWorkerObject(message, channels.release());
 }
 
 void DedicatedWorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
diff --git a/WebCore/workers/DedicatedWorkerContext.h b/WebCore/workers/DedicatedWorkerContext.h
index e974cef..74a39d9 100644
--- a/WebCore/workers/DedicatedWorkerContext.h
+++ b/WebCore/workers/DedicatedWorkerContext.h
@@ -33,6 +33,7 @@
 
 #if ENABLE(WORKERS)
 
+#include "MessagePort.h"
 #include "WorkerContext.h"
 
 namespace WebCore {
@@ -46,31 +47,24 @@ namespace WebCore {
         {
             return adoptRef(new DedicatedWorkerContext(url, userAgent, thread));
         }
-        virtual ~DedicatedWorkerContext();
 
         virtual bool isDedicatedWorkerContext() const { return true; }
 
         // Overridden to allow us to check our pending activity after executing imported script.
         virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
 
-        // ScriptExecutionContext
-        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
-
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL);
-
         // EventTarget
         virtual DedicatedWorkerContext* toDedicatedWorkerContext() { return this; }
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onmessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onmessageListener.get(); }
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue>, MessagePort*, ExceptionCode&);
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
         DedicatedWorkerThread* thread();
     private:
         DedicatedWorkerContext(const KURL&, const String&, DedicatedWorkerThread*);
-        RefPtr<EventListener> m_onmessageListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/DedicatedWorkerContext.idl b/WebCore/workers/DedicatedWorkerContext.idl
index ebbee33..f421b9a 100644
--- a/WebCore/workers/DedicatedWorkerContext.idl
+++ b/WebCore/workers/DedicatedWorkerContext.idl
@@ -32,15 +32,20 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
         NoStaticTables
     ] DedicatedWorkerContext : WorkerContext {
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in any message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
                  attribute EventListener onmessage;
 
     };
diff --git a/WebCore/workers/DedicatedWorkerThread.cpp b/WebCore/workers/DedicatedWorkerThread.cpp
index 0905843..d4789a1 100644
--- a/WebCore/workers/DedicatedWorkerThread.cpp
+++ b/WebCore/workers/DedicatedWorkerThread.cpp
@@ -45,7 +45,7 @@ PassRefPtr<DedicatedWorkerThread> DedicatedWorkerThread::create(const KURL& scri
 }
 
 DedicatedWorkerThread::DedicatedWorkerThread(const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerObjectProxy& workerObjectProxy)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerObjectProxy)
     , m_workerObjectProxy(workerObjectProxy)
 {
 }
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.cpp b/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 1c1ed4c..8b1a480 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -35,6 +35,9 @@
 #include "DefaultSharedWorkerRepository.h"
 
 #include "ActiveDOMObject.h"
+#include "Document.h"
+#include "GenericWorkerTask.h"
+#include "MessageEvent.h"
 #include "MessagePort.h"
 #include "NotImplemented.h"
 #include "PlatformString.h"
@@ -42,52 +45,178 @@
 #include "SecurityOriginHash.h"
 #include "SharedWorker.h"
 #include "SharedWorkerContext.h"
+#include "SharedWorkerRepository.h"
 #include "SharedWorkerThread.h"
 #include "WorkerLoaderProxy.h"
+#include "WorkerReportingProxy.h"
 #include "WorkerScriptLoader.h"
 #include "WorkerScriptLoaderClient.h"
-
+#include <wtf/HashSet.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
-class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy {
+class SharedWorkerProxy : public ThreadSafeShared<SharedWorkerProxy>, public WorkerLoaderProxy, public WorkerReportingProxy {
 public:
-    static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url) { return adoptRef(new SharedWorkerProxy(name, url)); }
+    static PassRefPtr<SharedWorkerProxy> create(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin) { return adoptRef(new SharedWorkerProxy(name, url, origin)); }
 
     void setThread(PassRefPtr<SharedWorkerThread> thread) { m_thread = thread; }
     SharedWorkerThread* thread() { return m_thread.get(); }
-    bool closing() const { return m_closing; }
-    KURL url() const { return m_url.copy(); }
-    String name() const { return m_name.copy(); }
+    bool isClosing() const { return m_closing; }
+    KURL url() const
+    {
+        // Don't use m_url.copy() because it isn't a threadsafe method.
+        return KURL(ParsedURLString, m_url.string().threadsafeCopy());
+    }
+
+    String name() const { return m_name.threadsafeCopy(); }
+    bool matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const;
 
     // WorkerLoaderProxy
-    // FIXME: Implement WorkerLoaderProxy APIs by proxying to an active document.
-    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>) { notImplemented(); }
-    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&) { notImplemented(); }
+    virtual void postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task>);
+    virtual void postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task>, const String&);
+
+    // WorkerReportingProxy
+    virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
+    virtual void workerContextClosed();
+    virtual void workerContextDestroyed();
 
     // Updates the list of the worker's documents, per section 4.5 of the WebWorkers spec.
     void addToWorkerDocuments(ScriptExecutionContext*);
+
+    bool isInWorkerDocuments(Document* document) { return m_workerDocuments.contains(document); }
+
+    // Removes a detached document from the list of worker's documents. May set the closing flag if this is the last document in the list.
+    void documentDetached(Document*);
+
 private:
-    SharedWorkerProxy(const String& name, const KURL&);
+    SharedWorkerProxy(const String& name, const KURL&, PassRefPtr<SecurityOrigin>);
+    void close();
+
     bool m_closing;
     String m_name;
     KURL m_url;
+    // The thread is freed when the proxy is destroyed, so we need to make sure that the proxy stays around until the SharedWorkerContext exits.
     RefPtr<SharedWorkerThread> m_thread;
+    RefPtr<SecurityOrigin> m_origin;
+    HashSet<Document*> m_workerDocuments;
+    // Ensures exclusive access to the worker documents. Must not grab any other locks (such as the DefaultSharedWorkerRepository lock) while holding this one.
+    Mutex m_workerDocumentsLock;
 };
 
-SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url)
+SharedWorkerProxy::SharedWorkerProxy(const String& name, const KURL& url, PassRefPtr<SecurityOrigin> origin)
     : m_closing(false)
-    , m_name(name.copy())
+    , m_name(name.crossThreadString())
     , m_url(url.copy())
+    , m_origin(origin)
+{
+    // We should be the sole owner of the SecurityOrigin, as we will free it on another thread.
+    ASSERT(m_origin->hasOneRef());
+}
+
+bool SharedWorkerProxy::matches(const String& name, PassRefPtr<SecurityOrigin> origin, const KURL& urlToMatch) const
+{
+    // If the origins don't match, or the names don't match, then this is not the proxy we are looking for.
+    if (!origin->equal(m_origin.get()))
+        return false;
+
+    // If the names are both empty, compares the URLs instead per the Web Workers spec.
+    if (name.isEmpty() && m_name.isEmpty())
+        return urlToMatch == url();
+
+    return name == m_name;
+}
+
+void SharedWorkerProxy::postTaskToLoader(PassRefPtr<ScriptExecutionContext::Task> task)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+
+    if (isClosing())
+        return;
+
+    // If we aren't closing, then we must have at least one document.
+    ASSERT(m_workerDocuments.size());
+
+    // Just pick an arbitrary active document from the HashSet and pass load requests to it.
+    // FIXME: Do we need to deal with the case where the user closes the document mid-load, via a shadow document or some other solution?
+    Document* document = *(m_workerDocuments.begin());
+    document->postTask(task);
+}
+
+void SharedWorkerProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
+{
+    if (isClosing())
+        return;
+    ASSERT(m_thread);
+    m_thread->runLoop().postTaskForMode(task, mode);
+}
+
+static void postExceptionTask(ScriptExecutionContext* context, const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    context->reportException(errorMessage, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postExceptionTask, errorMessage, lineNumber, sourceURL));
+}
+
+static void postConsoleMessageTask(ScriptExecutionContext* document, MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    document->addMessage(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+void SharedWorkerProxy::postConsoleMessageToWorkerObject(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, int lineNumber, const String& sourceURL)
+{
+    MutexLocker lock(m_workerDocumentsLock);
+    for (HashSet<Document*>::iterator iter = m_workerDocuments.begin(); iter != m_workerDocuments.end(); ++iter)
+        (*iter)->postTask(createCallbackTask(&postConsoleMessageTask, destination, source, type, level, message, lineNumber, sourceURL));
+}
+
+void SharedWorkerProxy::workerContextClosed()
+{
+    if (isClosing())
+        return;
+    close();
+}
+
+void SharedWorkerProxy::workerContextDestroyed()
 {
+    // The proxy may be freed by this call, so do not reference it any further.
+    DefaultSharedWorkerRepository::instance().removeProxy(this);
 }
 
 void SharedWorkerProxy::addToWorkerDocuments(ScriptExecutionContext* context)
 {
     // Nested workers are not yet supported, so passed-in context should always be a Document.
     ASSERT(context->isDocument());
-    // FIXME: track referring documents so we can shutdown the thread when the last one exits and remove the proxy from the cache.
+    ASSERT(!isClosing());
+    MutexLocker lock(m_workerDocumentsLock);
+    Document* document = static_cast<Document*>(context);
+    m_workerDocuments.add(document);
+}
+
+void SharedWorkerProxy::documentDetached(Document* document)
+{
+    if (isClosing())
+        return;
+    // Remove the document from our set (if it's there) and if that was the last document in the set, mark the proxy as closed.
+    MutexLocker lock(m_workerDocumentsLock);
+    m_workerDocuments.remove(document);
+    if (!m_workerDocuments.size())
+        close();
+}
+
+void SharedWorkerProxy::close()
+{
+    ASSERT(!isClosing());
+    m_closing = true;
+    // Stop the worker thread - the proxy will stay around until we get workerThreadExited() notification.
+    if (m_thread)
+        m_thread->stop();
 }
 
 class SharedWorkerConnectTask : public ScriptExecutionContext::Task {
@@ -109,8 +238,10 @@ private:
         port->entangle(m_channel.release());
         ASSERT(scriptContext->isWorkerContext());
         WorkerContext* workerContext = static_cast<WorkerContext*>(scriptContext);
+        // Since close() stops the thread event loop, this should not ever get called while closing.
+        ASSERT(!workerContext->isClosing());
         ASSERT(workerContext->isSharedWorkerContext());
-        workerContext->toSharedWorkerContext()->dispatchConnect(port);
+        workerContext->toSharedWorkerContext()->dispatchEvent(createConnectEvent(port));
     }
 
     OwnPtr<MessagePortChannel> m_channel;
@@ -145,22 +276,23 @@ void SharedWorkerScriptLoader::load(const KURL& url)
     // Mark this object as active for the duration of the load.
     ASSERT(!hasPendingActivity());
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRedirect, this);
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), url, DenyCrossOriginRequests, this);
 
     // Stay alive until the load finishes.
     setPendingActivity(this);
+    m_worker->setPendingActivity(m_worker.get());
 }
 
 void SharedWorkerScriptLoader::notifyFinished()
 {
     // Hand off the just-loaded code to the repository to start up the worker thread.
     if (m_scriptLoader->failed())
-        m_worker->dispatchLoadErrorEvent();
+        m_worker->dispatchEvent(Event::create(eventNames().errorEvent, false, true));
     else
         DefaultSharedWorkerRepository::instance().workerScriptLoaded(*m_proxy, scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script(), m_port.release());
 
-    // This frees this object - must be the last action in this function.
-    unsetPendingActivity(this);
+    m_worker->unsetPendingActivity(m_worker.get());
+    unsetPendingActivity(this); // This frees this object - must be the last action in this function.
 }
 
 DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
@@ -172,23 +304,67 @@ DefaultSharedWorkerRepository& DefaultSharedWorkerRepository::instance()
 void DefaultSharedWorkerRepository::workerScriptLoaded(SharedWorkerProxy& proxy, const String& userAgent, const String& workerScript, PassOwnPtr<MessagePortChannel> port)
 {
     MutexLocker lock(m_lock);
-    if (proxy.closing())
+    if (proxy.isClosing())
         return;
 
     // Another loader may have already started up a thread for this proxy - if so, just send a connect to the pre-existing thread.
     if (!proxy.thread()) {
-        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy);
+        RefPtr<SharedWorkerThread> thread = SharedWorkerThread::create(proxy.name(), proxy.url(), userAgent, workerScript, proxy, proxy);
         proxy.setThread(thread);
         thread->start();
     }
     proxy.thread()->runLoop().postTask(SharedWorkerConnectTask::create(port));
 }
 
+bool SharedWorkerRepository::isAvailable()
+{
+    // SharedWorkers are enabled on the default WebKit platform.
+    return true;
+}
+
 void SharedWorkerRepository::connect(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     DefaultSharedWorkerRepository::instance().connectToWorker(worker, port, url, name, ec);
 }
 
+void SharedWorkerRepository::documentDetached(Document* document)
+{
+    DefaultSharedWorkerRepository::instance().documentDetached(document);
+}
+
+bool SharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    return DefaultSharedWorkerRepository::instance().hasSharedWorkers(document);
+}
+
+bool DefaultSharedWorkerRepository::hasSharedWorkers(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (m_proxies[i]->isInWorkerDocuments(document))
+            return true;
+    }
+    return false;
+}
+
+void DefaultSharedWorkerRepository::removeProxy(SharedWorkerProxy* proxy)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (proxy == m_proxies[i].get()) {
+            m_proxies.remove(i);
+            return;
+        }
+    }
+}
+
+void DefaultSharedWorkerRepository::documentDetached(Document* document)
+{
+    MutexLocker lock(m_lock);
+    for (unsigned i = 0; i < m_proxies.size(); i++)
+        m_proxies[i]->documentDetached(document);
+}
+
 void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> worker, PassOwnPtr<MessagePortChannel> port, const KURL& url, const String& name, ExceptionCode& ec)
 {
     MutexLocker lock(m_lock);
@@ -214,20 +390,17 @@ void DefaultSharedWorkerRepository::connectToWorker(PassRefPtr<SharedWorker> wor
 PassRefPtr<SharedWorkerProxy> DefaultSharedWorkerRepository::getProxy(const String& name, const KURL& url)
 {
     // Look for an existing worker, and create one if it doesn't exist.
-    // Items in the cache are freed on another thread, so copy the URL before creating the origin, to make sure no references to external strings linger.
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url.copy());
-    SharedWorkerNameMap* nameMap = m_cache.get(origin);
-    if (!nameMap) {
-        nameMap = new SharedWorkerNameMap();
-        m_cache.set(origin, nameMap);
-    }
-
-    RefPtr<SharedWorkerProxy> proxy = nameMap->get(name);
-    if (!proxy.get()) {
-        proxy = SharedWorkerProxy::create(name, url);
-        nameMap->set(proxy->name(), proxy);
+    // Items in the cache are freed on another thread, so do a threadsafe copy of the URL before creating the origin,
+    // to make sure no references to external strings linger.
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(KURL(ParsedURLString, url.string().threadsafeCopy()));
+    for (unsigned i = 0; i < m_proxies.size(); i++) {
+        if (!m_proxies[i]->isClosing() && m_proxies[i]->matches(name, origin, url))
+            return m_proxies[i];
     }
-    return proxy;
+    // Proxy is not in the repository currently - create a new one.
+    RefPtr<SharedWorkerProxy> proxy = SharedWorkerProxy::create(name, url, origin.release());
+    m_proxies.append(proxy);
+    return proxy.release();
 }
 
 DefaultSharedWorkerRepository::DefaultSharedWorkerRepository()
diff --git a/WebCore/workers/DefaultSharedWorkerRepository.h b/WebCore/workers/DefaultSharedWorkerRepository.h
index 0b4e66c..c2eaff4 100644
--- a/WebCore/workers/DefaultSharedWorkerRepository.h
+++ b/WebCore/workers/DefaultSharedWorkerRepository.h
@@ -33,22 +33,24 @@
 
 #if ENABLE(SHARED_WORKERS)
 
-#include "SharedWorkerRepository.h"
+#include "ExceptionCode.h"
 #include "StringHash.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
 
 namespace WebCore {
 
+    class Document;
     class KURL;
+    class MessagePortChannel;
     class ScriptExecutionContext;
-    class SecurityOrigin;
+    class SharedWorker;
     class SharedWorkerProxy;
-
-    struct SecurityOriginHash;
-    struct SecurityOriginTraits;
+    class String;
 
     // Platform-specific implementation of the SharedWorkerRepository static interface.
     class DefaultSharedWorkerRepository : public Noncopyable {
@@ -59,6 +61,14 @@ namespace WebCore {
         // Internal implementation of SharedWorkerRepository::connect()
         void connectToWorker(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
 
+        // Notification that a document has been detached.
+        void documentDetached(Document*);
+
+        // Removes the passed SharedWorkerProxy from the repository.
+        void removeProxy(SharedWorkerProxy*);
+
+        bool hasSharedWorkers(Document*);
+
         static DefaultSharedWorkerRepository& instance();
     private:
         DefaultSharedWorkerRepository();
@@ -68,11 +78,9 @@ namespace WebCore {
         // Mutex used to protect internal data structures.
         Mutex m_lock;
 
-        typedef HashMap<String, RefPtr<SharedWorkerProxy> > SharedWorkerNameMap;
-        typedef HashMap<RefPtr<SecurityOrigin>, SharedWorkerNameMap*, SecurityOriginHash> SharedWorkerProxyCache;
-
-        // Items in this cache may be freed on another thread, so all keys and values must be either copied before insertion or thread safe.
-        SharedWorkerProxyCache m_cache;
+        // List of shared workers. Expectation is that there will be a limited number of shared workers, and so tracking them in a Vector is more efficient than nested HashMaps.
+        typedef Vector<RefPtr<SharedWorkerProxy> > SharedWorkerProxyRepository;
+        SharedWorkerProxyRepository m_proxies;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/SharedWorkerContext.cpp b/WebCore/workers/SharedWorkerContext.cpp
index 2c50d94..cd76e3b 100644
--- a/WebCore/workers/SharedWorkerContext.cpp
+++ b/WebCore/workers/SharedWorkerContext.cpp
@@ -39,10 +39,16 @@
 #include "MessageEvent.h"
 #include "NotImplemented.h"
 #include "SharedWorkerThread.h"
-#include "WorkerObjectProxy.h"
 
 namespace WebCore {
 
+PassRefPtr<MessageEvent> createConnectEvent(PassRefPtr<MessagePort> port)
+{
+    RefPtr<MessageEvent> event = MessageEvent::create(new MessagePortArray(1, port));
+    event->initEvent(eventNames().connectEvent, false, false);
+    return event;
+}
+
 SharedWorkerContext::SharedWorkerContext(const String& name, const KURL& url, const String& userAgent, SharedWorkerThread* thread)
     : WorkerContext(url, userAgent, thread)
     , m_name(name)
@@ -53,36 +59,6 @@ SharedWorkerContext::~SharedWorkerContext()
 {
 }
 
-void SharedWorkerContext::forwardException(const String&, int, const String&)
-{
-    // FIXME: forward to console (do not need to report to parent context).
-}
-
-void SharedWorkerContext::addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String&, unsigned, const String&)
-{
-    // FIXME: forward to console.
-    notImplemented();
-}
-
-void SharedWorkerContext::dispatchConnect(PassRefPtr<MessagePort> port)
-{
-    // Since close() stops the thread event loop, this should not ever get called while closing.
-    ASSERT(!isClosing());
-    // The connect event uses the MessageEvent interface, but has the name "connect".
-    RefPtr<Event> event = MessageEvent::create("", "", "", 0, port);
-    event->initEvent(eventNames().connectEvent, false, false);
-
-    if (m_onconnectListener.get()) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        m_onconnectListener->handleEvent(event.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(event.release(), ec);
-    ASSERT(!ec);
-}
-
 SharedWorkerThread* SharedWorkerContext::thread()
 {
     return static_cast<SharedWorkerThread*>(Base::thread());
diff --git a/WebCore/workers/SharedWorkerContext.h b/WebCore/workers/SharedWorkerContext.h
index a7e4133..59a7605 100644
--- a/WebCore/workers/SharedWorkerContext.h
+++ b/WebCore/workers/SharedWorkerContext.h
@@ -37,6 +37,7 @@
 
 namespace WebCore {
 
+    class MessageEvent;
     class SharedWorkerThread;
 
     class SharedWorkerContext : public WorkerContext {
@@ -50,28 +51,21 @@ namespace WebCore {
 
         virtual bool isSharedWorkerContext() const { return true; }
 
-        // ScriptExecutionContext
-        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
-
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL);
-
         // EventTarget
         virtual SharedWorkerContext* toSharedWorkerContext() { return this; }
 
         // Setters/Getters for attributes in SharedWorkerContext.idl
-        void setOnconnect(PassRefPtr<EventListener> eventListener) { m_onconnectListener = eventListener; }
-        EventListener* onconnect() const { return m_onconnectListener.get(); }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(connect);
         String name() const { return m_name; }
 
-        void dispatchConnect(PassRefPtr<MessagePort>);
-
         SharedWorkerThread* thread();
     private:
         SharedWorkerContext(const String& name, const KURL&, const String&, SharedWorkerThread*);
-        RefPtr<EventListener> m_onconnectListener;
         String m_name;
     };
 
+    PassRefPtr<MessageEvent> createConnectEvent(PassRefPtr<MessagePort>);
+
 } // namespace WebCore
 
 #endif // ENABLE(SHARED_WORKERS)
diff --git a/WebCore/workers/SharedWorkerContext.idl b/WebCore/workers/SharedWorkerContext.idl
index 8e450e0..a48e5bd 100644
--- a/WebCore/workers/SharedWorkerContext.idl
+++ b/WebCore/workers/SharedWorkerContext.idl
@@ -32,7 +32,6 @@ module threads {
 
     interface [
         Conditional=SHARED_WORKERS,
-        CustomMarkFunction,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         GenerateNativeConverter,
diff --git a/WebCore/workers/SharedWorkerRepository.h b/WebCore/workers/SharedWorkerRepository.h
index 84acf77..49f3941 100644
--- a/WebCore/workers/SharedWorkerRepository.h
+++ b/WebCore/workers/SharedWorkerRepository.h
@@ -34,12 +34,12 @@
 #if ENABLE(SHARED_WORKERS)
 
 #include "ExceptionCode.h"
-
 #include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
+    class Document;
     class KURL;
     class MessagePortChannel;
     class SharedWorker;
@@ -48,8 +48,17 @@ namespace WebCore {
     // Interface to a repository which manages references to the set of active shared workers.
     class SharedWorkerRepository {
     public:
+        // Returns true if the platform supports SharedWorkers, otherwise false.
+        static bool isAvailable();
+
         // Connects the passed SharedWorker object with the specified worker thread, creating a new thread if necessary.
         static void connect(PassRefPtr<SharedWorker>, PassOwnPtr<MessagePortChannel>, const KURL&, const String& name, ExceptionCode&);
+
+        // Invoked when a document has been detached.
+        static void documentDetached(Document*);
+
+        // Returns true if the passed document is associated with any SharedWorkers.
+        static bool hasSharedWorkers(Document*);
     private:
         SharedWorkerRepository() { }
     };
diff --git a/WebCore/workers/SharedWorkerThread.cpp b/WebCore/workers/SharedWorkerThread.cpp
index 40bb2de..e59df4f 100644
--- a/WebCore/workers/SharedWorkerThread.cpp
+++ b/WebCore/workers/SharedWorkerThread.cpp
@@ -38,14 +38,14 @@
 
 namespace WebCore {
 
-PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
+PassRefPtr<SharedWorkerThread> SharedWorkerThread::create(const String& name, const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
 {
-    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy));
+    return adoptRef(new SharedWorkerThread(name, scriptURL, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy));
 }
 
-SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
-    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy)
-    , m_name(name.copy())
+SharedWorkerThread::SharedWorkerThread(const String& name, const KURL& url, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
+    : WorkerThread(url, userAgent, sourceCode, workerLoaderProxy, workerReportingProxy)
+    , m_name(name.crossThreadString())
 {
 }
 
diff --git a/WebCore/workers/SharedWorkerThread.h b/WebCore/workers/SharedWorkerThread.h
index 15838d7..d96fd2a 100644
--- a/WebCore/workers/SharedWorkerThread.h
+++ b/WebCore/workers/SharedWorkerThread.h
@@ -38,14 +38,14 @@ namespace WebCore {
 
     class SharedWorkerThread : public WorkerThread {
     public:
-        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        static PassRefPtr<SharedWorkerThread> create(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
         ~SharedWorkerThread();
 
     protected:
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL&, const String&);
 
     private:
-        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        SharedWorkerThread(const String& name, const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
 
         String m_name;
     };
diff --git a/WebCore/workers/Worker.cpp b/WebCore/workers/Worker.cpp
index a906134..864b7c6 100644
--- a/WebCore/workers/Worker.cpp
+++ b/WebCore/workers/Worker.cpp
@@ -58,7 +58,7 @@ Worker::Worker(const String& url, ScriptExecutionContext* context, ExceptionCode
         return;
 
     m_scriptLoader = new WorkerScriptLoader();
-    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRedirect, this);
+    m_scriptLoader->loadAsynchronously(scriptExecutionContext(), scriptURL, DenyCrossOriginRequests, this);
     setPendingActivity(this);  // The worker context does not exist while loading, so we must ensure that the worker object is not collected, as well as its event listeners.
 }
 
@@ -69,18 +69,27 @@ Worker::~Worker()
     m_contextProxy->workerObjectDestroyed();
 }
 
-void Worker::postMessage(const String& message, ExceptionCode& ec)
+// FIXME: remove this when we update the ObjC bindings (bug #28774).
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, ExceptionCode& ec)
 {
-    postMessage(message, 0, ec);
+    MessagePortArray ports;
+    if (port)
+        ports.append(port);
+    postMessage(message, &ports, ec);
 }
 
-void Worker::postMessage(const String& message, MessagePort* messagePort, ExceptionCode& ec)
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, ExceptionCode& ec)
+{
+    postMessage(message, static_cast<MessagePortArray*>(0), ec);
+}
+
+void Worker::postMessage(PassRefPtr<SerializedScriptValue> message, const MessagePortArray* ports, ExceptionCode& ec)
 {
     // Disentangle the port in preparation for sending it to the remote context.
-    OwnPtr<MessagePortChannel> channel = messagePort ? messagePort->disentangle(ec) : 0;
+    OwnPtr<MessagePortChannelArray> channels = MessagePort::disentanglePorts(ports, ec);
     if (ec)
         return;
-    m_contextProxy->postMessageToWorkerContext(message, channel.release());
+    m_contextProxy->postMessageToWorkerContext(message, channels.release());
 }
 
 void Worker::terminate()
@@ -107,7 +116,7 @@ bool Worker::hasPendingActivity() const
 void Worker::notifyFinished()
 {
     if (m_scriptLoader->failed())
-        dispatchLoadErrorEvent();
+        dispatchEvent(Event::create(eventNames().errorEvent, false, true));
     else
         m_contextProxy->startWorkerContext(m_scriptLoader->url(), scriptExecutionContext()->userAgent(m_scriptLoader->url()), m_scriptLoader->script());
 
@@ -116,21 +125,6 @@ void Worker::notifyFinished()
     unsetPendingActivity(this);
 }
 
-void Worker::dispatchMessage(const String& message, PassRefPtr<MessagePort> port)
-{
-    RefPtr<Event> evt = MessageEvent::create(message, "", "", 0, port);
-
-    if (m_onMessageListener.get()) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onMessageListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/WebCore/workers/Worker.h b/WebCore/workers/Worker.h
index 66a8ae9..6b8fa84 100644
--- a/WebCore/workers/Worker.h
+++ b/WebCore/workers/Worker.h
@@ -33,7 +33,9 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
+#include "MessagePort.h"
 #include "WorkerScriptLoaderClient.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
@@ -56,20 +58,18 @@ namespace WebCore {
 
         virtual Worker* toWorker() { return this; }
 
-        void postMessage(const String&, ExceptionCode&);
-        void postMessage(const String&, MessagePort*, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+        void postMessage(PassRefPtr<SerializedScriptValue>, const MessagePortArray*, ExceptionCode&);
+        // FIXME: remove this when we update the ObjC bindings (bug #28774).
+        void postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort*, ExceptionCode&);
 
         void terminate();
 
-        void dispatchMessage(const String&, PassRefPtr<MessagePort>);
-        void dispatchErrorEvent();
-
         virtual bool canSuspend() const;
         virtual void stop();
         virtual bool hasPendingActivity() const;
-
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onMessageListener = eventListener; }
-        EventListener* onmessage() const { return m_onMessageListener.get(); }
+    
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(message);
 
     private:
         Worker(const String&, ScriptExecutionContext*, ExceptionCode&);
@@ -80,10 +80,7 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
 
         OwnPtr<WorkerScriptLoader> m_scriptLoader;
-
         WorkerContextProxy* m_contextProxy; // The proxy outlives the worker to perform thread shutdown.
-
-        RefPtr<EventListener> m_onMessageListener;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/Worker.idl b/WebCore/workers/Worker.idl
index e701523..0382739 100644
--- a/WebCore/workers/Worker.idl
+++ b/WebCore/workers/Worker.idl
@@ -28,14 +28,20 @@ module threads {
 
     interface [
         Conditional=WORKERS,
-        CustomMarkFunction,
         GenerateNativeConverter,
         GenerateToJS
     ] Worker : AbstractWorker {
 
         attribute EventListener onmessage;
-        void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [Custom] void postMessage(in SerialisedScriptValue message, in [Optional] Array messagePorts)
+            raises(DOMException);
+#else
+        // There's no good way to expose an array via the ObjC bindings, so for now just allow passing in a single port.
+        void postMessage(in SerializedScriptValue message, in [Optional] MessagePort messagePort)
             raises(DOMException);
+#endif
 
         void terminate();
     };
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 722588f..f4d795b 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -50,6 +50,10 @@
 #include "XMLHttpRequestException.h"
 #include <wtf/RefPtr.h>
 
+#if ENABLE(NOTIFICATIONS)
+#include "NotificationCenter.h"
+#endif
+
 namespace WebCore {
 
 WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThread* thread)
@@ -64,6 +68,12 @@ WorkerContext::WorkerContext(const KURL& url, const String& userAgent, WorkerThr
 
 WorkerContext::~WorkerContext()
 {
+    ASSERT(currentThread() == thread()->threadID());
+#if ENABLE(NOTIFICATIONS)
+    m_notifications.clear();
+#endif
+    // Notify proxy that we are going away. This can free the WorkerThread object, so do not access it after this.
+    thread()->workerReportingProxy().workerContextDestroyed();
 }
 
 ScriptExecutionContext* WorkerContext::scriptExecutionContext() const
@@ -109,7 +119,8 @@ void WorkerContext::close()
         return;
 
     m_closing = true;
-    m_thread->stop();
+    // Notify parent that this context is closed. Parent is responsible for calling WorkerThread::stop().
+    thread()->workerReportingProxy().workerContextClosed();
 }
 
 WorkerNavigator* WorkerContext::navigator() const
@@ -150,57 +161,6 @@ void WorkerContext::scriptImported(unsigned long, const String&)
     notImplemented();
 }
 
-void WorkerContext::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }    
-}
-
-void WorkerContext::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-    
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool WorkerContext::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
-{
-    if (!event || event->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-    
-    ListenerVector listenersCopy = m_eventListeners.get(event->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        event->setTarget(this);
-        event->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(event.get(), false);
-    }
-    
-    return !event->defaultPrevented();
-}
-
 void WorkerContext::postTask(PassRefPtr<Task> task)
 {
     thread()->runLoop().postTask(task);
@@ -228,6 +188,10 @@ void WorkerContext::clearInterval(int timeoutId)
 
 void WorkerContext::importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode& ec)
 {
+#if !ENABLE(INSPECTOR)
+    UNUSED_PARAM(callerURL);
+    UNUSED_PARAM(callerLine);
+#endif
     ec = 0;
     Vector<String>::const_iterator urlsEnd = urls.end();
     Vector<KURL> completedURLs;
@@ -239,12 +203,11 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
         completedURLs.append(url);
     }
-    String securityOrigin = scriptExecutionContext()->securityOrigin()->toString();
     Vector<KURL>::const_iterator end = completedURLs.end();
 
     for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
         WorkerScriptLoader scriptLoader;
-        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRedirect);
+        scriptLoader.loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRequests);
 
         // If the fetching attempt failed, throw a NETWORK_ERR exception and abort all these steps.
         if (scriptLoader.failed()) {
@@ -253,7 +216,9 @@ void WorkerContext::importScripts(const Vector<String>& urls, const String& call
         }
 
         scriptExecutionContext()->scriptImported(scriptLoader.identifier(), scriptLoader.script());
+#if ENABLE(INSPECTOR)
         scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "Worker script imported: \"" + *it + "\".", callerLine, callerURL);
+#endif
 
         ScriptValue exception;
         m_script->evaluate(ScriptSourceCode(scriptLoader.script(), *it), &exception);
@@ -268,10 +233,34 @@ void WorkerContext::reportException(const String& errorMessage, int lineNumber,
 {
     bool errorHandled = false;
     if (onerror())
-        errorHandled = onerror()->reportError(errorMessage, sourceURL, lineNumber);
+        errorHandled = onerror()->reportError(this, errorMessage, sourceURL, lineNumber);
 
     if (!errorHandled)
-        forwardException(errorMessage, lineNumber, sourceURL);
+        thread()->workerReportingProxy().postExceptionToWorkerObject(errorMessage, lineNumber, sourceURL);
+}
+
+void WorkerContext::addMessage(MessageDestination destination, MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
+{
+    thread()->workerReportingProxy().postConsoleMessageToWorkerObject(destination, source, type, level, message, lineNumber, sourceURL);
+}
+
+#if ENABLE(NOTIFICATIONS)
+NotificationCenter* WorkerContext::webkitNotifications() const
+{
+    if (!m_notifications)
+        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationPresenter());
+    return m_notifications.get();
+}
+#endif
+
+EventTargetData* WorkerContext::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* WorkerContext::ensureEventTargetData()
+{
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index aa47475..9725cf7 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -31,6 +31,7 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "ScriptExecutionContext.h"
 #include "WorkerScriptController.h"
@@ -41,6 +42,7 @@
 
 namespace WebCore {
 
+    class NotificationCenter;
     class ScheduledAction;
     class WorkerLocation;
     class WorkerNavigator;
@@ -48,7 +50,6 @@ namespace WebCore {
 
     class WorkerContext : public RefCounted<WorkerContext>, public ScriptExecutionContext, public EventTarget {
     public:
-
         virtual ~WorkerContext();
 
         virtual bool isWorkerContext() const { return true; }
@@ -79,8 +80,8 @@ namespace WebCore {
         WorkerContext* self() { return this; }
         WorkerLocation* location() const;
         void close();
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onerrorListener = eventListener; }
-        EventListener* onerror() const { return m_onerrorListener.get(); }
+
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
         // WorkerUtils
         virtual void importScripts(const Vector<String>& urls, const String& callerURL, int callerLine, ExceptionCode&);
@@ -92,19 +93,13 @@ namespace WebCore {
         int setInterval(ScheduledAction*, int timeout);
         void clearInterval(int timeoutId);
 
-        // EventTarget
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-        EventListenersMap& eventListeners() { return m_eventListeners; }
-
         // ScriptExecutionContext
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+        virtual void addMessage(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
 
-        virtual void forwardException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+#if ENABLE(NOTIFICATIONS)
+        NotificationCenter* webkitNotifications() const;
+#endif
 
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
         // JSWorkerContextCustom.cpp.
@@ -114,15 +109,19 @@ namespace WebCore {
         using RefCounted<WorkerContext>::ref;
         using RefCounted<WorkerContext>::deref;
 
+        bool isClosing() { return m_closing; }
+
     protected:
         WorkerContext(const KURL&, const String&, WorkerThread*);
-        bool isClosing() { return m_closing; }
 
     private:
         virtual void refScriptExecutionContext() { ref(); }
         virtual void derefScriptExecutionContext() { deref(); }
+
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         virtual const KURL& virtualURL() const;
         virtual KURL virtualCompleteURL(const String&) const;
@@ -136,10 +135,11 @@ namespace WebCore {
         OwnPtr<WorkerScriptController> m_script;
         WorkerThread* m_thread;
 
-        RefPtr<EventListener> m_onerrorListener;
-        EventListenersMap m_eventListeners;
-
+#if ENABLE_NOTIFICATIONS
+        mutable RefPtr<NotificationCenter> m_notifications;
+#endif
         bool m_closing;
+        EventTargetData m_eventTargetData;
     };
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerContext.idl b/WebCore/workers/WorkerContext.idl
index 2404d22..17bee55 100644
--- a/WebCore/workers/WorkerContext.idl
+++ b/WebCore/workers/WorkerContext.idl
@@ -30,6 +30,7 @@ module threads {
         Conditional=WORKERS,
         CustomMarkFunction,
         DelegatingGetOwnPropertySlot,
+        EventTarget,
         ExtendsDOMGlobalObject,
         IsWorkerContext,
         LegacyParent=JSWorkerContextBase,
@@ -69,6 +70,10 @@ module threads {
         boolean dispatchEvent(in Event evt)
             raises(EventException);
 
+#if defined(ENABLE_NOTIFICATIONS) && ENABLE_NOTIFICATIONS
+        // Notification interface
+        readonly attribute NotificationCenter webkitNotifications;
+#endif
 
         // Constructors
         attribute MessageEventConstructor MessageEvent;
@@ -77,6 +82,9 @@ module threads {
 #if ENABLE_CHANNEL_MESSAGING
         attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel;
 #endif
+#if ENABLE_EVENTSOURCE
+        attribute [JSCCustomGetter] EventSourceConstructor EventSource;
+#endif
         attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest;
     };
 
diff --git a/WebCore/workers/WorkerContextProxy.h b/WebCore/workers/WorkerContextProxy.h
index f42527e..e1ca139 100644
--- a/WebCore/workers/WorkerContextProxy.h
+++ b/WebCore/workers/WorkerContextProxy.h
@@ -33,12 +33,12 @@
 
 #if ENABLE(WORKERS)
 
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class KURL;
-    class MessagePortChannel;
     class String;
     class Worker;
 
@@ -53,7 +53,7 @@ namespace WebCore {
 
         virtual void terminateWorkerContext() = 0;
 
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>) = 0;
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual bool hasPendingActivity() const = 0;
 
diff --git a/WebCore/workers/WorkerMessagingProxy.cpp b/WebCore/workers/WorkerMessagingProxy.cpp
index 1dac28e..0b66694 100644
--- a/WebCore/workers/WorkerMessagingProxy.cpp
+++ b/WebCore/workers/WorkerMessagingProxy.cpp
@@ -35,6 +35,8 @@
 #include "DedicatedWorkerThread.h"
 #include "DOMWindow.h"
 #include "Document.h"
+#include "ErrorEvent.h"
+#include "ExceptionCode.h"
 #include "GenericWorkerTask.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
@@ -44,15 +46,15 @@ namespace WebCore {
 
 class MessageWorkerContextTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerContextTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+    static PassRefPtr<MessageWorkerContextTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
     {
-        return adoptRef(new MessageWorkerContextTask(message, channel));
+        return adoptRef(new MessageWorkerContextTask(message, channels));
     }
 
 private:
-    MessageWorkerContextTask(const String& message, PassOwnPtr<MessagePortChannel> channel)
-        : m_message(message.copy())
-        , m_channel(channel)
+    MessageWorkerContextTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
+        : m_message(message->release())
+        , m_channels(channels)
     {
     }
 
@@ -60,31 +62,27 @@ private:
     {
         ASSERT(scriptContext->isWorkerContext());
         DedicatedWorkerContext* context = static_cast<DedicatedWorkerContext*>(scriptContext);
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        context->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        context->dispatchEvent(MessageEvent::create(ports.release(), m_message));
         context->thread()->workerObjectProxy().confirmMessageFromWorkerObject(context->hasPendingActivity());
     }
 
 private:
-    String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    RefPtr<SerializedScriptValue> m_message;
+    OwnPtr<MessagePortChannelArray> m_channels;
 };
 
 class MessageWorkerTask : public ScriptExecutionContext::Task {
 public:
-    static PassRefPtr<MessageWorkerTask> create(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
+    static PassRefPtr<MessageWorkerTask> create(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
     {
-        return adoptRef(new MessageWorkerTask(message, channel, messagingProxy));
+        return adoptRef(new MessageWorkerTask(message, channels, messagingProxy));
     }
 
 private:
-    MessageWorkerTask(const String& message, PassOwnPtr<MessagePortChannel> channel, WorkerMessagingProxy* messagingProxy)
-        : m_message(message.copy())
-        , m_channel(channel)
+    MessageWorkerTask(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels, WorkerMessagingProxy* messagingProxy)
+        : m_message(message->release())
+        , m_channels(channels)
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -95,17 +93,13 @@ private:
         if (!workerObject || m_messagingProxy->askedToTerminate())
             return;
 
-        RefPtr<MessagePort> port;
-        if (m_channel) {
-            port = MessagePort::create(*scriptContext);
-            port->entangle(m_channel.release());
-        }
-        workerObject->dispatchMessage(m_message, port.release());
+        OwnPtr<MessagePortArray> ports = MessagePort::entanglePorts(*scriptContext, m_channels.release());
+        workerObject->dispatchEvent(MessageEvent::create(ports.release(), m_message));
     }
 
 private:
-    String m_message;
-    OwnPtr<MessagePortChannel> m_channel;
+    RefPtr<SerializedScriptValue> m_message;
+    OwnPtr<MessagePortChannelArray> m_channels;
     WorkerMessagingProxy* m_messagingProxy;
 };
 
@@ -118,9 +112,9 @@ public:
 
 private:
     WorkerExceptionTask(const String& errorMessage, int lineNumber, const String& sourceURL, WorkerMessagingProxy* messagingProxy)
-        : m_errorMessage(errorMessage.copy())
+        : m_errorMessage(errorMessage.crossThreadString())
         , m_lineNumber(lineNumber)
-        , m_sourceURL(sourceURL.copy())
+        , m_sourceURL(sourceURL.crossThreadString())
         , m_messagingProxy(messagingProxy)
     {
     }
@@ -128,13 +122,13 @@ private:
     virtual void performTask(ScriptExecutionContext* context)
     {
         Worker* workerObject = m_messagingProxy->workerObject();
-        if (!workerObject || m_messagingProxy->askedToTerminate())
+        if (!workerObject)
             return;
 
-        bool errorHandled = false;
-        if (workerObject->onerror())
-            errorHandled = workerObject->dispatchScriptErrorEvent(m_errorMessage, m_sourceURL, m_lineNumber);
+        // We don't bother checking the askedToTerminate() flag here, because exceptions should *always* be reported even if the thread is terminated.
+        // This is intentionally different than the behavior in MessageWorkerTask, because terminated workers no longer deliver messages (section 4.6 of the WebWorker spec), but they do report exceptions.
 
+        bool errorHandled = !workerObject->dispatchEvent(ErrorEvent::create(m_errorMessage, m_sourceURL, m_lineNumber));
         if (!errorHandled)
             context->reportException(m_errorMessage, m_lineNumber, m_sourceURL);
     }
@@ -166,6 +160,27 @@ private:
     WorkerMessagingProxy* m_messagingProxy;
 };
 
+class WorkerTerminateTask : public ScriptExecutionContext::Task {
+public:
+    static PassRefPtr<WorkerTerminateTask> create(WorkerMessagingProxy* messagingProxy)
+    {
+        return adoptRef(new WorkerTerminateTask(messagingProxy));
+    }
+
+private:
+    WorkerTerminateTask(WorkerMessagingProxy* messagingProxy)
+        : m_messagingProxy(messagingProxy)
+    {
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_messagingProxy->terminateWorkerContext();
+    }
+
+    WorkerMessagingProxy* m_messagingProxy;
+};
+
 class WorkerThreadActivityReportTask : public ScriptExecutionContext::Task {
 public:
     static PassRefPtr<WorkerThreadActivityReportTask> create(WorkerMessagingProxy* messagingProxy, bool confirmingMessage, bool hasPendingActivity)
@@ -225,21 +240,21 @@ void WorkerMessagingProxy::startWorkerContext(const KURL& scriptURL, const Strin
     thread->start();
 }
 
-void WorkerMessagingProxy::postMessageToWorkerObject(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerObject(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
-    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channel, this));
+    m_scriptExecutionContext->postTask(MessageWorkerTask::create(message, channels.release(), this));
 }
 
-void WorkerMessagingProxy::postMessageToWorkerContext(const String& message, PassOwnPtr<MessagePortChannel> channel)
+void WorkerMessagingProxy::postMessageToWorkerContext(PassRefPtr<SerializedScriptValue> message, PassOwnPtr<MessagePortChannelArray> channels)
 {
     if (m_askedToTerminate)
         return;
 
     if (m_workerThread) {
         ++m_unconfirmedMessageCount;
-        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channel));
+        m_workerThread->runLoop().postTask(MessageWorkerContextTask::create(message, channels.release()));
     } else
-        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channel));
+        m_queuedEarlyTasks.append(MessageWorkerContextTask::create(message, channels.release()));
 }
 
 void WorkerMessagingProxy::postTaskForModeToWorkerContext(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
@@ -309,6 +324,12 @@ void WorkerMessagingProxy::workerContextDestroyed()
     // Will execute workerContextDestroyedInternal() on context's thread.
 }
 
+void WorkerMessagingProxy::workerContextClosed()
+{
+    // Executes terminateWorkerContext() on parent context's thread.
+    m_scriptExecutionContext->postTask(WorkerTerminateTask::create(this));
+}
+
 void WorkerMessagingProxy::workerContextDestroyedInternal()
 {
     // WorkerContextDestroyedTask is always the last to be performed, so the proxy is not needed for communication
diff --git a/WebCore/workers/WorkerMessagingProxy.h b/WebCore/workers/WorkerMessagingProxy.h
index 841fc9a..754102a 100644
--- a/WebCore/workers/WorkerMessagingProxy.h
+++ b/WebCore/workers/WorkerMessagingProxy.h
@@ -42,7 +42,6 @@
 namespace WebCore {
 
     class DedicatedWorkerThread;
-    class MessagePortChannel;
     class ScriptExecutionContext;
     class String;
     class Worker;
@@ -55,17 +54,18 @@ namespace WebCore {
         // (Only use these methods in the worker object thread.)
         virtual void startWorkerContext(const KURL& scriptURL, const String& userAgent, const String& sourceCode);
         virtual void terminateWorkerContext();
-        virtual void postMessageToWorkerContext(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerContext(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual bool hasPendingActivity() const;
         virtual void workerObjectDestroyed();
 
         // Implementations of WorkerObjectProxy.
         // (Only use these methods in the worker context thread.)
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>);
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>);
         virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL);
         virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL);
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity);
         virtual void reportPendingActivity(bool hasPendingActivity);
+        virtual void workerContextClosed();
         virtual void workerContextDestroyed();
 
         // Implementation of WorkerLoaderProxy.
diff --git a/WebCore/workers/WorkerObjectProxy.h b/WebCore/workers/WorkerObjectProxy.h
index c5f4456..33e0bc3 100644
--- a/WebCore/workers/WorkerObjectProxy.h
+++ b/WebCore/workers/WorkerObjectProxy.h
@@ -33,31 +33,24 @@
 
 #if ENABLE(WORKERS)
 
-#include "Console.h"
-
+#include "WorkerReportingProxy.h"
+#include "MessagePort.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
     class MessagePortChannel;
-    class String;
 
     // A proxy to talk to the worker object.
-    class WorkerObjectProxy {
+    class WorkerObjectProxy : public WorkerReportingProxy {
     public:
-        virtual ~WorkerObjectProxy() {}
-
-        virtual void postMessageToWorkerObject(const String&, PassOwnPtr<MessagePortChannel>) = 0;
-
-        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-
-        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
+        virtual void postMessageToWorkerObject(PassRefPtr<SerializedScriptValue>, PassOwnPtr<MessagePortChannelArray>) = 0;
 
         virtual void confirmMessageFromWorkerObject(bool hasPendingActivity) = 0;
-
         virtual void reportPendingActivity(bool hasPendingActivity) = 0;
 
-        virtual void workerContextDestroyed() = 0;
+        // No need to notify the parent page context when dedicated workers are closing.
+        virtual void workerContextClosed() { }
     };
 
 } // namespace WebCore
diff --git a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h b/WebCore/workers/WorkerReportingProxy.h
index 6471637..f0447c8 100644
--- a/WebCore/bindings/v8/V8WorkerContextObjectEventListener.h
+++ b/WebCore/workers/WorkerReportingProxy.h
@@ -28,32 +28,34 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef V8WorkerContextObjectEventListener_h
-#define V8WorkerContextObjectEventListener_h
+#ifndef WorkerReportingProxy_h
+#define WorkerReportingProxy_h
 
 #if ENABLE(WORKERS)
 
-#include "V8WorkerContextEventListener.h"
-#include <v8.h>
-#include <wtf/PassRefPtr.h>
+#include "Console.h"
 
 namespace WebCore {
 
-    class WorkerContextExecutionProxy;
+    class String;
 
-    class V8WorkerContextObjectEventListener : public V8WorkerContextEventListener {
+    // APIs used by workers to report console activity.
+    class WorkerReportingProxy {
     public:
-        static PassRefPtr<V8WorkerContextObjectEventListener> create(WorkerContextExecutionProxy* proxy, v8::Local<v8::Object> listener, bool isInline)
-        {
-            return adoptRef(new V8WorkerContextObjectEventListener(proxy, listener, isInline));
-        }
+        virtual ~WorkerReportingProxy() {}
 
-    private:
-        V8WorkerContextObjectEventListener(WorkerContextExecutionProxy*, v8::Local<v8::Object> listener, bool isInline);
-    };
+        virtual void postExceptionToWorkerObject(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
+
+        virtual void postConsoleMessageToWorkerObject(MessageDestination, MessageSource, MessageType, MessageLevel, const String& message, int lineNumber, const String& sourceURL) = 0;
 
+        // Invoked when close() is invoked on the worker context.
+        virtual void workerContextClosed() = 0;
+
+        // Invoked when the thread has stopped.
+        virtual void workerContextDestroyed() = 0;
+    };
 } // namespace WebCore
 
-#endif // WORKERS
+#endif // ENABLE(WORKERS)
 
-#endif // V8WorkerContextObjectEventListener_h
+#endif // WorkerReportingProxy_h
diff --git a/WebCore/workers/WorkerRunLoop.cpp b/WebCore/workers/WorkerRunLoop.cpp
index cb31fe7..39b21c6 100644
--- a/WebCore/workers/WorkerRunLoop.cpp
+++ b/WebCore/workers/WorkerRunLoop.cpp
@@ -77,7 +77,7 @@ public:
 private:
     Task(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
         : m_task(task)
-        , m_mode(mode.copy())
+        , m_mode(mode.crossThreadString())
     {
     }
 
@@ -173,6 +173,10 @@ MessageQueueWaitResult WorkerRunLoop::runInMode(WorkerContext* context, const Mo
     RefPtr<Task> task;
     MessageQueueWaitResult result = m_messageQueue.waitForMessageFilteredWithTimeout(task, predicate, absoluteTime);
 
+    // If the context is closing, don't dispatch any further tasks (per section 4.1.1 of the Web Workers spec).
+    if (context->isClosing())
+        return result;
+
     switch (result) {
     case MessageQueueTerminated:
         break;
@@ -201,7 +205,7 @@ void WorkerRunLoop::postTask(PassRefPtr<ScriptExecutionContext::Task> task)
 
 void WorkerRunLoop::postTaskForMode(PassRefPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
-    m_messageQueue.append(Task::create(task, mode.copy()));
+    m_messageQueue.append(Task::create(task, mode.crossThreadString()));
 }
 
 } // namespace WebCore
diff --git a/WebCore/workers/WorkerScriptLoader.cpp b/WebCore/workers/WorkerScriptLoader.cpp
index 0162b26..52baf2d 100644
--- a/WebCore/workers/WorkerScriptLoader.cpp
+++ b/WebCore/workers/WorkerScriptLoader.cpp
@@ -50,7 +50,7 @@ WorkerScriptLoader::WorkerScriptLoader()
 {
 }
 
-void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy)
 {
     m_url = url;
 
@@ -59,10 +59,15 @@ void WorkerScriptLoader::loadSynchronously(ScriptExecutionContext* scriptExecuti
         return;
 
     ASSERT(scriptExecutionContext->isWorkerContext());
-    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, AllowStoredCredentials, crossOriginRedirectPolicy);
+
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+
+    WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(scriptExecutionContext), *request, *this, options);
 }
     
-void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRedirectPolicy crossOriginRedirectPolicy, WorkerScriptLoaderClient* client)
+void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecutionContext, const KURL& url, CrossOriginRequestPolicy crossOriginRequestPolicy, WorkerScriptLoaderClient* client)
 {
     ASSERT(client);
     m_client = client;
@@ -72,7 +77,11 @@ void WorkerScriptLoader::loadAsynchronously(ScriptExecutionContext* scriptExecut
     if (!request)
         return;
 
-    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, DoNotSendLoadCallbacks, DoNotSniffContent, AllowStoredCredentials, crossOriginRedirectPolicy);
+    ThreadableLoaderOptions options;
+    options.allowCredentials = true;
+    options.crossOriginRequestPolicy = crossOriginRequestPolicy;
+
+    m_threadableLoader = ThreadableLoader::create(scriptExecutionContext, this, *request, options);
 }
 
 PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
diff --git a/WebCore/workers/WorkerScriptLoader.h b/WebCore/workers/WorkerScriptLoader.h
index 2924ec8..47623f6 100644
--- a/WebCore/workers/WorkerScriptLoader.h
+++ b/WebCore/workers/WorkerScriptLoader.h
@@ -46,8 +46,8 @@ namespace WebCore {
     public:
         WorkerScriptLoader();
 
-        void loadSynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRedirectPolicy);
-        void loadAsynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRedirectPolicy, WorkerScriptLoaderClient*);
+        void loadSynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy);
+        void loadAsynchronously(ScriptExecutionContext*, const KURL&, CrossOriginRequestPolicy, WorkerScriptLoaderClient*);
 
         void notifyError();
 
diff --git a/WebCore/workers/WorkerThread.cpp b/WebCore/workers/WorkerThread.cpp
index 86a5fa8..467157b 100644
--- a/WebCore/workers/WorkerThread.cpp
+++ b/WebCore/workers/WorkerThread.cpp
@@ -40,6 +40,21 @@
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
+
+static Mutex& threadCountMutex()
+{
+    AtomicallyInitializedStatic(Mutex&, mutex = *new Mutex);
+    return mutex;
+}
+
+unsigned WorkerThread::m_threadCount = 0;
+
+unsigned WorkerThread::workerThreadCount()
+{
+    MutexLocker lock(threadCountMutex());
+    return m_threadCount;
+}
+
 struct WorkerThreadStartupData : Noncopyable {
 public:
     static std::auto_ptr<WorkerThreadStartupData> create(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
@@ -56,20 +71,26 @@ private:
 
 WorkerThreadStartupData::WorkerThreadStartupData(const KURL& scriptURL, const String& userAgent, const String& sourceCode)
     : m_scriptURL(scriptURL.copy())
-    , m_userAgent(userAgent.copy())
-    , m_sourceCode(sourceCode.copy())
+    , m_userAgent(userAgent.crossThreadString())
+    , m_sourceCode(sourceCode.crossThreadString())
 {
 }
 
-WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy)
+WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const String& sourceCode, WorkerLoaderProxy& workerLoaderProxy, WorkerReportingProxy& workerReportingProxy)
     : m_threadID(0)
     , m_workerLoaderProxy(workerLoaderProxy)
+    , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode))
 {
+    MutexLocker lock(threadCountMutex());
+    m_threadCount++;
 }
 
 WorkerThread::~WorkerThread()
 {
+    MutexLocker lock(threadCountMutex());
+    ASSERT(m_threadCount > 0);
+    m_threadCount--;
 }
 
 bool WorkerThread::start()
diff --git a/WebCore/workers/WorkerThread.h b/WebCore/workers/WorkerThread.h
index a6b22dc..cb33308 100644
--- a/WebCore/workers/WorkerThread.h
+++ b/WebCore/workers/WorkerThread.h
@@ -37,9 +37,11 @@
 namespace WebCore {
 
     class KURL;
+    class NotificationPresenter;
     class String;
     class WorkerContext;
     class WorkerLoaderProxy;
+    class WorkerReportingProxy;
     struct WorkerThreadStartupData;
 
     class WorkerThread : public RefCounted<WorkerThread> {
@@ -52,9 +54,18 @@ namespace WebCore {
         ThreadIdentifier threadID() const { return m_threadID; }
         WorkerRunLoop& runLoop() { return m_runLoop; }
         WorkerLoaderProxy& workerLoaderProxy() const { return m_workerLoaderProxy; }
+        WorkerReportingProxy& workerReportingProxy() const { return m_workerReportingProxy; }
+
+        // Number of active worker threads.
+        static unsigned workerThreadCount();
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* getNotificationPresenter() { return m_notificationPresenter; }
+        void setNotificationPresenter(NotificationPresenter* presenter) { m_notificationPresenter = presenter; }
+#endif
 
     protected:
-        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&);
+        WorkerThread(const KURL&, const String& userAgent, const String& sourceCode, WorkerLoaderProxy&, WorkerReportingProxy&);
 
         // Factory method for creating a new worker context for the thread.
         virtual PassRefPtr<WorkerContext> createWorkerContext(const KURL& url, const String& userAgent) = 0;
@@ -72,11 +83,19 @@ namespace WebCore {
         ThreadIdentifier m_threadID;
         WorkerRunLoop m_runLoop;
         WorkerLoaderProxy& m_workerLoaderProxy;
+        WorkerReportingProxy& m_workerReportingProxy;
 
         RefPtr<WorkerContext> m_workerContext;
         Mutex m_threadCreationMutex;
 
         OwnPtr<WorkerThreadStartupData> m_startupData;
+
+#if ENABLE(NOTIFICATIONS)
+        NotificationPresenter* m_notificationPresenter;
+#endif
+
+        // Track the number of WorkerThread instances for use in layout tests.
+        static unsigned m_threadCount;
     };
 
 } // namespace WebCore
diff --git a/WebCore/wscript b/WebCore/wscript
index eeb0802..f183071 100644
--- a/WebCore/wscript
+++ b/WebCore/wscript
@@ -76,12 +76,11 @@ def set_options(opt):
 
 def configure(conf):
     common_configure(conf)
+    generate_webcore_derived_sources()
 
 def build(bld):
     import Options
 
-    generate_webcore_derived_sources()
-
     wk_includes = ['.', '..', 'DerivedSources',
                 wk_root, 
                 os.path.join(wk_root, 'JavaScriptCore'),
@@ -117,7 +116,7 @@ def build(bld):
         source = ' '.join(flattenSources(webcore_sources.values())),
         cxxflags = cxxflags,
         target = 'webcore',
-        uselib = 'WX ICU XML XSLT CURL ' + waf_configname,
+        uselib = 'WX ICU XML XSLT CURL ' + get_config(),
         uselib_local = '',
         install_path = output_dir,
         )
@@ -127,6 +126,11 @@ def build(bld):
         excludes = get_excludes(webcore_dir, ['*None.cpp', '*CF.cpp', '*Qt.cpp', '*Win.cpp', '*Wince.cpp', '*Gtk.cpp', '*Mac.cpp', '*Safari.cpp', '*Chromium*.cpp','*SVG*.cpp', '*AllInOne.cpp', 'test*bindings.*'])
         excludes.extend(['UserStyleSheetLoader.cpp', 'RenderMediaControls.cpp'])
 
+
+        # FIXME: undo this once these classes are fully implemented
+        excludes.append('SocketStreamErrorBase.cpp')
+        excludes.append('SocketStreamHandleBase.cpp')
+
         # intermediate sources
         excludes.append('CSSValueKeywords.c')
         excludes.append('CSSPropertyNames.cpp')
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 5e20252..ca48d8d 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -25,7 +25,6 @@
 #include "Cache.h"
 #include "CString.h"
 #include "CrossOriginAccessControl.h"
-#include "CrossOriginPreflightResultCache.h"
 #include "DOMImplementation.h"
 #include "Document.h"
 #include "Event.h"
@@ -45,6 +44,7 @@
 #include "XMLHttpRequestUpload.h"
 #include "markup.h"
 #include <wtf/StdLibExtras.h>
+#include <wtf/RefCountedLeakCounter.h>
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -52,6 +52,10 @@
 
 namespace WebCore {
 
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");
+#endif
+
 struct XMLHttpRequestStaticData {
     XMLHttpRequestStaticData();
     String m_proxyHeaderPrefix;
@@ -93,25 +97,25 @@ static bool isValidToken(const String& name)
     unsigned length = name.length();
     for (unsigned i = 0; i < length; i++) {
         UChar c = name[i];
-        
+
         if (c >= 127 || c <= 32)
             return false;
-        
+
         if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||
             c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||
             c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||
             c == '{' || c == '}')
             return false;
     }
-    
+
     return true;
 }
-    
+
 static bool isValidHeaderValue(const String& name)
 {
-    // FIXME: This should really match name against 
+    // FIXME: This should really match name against
     // field-value in section 4.2 of RFC 2616.
-        
+
     return !name.contains('\r') && !name.contains('\n');
 }
 
@@ -143,15 +147,18 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
     , m_responseText("")
     , m_createdDocument(false)
     , m_error(false)
+    , m_uploadEventsAllowed(true)
     , m_uploadComplete(false)
     , m_sameOriginRequest(true)
-    , m_inPreflight(false)
     , m_didTellLoaderAboutRequest(false)
     , m_receivedLength(0)
     , m_lastSendLineNumber(0)
     , m_exceptionCode(0)
 {
     initializeXMLHttpRequestStaticData();
+#ifndef NDEBUG
+    xmlHttpRequestCounter.increment();
+#endif
 }
 
 XMLHttpRequest::~XMLHttpRequest()
@@ -162,6 +169,10 @@ XMLHttpRequest::~XMLHttpRequest()
     }
     if (m_upload)
         m_upload->disconnectXMLHttpRequest();
+
+#ifndef NDEBUG
+    xmlHttpRequestCounter.decrement();
+#endif
 }
 
 Document* XMLHttpRequest::document() const
@@ -207,7 +218,7 @@ Document* XMLHttpRequest::responseXML() const
             m_responseXML->write(String(m_responseText));
             m_responseXML->finishParsing();
             m_responseXML->close();
-            
+
             if (!m_responseXML->wellFormed())
                 m_responseXML = 0;
         }
@@ -224,56 +235,6 @@ XMLHttpRequestUpload* XMLHttpRequest::upload()
     return m_upload.get();
 }
 
-void XMLHttpRequest::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-            if (*listenerIter == eventListener)
-                return;
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void XMLHttpRequest::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter)
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-}
-
-bool XMLHttpRequest::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
-{
-    // FIXME: check for other error conditions enumerated in the spec.
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(evt->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(evt.get(), false);
-    }
-
-    return !evt->defaultPrevented();
-}
-
 void XMLHttpRequest::changeState(State newState)
 {
     if (m_state != newState) {
@@ -287,10 +248,10 @@ void XMLHttpRequest::callReadyStateChangeListener()
     if (!scriptExecutionContext())
         return;
 
-    dispatchReadyStateChangeEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent));
 
     if (m_state == DONE && !m_error)
-        dispatchLoadEvent();
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
 }
 
 void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)
@@ -322,10 +283,10 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
         ec = SYNTAX_ERR;
         return;
     }
-    
+
     // Method names are case sensitive. But since Firefox uppercases method names it knows, we'll do the same.
     String methodUpper(method.upper());
-    
+
     if (methodUpper == "TRACE" || methodUpper == "TRACK" || methodUpper == "CONNECT") {
         ec = SECURITY_ERR;
         return;
@@ -335,7 +296,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, Exc
 
     if (methodUpper == "COPY" || methodUpper == "DELETE" || methodUpper == "GET" || methodUpper == "HEAD"
         || methodUpper == "INDEX" || methodUpper == "LOCK" || methodUpper == "M-POST" || methodUpper == "MKCOL" || methodUpper == "MOVE"
-        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT" 
+        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT"
         || methodUpper == "UNLOCK")
         m_method = methodUpper;
     else
@@ -357,7 +318,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
 {
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -366,7 +327,7 @@ void XMLHttpRequest::open(const String& method, const KURL& url, bool async, con
     KURL urlWithCredentials(url);
     urlWithCredentials.setUser(user);
     urlWithCredentials.setPass(password);
-    
+
     open(method, urlWithCredentials, async, ec);
 }
 
@@ -463,34 +424,23 @@ void XMLHttpRequest::send(File* body, ExceptionCode& ec)
 
 void XMLHttpRequest::createRequest(ExceptionCode& ec)
 {
-    // Upload event listeners should be disallowed for simple cross-origin requests, because POSTing to an URL that does not
-    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all. If a listener exists
-    // when creating the request, it will force preflight.
+    // The presence of upload event listeners forces us to use preflighting because POSTing to an URL that does not
+    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all.
     // Also, only async requests support upload progress events.
-    m_uploadEventsAllowed = false;
+    bool forcePreflight = false;
     if (m_async) {
-        dispatchLoadStartEvent();
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
         if (m_requestEntityBody && m_upload) {
-            m_uploadEventsAllowed = m_upload->hasListeners();
-            m_upload->dispatchLoadStartEvent();
+            forcePreflight = m_upload->hasEventListeners();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));
         }
     }
 
     m_sameOriginRequest = scriptExecutionContext()->securityOrigin()->canRequest(m_url);
 
-    if (!m_sameOriginRequest) {
-        makeCrossOriginAccessRequest(ec);
-        return;
-    }
-
-    m_uploadEventsAllowed = true;
-
-    makeSameOriginRequest(ec);
-}
-
-void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
-{
-    ASSERT(m_sameOriginRequest);
+    // We also remember whether upload events should be allowed for this request in case the upload listeners are
+    // added after the request is started.
+    m_uploadEventsAllowed = !isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders);
 
     ResourceRequest request(m_url);
     request.setHTTPMethod(m_method);
@@ -504,202 +454,49 @@ void XMLHttpRequest::makeSameOriginRequest(ExceptionCode& ec)
     if (m_requestHeaders.size() > 0)
         request.addHTTPHeaderFields(m_requestHeaders);
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::makeCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(!m_sameOriginRequest);
-
-    if (!m_uploadEventsAllowed && isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders))
-        makeSimpleCrossOriginAccessRequest(ec);
-    else
-        makeCrossOriginAccessRequestWithPreflight(ec);
-}
-
-void XMLHttpRequest::makeSimpleCrossOriginAccessRequest(ExceptionCode& ec)
-{
-    ASSERT(isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders));
-
-    // Cross-origin requests are only defined for HTTP. We would catch this when checking response headers later, but there is no reason to send a request that's guaranteed to be denied.
-    if (!m_url.protocolInHTTPFamily()) {
-        ec = XMLHttpRequestException::NETWORK_ERR;
-        networkError();
-        return;
-    }
-
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
+    ThreadableLoaderOptions options;
+    options.sendLoadCallbacks = true;
+    options.sniffContent = false;
+    options.forcePreflight = forcePreflight;
+    options.allowCredentials = m_sameOriginRequest || m_includeCredentials;
+    options.crossOriginRequestPolicy = UseAccessControl;
 
-    if (m_async)
-        loadRequestAsynchronously(request);
-    else
-        loadRequestSynchronously(request, ec);
-}
+    m_exceptionCode = 0;
+    m_error = false;
 
-void XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight(ExceptionCode& ec)
-{
-    String origin = scriptExecutionContext()->securityOrigin()->toString();
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    if (!CrossOriginPreflightResultCache::shared().canSkipPreflight(origin, url, m_includeCredentials, m_method, m_requestHeaders)) {
-        m_inPreflight = true;
-        ResourceRequest preflightRequest(url);
-        preflightRequest.setHTTPMethod("OPTIONS");
-        preflightRequest.setHTTPHeaderField("Origin", origin);
-        preflightRequest.setHTTPHeaderField("Access-Control-Request-Method", m_method);
-
-        if (m_requestHeaders.size() > 0) {
-            Vector<UChar> headerBuffer;
-            HTTPHeaderMap::const_iterator it = m_requestHeaders.begin();
-            append(headerBuffer, it->first);
-            ++it;
-
-            HTTPHeaderMap::const_iterator end = m_requestHeaders.end();
-            for (; it != end; ++it) {
-                headerBuffer.append(',');
-                headerBuffer.append(' ');
-                append(headerBuffer, it->first);
+    if (m_async) {
+        if (m_upload)
+            request.setReportUploadProgress(true);
+
+        // ThreadableLoader::create can return null here, for example if we're no longer attached to a page.
+        // This is true while running onunload handlers.
+        // FIXME: Maybe we need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
+        // FIXME: Maybe create() can return null for other reasons too?
+        m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, options);
+        if (m_loader) {
+            // Neither this object nor the JavaScript wrapper should be deleted while
+            // a request is in progress because we need to keep the listeners alive,
+            // and they are referenced by the JavaScript wrapper.
+            setPendingActivity(this);
+
+            // For now we should only balance the nonCached request count for main-thread XHRs and not
+            // Worker XHRs, as the Cache is not thread-safe.
+            // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
+            if (!scriptExecutionContext()->isWorkerContext()) {
+                ASSERT(isMainThread());
+                ASSERT(!m_didTellLoaderAboutRequest);
+                cache()->loader()->nonCacheRequestInFlight(m_url);
+                m_didTellLoaderAboutRequest = true;
             }
-
-            preflightRequest.setHTTPHeaderField("Access-Control-Request-Headers", String::adopt(headerBuffer));
-            preflightRequest.addHTTPHeaderFields(m_requestHeaders);
-        }
-
-        if (m_async) {
-            m_uploadEventsAllowed = true;
-            loadRequestAsynchronously(preflightRequest);
-            return;
         }
+    } else
+        ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, options);
 
-        loadRequestSynchronously(preflightRequest, ec);
-        m_inPreflight = false;
-
-        if (ec)
-            return;
-    }
-
-    // Send the actual request.
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPHeaderField("Origin", origin);
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    if (m_async) {
-        m_uploadEventsAllowed = true;
-        loadRequestAsynchronously(request);
-        return;
-    }
-
-    loadRequestSynchronously(request, ec);
-}
-
-void XMLHttpRequest::handleAsynchronousPreflightResult()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(m_async);
-
-    m_inPreflight = false;
-
-    KURL url = m_url;
-    url.setUser(String());
-    url.setPass(String());
-
-    ResourceRequest request(url);
-    request.setHTTPMethod(m_method);
-    request.setAllowHTTPCookies(m_includeCredentials);
-    request.setHTTPOrigin(scriptExecutionContext()->securityOrigin()->toString());
-
-    if (m_requestHeaders.size() > 0)
-        request.addHTTPHeaderFields(m_requestHeaders);
-
-    if (m_requestEntityBody) {
-        ASSERT(m_method != "GET");
-        ASSERT(m_method != "HEAD");
-        request.setHTTPBody(m_requestEntityBody.release());
-    }
-
-    m_uploadEventsAllowed = true;
-    loadRequestAsynchronously(request);
-}
-
-void XMLHttpRequest::loadRequestSynchronously(ResourceRequest& request, ExceptionCode& ec)
-{
-    ASSERT(!m_async);
-
-    m_loader = 0;
-    m_exceptionCode = 0;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    ThreadableLoader::loadResourceSynchronously(scriptExecutionContext(), request, *this, storedCredentials);
     if (!m_exceptionCode && m_error)
         m_exceptionCode = XMLHttpRequestException::NETWORK_ERR;
     ec = m_exceptionCode;
 }
 
-void XMLHttpRequest::loadRequestAsynchronously(ResourceRequest& request)
-{
-    ASSERT(m_async);
-    m_exceptionCode = 0;
-    // SubresourceLoader::create can return null here, for example if we're no longer attached to a page.
-    // This is true while running onunload handlers.
-    // FIXME: We need to be able to send XMLHttpRequests from onunload, <http://bugs.webkit.org/show_bug.cgi?id=10904>.
-    // FIXME: Maybe create can return null for other reasons too?
-    LoadCallbacks callbacks = m_inPreflight ? DoNotSendLoadCallbacks : SendLoadCallbacks;
-    StoredCredentials storedCredentials = (m_sameOriginRequest || m_includeCredentials) ? AllowStoredCredentials : DoNotAllowStoredCredentials;
-
-    if (m_upload)
-        request.setReportUploadProgress(true);
-
-    m_loader = ThreadableLoader::create(scriptExecutionContext(), this, request, callbacks, DoNotSniffContent, storedCredentials, DenyCrossOriginRedirect);
-
-    if (m_loader) {
-        // Neither this object nor the JavaScript wrapper should be deleted while
-        // a request is in progress because we need to keep the listeners alive,
-        // and they are referenced by the JavaScript wrapper.
-        setPendingActivity(this);
-        
-        // For now we should only balance the nonCached request count for main-thread XHRs and not
-        // Worker XHRs, as the Cache is not thread-safe.
-        // This will become irrelevant after https://bugs.webkit.org/show_bug.cgi?id=27165 is resolved.
-        if (!scriptExecutionContext()->isWorkerContext()) {
-            ASSERT(isMainThread());
-            ASSERT(!m_didTellLoaderAboutRequest);
-            cache()->loader()->nonCacheRequestInFlight(m_url);
-            m_didTellLoaderAboutRequest = true;
-        }
-    }
-}
-
 void XMLHttpRequest::abort()
 {
     // internalAbort() calls dropProtection(), which may release the last reference.
@@ -709,9 +506,13 @@ void XMLHttpRequest::abort()
 
     internalAbort();
 
+    m_responseText = "";
+    m_createdDocument = false;
+    m_responseXML = 0;
+
     // Clear headers as required by the spec
     m_requestHeaders.clear();
-    
+
     if ((m_state <= OPENED && !sendFlag) || m_state == DONE)
         m_state = UNSENT;
     else {
@@ -720,11 +521,11 @@ void XMLHttpRequest::abort()
         m_state = UNSENT;
     }
 
-    dispatchAbortEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchAbortEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
@@ -774,11 +575,11 @@ void XMLHttpRequest::genericError()
 void XMLHttpRequest::networkError()
 {
     genericError();
-    dispatchErrorEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchErrorEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().errorEvent));
     }
     internalAbort();
 }
@@ -786,15 +587,15 @@ void XMLHttpRequest::networkError()
 void XMLHttpRequest::abortError()
 {
     genericError();
-    dispatchAbortEvent();
+    dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     if (!m_uploadComplete) {
         m_uploadComplete = true;
         if (m_upload && m_uploadEventsAllowed)
-            m_upload->dispatchAbortEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().abortEvent));
     }
 }
 
-void XMLHttpRequest::dropProtection()        
+void XMLHttpRequest::dropProtection()
 {
 #if USE(JSC)
     // The XHR object itself holds on to the responseText, and
@@ -854,7 +655,7 @@ void XMLHttpRequest::setRequestHeader(const AtomicString& name, const String& va
 
 void XMLHttpRequest::setRequestHeaderInternal(const AtomicString& name, const String& value)
 {
-    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value); 
+    pair<HTTPHeaderMap::iterator, bool> result = m_requestHeaders.add(name, value);
     if (!result.second)
         result.first->second += ", " + value;
 }
@@ -872,7 +673,7 @@ String XMLHttpRequest::getRequestHeader(const AtomicString& name) const
 
 String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
         return "";
     }
@@ -906,25 +707,21 @@ String XMLHttpRequest::getAllResponseHeaders(ExceptionCode& ec) const
 
 String XMLHttpRequest::getResponseHeader(const AtomicString& name, ExceptionCode& ec) const
 {
-    if (m_state < LOADING) {
+    if (m_state < HEADERS_RECEIVED) {
         ec = INVALID_STATE_ERR;
-        return "";
+        return String();
     }
 
-    if (!isValidToken(name))
-        return "";
-
     // See comment in getAllResponseHeaders above.
     if (isSetCookieHeader(name) && !scriptExecutionContext()->securityOrigin()->canLoadLocalResources()) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
 
     if (!m_sameOriginRequest && !isOnAccessControlResponseHeaderWhitelist(name)) {
         reportUnsafeUsage(scriptExecutionContext(), "Refused to get unsafe header \"" + name + "\"");
-        return "";
+        return String();
     }
-
     return m_response.httpHeaderField(name);
 }
 
@@ -939,7 +736,7 @@ String XMLHttpRequest::responseMIMEType() const
     }
     if (mimeType.isEmpty())
         mimeType = "text/xml";
-    
+
     return mimeType;
 }
 
@@ -981,7 +778,7 @@ void XMLHttpRequest::didFail(const ResourceError& error)
         cache()->loader()->nonCacheRequestComplete(m_url);
         m_didTellLoaderAboutRequest = false;
     }
-    
+
     // If we are already in an error state, for instance we called abort(), bail out early.
     if (m_error)
         return;
@@ -1011,11 +808,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
     if (m_error)
         return;
 
-    if (m_inPreflight) {
-        didFinishLoadingPreflight();
-        return;
-    }
-
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
 
@@ -1023,7 +815,9 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         m_responseText += m_decoder->flush();
 
     scriptExecutionContext()->resourceRetrievedByXMLHttpRequest(identifier, m_responseText);
+#if ENABLE(INSPECTOR)
     scriptExecutionContext()->addMessage(InspectorControllerDestination, JSMessageSource, LogMessageType, LogMessageLevel, "XHR finished loading: \"" + m_url + "\".", m_lastSendLineNumber, m_lastSendURL);
+#endif
 
     bool hadLoader = m_loader;
     m_loader = 0;
@@ -1035,75 +829,29 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         dropProtection();
 }
 
-void XMLHttpRequest::didFinishLoadingPreflight()
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    // FIXME: this can probably be moved to didReceiveResponsePreflight.
-    if (m_async)
-        handleAsynchronousPreflightResult();
-
-    if (m_loader)
-        unsetPendingActivity(this);
-}
-
 void XMLHttpRequest::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
 {
     if (!m_upload)
         return;
 
     if (m_uploadEventsAllowed)
-        m_upload->dispatchProgressEvent(bytesSent, totalBytesToBeSent);
+        m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, true, static_cast<unsigned>(bytesSent), static_cast<unsigned>(totalBytesToBeSent)));
 
     if (bytesSent == totalBytesToBeSent && !m_uploadComplete) {
         m_uploadComplete = true;
         if (m_uploadEventsAllowed)
-            m_upload->dispatchLoadEvent();
+            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
     }
 }
 
 void XMLHttpRequest::didReceiveResponse(const ResourceResponse& response)
 {
-    if (m_inPreflight) {
-        didReceiveResponsePreflight(response);
-        return;
-    }
-
-    if (!m_sameOriginRequest) {
-        if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-            networkError();
-            return;
-        }
-    }
-
     m_response = response;
     m_responseEncoding = extractCharsetFromMediaType(m_mimeTypeOverride);
     if (m_responseEncoding.isEmpty())
         m_responseEncoding = response.textEncodingName();
 }
 
-void XMLHttpRequest::didReceiveResponsePreflight(const ResourceResponse& response)
-{
-    ASSERT(m_inPreflight);
-    ASSERT(!m_sameOriginRequest);
-
-    if (!passesAccessControlCheck(response, m_includeCredentials, scriptExecutionContext()->securityOrigin())) {
-        networkError();
-        return;
-    }
-
-    OwnPtr<CrossOriginPreflightResultCacheItem> preflightResult(new CrossOriginPreflightResultCacheItem(m_includeCredentials));
-    if (!preflightResult->parse(response)
-        || !preflightResult->allowsCrossOriginMethod(m_method)
-        || !preflightResult->allowsCrossOriginHeaders(m_requestHeaders)) {
-        networkError();
-        return;
-    }
-
-    CrossOriginPreflightResultCache::shared().appendEntry(scriptExecutionContext()->securityOrigin()->toString(), m_url, preflightResult.release());
-}
-
 void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse& failureResponse)
 {
     m_response = failureResponse;
@@ -1111,12 +859,12 @@ void XMLHttpRequest::didReceiveAuthenticationCancellation(const ResourceResponse
 
 void XMLHttpRequest::didReceiveData(const char* data, int len)
 {
-    if (m_inPreflight || m_error)
+    if (m_error)
         return;
 
     if (m_state < HEADERS_RECEIVED)
         changeState(HEADERS_RECEIVED);
-  
+
     if (!m_decoder) {
         if (!m_responseEncoding.isEmpty())
             m_decoder = TextResourceDecoder::create("text/plain", m_responseEncoding);
@@ -1140,7 +888,12 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     m_responseText += m_decoder->decode(data, len);
 
     if (!m_error) {
-        updateAndDispatchOnProgress(len);
+        long long expectedLength = m_response.expectedContentLength();
+        m_receivedLength += len;
+
+        // FIXME: the spec requires that we dispatch the event according to the least
+        // frequent method between every 350ms (+/-200ms) and for every byte received.
+        dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength)));
 
         if (m_state != LOADING)
             changeState(LOADING);
@@ -1150,70 +903,6 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     }
 }
 
-void XMLHttpRequest::updateAndDispatchOnProgress(unsigned int len)
-{
-    long long expectedLength = m_response.expectedContentLength();
-    m_receivedLength += len;
-
-    // FIXME: the spec requires that we dispatch the event according to the least
-    // frequent method between every 350ms (+/-200ms) and for every byte received.
-    dispatchProgressEvent(expectedLength);
-}
-
-void XMLHttpRequest::dispatchReadyStateChangeEvent()
-{
-    RefPtr<Event> evt = Event::create(eventNames().readystatechangeEvent, false, false);
-    if (m_onReadyStateChangeListener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onReadyStateChangeListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequest::dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
-{
-    RefPtr<XMLHttpRequestProgressEvent> evt = XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total);
-    if (listener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequest::dispatchAbortEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onAbortListener.get(), eventNames().abortEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchErrorEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onErrorListener.get(), eventNames().errorEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchLoadEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadListener.get(), eventNames().loadEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchLoadStartEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadStartListener.get(), eventNames().loadstartEvent, false, 0, 0);
-}
-
-void XMLHttpRequest::dispatchProgressEvent(long long expectedLength)
-{
-    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, expectedLength && m_receivedLength <= expectedLength, 
-                                        static_cast<unsigned>(m_receivedLength), static_cast<unsigned>(expectedLength));
-}
-
 bool XMLHttpRequest::canSuspend() const
 {
     return !m_loader;
@@ -1235,4 +924,14 @@ ScriptExecutionContext* XMLHttpRequest::scriptExecutionContext() const
     return ActiveDOMObject::scriptExecutionContext();
 }
 
-} // namespace WebCore 
+EventTargetData* XMLHttpRequest::eventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+EventTargetData* XMLHttpRequest::ensureEventTargetData()
+{
+    return &m_eventTargetData;
+}
+
+} // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index d581d3d..30744a0 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -23,6 +23,7 @@
 #include "ActiveDOMObject.h"
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include "FormData.h"
 #include "ResourceResponse.h"
@@ -85,41 +86,23 @@ public:
     XMLHttpRequestUpload* upload();
     XMLHttpRequestUpload* optionalUpload() const { return m_upload.get(); }
 
-    void setOnreadystatechange(PassRefPtr<EventListener> eventListener) { m_onReadyStateChangeListener = eventListener; }
-    EventListener* onreadystatechange() const { return m_onReadyStateChangeListener.get(); }
-
-    void setOnabort(PassRefPtr<EventListener> eventListener) { m_onAbortListener = eventListener; }
-    EventListener* onabort() const { return m_onAbortListener.get(); }
-
-    void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-    EventListener* onerror() const { return m_onErrorListener.get(); }
-
-    void setOnload(PassRefPtr<EventListener> eventListener) { m_onLoadListener = eventListener; }
-    EventListener* onload() const { return m_onLoadListener.get(); }
-
-    void setOnloadstart(PassRefPtr<EventListener> eventListener) { m_onLoadStartListener = eventListener; }
-    EventListener* onloadstart() const { return m_onLoadStartListener.get(); }
-
-    void setOnprogress(PassRefPtr<EventListener> eventListener) { m_onProgressListener = eventListener; }
-    EventListener* onprogress() const { return m_onProgressListener.get(); }
-
-    typedef Vector<RefPtr<EventListener> > ListenerVector;
-    typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-
-    // useCapture is not used, even for add/remove pairing (for Firefox compatibility).
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    EventListenersMap& eventListeners() { return m_eventListeners; }
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(readystatechange);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
 
     using RefCounted<XMLHttpRequest>::ref;
     using RefCounted<XMLHttpRequest>::deref;
 
 private:
     XMLHttpRequest(ScriptExecutionContext*);
-    
+
     virtual void refEventTarget() { ref(); }
     virtual void derefEventTarget() { deref(); }
+    virtual EventTargetData* eventTargetData();
+    virtual EventTargetData* ensureEventTargetData();
 
     Document* document() const;
 
@@ -135,12 +118,6 @@ private:
     virtual void didFailRedirectCheck();
     virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
 
-    // Special versions for the preflight
-    void didReceiveResponsePreflight(const ResourceResponse&);
-    void didFinishLoadingPreflight();
-
-    void updateAndDispatchOnProgress(unsigned int len);
-
     String responseMIMEType() const;
     bool responseIsXML() const;
 
@@ -159,36 +136,10 @@ private:
 
     void createRequest(ExceptionCode&);
 
-    void makeSameOriginRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequest(ExceptionCode&);
-
-    void makeSimpleCrossOriginAccessRequest(ExceptionCode&);
-    void makeCrossOriginAccessRequestWithPreflight(ExceptionCode&);
-    void handleAsynchronousPreflightResult();
-
-    void loadRequestSynchronously(ResourceRequest&, ExceptionCode&);
-    void loadRequestAsynchronously(ResourceRequest&);
-
     void genericError();
     void networkError();
     void abortError();
 
-    void dispatchReadyStateChangeEvent();
-    void dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total);
-    void dispatchAbortEvent();
-    void dispatchErrorEvent();
-    void dispatchLoadEvent();
-    void dispatchLoadStartEvent();
-    void dispatchProgressEvent(long long expectedLength);
-
-    RefPtr<EventListener> m_onReadyStateChangeListener;
-    RefPtr<EventListener> m_onAbortListener;
-    RefPtr<EventListener> m_onErrorListener;
-    RefPtr<EventListener> m_onLoadListener;
-    RefPtr<EventListener> m_onLoadStartListener;
-    RefPtr<EventListener> m_onProgressListener;
-    EventListenersMap m_eventListeners;
-
     RefPtr<XMLHttpRequestUpload> m_upload;
 
     KURL m_url;
@@ -223,16 +174,16 @@ private:
     bool m_uploadComplete;
 
     bool m_sameOriginRequest;
-    bool m_allowAccess;
-    bool m_inPreflight;
     bool m_didTellLoaderAboutRequest;
 
     // Used for onprogress tracking
     long long m_receivedLength;
-    
+
     unsigned m_lastSendLineNumber;
     String m_lastSendURL;
     ExceptionCode m_exceptionCode;
+    
+    EventTargetData m_eventTargetData;
 };
 
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequest.idl b/WebCore/xml/XMLHttpRequest.idl
index 79005e2..89d9c7f 100644
--- a/WebCore/xml/XMLHttpRequest.idl
+++ b/WebCore/xml/XMLHttpRequest.idl
@@ -30,6 +30,7 @@ module xml {
 
     interface [
         CustomMarkFunction,
+        EventTarget,
         NoStaticTables
     ] XMLHttpRequest {
         // From XMLHttpRequestEventTarget
diff --git a/WebCore/xml/XMLHttpRequestProgressEvent.h b/WebCore/xml/XMLHttpRequestProgressEvent.h
index 02bfdea..27f3b8c 100644
--- a/WebCore/xml/XMLHttpRequestProgressEvent.h
+++ b/WebCore/xml/XMLHttpRequestProgressEvent.h
@@ -37,7 +37,7 @@ namespace WebCore {
         {
             return adoptRef(new XMLHttpRequestProgressEvent);
         }
-        static PassRefPtr<XMLHttpRequestProgressEvent> create(const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
+        static PassRefPtr<XMLHttpRequestProgressEvent> create(const AtomicString& type, bool lengthComputable = false, unsigned loaded = 0, unsigned total = 0)
         {
             return adoptRef(new XMLHttpRequestProgressEvent(type, lengthComputable, loaded, total));
         }
diff --git a/WebCore/xml/XMLHttpRequestUpload.cpp b/WebCore/xml/XMLHttpRequestUpload.cpp
index d8a76d5..9d0fafc 100644
--- a/WebCore/xml/XMLHttpRequestUpload.cpp
+++ b/WebCore/xml/XMLHttpRequestUpload.cpp
@@ -41,11 +41,6 @@ XMLHttpRequestUpload::XMLHttpRequestUpload(XMLHttpRequest* xmlHttpRequest)
 {
 }
 
-bool XMLHttpRequestUpload::hasListeners() const
-{
-    return m_onAbortListener || m_onErrorListener || m_onLoadListener || m_onLoadStartListener || m_onProgressListener || !m_eventListeners.isEmpty();
-}
-
 ScriptExecutionContext* XMLHttpRequestUpload::scriptExecutionContext() const
 {
     XMLHttpRequest* xmlHttpRequest = associatedXMLHttpRequest();
@@ -54,95 +49,14 @@ ScriptExecutionContext* XMLHttpRequestUpload::scriptExecutionContext() const
     return xmlHttpRequest->scriptExecutionContext();
 }
 
-void XMLHttpRequestUpload::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end()) {
-        ListenerVector listeners;
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    } else {
-        ListenerVector& listeners = iter->second;
-        for (ListenerVector::iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-            if (*listenerIter == eventListener)
-                return;
-        }
-        
-        listeners.append(eventListener);
-        m_eventListeners.add(eventType, listeners);
-    }
-}
-
-void XMLHttpRequestUpload::removeEventListener(const AtomicString& eventType, EventListener* eventListener, bool)
-{
-    EventListenersMap::iterator iter = m_eventListeners.find(eventType);
-    if (iter == m_eventListeners.end())
-        return;
-
-    ListenerVector& listeners = iter->second;
-    for (ListenerVector::const_iterator listenerIter = listeners.begin(); listenerIter != listeners.end(); ++listenerIter) {
-        if (*listenerIter == eventListener) {
-            listeners.remove(listenerIter - listeners.begin());
-            return;
-        }
-    }
-}
-
-bool XMLHttpRequestUpload::dispatchEvent(PassRefPtr<Event> evt, ExceptionCode& ec)
-{
-    // FIXME: check for other error conditions enumerated in the spec.
-    if (!evt || evt->type().isEmpty()) {
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return true;
-    }
-
-    ListenerVector listenersCopy = m_eventListeners.get(evt->type());
-    for (ListenerVector::const_iterator listenerIter = listenersCopy.begin(); listenerIter != listenersCopy.end(); ++listenerIter) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listenerIter->get()->handleEvent(evt.get(), false);
-    }
-
-    return !evt->defaultPrevented();
-}
-
-void XMLHttpRequestUpload::dispatchXMLHttpRequestProgressEvent(EventListener* listener, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total)
-{
-    RefPtr<XMLHttpRequestProgressEvent> evt = XMLHttpRequestProgressEvent::create(type, lengthComputable, loaded, total);
-    if (listener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        listener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
-void XMLHttpRequestUpload::dispatchAbortEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onAbortListener.get(), eventNames().abortEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchErrorEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onErrorListener.get(), eventNames().errorEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchLoadEvent()
-{
-    dispatchXMLHttpRequestProgressEvent(m_onLoadListener.get(), eventNames().loadEvent, false, 0, 0);
-}
-
-void XMLHttpRequestUpload::dispatchLoadStartEvent()
+EventTargetData* XMLHttpRequestUpload::eventTargetData()
 {
-    dispatchXMLHttpRequestProgressEvent(m_onLoadStartListener.get(), eventNames().loadstartEvent, false, 0, 0);
+    return &m_eventTargetData;
 }
 
-void XMLHttpRequestUpload::dispatchProgressEvent(long long bytesSent, long long totalBytesToBeSent)
+EventTargetData* XMLHttpRequestUpload::ensureEventTargetData()
 {
-    dispatchXMLHttpRequestProgressEvent(m_onProgressListener.get(), eventNames().progressEvent, true, static_cast<unsigned>(bytesSent), static_cast<unsigned>(totalBytesToBeSent));
+    return &m_eventTargetData;
 }
 
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequestUpload.h b/WebCore/xml/XMLHttpRequestUpload.h
index b4f40e0..7640643 100644
--- a/WebCore/xml/XMLHttpRequestUpload.h
+++ b/WebCore/xml/XMLHttpRequestUpload.h
@@ -28,6 +28,7 @@
 
 #include "AtomicStringHash.h"
 #include "EventListener.h"
+#include "EventNames.h"
 #include "EventTarget.h"
 #include <wtf/HashMap.h>
 #include <wtf/RefCounted.h>
@@ -48,8 +49,6 @@ namespace WebCore {
             return adoptRef(new XMLHttpRequestUpload(xmlHttpRequest));
         }
 
-        bool hasListeners() const;
-
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload() { return this; }
 
         XMLHttpRequest* associatedXMLHttpRequest() const { return m_xmlHttpRequest; }
@@ -57,34 +56,11 @@ namespace WebCore {
 
         ScriptExecutionContext* scriptExecutionContext() const;
 
-        void dispatchAbortEvent();
-        void dispatchErrorEvent();
-        void dispatchLoadEvent();
-        void dispatchLoadStartEvent();
-        void dispatchProgressEvent(long long bytesSent, long long totalBytesToBeSent);
-
-        void setOnabort(PassRefPtr<EventListener> eventListener) { m_onAbortListener = eventListener; }
-        EventListener* onabort() const { return m_onAbortListener.get(); }
-
-        void setOnerror(PassRefPtr<EventListener> eventListener) { m_onErrorListener = eventListener; }
-        EventListener* onerror() const { return m_onErrorListener.get(); }
-
-        void setOnload(PassRefPtr<EventListener> eventListener) { m_onLoadListener = eventListener; }
-        EventListener* onload() const { return m_onLoadListener.get(); }
-
-        void setOnloadstart(PassRefPtr<EventListener> eventListener) { m_onLoadStartListener = eventListener; }
-        EventListener* onloadstart() const { return m_onLoadStartListener.get(); }
-
-        void setOnprogress(PassRefPtr<EventListener> eventListener) { m_onProgressListener = eventListener; }
-        EventListener* onprogress() const { return m_onProgressListener.get(); }
-
-        typedef Vector<RefPtr<EventListener> > ListenerVector;
-        typedef HashMap<AtomicString, ListenerVector> EventListenersMap;
-
-        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-        EventListenersMap& eventListeners() { return m_eventListeners; }
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart);
+        DEFINE_ATTRIBUTE_EVENT_LISTENER(progress);
 
         using RefCounted<XMLHttpRequestUpload>::ref;
         using RefCounted<XMLHttpRequestUpload>::deref;
@@ -92,19 +68,13 @@ namespace WebCore {
     private:
         XMLHttpRequestUpload(XMLHttpRequest*);
 
-        void dispatchXMLHttpRequestProgressEvent(EventListener*, const AtomicString& type, bool lengthComputable, unsigned loaded, unsigned total);
-
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
-
-        RefPtr<EventListener> m_onAbortListener;
-        RefPtr<EventListener> m_onErrorListener;
-        RefPtr<EventListener> m_onLoadListener;
-        RefPtr<EventListener> m_onLoadStartListener;
-        RefPtr<EventListener> m_onProgressListener;
-        EventListenersMap m_eventListeners;
+        virtual EventTargetData* eventTargetData();
+        virtual EventTargetData* ensureEventTargetData();
 
         XMLHttpRequest* m_xmlHttpRequest;
+        EventTargetData m_eventTargetData;
     };
     
 } // namespace WebCore
diff --git a/WebCore/xml/XMLHttpRequestUpload.idl b/WebCore/xml/XMLHttpRequestUpload.idl
index 3172f68..901b47c 100644
--- a/WebCore/xml/XMLHttpRequestUpload.idl
+++ b/WebCore/xml/XMLHttpRequestUpload.idl
@@ -29,8 +29,9 @@
 module xml {
 
     interface [
-        GenerateConstructor,
         CustomMarkFunction,
+        EventTarget,
+        GenerateConstructor,
         NoStaticTables
     ] XMLHttpRequestUpload {
         // From XMLHttpRequestEventTarget
diff --git a/WebCore/xml/XPathNamespace.cpp b/WebCore/xml/XPathNamespace.cpp
index 3c8c42c..9646402 100644
--- a/WebCore/xml/XPathNamespace.cpp
+++ b/WebCore/xml/XPathNamespace.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,18 +33,14 @@
 
 namespace WebCore {
 
-XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri)
-    : Node(ownerElement->document())
+XPathNamespace::XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri)
+    : Node(ownerElement->document(), CreateOther)
     , m_ownerElement(ownerElement)
     , m_prefix(prefix)
     , m_uri(uri)
 {
 }
 
-XPathNamespace::~XPathNamespace()
-{
-}
-
 Document* XPathNamespace::ownerDocument() const
 {
     return m_ownerElement->ownerDocument();
diff --git a/WebCore/xml/XPathNamespace.h b/WebCore/xml/XPathNamespace.h
index c0e4280..996cb9a 100644
--- a/WebCore/xml/XPathNamespace.h
+++ b/WebCore/xml/XPathNamespace.h
@@ -1,6 +1,6 @@
 /*
  * Copyright 2005 Frerich Raabe <raabe@kde.org>
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,11 @@
 
 namespace WebCore {
 
-    class Document;
-    class Element;
+    // FIXME: This class is never instantiated. Maybe it should be removed.
 
     class XPathNamespace : public Node {
-    public:
-        XPathNamespace(PassRefPtr<Element> ownerElement, const String& prefix, const String& uri);
-        virtual ~XPathNamespace();
+    private:
+        XPathNamespace(PassRefPtr<Element> ownerElement, const AtomicString& prefix, const AtomicString& uri);
 
         virtual Document* ownerDocument() const;
         virtual Element* ownerElement() const;
@@ -50,9 +48,8 @@ namespace WebCore {
         virtual String nodeValue() const;
         virtual const AtomicString& namespaceURI() const;
 
-        virtual Node::NodeType nodeType() const;
+        virtual NodeType nodeType() const;
 
-    private:
         RefPtr<Element> m_ownerElement;
         AtomicString m_prefix;
         AtomicString m_uri;
diff --git a/WebCore/xml/XSLImportRule.cpp b/WebCore/xml/XSLImportRule.cpp
index 6ceb108..b697c0d 100644
--- a/WebCore/xml/XSLImportRule.cpp
+++ b/WebCore/xml/XSLImportRule.cpp
@@ -89,7 +89,7 @@ void XSLImportRule::loadSheet()
     XSLStyleSheet* parentSheet = parentStyleSheet();
     if (!parentSheet->href().isNull())
         // use parent styleheet's URL as the base URL
-        absHref = KURL(KURL(parentSheet->href()), m_strHref).string();
+        absHref = KURL(KURL(ParsedURLString, parentSheet->href()), m_strHref).string();
     
     // Check for a cycle in our import chain.  If we encounter a stylesheet
     // in our parent chain with the same URL, then just bail.
diff --git a/WebCore/xml/XSLStyleSheet.h b/WebCore/xml/XSLStyleSheet.h
index fe97b54..c9729bb 100644
--- a/WebCore/xml/XSLStyleSheet.h
+++ b/WebCore/xml/XSLStyleSheet.h
@@ -26,8 +26,12 @@
 #if ENABLE(XSLT)
 
 #include "StyleSheet.h"
+
+#if !USE(QXMLQUERY)
 #include <libxml/parser.h>
 #include <libxslt/transform.h>
+#endif
+
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
@@ -38,10 +42,12 @@ class XSLImportRule;
     
 class XSLStyleSheet : public StyleSheet {
 public:
+#if !USE(QXMLQUERY)
     static PassRefPtr<XSLStyleSheet> create(XSLImportRule* parentImport, const String& href)
     {
         return adoptRef(new XSLStyleSheet(parentImport, href));
     }
+#endif
     static PassRefPtr<XSLStyleSheet> create(Node* parentNode, const String& href)
     {
         return adoptRef(new XSLStyleSheet(parentNode, href, false));
@@ -65,31 +71,41 @@ public:
     void loadChildSheets();
     void loadChildSheet(const String& href);
 
-    xsltStylesheetPtr compileStyleSheet();
-
     DocLoader* docLoader();
 
     Document* ownerDocument() { return m_ownerDocument; }
     void setParentStyleSheet(XSLStyleSheet* parent);
 
+#if USE(QXMLQUERY)
+    String sheetString() const { return m_sheetString; }
+#else
     xmlDocPtr document();
+    xsltStylesheetPtr compileStyleSheet();
+    xmlDocPtr locateStylesheetSubResource(xmlDocPtr parentDoc, const xmlChar* uri);
+#endif
 
     void clearDocuments();
 
-    xmlDocPtr locateStylesheetSubResource(xmlDocPtr parentDoc, const xmlChar* uri);
-    
     void markAsProcessed();
     bool processed() const { return m_processed; }
 
 private:
     XSLStyleSheet(Node* parentNode, const String& href, bool embedded);
+#if !USE(QXMLQUERY)
     XSLStyleSheet(XSLImportRule* parentImport, const String& href);
+#endif
 
     Document* m_ownerDocument;
-    xmlDocPtr m_stylesheetDoc;
     bool m_embedded;
     bool m_processed;
+
+#if USE(QXMLQUERY)
+    String m_sheetString;
+#else
+    xmlDocPtr m_stylesheetDoc;
     bool m_stylesheetDocTaken;
+#endif
+    
     XSLStyleSheet* m_parentStyleSheet;
 };
 
diff --git a/WebCore/xml/XSLStyleSheet.cpp b/WebCore/xml/XSLStyleSheetLibxslt.cpp
index b7d52f8..2ae8b82 100644
--- a/WebCore/xml/XSLStyleSheet.cpp
+++ b/WebCore/xml/XSLStyleSheetLibxslt.cpp
@@ -31,6 +31,7 @@
 #include "Document.h"
 #include "Frame.h"
 #include "Node.h"
+#include "TransformSource.h"
 #include "XMLTokenizer.h"
 #include "XMLTokenizerScope.h"
 #include "XSLImportRule.h"
@@ -57,9 +58,9 @@ namespace WebCore {
 XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
     : StyleSheet(parentRule, href)
     , m_ownerDocument(0)
-    , m_stylesheetDoc(0)
     , m_embedded(false)
     , m_processed(false) // Child sheets get marked as processed when the libxslt engine has finally seen them.
+    , m_stylesheetDoc(0)
     , m_stylesheetDocTaken(false)
     , m_parentStyleSheet(0)
 {
@@ -68,9 +69,9 @@ XSLStyleSheet::XSLStyleSheet(XSLImportRule* parentRule, const String& href)
 XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
     : StyleSheet(parentNode, href)
     , m_ownerDocument(parentNode->document())
-    , m_stylesheetDoc(0)
     , m_embedded(embedded)
     , m_processed(true) // The root sheet starts off processed.
+    , m_stylesheetDoc(0)
     , m_stylesheetDocTaken(false)
     , m_parentStyleSheet(0)
 {
@@ -98,7 +99,7 @@ bool XSLStyleSheet::isLoading()
 
 void XSLStyleSheet::checkLoaded()
 {
-    if (isLoading()) 
+    if (isLoading())
         return;
     if (parent())
         parent()->checkLoaded();
@@ -108,8 +109,8 @@ void XSLStyleSheet::checkLoaded()
 
 xmlDocPtr XSLStyleSheet::document()
 {
-    if (m_embedded && ownerDocument())
-        return (xmlDocPtr)ownerDocument()->transformSource();
+    if (m_embedded && ownerDocument() && ownerDocument()->transformSource())
+        return (xmlDocPtr)ownerDocument()->transformSource()->platformSource();
     return m_stylesheetDoc;
 }
 
@@ -168,7 +169,7 @@ bool XSLStyleSheet::parseString(const String& string, bool)
 
     m_stylesheetDoc = xmlCtxtReadMemory(ctxt, buffer, size,
         href().utf8().data(),
-        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
+        BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE",
         XML_PARSE_NOENT | XML_PARSE_DTDATTR | XML_PARSE_NOWARNING | XML_PARSE_NOCDATA);
     xmlFreeParserCtxt(ctxt);
 
@@ -181,15 +182,15 @@ void XSLStyleSheet::loadChildSheets()
 {
     if (!document())
         return;
-    
+
     xmlNodePtr stylesheetRoot = document()->children;
-    
+
     // Top level children may include other things such as DTD nodes, we ignore those.
     while (stylesheetRoot && stylesheetRoot->type != XML_ELEMENT_NODE)
         stylesheetRoot = stylesheetRoot->next;
-    
+
     if (m_embedded) {
-        // We have to locate (by ID) the appropriate embedded stylesheet element, so that we can walk the 
+        // We have to locate (by ID) the appropriate embedded stylesheet element, so that we can walk the
         // import/include list.
         xmlAttrPtr idNode = xmlGetID(document(), (const xmlChar*)(href().utf8().data()));
         if (!idNode)
@@ -199,7 +200,7 @@ void XSLStyleSheet::loadChildSheets()
         // FIXME: Need to handle an external URI with a # in it.  This is a pretty minor edge case, so we'll deal
         // with it later.
     }
-    
+
     if (stylesheetRoot) {
         // Walk the children of the root element and look for import/include elements.
         // Imports must occur first.
@@ -210,7 +211,7 @@ void XSLStyleSheet::loadChildSheets()
                 continue;
             }
             if (IS_XSLT_ELEM(curr) && IS_XSLT_NAME(curr, "import")) {
-                xmlChar* uriRef = xsltGetNsProp(curr, (const xmlChar*)"href", XSLT_NAMESPACE);                
+                xmlChar* uriRef = xsltGetNsProp(curr, (const xmlChar*)"href", XSLT_NAMESPACE);
                 loadChildSheet(String::fromUTF8((const char*)uriRef));
                 xmlFree(uriRef);
             } else
@@ -242,7 +243,7 @@ xsltStylesheetPtr XSLStyleSheet::compileStyleSheet()
     // FIXME: Hook up error reporting for the stylesheet compilation process.
     if (m_embedded)
         return xsltLoadStylesheetPI(document());
-    
+
     // xsltParseStylesheetDoc makes the document part of the stylesheet
     // so we have to release our pointer to it.
     ASSERT(!m_stylesheetDocTaken);
@@ -273,7 +274,7 @@ xmlDocPtr XSLStyleSheet::locateStylesheetSubResource(xmlDocPtr parentDoc, const
             if (matchedParent) {
                 if (child->processed())
                     continue; // libxslt has been given this sheet already.
-                
+
                 // Check the URI of the child stylesheet against the doc URI.
                 // In order to ensure that libxml canonicalized both URLs, we get the original href
                 // string from the import rule and canonicalize it using libxml before comparing it
@@ -295,7 +296,7 @@ xmlDocPtr XSLStyleSheet::locateStylesheetSubResource(xmlDocPtr parentDoc, const
             }
         }
     }
-    
+
     return 0;
 }
 
diff --git a/WebCore/xml/XSLStyleSheetQt.cpp b/WebCore/xml/XSLStyleSheetQt.cpp
new file mode 100644
index 0000000..6d27e20
--- /dev/null
+++ b/WebCore/xml/XSLStyleSheetQt.cpp
@@ -0,0 +1,103 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "XSLStyleSheet.h"
+
+#if ENABLE(XSLT)
+
+#include "DOMWindow.h"
+#include "Document.h"
+#include "Node.h"
+#include "NotImplemented.h"
+#include "XSLTProcessor.h"
+#include "loader.h"
+
+namespace WebCore {
+
+XSLStyleSheet::XSLStyleSheet(Node* parentNode, const String& href,  bool embedded)
+    : StyleSheet(parentNode, href)
+    , m_ownerDocument(parentNode->document())
+    , m_embedded(embedded)
+{
+}
+
+XSLStyleSheet::~XSLStyleSheet()
+{
+}
+
+bool XSLStyleSheet::isLoading()
+{
+    notImplemented();
+    return false;
+}
+
+void XSLStyleSheet::checkLoaded()
+{
+    if (ownerNode())
+        ownerNode()->sheetLoaded();
+}
+
+void XSLStyleSheet::clearDocuments()
+{
+    notImplemented();
+}
+
+DocLoader* XSLStyleSheet::docLoader()
+{
+    if (!m_ownerDocument)
+        return 0;
+    return m_ownerDocument->docLoader();
+}
+
+bool XSLStyleSheet::parseString(const String& string, bool)
+{
+    // FIXME: Fix QXmlQuery so that it allows compiling the stylesheet before setting the document
+    // to be transformed. This way we could not only check if the stylesheet is correct before using it
+    // but also turn XSLStyleSheet::sheetString() into XSLStyleSheet::query() that returns a QXmlQuery.
+
+    m_sheetString = string;
+    return !m_sheetString.isEmpty();
+}
+
+void XSLStyleSheet::loadChildSheets()
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::loadChildSheet(const String&)
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::setParentStyleSheet(XSLStyleSheet*)
+{
+    notImplemented();
+}
+
+void XSLStyleSheet::markAsProcessed()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessor.cpp b/WebCore/xml/XSLTProcessor.cpp
index a26fe77..b182243 100644
--- a/WebCore/xml/XSLTProcessor.cpp
+++ b/WebCore/xml/XSLTProcessor.cpp
@@ -26,10 +26,7 @@
 
 #include "XSLTProcessor.h"
 
-#include "CString.h"
-#include "Console.h"
 #include "DOMImplementation.h"
-#include "DOMWindow.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
 #include "Frame.h"
@@ -38,166 +35,17 @@
 #include "HTMLDocument.h"
 #include "HTMLTokenizer.h" // for parseHTMLDocumentFragment
 #include "Page.h"
-#include "ResourceError.h"
-#include "ResourceHandle.h"
-#include "ResourceRequest.h"
-#include "ResourceResponse.h"
 #include "Text.h"
 #include "TextResourceDecoder.h"
 #include "XMLTokenizer.h"
-#include "XSLTExtensions.h"
-#include "XSLTUnicodeSort.h"
 #include "loader.h"
 #include "markup.h"
-#include <libxslt/imports.h>
-#include <libxslt/variables.h>
-#include <libxslt/xsltutils.h>
 #include <wtf/Assertions.h>
 #include <wtf/Platform.h>
 #include <wtf/Vector.h>
 
-#if PLATFORM(MAC)
-#include "SoftLinking.h"
-
-SOFT_LINK_LIBRARY(libxslt);
-SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
-SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
-SOFT_LINK(libxslt, xsltNewTransformContext, xsltTransformContextPtr, (xsltStylesheetPtr style, xmlDocPtr doc), (style, doc))
-SOFT_LINK(libxslt, xsltApplyStylesheetUser, xmlDocPtr, (xsltStylesheetPtr style, xmlDocPtr doc, const char** params, const char* output, FILE* profile, xsltTransformContextPtr userCtxt), (style, doc, params, output, profile, userCtxt))
-SOFT_LINK(libxslt, xsltQuoteUserParams, int, (xsltTransformContextPtr ctxt, const char** params), (ctxt, params))
-SOFT_LINK(libxslt, xsltSetCtxtSortFunc, void, (xsltTransformContextPtr ctxt, xsltSortFunc handler), (ctxt, handler))
-SOFT_LINK(libxslt, xsltSetLoaderFunc, void, (xsltDocLoaderFunc f), (f))
-SOFT_LINK(libxslt, xsltSaveResultTo, int, (xmlOutputBufferPtr buf, xmlDocPtr result, xsltStylesheetPtr style), (buf, result, style))
-SOFT_LINK(libxslt, xsltNextImport, xsltStylesheetPtr, (xsltStylesheetPtr style), (style))
-#endif
-
 namespace WebCore {
 
-void XSLTProcessor::genericErrorFunc(void*, const char*, ...)
-{
-    // It would be nice to do something with this error message.
-}
-    
-void XSLTProcessor::parseErrorFunc(void* userData, xmlError* error)
-{
-    Console* console = static_cast<Console*>(userData);
-    if (!console)
-        return;
-
-    MessageLevel level;
-    switch (error->level) {
-        case XML_ERR_NONE:
-            level = TipMessageLevel;
-            break;
-        case XML_ERR_WARNING:
-            level = WarningMessageLevel;
-            break;
-        case XML_ERR_ERROR:
-        case XML_ERR_FATAL:
-        default:
-            level = ErrorMessageLevel;
-            break;
-    }
-
-    console->addMessage(XMLMessageSource, LogMessageType, level, error->message, error->line, error->file);
-}
-
-// FIXME: There seems to be no way to control the ctxt pointer for loading here, thus we have globals.
-static XSLTProcessor* globalProcessor = 0;
-static DocLoader* globalDocLoader = 0;
-static xmlDocPtr docLoaderFunc(const xmlChar* uri,
-                                    xmlDictPtr,
-                                    int options,
-                                    void* ctxt,
-                                    xsltLoadType type)
-{
-    if (!globalProcessor)
-        return 0;
-    
-    switch (type) {
-        case XSLT_LOAD_DOCUMENT: {
-            xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
-            xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
-            KURL url(KURL(reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
-            xmlFree(base);
-            ResourceError error;
-            ResourceResponse response;
-
-            Vector<char> data;
-
-            bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
-            if (requestAllowed) {
-                globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
-                requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
-            }
-            if (!requestAllowed) {
-                data.clear();
-                globalDocLoader->printAccessDeniedMessage(url);
-            }
-
-            Console* console = 0;
-            if (Frame* frame = globalProcessor->xslStylesheet()->ownerDocument()->frame())
-                console = frame->domWindow()->console();
-            xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
-            xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
-            
-            // We don't specify an encoding here. Neither Gecko nor WinIE respects
-            // the encoding specified in the HTTP headers.
-            xmlDocPtr doc = xmlReadMemory(data.data(), data.size(), (const char*)uri, 0, options);
-
-            xmlSetStructuredErrorFunc(0, 0);
-            xmlSetGenericErrorFunc(0, 0);
-
-            return doc;
-        }
-        case XSLT_LOAD_STYLESHEET:
-            return globalProcessor->xslStylesheet()->locateStylesheetSubResource(((xsltStylesheetPtr)ctxt)->doc, uri);
-        default:
-            break;
-    }
-    
-    return 0;
-}
-
-static inline void setXSLTLoadCallBack(xsltDocLoaderFunc func, XSLTProcessor* processor, DocLoader* loader)
-{
-    xsltSetLoaderFunc(func);
-    globalProcessor = processor;
-    globalDocLoader = loader;
-}
-
-static int writeToVector(void* context, const char* buffer, int len)
-{
-    Vector<UChar>& resultOutput = *static_cast<Vector<UChar>*>(context);
-    String decodedChunk = String::fromUTF8(buffer, len);
-    resultOutput.append(decodedChunk.characters(), decodedChunk.length());
-    return len;
-}
-
-static bool saveResultToString(xmlDocPtr resultDoc, xsltStylesheetPtr sheet, String& resultString)
-{
-    xmlOutputBufferPtr outputBuf = xmlAllocOutputBuffer(0);
-    if (!outputBuf)
-        return false;
-
-    Vector<UChar> resultVector;
-    outputBuf->context = &resultVector;
-    outputBuf->writecallback = writeToVector;
-    
-    int retval = xsltSaveResultTo(outputBuf, resultDoc, sheet);
-    xmlOutputBufferClose(outputBuf);
-    if (retval < 0)
-        return false;
-
-    // Workaround for <http://bugzilla.gnome.org/show_bug.cgi?id=495668>: libxslt appends an extra line feed to the result.
-    if (resultVector.size() > 0 && resultVector[resultVector.size() - 1] == '\n')
-        resultVector.removeLast();
-
-    resultString = String::adopt(resultVector);
-
-    return true;
-}
-
 static inline void transformTextStringToXHTMLDocumentString(String& text)
 {
     // Modify the output so that it is a well-formed XHTML document with a <pre> tag enclosing the text.
@@ -213,38 +61,6 @@ static inline void transformTextStringToXHTMLDocumentString(String& text)
         "</html>\n";
 }
 
-static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
-{
-    if (parameters.isEmpty())
-        return 0;
-
-    const char** parameterArray = (const char**)fastMalloc(((parameters.size() * 2) + 1) * sizeof(char*));
-
-    XSLTProcessor::ParameterMap::iterator end = parameters.end();
-    unsigned index = 0;
-    for (XSLTProcessor::ParameterMap::iterator it = parameters.begin(); it != end; ++it) {
-        parameterArray[index++] = strdup(it->first.utf8().data());
-        parameterArray[index++] = strdup(it->second.utf8().data());
-    }
-    parameterArray[index] = 0;
-
-    return parameterArray;
-}
-
-static void freeXsltParamArray(const char** params)
-{
-    const char** temp = params;
-    if (!params)
-        return;
-    
-    while (*temp) {
-        free((void*)*(temp++)); // strdup returns malloc'd blocks, so we have to use free() here
-        free((void*)*(temp++));
-    }
-    fastFree(params);
-}
-
-
 PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourceString,
     const String& sourceEncoding, const String& sourceMIMEType, Node* sourceNode, Frame* frame)
 {
@@ -258,7 +74,7 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
         transformTextStringToXHTMLDocumentString(documentSource);
     } else
         result = ownerDocument->implementation()->createDocument(sourceMIMEType, frame, false);
-    
+
     // Before parsing, we need to save & detach the old document and get the new document
     // in place. We have to do this only if we're rendering the result document.
     if (frame) {
@@ -267,15 +83,15 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
         result->setTransformSourceDocument(frame->document());
         frame->setDocument(result);
     }
-    
+
     if (sourceIsDocument)
         result->setURL(ownerDocument->url());
     result->open();
-    
+
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create(sourceMIMEType);
     decoder->setEncoding(sourceEncoding.isEmpty() ? UTF8Encoding() : TextEncoding(sourceEncoding), TextResourceDecoder::EncodingFromXMLHeader);
     result->setDecoder(decoder.release());
-    
+
     result->write(documentSource);
     result->finishParsing();
     result->close();
@@ -285,129 +101,21 @@ PassRefPtr<Document> XSLTProcessor::createDocumentFromSource(const String& sourc
 
 static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& sourceString, const String& sourceMIMEType, Document* outputDoc)
 {
-    RefPtr<DocumentFragment> fragment = new DocumentFragment(outputDoc);
-    
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(outputDoc);
+
     if (sourceMIMEType == "text/html")
         parseHTMLDocumentFragment(sourceString, fragment.get());
     else if (sourceMIMEType == "text/plain")
-        fragment->addChild(new Text(outputDoc, sourceString));
+        fragment->addChild(Text::create(outputDoc, sourceString));
     else {
         bool successfulParse = parseXMLDocumentFragment(sourceString, fragment.get(), outputDoc->documentElement());
         if (!successfulParse)
             return 0;
     }
-    
-    // FIXME: Do we need to mess with URLs here?
-        
-    return fragment;
-}
-
-static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStylesheet, Node* stylesheetRootNode)
-{
-    if (!cachedStylesheet && stylesheetRootNode) {
-        cachedStylesheet = XSLStyleSheet::create(stylesheetRootNode->parent() ? stylesheetRootNode->parent() : stylesheetRootNode,
-            stylesheetRootNode->document()->url().string());
-        cachedStylesheet->parseString(createMarkup(stylesheetRootNode));
-    }
-    
-    if (!cachedStylesheet || !cachedStylesheet->document())
-        return 0;
-    
-    return cachedStylesheet->compileStyleSheet();
-}
 
-static inline xmlDocPtr xmlDocPtrFromNode(Node* sourceNode, bool& shouldDelete)
-{
-    RefPtr<Document> ownerDocument = sourceNode->document();
-    bool sourceIsDocument = (sourceNode == ownerDocument.get());
-    
-    xmlDocPtr sourceDoc = 0;
-    if (sourceIsDocument)
-        sourceDoc = (xmlDocPtr)ownerDocument->transformSource();
-    if (!sourceDoc) {
-        sourceDoc = (xmlDocPtr)xmlDocPtrForString(ownerDocument->docLoader(), createMarkup(sourceNode),
-            sourceIsDocument ? ownerDocument->url().string() : String());
-        shouldDelete = (sourceDoc != 0);
-    }
-    return sourceDoc;
-}
-
-static inline String resultMIMEType(xmlDocPtr resultDoc, xsltStylesheetPtr sheet)
-{
-    // There are three types of output we need to be able to deal with:
-    // HTML (create an HTML document), XML (create an XML document),
-    // and text (wrap in a <pre> and create an XML document).
-
-    const xmlChar* resultType = 0;
-    XSLT_GET_IMPORT_PTR(resultType, sheet, method);
-    if (resultType == 0 && resultDoc->type == XML_HTML_DOCUMENT_NODE)
-        resultType = (const xmlChar*)"html";
-    
-    if (xmlStrEqual(resultType, (const xmlChar*)"html"))
-        return "text/html";
-    else if (xmlStrEqual(resultType, (const xmlChar*)"text"))
-        return "text/plain";
-        
-    return "application/xml";
-}
-
-bool XSLTProcessor::transformToString(Node* sourceNode, String& mimeType, String& resultString, String& resultEncoding)
-{
-    RefPtr<Document> ownerDocument = sourceNode->document();
-    
-    setXSLTLoadCallBack(docLoaderFunc, this, ownerDocument->docLoader());
-    xsltStylesheetPtr sheet = xsltStylesheetPointer(m_stylesheet, m_stylesheetRootNode.get());
-    if (!sheet) {
-        setXSLTLoadCallBack(0, 0, 0);
-        return false;
-    }
-    m_stylesheet->clearDocuments();
-
-    xmlChar* origMethod = sheet->method;
-    if (!origMethod && mimeType == "text/html")
-        sheet->method = (xmlChar*)"html";
-
-    bool success = false;
-    bool shouldFreeSourceDoc = false;
-    if (xmlDocPtr sourceDoc = xmlDocPtrFromNode(sourceNode, shouldFreeSourceDoc)) {
-        // The XML declaration would prevent parsing the result as a fragment, and it's not needed even for documents, 
-        // as the result of this function is always immediately parsed.
-        sheet->omitXmlDeclaration = true;
-
-        xsltTransformContextPtr transformContext = xsltNewTransformContext(sheet, sourceDoc);
-        registerXSLTExtensions(transformContext);
-
-        // <http://bugs.webkit.org/show_bug.cgi?id=16077>: XSLT processor <xsl:sort> algorithm only compares by code point
-        xsltSetCtxtSortFunc(transformContext, xsltUnicodeSortFunction);
-
-        // This is a workaround for a bug in libxslt. 
-        // The bug has been fixed in version 1.1.13, so once we ship that this can be removed.
-        if (transformContext->globalVars == NULL)
-           transformContext->globalVars = xmlHashCreate(20);
-
-        const char** params = xsltParamArrayFromParameterMap(m_parameters);
-        xsltQuoteUserParams(transformContext, params);
-        xmlDocPtr resultDoc = xsltApplyStylesheetUser(sheet, sourceDoc, 0, 0, 0, transformContext);
-        
-        xsltFreeTransformContext(transformContext);        
-        freeXsltParamArray(params);
-        
-        if (shouldFreeSourceDoc)
-            xmlFreeDoc(sourceDoc);
-        
-        if (success = saveResultToString(resultDoc, sheet, resultString)) {
-            mimeType = resultMIMEType(resultDoc, sheet);
-            resultEncoding = (char*)resultDoc->encoding;
-        }
-        xmlFreeDoc(resultDoc);
-    }
-    
-    sheet->method = origMethod;
-    setXSLTLoadCallBack(0, 0, 0);
-    xsltFreeStylesheet(sheet);
-    m_stylesheet = 0;
+    // FIXME: Do we need to mess with URLs here?
 
-    return success;
+    return fragment;
 }
 
 PassRefPtr<Document> XSLTProcessor::transformToDocument(Node* sourceNode)
@@ -429,7 +137,7 @@ PassRefPtr<DocumentFragment> XSLTProcessor::transformToFragment(Node* sourceNode
     // If the output document is HTML, default to HTML method.
     if (outputDoc->isHTMLDocument())
         resultMIMEType = "text/html";
-    
+
     if (!transformToString(sourceNode, resultMIMEType, resultString, resultEncoding))
         return 0;
     return createFragmentFromSource(resultString, resultMIMEType, outputDoc);
@@ -455,6 +163,13 @@ void XSLTProcessor::removeParameter(const String& /*namespaceURI*/, const String
     m_parameters.remove(localName);
 }
 
+void XSLTProcessor::reset()
+{
+    m_stylesheet.clear();
+    m_stylesheetRootNode.clear();
+    m_parameters.clear();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessor.h b/WebCore/xml/XSLTProcessor.h
index 9ee2aad..9b91017 100644
--- a/WebCore/xml/XSLTProcessor.h
+++ b/WebCore/xml/XSLTProcessor.h
@@ -28,9 +28,12 @@
 #include "Node.h"
 #include "StringHash.h"
 #include "XSLStyleSheet.h"
+#include <wtf/HashMap.h>
+
+#if !USE(QXMLQUERY)
 #include <libxml/parserInternals.h>
 #include <libxslt/documents.h>
-#include <wtf/HashMap.h>
+#endif
 
 namespace WebCore {
 
@@ -56,14 +59,15 @@ public:
     void removeParameter(const String& namespaceURI, const String& localName);
     void clearParameters() { m_parameters.clear(); }
 
-    void reset() { m_stylesheet.clear(); m_stylesheetRootNode.clear();  m_parameters.clear(); }
+    void reset();
 
+#if !USE(QXMLQUERY)
     static void parseErrorFunc(void* userData, xmlError*);
     static void genericErrorFunc(void* userData, const char* msg, ...);
     
-public:
     // Only for libXSLT callbacks
     XSLStyleSheet* xslStylesheet() const { return m_stylesheet.get(); }
+#endif
 
     typedef HashMap<String, String> ParameterMap;
 
diff --git a/WebCore/xml/XSLTProcessorLibxslt.cpp b/WebCore/xml/XSLTProcessorLibxslt.cpp
new file mode 100644
index 0000000..200c56b
--- /dev/null
+++ b/WebCore/xml/XSLTProcessorLibxslt.cpp
@@ -0,0 +1,335 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2005, 2006 Alexey Proskuryakov <ap@webkit.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "XSLTProcessor.h"
+
+#include "Console.h"
+#include "CString.h"
+#include "DOMWindow.h"
+#include "DocLoader.h"
+#include "Frame.h"
+#include "ResourceError.h"
+#include "ResourceHandle.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "TransformSource.h"
+#include "XMLTokenizer.h"
+#include "XSLStyleSheet.h"
+#include "XSLTExtensions.h"
+#include "XSLTUnicodeSort.h"
+#include "loader.h"
+#include "markup.h"
+#include <libxslt/imports.h>
+#include <libxslt/variables.h>
+#include <libxslt/xsltutils.h>
+#include <wtf/Assertions.h>
+#include <wtf/Platform.h>
+#include <wtf/Vector.h>
+
+#if PLATFORM(MAC)
+#include "SoftLinking.h"
+
+SOFT_LINK_LIBRARY(libxslt);
+SOFT_LINK(libxslt, xsltFreeStylesheet, void, (xsltStylesheetPtr sheet), (sheet))
+SOFT_LINK(libxslt, xsltFreeTransformContext, void, (xsltTransformContextPtr ctxt), (ctxt))
+SOFT_LINK(libxslt, xsltNewTransformContext, xsltTransformContextPtr, (xsltStylesheetPtr style, xmlDocPtr doc), (style, doc))
+SOFT_LINK(libxslt, xsltApplyStylesheetUser, xmlDocPtr, (xsltStylesheetPtr style, xmlDocPtr doc, const char** params, const char* output, FILE* profile, xsltTransformContextPtr userCtxt), (style, doc, params, output, profile, userCtxt))
+SOFT_LINK(libxslt, xsltQuoteUserParams, int, (xsltTransformContextPtr ctxt, const char** params), (ctxt, params))
+SOFT_LINK(libxslt, xsltSetCtxtSortFunc, void, (xsltTransformContextPtr ctxt, xsltSortFunc handler), (ctxt, handler))
+SOFT_LINK(libxslt, xsltSetLoaderFunc, void, (xsltDocLoaderFunc f), (f))
+SOFT_LINK(libxslt, xsltSaveResultTo, int, (xmlOutputBufferPtr buf, xmlDocPtr result, xsltStylesheetPtr style), (buf, result, style))
+SOFT_LINK(libxslt, xsltNextImport, xsltStylesheetPtr, (xsltStylesheetPtr style), (style))
+#endif
+
+namespace WebCore {
+
+void XSLTProcessor::genericErrorFunc(void*, const char*, ...)
+{
+    // It would be nice to do something with this error message.
+}
+
+void XSLTProcessor::parseErrorFunc(void* userData, xmlError* error)
+{
+    Console* console = static_cast<Console*>(userData);
+    if (!console)
+        return;
+
+    MessageLevel level;
+    switch (error->level) {
+    case XML_ERR_NONE:
+        level = TipMessageLevel;
+        break;
+    case XML_ERR_WARNING:
+        level = WarningMessageLevel;
+        break;
+    case XML_ERR_ERROR:
+    case XML_ERR_FATAL:
+    default:
+        level = ErrorMessageLevel;
+        break;
+    }
+
+    console->addMessage(XMLMessageSource, LogMessageType, level, error->message, error->line, error->file);
+}
+
+// FIXME: There seems to be no way to control the ctxt pointer for loading here, thus we have globals.
+static XSLTProcessor* globalProcessor = 0;
+static DocLoader* globalDocLoader = 0;
+static xmlDocPtr docLoaderFunc(const xmlChar* uri,
+                                    xmlDictPtr,
+                                    int options,
+                                    void* ctxt,
+                                    xsltLoadType type)
+{
+    if (!globalProcessor)
+        return 0;
+
+    switch (type) {
+    case XSLT_LOAD_DOCUMENT: {
+        xsltTransformContextPtr context = (xsltTransformContextPtr)ctxt;
+        xmlChar* base = xmlNodeGetBase(context->document->doc, context->node);
+        KURL url(KURL(ParsedURLString, reinterpret_cast<const char*>(base)), reinterpret_cast<const char*>(uri));
+        xmlFree(base);
+        ResourceError error;
+        ResourceResponse response;
+
+        Vector<char> data;
+
+        bool requestAllowed = globalDocLoader->frame() && globalDocLoader->doc()->securityOrigin()->canRequest(url);
+        if (requestAllowed) {
+            globalDocLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
+            requestAllowed = globalDocLoader->doc()->securityOrigin()->canRequest(response.url());
+        }
+        if (!requestAllowed) {
+            data.clear();
+            globalDocLoader->printAccessDeniedMessage(url);
+        }
+
+        Console* console = 0;
+        if (Frame* frame = globalProcessor->xslStylesheet()->ownerDocument()->frame())
+            console = frame->domWindow()->console();
+        xmlSetStructuredErrorFunc(console, XSLTProcessor::parseErrorFunc);
+        xmlSetGenericErrorFunc(console, XSLTProcessor::genericErrorFunc);
+
+        // We don't specify an encoding here. Neither Gecko nor WinIE respects
+        // the encoding specified in the HTTP headers.
+        xmlDocPtr doc = xmlReadMemory(data.data(), data.size(), (const char*)uri, 0, options);
+
+        xmlSetStructuredErrorFunc(0, 0);
+        xmlSetGenericErrorFunc(0, 0);
+
+        return doc;
+    }
+    case XSLT_LOAD_STYLESHEET:
+        return globalProcessor->xslStylesheet()->locateStylesheetSubResource(((xsltStylesheetPtr)ctxt)->doc, uri);
+    default:
+        break;
+    }
+
+    return 0;
+}
+
+static inline void setXSLTLoadCallBack(xsltDocLoaderFunc func, XSLTProcessor* processor, DocLoader* loader)
+{
+    xsltSetLoaderFunc(func);
+    globalProcessor = processor;
+    globalDocLoader = loader;
+}
+
+static int writeToVector(void* context, const char* buffer, int len)
+{
+    Vector<UChar>& resultOutput = *static_cast<Vector<UChar>*>(context);
+    String decodedChunk = String::fromUTF8(buffer, len);
+    resultOutput.append(decodedChunk.characters(), decodedChunk.length());
+    return len;
+}
+
+static bool saveResultToString(xmlDocPtr resultDoc, xsltStylesheetPtr sheet, String& resultString)
+{
+    xmlOutputBufferPtr outputBuf = xmlAllocOutputBuffer(0);
+    if (!outputBuf)
+        return false;
+
+    Vector<UChar> resultVector;
+    outputBuf->context = &resultVector;
+    outputBuf->writecallback = writeToVector;
+
+    int retval = xsltSaveResultTo(outputBuf, resultDoc, sheet);
+    xmlOutputBufferClose(outputBuf);
+    if (retval < 0)
+        return false;
+
+    // Workaround for <http://bugzilla.gnome.org/show_bug.cgi?id=495668>: libxslt appends an extra line feed to the result.
+    if (resultVector.size() > 0 && resultVector[resultVector.size() - 1] == '\n')
+        resultVector.removeLast();
+
+    resultString = String::adopt(resultVector);
+
+    return true;
+}
+
+static const char** xsltParamArrayFromParameterMap(XSLTProcessor::ParameterMap& parameters)
+{
+    if (parameters.isEmpty())
+        return 0;
+
+    const char** parameterArray = (const char**)fastMalloc(((parameters.size() * 2) + 1) * sizeof(char*));
+
+    XSLTProcessor::ParameterMap::iterator end = parameters.end();
+    unsigned index = 0;
+    for (XSLTProcessor::ParameterMap::iterator it = parameters.begin(); it != end; ++it) {
+        parameterArray[index++] = strdup(it->first.utf8().data());
+        parameterArray[index++] = strdup(it->second.utf8().data());
+    }
+    parameterArray[index] = 0;
+
+    return parameterArray;
+}
+
+static void freeXsltParamArray(const char** params)
+{
+    const char** temp = params;
+    if (!params)
+        return;
+
+    while (*temp) {
+        free((void*)*(temp++)); // strdup returns malloc'd blocks, so we have to use free() here
+        free((void*)*(temp++));
+    }
+    fastFree(params);
+}
+
+static xsltStylesheetPtr xsltStylesheetPointer(RefPtr<XSLStyleSheet>& cachedStylesheet, Node* stylesheetRootNode)
+{
+    if (!cachedStylesheet && stylesheetRootNode) {
+        cachedStylesheet = XSLStyleSheet::create(stylesheetRootNode->parent() ? stylesheetRootNode->parent() : stylesheetRootNode,
+            stylesheetRootNode->document()->url().string());
+        cachedStylesheet->parseString(createMarkup(stylesheetRootNode));
+    }
+
+    if (!cachedStylesheet || !cachedStylesheet->document())
+        return 0;
+
+    return cachedStylesheet->compileStyleSheet();
+}
+
+static inline xmlDocPtr xmlDocPtrFromNode(Node* sourceNode, bool& shouldDelete)
+{
+    RefPtr<Document> ownerDocument = sourceNode->document();
+    bool sourceIsDocument = (sourceNode == ownerDocument.get());
+
+    xmlDocPtr sourceDoc = 0;
+    if (sourceIsDocument && ownerDocument->transformSource())
+        sourceDoc = (xmlDocPtr)ownerDocument->transformSource()->platformSource();
+    if (!sourceDoc) {
+        sourceDoc = (xmlDocPtr)xmlDocPtrForString(ownerDocument->docLoader(), createMarkup(sourceNode),
+            sourceIsDocument ? ownerDocument->url().string() : String());
+        shouldDelete = sourceDoc;
+    }
+    return sourceDoc;
+}
+
+static inline String resultMIMEType(xmlDocPtr resultDoc, xsltStylesheetPtr sheet)
+{
+    // There are three types of output we need to be able to deal with:
+    // HTML (create an HTML document), XML (create an XML document),
+    // and text (wrap in a <pre> and create an XML document).
+
+    const xmlChar* resultType = 0;
+    XSLT_GET_IMPORT_PTR(resultType, sheet, method);
+    if (!resultType && resultDoc->type == XML_HTML_DOCUMENT_NODE)
+        resultType = (const xmlChar*)"html";
+
+    if (xmlStrEqual(resultType, (const xmlChar*)"html"))
+        return "text/html";
+    if (xmlStrEqual(resultType, (const xmlChar*)"text"))
+        return "text/plain";
+
+    return "application/xml";
+}
+
+bool XSLTProcessor::transformToString(Node* sourceNode, String& mimeType, String& resultString, String& resultEncoding)
+{
+    RefPtr<Document> ownerDocument = sourceNode->document();
+
+    setXSLTLoadCallBack(docLoaderFunc, this, ownerDocument->docLoader());
+    xsltStylesheetPtr sheet = xsltStylesheetPointer(m_stylesheet, m_stylesheetRootNode.get());
+    if (!sheet) {
+        setXSLTLoadCallBack(0, 0, 0);
+        return false;
+    }
+    m_stylesheet->clearDocuments();
+
+    xmlChar* origMethod = sheet->method;
+    if (!origMethod && mimeType == "text/html")
+        sheet->method = (xmlChar*)"html";
+
+    bool success = false;
+    bool shouldFreeSourceDoc = false;
+    if (xmlDocPtr sourceDoc = xmlDocPtrFromNode(sourceNode, shouldFreeSourceDoc)) {
+        // The XML declaration would prevent parsing the result as a fragment, and it's not needed even for documents,
+        // as the result of this function is always immediately parsed.
+        sheet->omitXmlDeclaration = true;
+
+        xsltTransformContextPtr transformContext = xsltNewTransformContext(sheet, sourceDoc);
+        registerXSLTExtensions(transformContext);
+
+        // <http://bugs.webkit.org/show_bug.cgi?id=16077>: XSLT processor <xsl:sort> algorithm only compares by code point
+        xsltSetCtxtSortFunc(transformContext, xsltUnicodeSortFunction);
+
+        // This is a workaround for a bug in libxslt.
+        // The bug has been fixed in version 1.1.13, so once we ship that this can be removed.
+        if (!transformContext->globalVars)
+           transformContext->globalVars = xmlHashCreate(20);
+
+        const char** params = xsltParamArrayFromParameterMap(m_parameters);
+        xsltQuoteUserParams(transformContext, params);
+        xmlDocPtr resultDoc = xsltApplyStylesheetUser(sheet, sourceDoc, 0, 0, 0, transformContext);
+
+        xsltFreeTransformContext(transformContext);
+        freeXsltParamArray(params);
+
+        if (shouldFreeSourceDoc)
+            xmlFreeDoc(sourceDoc);
+
+        if (success = saveResultToString(resultDoc, sheet, resultString)) {
+            mimeType = resultMIMEType(resultDoc, sheet);
+            resultEncoding = (char*)resultDoc->encoding;
+        }
+        xmlFreeDoc(resultDoc);
+    }
+
+    sheet->method = origMethod;
+    setXSLTLoadCallBack(0, 0, 0);
+    xsltFreeStylesheet(sheet);
+    m_stylesheet = 0;
+
+    return success;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)
diff --git a/WebCore/xml/XSLTProcessorQt.cpp b/WebCore/xml/XSLTProcessorQt.cpp
new file mode 100644
index 0000000..50ee427
--- /dev/null
+++ b/WebCore/xml/XSLTProcessorQt.cpp
@@ -0,0 +1,149 @@
+/*
+ * This file is part of the XSL implementation.
+ *
+ * Copyright (C) 2009 Jakub Wieczorek <faw217@gmail.com>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XSLT)
+
+#include "XSLTProcessor.h"
+
+#include "Console.h"
+#include "DOMWindow.h"
+#include "Frame.h"
+#include "TransformSource.h"
+#include "loader.h"
+#include "markup.h"
+#include <wtf/Assertions.h>
+#include <wtf/Platform.h>
+#include <wtf/Vector.h>
+
+#include <qabstractmessagehandler.h>
+#include <qbuffer.h>
+#include <qsourcelocation.h>
+#include <qxmlquery.h>
+
+namespace WebCore {
+
+class XSLTMessageHandler : public QAbstractMessageHandler {
+
+public:
+    XSLTMessageHandler(Document* document = 0);
+    virtual void handleMessage(QtMsgType type, const QString& description,
+                               const QUrl& identifier, const QSourceLocation& sourceLocation);
+
+private:
+    Document* m_document;
+};
+
+XSLTMessageHandler::XSLTMessageHandler(Document* document)
+    : QAbstractMessageHandler()
+    , m_document(document)
+{
+}
+
+void XSLTMessageHandler::handleMessage(QtMsgType type, const QString& description,
+                                       const QUrl&, const QSourceLocation& sourceLocation)
+{
+    if (!m_document->frame())
+        return;
+
+    MessageLevel level;
+    switch (type) {
+    case QtDebugMsg:
+        level = TipMessageLevel;
+        break;
+    case QtWarningMsg:
+        level = WarningMessageLevel;
+        break;
+    case QtCriticalMsg:
+    case QtFatalMsg:
+        level = ErrorMessageLevel;
+        break;
+    default:
+        level = LogMessageLevel;
+        break;
+    }
+
+    Console* console = m_document->frame()->domWindow()->console();
+    console->addMessage(XMLMessageSource, LogMessageType, level, description,
+                        sourceLocation.line(), sourceLocation.uri().toString());
+}
+
+bool XSLTProcessor::transformToString(Node* sourceNode, String&, String& resultString, String&)
+{
+    bool success = false;
+
+    RefPtr<XSLStyleSheet> stylesheet = m_stylesheet;
+    if (!stylesheet && m_stylesheetRootNode) {
+        Node* node = m_stylesheetRootNode.get();
+        stylesheet = XSLStyleSheet::create(node->parent() ? node->parent() : node, node->document()->url().string());
+        stylesheet->parseString(createMarkup(node));
+    }
+
+    if (!stylesheet || stylesheet->sheetString().isEmpty())
+        return success;
+
+    RefPtr<Document> ownerDocument = sourceNode->document();
+    bool sourceIsDocument = (sourceNode == ownerDocument.get());
+
+    QXmlQuery query(QXmlQuery::XSLT20);
+
+    XSLTMessageHandler messageHandler(ownerDocument.get());
+    query.setMessageHandler(&messageHandler);
+
+    XSLTProcessor::ParameterMap::iterator end = m_parameters.end();
+    for (XSLTProcessor::ParameterMap::iterator it = m_parameters.begin(); it != end; ++it)
+        query.bindVariable(QString(it->first), QXmlItem(QVariant(it->second)));
+
+    QString source;
+    if (sourceIsDocument && ownerDocument->transformSource())
+        source = ownerDocument->transformSource()->platformSource();
+    if (!sourceIsDocument || source.isEmpty())
+        source = createMarkup(sourceNode);
+
+    QBuffer inputBuffer;
+    QBuffer styleSheetBuffer;
+    QBuffer outputBuffer;
+
+    inputBuffer.setData(source.toUtf8());
+    styleSheetBuffer.setData(QString(stylesheet->sheetString()).toUtf8());
+
+    inputBuffer.open(QIODevice::ReadOnly);
+    styleSheetBuffer.open(QIODevice::ReadOnly);
+    outputBuffer.open(QIODevice::ReadWrite);
+
+    query.setFocus(&inputBuffer);
+    query.setQuery(&styleSheetBuffer, QUrl(stylesheet->href()));
+    success = query.evaluateTo(&outputBuffer);
+    outputBuffer.reset();
+    resultString = QString::fromUtf8(outputBuffer.readAll()).trimmed();
+
+    if (m_stylesheet) {
+        m_stylesheet->clearDocuments();
+        m_stylesheet = 0;
+    }
+
+    return success;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(XSLT)